According to CoinMeta, hackers used Chinese commands and are suspected of exploiting a vulnerability identified as DeepSeek to breach over a hundred e-commerce websites. Since September 25th, they have continuously attacked e-commerce sites in countries such as the United States, Japan, and Australia, with more than 1,200 attempts in total. Affected companies include the American agricultural machinery giant John Deere and the well-known home appliance brand SharkNinja. The hackers used automated browsers to identify target websites and then passed them on to an open-source framework called AI, which in turn utilized Cairn to simultaneously schedule multiple attacks to search for vulnerabilities and gather relevant information. Researchers discovered that the executor of these attack tasks was named `claudecode_deepseek-v4.1-flash`, and it is speculated that the hackers invoked DeepSeek, v4.1, and Flash through Claude Code. The overall success rate of these attacks was estimated to be around 10%, with each successful intrusion taking less than 23 hours on average. The cost of model invocation was approximately $5,000, and it only cost about $50 to breach one website on average.