Malicious Python packages target popular Bitcoin library

When it comes to the frequency and sophistication of software supply chain attacks, few industries can compare with cryptocurrency. As ReversingLabs' 2025 Software Supply Chain Security Report notes, 2024 saw close to two dozen sustained supply chain campaigns designed to compromise cryptocurrency applications, cryptocurrency owners’ wallets, and cryptocurrency trading platforms.

The trend continues in 2025. A string of malicious software supply chain campaigns has targeted developers working on crypto-related applications. The latest popped onto the RL research team's radar last week when automated machine-learning (ML) detection features in RL's Spectra platform identified two malicious Python packages, posted to the Python Package Index (PyPI), containing code designed to exfiltrate sensitive database files.

Here's how the crypto malware was discovered by the RL research team.

Download: 2025 Software Supply Chain Security ReportSee the SSCS Report Webinar

Popular Python crypto library targeted with a fake fix

The Python packages we found both had names that target users of bitcoinlib, a popular Python library that contains features for creating and managing crypto wallets, interacting with the blockchain, and running Bitcoin scripts, among other things. Bitcoinlib is a widely used open-source library, with more than 1 million downloads to date and frequent updates.

The malicious packages detected were named bitcoinlibdbfix and bitcoinlib-dev. Both names are apparent references to an issue raised recently related to error messages being generated by bitcoinlib during bitcoin transfers, with calls from developers for the maintainers to address that issue.