On July 2 at 7:06 p.m. UTC, the decentralized AI network Bittensor fell victim to a targeted supply-chain attack. A malicious package uploaded to the PyPi Package Manager impersonated the legitimate Bittensor client and exfiltrated unencrypted coldkey bytecode from affected users. The Opentensor Foundation, the development team behind the Bittensor blockchain, detected anomalous transfer volumes within minutes and activated its incident response protocol.
Attack Timeline and Impact
According to the official update published on July 4, the attack began at 19:06 UTC when monitoring systems flagged a spike in large-value transfers. A cross-functional response team assembled and, by 19:41 UTC, had already activated safe mode on Subtensor and moved all Opentensor chain validators behind a firewall. The team successfully neutralized the attack within 35 minutes. The malicious library masqueraded as Bittensor version 6.12.2 and, once installed, transmitted decrypted coldkey bytecode to a remote server controlled by the attacker.
Users who downloaded the affected version and performed on-chain operations such as staking or token transfers during the relevant window are considered compromised. The foundation stressed that users who did not execute such operations or relied on third-party applications were likely unaffected. The stolen coldkeys allowed the attacker to move funds directly from victim wallets; exact losses are still under assessment.
Remediation and Long-Term Measures
The Opentensor Foundation has issued a security advisory urging all users to upgrade to the latest Bittensor version immediately and regenerate both coldkeys and hotkeys. In parallel, the team is collaborating with security auditors to enhance package integrity checks within the PyPi ecosystem. “We are implementing mechanisms for code signing and multi-factor key protection,” the foundation stated. Bittensor’s mainnet has resumed normal operations, though some features remain in safe mode pending a comprehensive audit.
This incident has reignited discussions about the security posture of decentralized AI infrastructure. Bittensor, which coordinates distributed machine learning computation across thousands of nodes, relies heavily on the trustworthiness of client software distributed through public repositories. Security experts recommend that users always verify package signatures and, when possible, obtain critical components through official channels rather than directly from public package managers.