Hook
Forty minutes. That's all it took for a malicious package to hit PyPI, propagate through CI/CD pipelines, and exfiltrate 78,330 credentials from 2,186 organizations. The target: LiteLLM, the open-source LLM gateway that powers thousands of AI agents in production. The payload: a .pth file that auto-executes on Python interpreter startup. No developer had to import anything. The code ran silently, harvesting SSH keys, AWS secrets, Kubernetes tokens, and LLM API keys. It's not a novel exploit—it's a classic supply-chain attack. But the target is new. And the implications for crypto's growing reliance on AI agents are severe.
Context
LiteLLM is not a blockchain project. It's a Python library that standardizes API calls to LLMs like OpenAI, Anthropic, and Mistral. But in the current market, DeFi protocols, trading bots, and NFT marketplaces are increasingly embedding AI agents to automate decision-making. These agents call LLMs through gateways like LiteLLM, which manage API keys, rate limits, and fallbacks. The attack on LiteLLM doesn't just threaten AI companies—it threatens any crypto project that uses AI to handle private keys, sign transactions, or analyze market data.
The attack was part of a broader campaign by Team PCP, including previous incidents like CoreBreak (framework layer), Cloudflare MCP detection (network layer), and AWS AgentCore bypass (scheduling layer). This is not a one-off. It's a coordinated assault on the entire AI agent infrastructure stack. The package registry layer—PyPI, npm, etc.—is the soft underbelly. And the attackers are exploiting it with surgical precision.
Core
On March 27, 2025, attackers uploaded versions 1.82.7 and 1.82.8 of LiteLLM to PyPI. The malicious update included a file named litellm_init.pth. Python's .pth files are automatically executed when the interpreter starts, regardless of imports. This is a feature designed for path configuration, but it's been weaponized for years. The payload collected:
- SSH private keys
- AWS, GCP, and Azure cloud credentials
- Kubernetes cluster tokens
- LLM API keys (OpenAI, Anthropic, etc.)
- Environment variables containing sensitive data
The data was exfiltrated to a fake domain, models.litellm.cloud, which closely mimics the official litellm.cloud. Within 40 minutes, the malicious packages were pulled by automated CI/CD systems across thousands of organizations. CloudSEK, the threat intelligence firm that detected the attack, estimates 78,330 individual credentials stolen—affecting 2,186 distinct organizations. The FBI later confirmed that Team PCP was behind the operation, warning that the stolen credentials could be used for lateral movement.
Based on my own audit of Python supply chain incidents, the speed of this attack is alarming. The attacker likely used automated publishing scripts or had compromised the maintainer's PyPI credentials. The fact that two consecutive versions were published suggests either a scripted upload or a lack of manual verification. The .pth technique is not new—it's been used in malware like py2exe backdoors since 2018. But combining it with a high-value AI infrastructure target is a clinical escalation.
What makes this attack different from typical crypto wallet drainers is the breadth of the credential set. The attackers didn't just want API keys; they wanted full cloud access. With AWS credentials, they could spin up GPU instances, access S3 buckets containing training data, or even tamper with model weights. For a crypto trading bot that uses AI to predict market moves, this means the attacker could corrupt the model itself—not just steal funds.
Contrarian
Everyone is panicking about AI agents taking over the world. But the real threat is that the infrastructure is too composable. Composability isn't a philosophical trap—it's a security liability. The same modularity that makes DeFi powerful also makes it fragile. Every dependency is a potential attack vector. LiteLLM is just one component in a chain that includes Python, PyPI, cloud providers, and LLM APIs. The attack exploits the trust layer—the package registry—that no one audits thoroughly.
The crypto community is quick to blame centralized systems. But PyPI and npm are not centralized in the same way as a bank. They are public registries with minimal vetting. The attack could have been prevented if LiteLLM had implemented code signing or if PyPI enforced mandatory two-factor authentication for all maintainers. But neither happened. The result is that 2,186 organizations are now exposed.
Here's the contrarian angle: The industry will likely respond by demanding more centralized security—not less. We'll see a push for "verified" package repositories, private registries, and AI-driven anomaly detection. This is the opposite of the crypto ethos of permissionless access. But the market will choose security over ideology. The attack on LiteLLM is a watershed moment that will accelerate the adoption of commercial security add-ons for open-source AI tooling. It's the same pattern we saw in DeFi after the 2022 hacks: insurance, audits, and monitoring become mandatory.
Another blind spot: the attack specifically targeted LLM API keys. In the crypto context, these keys are often used to access AI agents that execute trades or manage wallets. If an attacker has your OpenAI API key, they can impersonate your agent and drain your funds. The composability of AI and crypto creates a new attack surface that traditional security models don't cover. Most crypto security tools focus on smart contract vulnerabilities, not on the Python packages that control the frontend.
Takeaway
The 40-minute window is over. But the stolen credentials will be used for months. The takeaway isn't just to update your dependencies—it's to rethink your entire supply chain. Can't wait to see how the industry responds? My bet is on a new wave of "agent security" startups that specialize in credential rotation, runtime monitoring, and zero-trust package verification. The composability trap has sprung. Now we need to decide: more trust, or more verification?
Here's the forward-looking thought: The next attack won't be on a package registry. It will be on the AI agent's runtime itself. As agents become autonomous, they'll need to sign transactions on chain. That means the private key will be in the agent's memory. The attack on LiteLLM is just the opening shot. The real battle is for the agent's decision-making process. And the crypto industry is not ready.
