My MetaMask Private Keys Stolen from GitHub Private Repo in 1 Hour

I am working on a crypto project using React.JS, just experimenting with web3 and MetaMask wallet.

In the project, I was reading my private keys from a json file and last night I accidentally committed this json file to my GitHub private repository. The repository was brand new and I just emailed an invitation to my colleague that we were working together on Zoom. After realizing that I have committed the private keys, I immediately deleted the whole repository and pushed a whole new repo again.

But after 1 hour, I discovered that nothing was left in my wallets and whatever I sent to these wallets is being transferred to another account afterwards.

Here is an example of transactions from the last night:

https://polygonscan.com/address/0x7a9eb3cc39bc6ac940febbdb5bb29b8f9ece8a5b

All of the sender wallets were mine for the recipient above.

What do you think?

But they shouldn't have access to private repos, right?

You're leaving out a lot of valuable information.

Did you check your security log in github?

Do you have MFA enabled on your account?

Did you check your repository and account and make sure that all of the SSH keys saved are recognized and known to you?

Did you refresh all of your keys and make new ones?

You need to start at the beginning.. starting with the theft transactions is starting at the end.

----

Long story short, there is no way to tell you what happened without you investigating first.

It could be you just not MFAing your account and re-using passwords.. and someone logged into your github account and added their own private keys.

Really it could be a million different scenarios, but whatever happened, you need to investigate first.

I deliberately leave various types of cryptocurrency in 'private' areas of quite a lot of online services, including GitHub.

So far, nothing has been taken from GitHub.

(It's part of research for my side project serverthiefbait.com)

I think your colleague cloned the repo, and he had wallet stealing malware in his PC, which probably automatically stole it within milliseconds of the clone happening.