Bittensor Supply-Chain Hack
What happened
On July 2, 2024, Bittensor halted transaction processing after wallet thefts linked to the malicious PyPI distribution of bittensor 6.12.2. Attackers obtained decrypted wallet keys and used them to authorize TAO transfers. Reports valued the stolen tokens at roughly $8 million.
This was a client-software and key-custody incident, not a failure of Bittensor consensus.
Malicious wallet.py code in the PyPI release transmitted unlocked key material to an attacker-controlled server. Independent analysis found that code absent from the corresponding GitHub release.
How it happened
The compromised package ran with access to wallet secrets. When affected users unlocked their keys, the inserted code could exfiltrate the key material. Possession of those keys allowed ordinary signed transfers; no forged consensus vote or Solidity contract call was required.
The independent investigation compared the PyPI source and wheel with the GitHub release. It considered a compromised publishing credential likely, but did not prove how the attacker obtained it.
For maintainers, reviewing repository code alone is insufficient: the distributed artifact must match the reviewed build. For affected wallets, reinstalling clean software does not make an already exposed key secret again.
Protocol details
Evidence
- report @vishal4c incident report x.com
- analysis Website reference theblock.co
- analysis DeFiLlama defillama.com
- analysis Opentensor Foundation: July 3 community update blog.bittensor.com
- analysis Independent analysis: malicious package and artifact comparison 0xda.de
- analysis Explained: The Bittensor Hack, July 2024 halborn.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
