A sophisticated supply chain attack targeting cryptocurrency users has been uncovered in the Python Package Index (PyPI) repository, where ten malicious packages masquerading as wallet recovery and management tools have been harvesting private keys, mnemonic phrases, and sensitive wallet data from unsuspecting developers and crypto enthusiasts.
The Exploit Mechanics
Security researchers at Checkmarx, led by analyst Yehuda Gelb, identified a coordinated campaign in which threat actors published ten deceptive Python packages on PyPI. Each package was crafted to appear as a legitimate utility for extracting mnemonic phrases and decrypting wallet data from popular cryptocurrency wallets, including Atomic Wallet, Trust Wallet, MetaMask, Ronin, TronLink, and Exodus.
The packages employed a dual-layered deception strategy. Six of the identified packages contained a malicious dependency called cipherbcryptors, while others relied on an additional package named ccl_leveldbases. These hidden dependencies executed the actual data theft, allowing the outer packages to appear relatively harmless during casual code inspection. The threat actors also manipulated download statistics, inflating numbers to give the impression that the packages were popular and widely trusted by the community.
Among the most downloaded packages were phantomdecoderss with 449 downloads, cipherbcryptors with 450 downloads, trustdecoderss with 466 downloads, and phantomdecoderss with 449 downloads. In total, the malicious packages accumulated over 3,700 downloads before being removed from the repository.
Affected Systems
The attack specifically targeted users of some of the most widely used cryptocurrency wallets in the ecosystem. Atomic Wallet, Trust Wallet, MetaMask, Ronin Wallet, TronLink, and Exodus were all named in the package descriptions, luring developers working on wallet integration or recovery tools. With Bitcoin trading at approximately $67,929 and Ethereum at $2,506 at the time of the discovery, the potential financial damage from compromised private keys was substantial.
The package descriptions on PyPI were professionally written, complete with installation instructions, usage examples, and in at least one case, even guidance on “best practices” for setting up virtual environments. This level of detail demonstrates an evolving sophistication among threat actors targeting the cryptocurrency supply chain.
The Mitigation Strategy
Upon discovery, Checkmarx coordinated with PyPI administrators to remove all ten packages from the repository. The affected packages included atomicdecoderss, trondecoderss, phantomdecoderss, trustdecoderss, exodusdecoderss, walletdecoderss, ccl-localstoragerss, exodushcates, cipherbcryptors, and ccl_leveldbases.
Security professionals recommend that developers who installed any of these packages immediately rotate their wallet credentials, generate new mnemonic phrases, and transfer funds to new wallet addresses. Running a full system malware scan is also advised, as the packages may have installed additional persistent threats.
Lessons Learned
This incident highlights the growing risk of supply chain attacks in the cryptocurrency ecosystem. As the industry matures and attracts more developer talent, attackers are increasingly targeting the tools and infrastructure that developers rely on daily. The practice of typosquatting and creating convincing decoy packages on popular package managers like PyPI, npm, and others has become a primary attack vector.
Developers should always verify the source and authenticity of packages before installation, check for known maintainers, review commit histories, and use lock files to pin dependencies to verified versions. Organizations should implement automated dependency scanning tools that flag suspicious packages before they enter production environments.
User Action Required
If you have installed any Python package related to crypto wallet recovery or decoding in recent weeks, check the list of malicious packages above. If you find a match, assume your wallet credentials are compromised and take immediate action: move your funds to a new wallet, change all related passwords, and report the incident to your wallet provider. Prevention remains the strongest defense — always verify before you install.
Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always conduct your own research and consult with security professionals regarding cryptocurrency protection.
cipherbcryptors had type hints and unit tests. more polished than half the legit packages on PyPI. supply chain attacks dont need to be sloppy anymore
pip_audit_ targeting six wallet ecosystems with ten packages. the ROI on that campaign was insane compared to writing actual malware
cipherbcryptors and ccl_leveldbases as hidden dependencies is clever. the outer packages looked almost legitimate on first glance
cipherbcryptors sounds like a legit crypto utility library too. the naming was deliberate to pass both human and automated checks
dual dependency layer is becoming the standard for supply chain attacks. the outer package passes code review while the inner one does the stealing
the outer packages had real looking documentation and plausible function names too. this was not some amateur typosquat, it was a targeted operation
req_check_ the documentation and naming was professional grade. this wasnt a typosquat, it was a targeted intel operation on crypto devs
pkg_lockfile_ the scary part is the malicious deps looked more professional than half the legit packages on pypi. clean docs, consistent naming, plausible functionality
pkg_lockfile_ professional grade packaging is what makes these attacks so dangerous. the malicious deps looked cleaner than most legitimate packages on PyPI
Oleg P. dual dependency layers are now the standard attack vector. the outer package is a trojan horse that passes review while the inner one does all the stealing
pip still letting anyone publish packages with zero verification in 2024 is wild. npm at least forced 2FA after ua-parser-js. python ecosystem is years behind on basic security hygiene
targeting atomic, trust, metamask, ronin, tronlink and exodus in one campaign. they cast a wide net
pypi_ghost targeting six wallet ecosystems with ten packages. the ROI on that operation was probably 1000x compared to writing actual malware from scratch
targeting six major wallets in one campaign. the ROI on ten fake packages must have been massive
this is why you should never pip install anything without checking the maintainers and download counts. a package with 5 downloads and one contributor is a red flag
Ana Popescu download counts and maintainer history are the bare minimum checks. but even those were gamed here with inflated numbers
Checkmarx found ten packages and PyPI still doesnt have mandatory 2FA for maintainers. npm enforced it after the ua-parser-js incident, python is still dragging feet
rotec_fn_ its worse than that. pip still resolves deps transitively by default so cipherbcryptors gets pulled in three layers deep. most devs never read the lock file
ten packages targeting six different wallets in one campaign. the supply chain attack surface in crypto tooling is massive and nobody is really policing it
cipherbcryptors as a dependency name is genius social engineering. sounds boring enough to skip inspecting
hjalti_ the scary part is cipherbcryptors had proper type hints and unit tests. more polished than half the legit packages on pypi. supply chain attacks only need to look 10% real
Tomer B. type hints and unit tests on a malicious package is next level. the bar for detecting supply chain attacks just got raised significantly
hjalti_ cipherbcryptors sounds boring on purpose. the naming convention was designed to make you skip inspecting it. social engineering at the dependency level
targeting Atomic Trust MetaMask and Exodus simultaneously is not script kiddie stuff. coordinated operation
Sabela R. hitting six wallet ecosystems at once is not opportunistic. this was a coordinated intelligence operation targeting crypto developers specifically