Greed

Rotate

Proxy

Read

Hackers planted crypto wallet-stealing malware inside LiteLLM, one of the most widely used AI developer tools, in a supply chain attack that silently harvested private keys, cloud credentials, and sensitive data from anyone who installed the compromised versions.
LiteLLM is an open-source library that routes requests across more than 100 large language model providers. It serves as critical infrastructure for thousands of AI applications and processes roughly <a href="https://x.com/SlowMist_Team/status/2036642420759330915" rel="noopener noreferrer nofollow">97 million monthly downloads</a> on PyPI, Python's official package repository.
The attack landed during a period of heightened unease across crypto markets, with the Fear &amp; Greed Index sitting at <a href="https://alternative.me/crypto/fear-and-greed-index/" rel="noopener noreferrer nofollow">13, deep in "Extreme Fear"</a> territory. For developers running AI-powered trading bots, wallet managers, or DeFi tools built on LiteLLM, the breach introduced a direct threat to their crypto holdings.
<h2 id="how-hackers-embedded-the-malicious-code">How Hackers Embedded the Malicious Code</h2>
A threat actor group tracked as TeamPCP compromised <a href="https://docs.litellm.ai/blog/security-update-march-2026" rel="noopener noreferrer nofollow">LiteLLM versions 1.82.7 and 1.82.8</a>, uploading the poisoned packages to PyPI on March 24, 2026 between 10:39 and 16:00 UTC. Both versions have since been removed.
The attackers did not hack LiteLLM's codebase directly. Instead, they exploited a compromised Trivy GitHub Action, a popular security scanner used in LiteLLM's own CI/CD pipeline, to steal PyPI publishing credentials. With those credentials in hand, TeamPCP bypassed official build workflows and <a href="https://snyk.io/articles/poisoned-security-scanner-backdooring-litellm/" rel="noopener noreferrer nofollow">uploaded the malicious packages directly to PyPI</a>.
The irony is sharp: a security scanner designed to protect software supply chains became the entry point that compromised one. This parallels the growing sophistication of attacks targeting crypto infrastructure, similar to the <a rel="noopener noreferrer nofollow">Web3 security threats that have cost the industry billions</a> in recent years.
The LiteLLM compromise was not an isolated incident. It was the third stage of an ongoing campaign: Trivy (March 19), then <a href="https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-teampcp-supply-chain-campaign/" rel="noopener noreferrer nofollow">44+ npm packages</a> including Aqua Security's GitHub repositories (March 20-22), then Checkmarx KICS (March 23), then LiteLLM (March 24), and Telnyx on March 27, showing the campaign remains active today.
<h2 id="what-the-wallet-stealing-code-actually-does">What the Wallet-Stealing Code Actually Does</h2>
The malicious code planted a file called <code>litellm_init.pth</code> in the Python installation directory. This file executed automatically on every Python startup, not just when LiteLLM was imported, meaning any Python process on an infected machine triggered the data theft.
The malware harvested an extensive list of sensitive data: SSH keys, AWS/GCP/Azure credentials, Kubernetes tokens, git credentials, environment variables containing API keys, shell history, crypto wallet files, SSL private keys, CI/CD secrets, and database passwords.
For crypto holders, the wallet file exfiltration is the most critical threat. The malware targeted local wallet keystores and configuration files. If a developer stored hot wallet keys, seed-related data, or private keys anywhere on the compromised machine, those are now presumed exposed. Unlike a compromised exchange password, stolen private keys cannot be rotated, and any funds in affected wallets should be considered permanently at risk.
All exfiltrated data was encrypted with <a href="https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign" rel="noopener noreferrer nofollow">AES-256 and RSA-4096</a> before being sent via POST request to a fraudulent domain, <code>models.litellm.cloud</code>, designed to look like legitimate LiteLLM infrastructure. The encryption made it harder for network monitoring tools to flag the outbound traffic as suspicious.
OpenAI co-founder Andrej Karpathy called it "software horror" in a widely shared warning to developers:
