On March 17, 2026, bittensor-wallet 4.0.2 was identified as a compromised PyPI package. The malicious release had been live on PyPI for approximately 48 hours before being yanked. This post is a ground-up technical breakdown based on a direct diff of the source tarballs for versions 4.0.1 and 4.0.2 — covering exactly what changed, how the backdoor works, and what defenders should do. We also ran the compromised package with StepSecurity Harden Runner and captured every C2 channel firing in real time.

StepSecurity

A technical breakdown of the compromised bittensor-wallet 4.0.2 PyPI package, which was live for ~48 hours before being yanked. The backdoor, written in Rust and compiled into the native extension, hooks into every keyfile decryption path to steal private keys. It uses three independent exfiltration channels: HTTPS to hardcoded lookalike domains, daily-rotating DGA domains, and DNS tunneling as a fallback. Anti-analysis checks (uptime, debugger detection, process scanning) prevent execution in sandboxes. All strings are XOR-obfuscated, the background thread is named 'cache-gc' to blend in, and build provenance attestation was stripped from the release. The post includes full IOCs, live C2 traffic captured via StepSecurity Harden Runner, and remediation steps including key rotation and hash-pinned dependencies.

bittensor-wallet 4.0.2 Compromised on PyPI

Harden Runner Catches the Backdoor in Action