wallet-tracking PyPI package: cryptocurrency-wallet information stealer exfiltrating data via Discord webhook
Severity: critical · Patch status: no-fix-needed · Since 2026-11-02
The PyPI package wallet-tracking is a cryptocurrency-wallet information stealer with no legitimate functionality; all published versions (1.0.0–1.0.6 and 0) are malicious. It collects wallet data on the victim host and exfiltrates it to an attacker-controlled Discord webhook. The source contains an unconfigured placeholder webhook URL (…/api/webhooks/YOURURL) alongside the live one, indicating a copy-paste stealer template. First observed by wormsign on 2026-05-30 and published to the GitHub Advisory Database on 2026-11-02 (GHSA-8wmf-9cp5-g5hq, CWE-506). Anyone who installed the package is affected; there are no fixed versions, so remediation is removal and credential/wallet rotation.
What to do
- Remove wallet-tracking from all environments and purge cached copies
- Rotate cryptocurrency wallet keys, seed phrases, and any secrets accessible from affected hosts
- Audit affected hosts for exfiltration activity to Discord webhooks and other attacker infrastructure
- Check dependency lockfiles and CI pipelines for the package and block it in dependency firewalls
Sources
All live incidents on Threat Watch