<blockquote class="twitter-tweet">
 Software horror: litellm PyPI supply chain attack. Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database… <a href="https://t.co/aKjZJcECFq" rel="noopener noreferrer nofollow">https://t.co/aKjZJcECFq</a>— Andrej Karpathy (@karpathy) <a href="https://twitter.com/karpathy/status/2036487306585268612?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">March 24, 2026</a>
</blockquote>
Source: @karpathy on X
The transitive dependency risk amplifies the blast radius. Projects like DSPy, which depend on <code>litellm&gt;=1.64.0</code>, could have pulled in the poisoned version automatically. Any AI application using LiteLLM as a sub-dependency was exposed even without directly installing it, a reality that makes <a rel="noopener noreferrer nofollow">protecting your wallet from evolving crypto scams</a> increasingly complex when threats arrive through developer toolchains.
According to unconfirmed reports, the attack was first discovered when a developer using an MCP plugin inside Cursor experienced a machine crash due to RAM exhaustion when LiteLLM 1.82.8 installed. This initial discovery mechanism has not been confirmed in the official LiteLLM advisory.
<figure><img src="https://coinlineup.com/wp-content/uploads/2026/03/coinlineup__coingecko__price-chart-1.jpg" alt="CoinGecko price chart for 🗞 Top Crypto News: Fri, Mar 27 (24H) ( - CryptoSlate ) 1️⃣ Hackers sneak crypto wallet-stealing code into a popular AI...">
 <figcaption>
 CoinGecko market data view included to frame the latest move in LiteLLM.
 </figcaption>
</figure>
<h2 id="how-to-check-if-you-are-affected-and-what-to-do-now">How to Check If You Are Affected and What to Do Now</h2>
LiteLLM has engaged Google's Mandiant team for forensic analysis and paused all new releases pending a full supply chain review. Users running the official LiteLLM Proxy Docker image (<code>ghcr.io/berriai/litellm</code>) were not affected.
If you installed LiteLLM via <code>pip</code> between March 24 10:39 UTC and 16:00 UTC, take these steps immediately:
<ul>
 <li>Check your installed version: Run <code>pip show litellm</code>. If it shows 1.82.7 or 1.82.8, you are affected.</li>
 <li>Downgrade immediately: Run <code>pip install litellm==1.82.6</code> to revert to the last safe version.</li>
 <li>Scan for the payload: Search your Python installation for <code>litellm_init.pth</code>. If found, delete it and treat the machine as fully compromised.</li>
 <li>Move crypto funds now: If you had any wallet files, private keys, or seed-related data on the affected machine, transfer all funds to a new wallet generated on a clean device. Do not reuse any keys from the compromised system.</li>
 <li>Rotate all credentials: This includes AWS/GCP/Azure keys, SSH keys, database passwords, API tokens, and any secrets stored in environment variables or shell history.</li>
 <li>Audit CI/CD pipelines: If the compromised machine had access to deployment systems, review recent builds and deployments for unauthorized changes.</li>
</ul>
Hardware wallets provide meaningful protection against this specific attack vector. Since hardware wallets sign transactions on the device itself and never expose private keys to the host machine, funds stored exclusively on hardware wallets were not directly at risk. Any hot wallet secrets on the same machine, however, remain compromised.
The expanding <a rel="noopener noreferrer nofollow">scope of crypto payment infrastructure</a> makes supply chain security increasingly critical. With TeamPCP's campaign still active and now targeting Telnyx as of today, developers working across crypto and AI should audit their dependency trees and pin package versions rather than accepting automatic upgrades. As <a rel="noopener noreferrer nofollow">large holders continue repositioning across crypto markets</a>, the intersection of AI tooling and digital asset security demands closer attention from the entire ecosystem.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.<a href="https://coinlineup.com/hackers-crypto-wallet-stealing-code-ai-tool/" rel="noopener noreferrer nofollow">Read original article on coinlineup.com</a>

Hackers Hide Crypto Wallet-Stealing Code in Popular AI Tool

Table of Contents

Coinlineup.com

Other articles published on Mar 27, 2026

Join our free newsletter for daily crypto updates!