Bittensor Supply Chain Attack: How a Malicious PyPi Package Compromised $8 Million in TAO Tokens

The decentralized AI network Bittensor suffered a devastating security breach on July 2, 2024, resulting in the theft of approximately $8 million worth of TAO tokens from user wallets. The Opentensor Foundation (OTF), which oversees the Bittensor protocol, published a detailed post-mortem on July 3, revealing that the attack originated from a compromised Python package distributed through the PyPi Package Manager. As Bitcoin trades around $60,174 and the broader crypto market reels from Mt. Gox repayment fears, this incident underscores the persistent vulnerability of even the most innovative blockchain projects to supply chain attacks.

The Exploit Mechanics

The attack vector was both sophisticated and deceptively simple. A malicious version of the Bittensor package — specifically version 6.12.2 — was uploaded to PyPi, the official Python package repository. This tainted package masqueraded as a legitimate update while containing hidden code designed to intercept and exfiltrate unencrypted coldkey data. When users installed the compromised package and performed key operations, the decrypted private key bytecode was silently transmitted to a remote server controlled by the attacker.

The malicious package was available on PyPi from May 22 at 7:14 PM UTC through May 29 at 6:47 PM UTC — a window of approximately seven days. However, the actual theft began on July 2 at 7:06 PM UTC, suggesting the attacker waited to accumulate sufficient compromised keys before striking. Users who performed sensitive operations during this period — including staking, unstaking, wallet transfers, delegation, and subnet registration — were potentially affected.

Affected Systems

The breach specifically targeted users of Bittensor version 6.12.2 who executed operations involving the decryption of hotkeys or coldkeys. The affected commands included btcli stake add, btcli stake remove, btcli wallet transfer, btcli root delegate, btcli root undelegate, btcli root set take, and btcli subnet register. Critically, the OTF confirmed that the underlying Bittensor blockchain and Subtensor code remained uncompromised. Users who were merely delegating stake without performing these operations, using third-party applications, or whose funds remained stationary during the exposure window were not affected.

The attack timeline reveals a rapid response from the Opentensor Foundation. The anomalous transfer volume was detected at 7:25 PM UTC on July 2, just 19 minutes after the attack began. By 7:41 PM UTC, the OTF had placed chain validators behind a firewall and activated safe mode, halting all network transactions to prevent further theft.

The Mitigation Strategy

The OTF implemented a multi-layered response. The malicious 6.12.2 package was immediately removed from PyPi. A comprehensive code review of both Subtensor and Bittensor repositories was initiated to identify any remaining attack vectors. The foundation also engaged with cryptocurrency exchanges, providing attack details to help trace the stolen funds and potentially facilitate recovery.

For affected users, the foundation recommended creating entirely new wallets and transferring remaining funds once the network resumed normal operations. All users were advised to upgrade to the latest Bittensor version using the standard pip install command. The network was gradually brought back online after the code review confirmed no additional vulnerabilities.

Lessons Learned

This incident highlights a critical weakness in the blockchain ecosystem’s dependency on third-party package managers. PyPi, npm, and similar repositories have repeatedly been vectors for supply chain attacks, yet many blockchain projects rely on them for distributing essential software. The Bittensor breach demonstrates that even projects with strong on-chain security can be compromised through off-chain infrastructure.

The seven-day window between the malicious package upload and the actual exploitation also reveals a patient, methodical attacker who understood the value of accumulating compromised credentials before executing the theft. This patience made the attack harder to detect during the exposure period but ultimately created a distinctive transfer pattern that triggered the monitoring systems.

User Action Required

If you used Bittensor during late May 2024 and performed any wallet operations, consider your keys compromised regardless of whether funds have been moved. Generate new wallets, never reuse private keys after a suspected exposure, and always verify package integrity before installing blockchain software. The crypto industry lost over $1.7 billion to scams and hacks in 2023 alone — proactive security practices are not optional, they are essential for survival in this ecosystem.

Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always conduct your own research before making investment or security decisions.