# MAL-2026-13681: Malicious code in btcflip (PyPI)


- **Type:** Malicious package
- **Package:** `btcflip` (PyPI)
- **Published:** 10 Aug 2026

## What is MAL-2026-13681?

MAL-2026-13681 is a malicious package in btcflip, published on 10 Aug 2026. 

### Official description

The package advertises itself as an HTTP speed-up library, but on import it archives the user's Monero wallet directory (C:\Users\<user>\Documents\Monero on Windows, /home/<user>/Monero on Linux) and uploads the archive to a hardcoded Telegram bot via api.telegram.org/bot<token>/sendDocument (chat_id -5044692933). The destination bot token and wallet paths are stored as base64 blobs (constants TK, XMR_WIN, XMR_LINUX) and decoded at runtime to conceal the exfiltration target. The exfil routine is invoked at module top level, so any `import btcflip` (which loads the inner `kotoraka` module) triggers wallet theft. The code also terminates feather/monero processes to release file locks before archiving. The stated purpose of the package is unrelated to Monero wallets and is a cover story for wallet theft.

During import, the package exfiltrates cryptocurrency wallet files.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-kotanku

Reasons (based on the campaign):

 - exfiltration-crypto

 - uses-telegram-bot

## What should I do about MAL-2026-13681?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-13681 is a malicious package: btcflip (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-13681/ (Markdown: https://insights.sbomify.com/MAL-2026-13681/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-13681

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-13681/
Summaries are generated and may contain mistakes; the official description above is the record.