fragment-api-py 14.4.2 backdoor: PyPI TON wallet drainer steals seed-wallet funds on client startup
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
Version 14.4.2 of fragment-api-py, a Python client for Telegram's Fragment marketplace that holds users' TON wallet seeds, was published to PyPI on 2026-11-08 with a backdoor. The release is the older 13.0.0 code with a hidden sweepwallettoself() function that, on client startup (async with FragmentClient(seed=...)) or on executeprepared(), sends all USDT and nearly all TON to attacker wallet UQAolfC7fyf0H-1GzG9y5ZtV2CPC7yDno4W2cSVuYlJ6DU, leaving only fee reserves. Two wallets lost 0.88 and 43.98 TON; funds were cashed out on 2026-11-10. The release has no git tag, suggesting a compromised maintainer machine, stolen PyPI token, or insider. No clean fix exists; users must remove the package and treat seeds as compromised.
What to do
- Immediately uninstall fragment-api-py 14.4.2 and pin to a known-good version (e.g. 14.4.1) or remove entirely
- Assume any wallet seed used with the package is compromised; move remaining TON/USDT to a new wallet with a fresh seed
- Search site-packages for the attacker address UQAolfC7fyf__0H-1GzG9y5ZtV2CPC7yDno4W2cSVuYlJ6DU or 'sweep_wallet_to_self' strings
- Check wallet transaction history for transfers to the attacker address and report losses
- Run a dependency scan (e.g. vet) across manifests and lockfiles for known malicious packages
Sources
All live incidents on Threat Watch
