LiteLLM Supply Chain Attack: Environment Variables Stolen — Why Cold Wallets Are Your Last Line of Defense

What Happened? The LiteLLM Supply Chain Attack

On March 24, 2026, the open-source AI community faced a nightmare scenario. LiteLLM, a popular Python package downloaded over 3.4 million times per day, was found to be compromised in a supply chain attack. The attacker published two backdoored versions on PyPI — v1.82.7 and v1.82.8 — that silently stole all environment variables from infected systems, including API keys, cloud credentials, SSH keys, and even cryptocurrency wallet files.

LiteLLM is a widely-used AI proxy framework that allows developers to call OpenAI, Anthropic, Google, and other LLM APIs through a unified interface. According to Wiz's research, LiteLLM is present in 36% of cloud environments. The potential blast radius of this attack is staggering.

What makes this incident particularly alarming is that the attackers didn't directly compromise LiteLLM. Instead, they first infiltrated another well-known open-source security tool — Aqua Security's Trivy vulnerability scanner. Through Trivy's CI/CD pipeline, the attackers obtained LiteLLM's PyPI publishing credentials (PYPI_PUBLISH token), then published the backdoored versions as a legitimate maintainer. This is the terrifying reality of modern supply chain attacks: the tools you trust may already be weaponized.

Attack Timeline

This was a carefully orchestrated, multi-stage operation carried out by a threat actor known as TeamPCP. Here is the complete timeline:

Deep Dive: The Deadly .pth File Exploit

The most ingenious aspect of this attack was its exploitation of an obscure Python mechanism — .pth files.

Python's .pth files were originally designed to modify module search paths. But they have a deadly feature: if a line in a .pth file starts with import, that line is automatically executed when the Python interpreter starts. This means the malicious code didn't need the user to explicitly import litellm — any Python program starting up would trigger the payload.

Here's the complete attack flow:

Complete List of Stolen Data

According to analyses by ReversingLabs, Snyk, and Sonatype, the malicious code harvested an extremely broad range of data — essentially every piece of sensitive information on a developer's machine:

The Unique Threat to Crypto Holders

For cryptocurrency holders, this attack is far more dangerous than a typical data breach. The reason is simple: crypto transactions are irreversible. Once private keys are stolen and assets are transferred, they're gone forever.

A Nightmare for Hot Wallet Users

If you're a developer using MetaMask, Trust Wallet, or other browser extension/software wallets, your situation is especially precarious. These hot wallets store private keys or keystore files on local disk — exactly what the malicious code was designed to scan and steal.

Even worse, many developers store wallet private keys directly in environment variables (e.g., PRIVATE_KEY=0x...) for DeFi testing or automation scripts. The very first thing this attack harvested was environment variables — your private key was sent in plaintext to the attacker's server.

Hardware Wallet Users Aren't Completely Safe Either

Even if you use a Ledger or Trezor hardware wallet, if you've interacted with DApps through a browser wallet on an affected machine, your Token Approvals may have been exploited. While attackers can't access your private keys, stolen session tokens or authorized DApp connection data from your environment could potentially be leveraged.

Why ArcSign Cold Wallet Users Were Unaffected

Now let's address the core question: if you're an ArcSign user, the LiteLLM supply chain attack had zero impact on your crypto assets. Why? Because ArcSign's security architecture was designed from day one with exactly this type of scenario in mind.

Layer 1: Private Keys Never Exist on Your Computer

ArcSign stores private keys on an offline USB device, not on your computer's hard drive or in memory. Malicious code can scan every file, every environment variable, every folder on your machine — it won't find any private key data because the keys simply aren't there.

This is the fundamental difference between cold and hot wallets. No matter how sophisticated LiteLLM's malware is, it cannot remotely read an unplugged USB device. Physical isolation is a gap that no software attack can cross.

Layer 2: XOR Triple-Shard Encryption

Even if an attacker physically obtained your USB device (impossible in a supply chain attack), ArcSign's XOR triple-shard encryption ensures the private key never exists in complete form. Three shards are stored in different locations — missing any single shard makes key reconstruction impossible.

Layer 3: .arcsign Encrypted Backup Replaces Plaintext Seed Phrases

Traditional wallets back up with 12 or 24 seed phrase words — a single piece of paper can destroy all your assets. ArcSign's .arcsign encrypted backup file is encrypted with AES-256 upon export with no additional password to set. Even if the backup file is stolen, without the decryption key on your USB device, attackers cannot extract any valuable information.

Layer 4: mlock Memory Protection

When ArcSign briefly needs to handle private keys in memory (e.g., signing transactions), it uses mlock memory protection to prevent the OS from writing sensitive data to swap. Even if LiteLLM's malware attempted to scan memory, it cannot find private key residuals in swap files.

Layer 5: Token Approvals Management

As a final safeguard, even if you accidentally authorized a suspicious smart contract in an unsafe environment, ArcSign's built-in Token Approvals management lets you view and revoke all token approvals across 6 EVM chains. Pro users get batch revocation, helping you cut losses the moment you detect a threat.

Wallet Types vs Supply Chain Attack Resilience

If You're Affected: Emergency Response Plan

If you installed or updated LiteLLM around March 24, 2026, or if you're unsure whether your environment was affected, take these steps immediately:

Developer Self-Defense Guide: 5 Key Measures

The LiteLLM incident taught every developer a harsh lesson. Here are 5 key protective measures to help you survive the next supply chain attack:

1. Completely Isolate Crypto Assets from Dev Environments

This is the most important rule. Never store real wallet private keys in your development machine's environment variables or config files. Use ArcSign cold wallet to keep private keys on an offline USB device. When you need to sign transactions, connect securely via WalletConnect. Use dedicated test wallets and test networks for development and testing.

2. Pin Package Versions, Use Lockfiles

Use pip freeze or poetry.lock to pin exact versions of all dependencies. Don't use pip install litellm (which installs the latest version) — specify a known-safe version number. Lockfiles ensure you never accidentally install a compromised new release.

3. Isolate Execution in Virtual Environments

Create independent Python virtual environments (venv or conda) for each project. Even if one virtual environment is compromised, its impact is contained to that environment and won't spread to your global Python installation or other projects.

4. Enable Dependency Security Scanning

Integrate dependency security scanning tools (like Snyk, Dependabot, Socket) into your CI/CD pipeline to check every installed package. Ironically, Trivy was one such tool — reminding us not to rely on any single security solution. Defense in depth is the only way.

5. Regularly Audit Token Approvals

Regardless of which wallet you use, regularly check and revoke smart contract approvals you no longer need. ArcSign's Token Approvals management supports one-stop viewing across 6 EVM chains, so you don't have to manually check chain by chain. This is your last safety net against unknown attacks.