11–20 of 47 posts
"I just emailed an invitation to my colleague that we were working together on Zoom" Most likely explanation is that if you didn't drain the wallet yourself then the only other person with access to your private key did.
There are bots that scan GitHub for credentials and private keys. Sorry that happened to you, I hope it wasn't a lot of money. Considered adding files like that to .gitignore in the future.
I think your colleague cloned the repo, and he had wallet stealing malware in his PC, which probably automatically stole it within milliseconds of the clone happening.
Or perhaps you unknowingly uploaded the file to another repo as well?
Others in the thread mentioned that they have private keys in their repo as a honeypot - if there was a security breach within GitHub, their keys would also be lost.
You're leaving out a lot of valuable information. Did you check your security log in github? Do you have MFA enabled on your account? Did you check your repository and account and make sure that all of the SSH keys saved are recognized and known to you? Did you refresh all of your keys and make new ones? You need to start at the beginning.. starting with the theft transactions is starting at the end. ---- Long story…
I use both MFA and a password manager tool for security purposes, and the account is connected to my work email. I am pretty sure that no security flaws was the cause of this, except pushing to the private repo. I have checked the transaction and the commit dates, which are matching perfectly. No doubt about that.
With that said, they stole 7 dollars. Pretty cheap lesson on security in my opinion.
There are bots that scan GitHub for credentials and private keys. Sorry that happened to you, I hope it wasn't a lot of money. Considered adding files like that to .gitignore in the future.
Actually already added to .gitignore file but then realized that .js files are not being discarded by .gitignore
Look up documentation and examples on .env files.
If you deploy to a service such as Vercel or AWS you can set environment variables there for production.
I could see an extension watching for git like listings with json files named like wallets and fetch()ing them when they appear.
Easy enough to recreate, test with the devtools tab open.
Earlier quoted context omitted.
But they shouldn't have access to private repos, right?
I deliberately leave various types of cryptocurrency in 'private' areas of quite a lot of online services, including GitHub. So far, nothing has been taken from GitHub. (It's part of research for my side project serverthiefbait.com)
Seems like you could achieve the same result if you just let your customers buy their own coins and provide an address for you to watch?
I hope you're enjoying being your own bank and in full control of your resources. Maybe you need to ask your bank (yourself) about your security policies. /s (Information security is hard and you only have to make a mistake once.)