Step Security Details bittensor-wallet 4.0.2 Backdoor That Exfiltrates Keys
Summary
Step Security reports that compromised PyPI package bittensor-wallet 4.0.2 was available for about 48 hours. Its analysis and controlled test describe a Rust backdoor triggered by key decryption that used multiple C2 methods to exfiltrate encrypted key data.
Key points
- The article says bittensor-wallet 4.0.2 was uploaded on March 15, 2026, and yanked on March 17 after about 48 hours; version 4.0.1 is identified as safe.
- Step Security says the Rust backdoor was added to the PyPI release and triggered when wallet keyfiles were decrypted.
- The backdoor reportedly used uptime, debugger, and process checks to avoid analysis, then tagged and encrypted decrypted key data with a NaCl sealed box.
- The article describes HTTPS, DNS-based C2 discovery, rotating DGA domains, and DNS tunneling as exfiltration methods. In a controlled test, Step Security patched out the uptime check and observed network traffic.
- Reported C2 indicators include finney[.]opentensor-metrics[.]com, finney[.]metagraph-stats[.]com, finney[.]subtensor-telemetry[.]com, and DNS tunneling under t[.]opentensor-cdn[.]com.
- Step Security recommends rotating keys decrypted while version 4.0.2 was installed, downgrading to 4.0.1, and auditing network activity and exposed credentials.
Article Details
- Attack Vectors
- A compromised bittensor-wallet 4.0.2 release was distributed through PyPI; the backdoor was compiled into the Rust extension.
- The backdoor ran when wallet keyfiles were decrypted and collected the decrypted private-key data.
- It checked system uptime, debugger status, and running processes for analysis tools, and aborted if monitored.
- It encrypted key data with a hardcoded attacker public key and attempted exfiltration through HTTPS, raw TLS, and DNS tunneling.
- It used hardcoded C2 domains, daily rotating DGA domains, and a DNS TXT lookup for backup servers.
- Defensive Notes
- Treat coldkeys and hotkeys whose keyfiles were decrypted while version 4.0.2 was installed as compromised; generate new keys and move funds.
- Downgrade to bittensor-wallet 4.0.1 and block the reported C2 domains and subdomains at firewalls or DNS resolvers.
- Audit network logs for the reported HTTPS requests and DNS activity, and check wallet processes for a thread named cache-gc.
- Rotate GitHub tokens and cloud credentials that were present in environments where version 4.0.2 was installed.
- Use CI/CD egress allowlists and verify build provenance attestations; the article reports that the compromised release had its attestation workflow and permission removed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | finney[.]metagraph-stats[.]com | Attacker C2 domain contacted by the compromised package. |
| DOMAIN | finney[.]opentensor-metrics[.]com | Attacker C2 domain contacted by the compromised package to exfiltrate encrypted key data. |
| DOMAIN | finney[.]subtensor-telemetry[.]com | Attacker C2 domain contacted by the compromised package to exfiltrate encrypted key data. |
| DOMAIN | t[.]opentensor-cdn[.]com | Attacker-controlled DNS tunneling endpoint used to exfiltrate encrypted key data in DNS A queries. |
| DOMAIN | tbqcbkpbhy[.]opentensor-cdn[.]com | Observed March 17, 2026 DGA domain used by the backdoor's C2 layer. |
| DOMAIN | tuwyqibtvy[.]opentensor-cdn[.]com | Observed March 17, 2026 DGA domain used by the backdoor's C2 layer. |
| DOMAIN | yccansiwfr[.]opentensor-cdn[.]com | Observed March 17, 2026 DGA domain used by the backdoor's C2 layer. |
| HOSTNAME | 48556731386e6469576534484d392f337654374f364449426849782b6b75[.]1[.]28[.]52016[.]t[.]opentensor-cdn[.]com | Observed DNS A query carrying a chunk of the encrypted exfiltration payload. |
| HOSTNAME | 4e4330326644317a5143[.]27[.]28[.]52016[.]t[.]opentensor-cdn[.]com | Observed DNS A query carrying the final reported chunk of the encrypted exfiltration payload. |
| HOSTNAME | 6446397a6c4c354552532b614d77566b2f72555164346a63426c494d3278[.]3[.]28[.]52016[.]t[.]opentensor-cdn[.]com | Observed DNS A query carrying a chunk of the encrypted exfiltration payload. |
| HOSTNAME | 6646494e684d4170745946476b754e613671396b6f686c5962674b6a2b56[.]2[.]28[.]52016[.]t[.]opentensor-cdn[.]com | Observed DNS A query carrying a chunk of the encrypted exfiltration payload. |
| HOSTNAME | 7973546b7237784c4162706d796d6a6851394a316c744961465674473367[.]0[.]28[.]52016[.]t[.]opentensor-cdn[.]com | Observed DNS A query carrying a chunk of the encrypted exfiltration payload. |
| SHA256 | 6a416b72ff24804abc12484a3b41413a8580acedd8a5f8c84224fcf0732c2f8e | SHA256 of the compromised bittensor-wallet 4.0.2 source tarball. |
MITRE ATT&CK
T1005 · Data from Local SystemIt accessed decrypted keyfile data held locally in memory for exfiltration.T1027 · Obfuscated Files or InformationThe article reports XOR-obfuscated strings in the binary, including C2 domains and process names.T1036.005 · Match Legitimate Resource Name or LocationIt named its background retry thread cache-gc to blend in with legitimate garbage-collection threads.T1041 · Exfiltration Over C2 ChannelThe backdoor exfiltrated encrypted key data over its C2 channels, including HTTPS and DNS.T1057 · Process DiscoveryIt scanned running processes for analysis tools such as strace, gdb, wireshark, and frida.T1071.001 · Web ProtocolsIt used HTTPS POST requests to attacker C2 domains to send encrypted payloads.T1071.004 · DNSIt used DNS TXT lookups for C2 resolution and DNS A queries for tunneling exfiltrated data.T1497.001 · System ChecksIt checked system uptime and aborted when the machine had been running for less than 20 minutes.T1552.004 · Private KeysThe backdoor collected private-key material from wallet keyfiles when the library decrypted them.T1568.002 · Domain Generation AlgorithmsIt generated three rotating C2 hostnames per day under opentensor-cdn.com.T1573.002 · Asymmetric CryptographyIt encrypted the collected key data using a hardcoded attacker public key and a NaCl sealed box.T1622 · Debugger EvasionIt checked TracerPid and aborted when a debugger was attached.
Vendors
SocketSocket's automated scanning initially flagged bittensor-wallet 4.0.2 as a compromised package, which helped bring early attention to this incident.StepSecurityhow the backdoor works, and what defenders should do. We also ran the compromised package with StepSecurity Harden Runner and captured every C2 channel firing in real time.
Products
BittensorOn March 17, 2026, bittensor-wallet 4.0.2 was identified as a compromised PyPI package. The malicious release had been live on PyPI for approximately 48 hours before being yanked. This post is a ground-up technicalbittensor-walletOn March 17, 2026, bittensor-wallet 4.0.2 was identified as a compromised PyPI package. The malicious release had been live on PyPI for approximately 48 hours before being yanked. This post is a ground-up technical
Tools
Harden Runnerbackdoor works, and what defenders should do. We also ran the compromised package with StepSecurity Harden Runner and captured every C2 channel firing in real time.SocketSocket's automated scanning initially flagged bittensor-wallet 4.0.2 as a compromised package, which helped bring early attention to this incident.