MAL-2026-13681 Malicious code in btcflip (PyPI)
- Package
- btcflip
- Registry
- PyPI
What is MAL-2026-13681?
MAL-2026-13681 is a malicious package in btcflip, published on 10 Aug 2026.
Official description
The package advertises itself as an HTTP speed-up library, but on import it archives the user's Monero wallet directory (C:\Users<user>\Documents\Monero on Windows, /home/<user>/Monero on Linux) and uploads the archive to a hardcoded Telegram bot via api.telegram.org/bot<token>/sendDocument (chat_id -5044692933). The destination bot token and wallet paths are stored as base64 blobs (constants TK, XMR_WIN, XMR_LINUX) and decoded at runtime to conceal the exfiltration target. The exfil routine is invoked at module top level, so any import btcflip (which loads the inner kotoraka module) triggers wallet theft. The code also terminates feather/monero processes to release file locks before archiving. The stated purpose of the package is unrelated to Monero wallets and is a cover story for wallet theft.
During import, the package exfiltrates cryptocurrency wallet files.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-08-kotanku
Reasons (based on the campaign):
exfiltration-crypto
uses-telegram-bot
What should I do about MAL-2026-13681?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.