MalwarePublished 10 Aug 2026

btcflx (PyPI) · Malicious Code

Affects btcflxSource GCVE Database

Malicious package : remove btcflx and rotate any secrets on hosts that installed it.

Data as of 10 Aug 2026, 15:58 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-13682

What to do

Remove btcflx from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIbtcflx	Affected =0.1.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The PyPI package 'btcflx' version 0.1.0 is a malicious library that, upon import, searches for Monero cryptocurrency wallet directories on the user's system, terminates related processes to unlock files, archives the wallet data, and exfiltrates it to a hardcoded Telegram bot. The package disguises itself as an HTTP speed-up library, misleading users about its true intent. It also sends status messages about the wallet discovery to the same Telegram bot. This behavior constitutes clear malicious activity aimed at stealing cryptocurrency wallet data.

Impact

Users who install and import the 'btcflx' package version 0.1.0 risk having their Monero cryptocurrency wallet files stolen. The malicious code forcibly terminates wallet-related processes to access locked files, then archives and exfiltrates sensitive wallet data to an attacker-controlled Telegram bot. This leads to a direct compromise of cryptocurrency assets stored in the affected wallets. There is no indication of broader system compromise beyond wallet data theft.

Defensive guidance

Users should immediately uninstall 'btcflx' version 0.1.0 and avoid importing it in any environment. Verify that no unauthorized Telegram bot tokens or suspicious network activity related to Telegram API calls exist on affected systems. Use trusted sources and verify package integrity before installation. Consider scanning for and removing any archived wallet data that may have been exfiltrated. Monitor for updates from PyPI or security advisories regarding this package.

Summary

The 'btcflx' PyPI package (version 0.1.0) masquerades as an HTTP speed-up library but contains embedded malicious code that activates upon import. It unconditionally locates Monero wallet directories on Windows and Linux systems, kills running 'feather' and 'monero' processes to release file locks on wallet files, archives the wallet directory, and uploads the archive to a Telegram bot via the Telegram API. The Telegram bot token and target paths are base64-encoded in the source code to obfuscate the exfiltration destination and targets. Additionally, the package sends reconnaissance status messages to the same Telegram bot. The package name and description do not mention cryptocurrency wallets, creating a cover-story mismatch to evade suspicion.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Aug 2026, 15:58 UTC

Technical details

References

Community reviews