Bittensor identifies malicious package as culprit after $8 million worth of native token TAO stolen

On July 2, the decentralized AI network Bittensor experienced a severe security breach, forcing it to suspend its network operations following a series of wallet hacks that resulted in the theft of 32,000 TAO tokens, valued at $8 million.

A similar wallet breach a month prior led to a loss of $11 million. The Bittensor team has now released a detailed report outlining the developments surrounding these attacks.

Root Cause of the Bittensor Wallet Hack

According to the foundation, the attack began at 7:06 PM UTC on July 2, when the attackers redirected funds from the compromised Bittensor wallets to their own.

The OTF detected "abnormal transaction volumes" at 7:26 PM and subsequently placed network validators in "secure mode" behind a firewall at 7:41 PM to prevent any nodes from connecting to the chain, halting transactions, and allowing the team time to investigate.

"The attack was traced back to version 6.12.2 of the PyPi package manager, which contained a malicious package compromising user security," OTF wrote. The vulnerability affected users who downloaded PyPi Package Manager version 6.12.2 between May 22 and May 29 and performed specific actions such as staking, wallet transfers, or delegations.

Bittensor's Response and Remediation

OTF stated that it has removed the malicious 6.12.2 package from the PyPi Package Manager repository and continues to review the Bittensor code on Github, claiming no other vulnerabilities have been found so far. The foundation added that it is working with several cryptocurrency exchanges and the broader Bittensor community to trace the attackers and possibly recover the victims' funds.

According to OTF, once normal operations resume, affected users can create new wallets and transfer their funds.

Users are strongly encouraged to upgrade to the latest version of Bittensor. Additionally, OTF has pledged to regularly update the community and is implementing enhanced security measures to prevent future incidents.

"In the short term, we are working with PyPi maintainers to investigate this breach and prevent similar incidents in the future," OTF stated in the report.

$8 Million Worth of TAO Stolen Leading to Price Drop

According to the Bittensor price page on Coinlive, the incident caused the value of TAO tokens to drop by 15% on Wednesday, falling to around $230.

The subsequent price decline may have been influenced by Bitcoin's price movements, with TAO trading at $200.28 at the time of writing, down 10% in the past 24 hours.