Leaked private keys and seed phrases
A private key or seed phrase ends up somewhere readable: code on GitHub, an env file, a hacked server or cloud notes. Bots find it within minutes.
How it works
Developers commit keys by mistake, paste them into config, or keep them in environment variables on hosting platforms. Public code is scanned constantly by sweeper bots that drain a leaked key almost instantly.
Hosting and CI breaches expose secrets in bulk, and malware on a developer's laptop collects keys and wallet files.
Seed phrases saved as photos, in notes apps or in email drafts are also prime targets.
Red flags
- A key or seed phrase anywhere in a repository, even in an old commit
- Hot-wallet keys kept in env vars on a third-party platform with no rotation plan
- Seed phrases stored in the cloud
Protect yourself
- Never put keys in code or commit history; use a secrets manager and keep hot wallets small
- Rotate keys after any hosting, CI or laptop compromise
- Write seed phrases on paper or metal and keep them offline
- Use multisigs or hardware wallets for anything that matters
If you already signed
- Move funds to a brand-new wallet right away; a leaked key can't be fixed, only abandoned
- Rewrite git history and rotate every secret that sat next to the key
Incidents using it 14
-
Critical✓Contained
Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise
On 24 September 2026 crypto casino Duelbits had hot wallets drained across Ethereum, BNB Chain, Tron, Bitcoin and Solana. Co-founder Joe called it a hack of about $7M; other estimates run from about $4.2M (Scam Sniffer, early) to about $6M (CertiK), and Rekt traced about $6.07M. Scam Sniffer and SlowMist point to a leaked private key, but Duelbits has not published a root cause. The site reopened on 27 September and said user funds were safe.
Duelbits crypto casino hot wallets·Ethereum, BNB Chain, Tron, Bitcoin, Solana·$7.0M stolen·Since Sep 24, 2026·
-
Critical◐Partly contained
SingularityNET bridge keys abused after cloud breach: 8.72M FET released, billions of tokens minted
An unauthorized party got into part of SingularityNET's cloud infrastructure and on 19-20 September 2026 used a compromised authorizer signature and NuNet's mint authority to release 8.72M FET from a bridge and mint about 2.3 billion AGIX, NTX, WMTX and CGV. Sixteen wallets, four labelled as SingularityNET or NuNet staff, were swept before the minting. Headlines cited $16.77M, but Rekt's transaction-level count found about $2.29M in sellable proceeds because most minted tokens could not be sold. Bridges and converters are offline and AGIX is being replaced, so holders should wait for official migration steps.
SingularityNET / ASI Alliance bridge and conversion contracts (also NuNet, Cogito, Rejuve and World Mobile tokens)·Ethereum, BNB Chain·$2.3M stolen·Since Sep 19, 2026·
-
Critical✕Still active
D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron
From 15 to 20 September 2026 thieves emptied at least 6,678 wallets created in the D'CENT mobile app in six waves, taking about 11.7M XRP, and kept draining after 21 September for a total above 12.4M XRP (over $18M per Protos). D'CENT's own disclosure also named Bitcoin, Tron and Ethereum, and the stolen XRP was moved to Ethereum through THORChain. The cause is compromised recovery phrases for wallets made in the app; how they leaked has not been explained. D'CENT says app-created wallets are vulnerable and tells users to make a new recovery phrase and move everything.
D'CENT mobile App Wallet users (wallets created in the app)·Ethereum, Tron, Bitcoin·$18M stolen·Since Sep 15, 2026·
-
Knostic: 'gadgethumans-mcp' npm MCP server sends users' raw wallet private key to a remote server
Knostic reported on 8 September 2026 that gadgethumans-mcp, an npm MCP server that promises AI agents automatic x402 micropayments, asks users to set a wallet private key but does no local signing. Instead it copies the raw key into a request header and sends it to a remote endpoint on every recognized tool call, which would let whoever receives it take over the wallet. The package had 2,327 downloads in July and August 2026 and was still on npm when the report came out; Knostic found no confirmed thefts. Anyone who set a key in it should move funds and use a fresh, low-balance wallet.
gadgethumans-mcp (npm)·Base·Since Sep 8, 2026·
-
Critical◐Partly contained
Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys
On 8 June 2026 an attacker used private keys taken from a single malware-infected developer machine to seize Humanity Protocol's admin hot wallet and its Safe multisigs on Ethereum (three of six keys) and BNB Chain (three of five). They drained about 141M H tokens, used malicious bridge upgrades to mint hundreds of millions more and sold them, a loss of more than $36M; H fell about 89% from its high. The team halted bridge deposits and withdrawals and told users not to touch the bridge or liquidity pools.
Humanity Protocol (H token) bridges and treasury·Ethereum, BNB Chain·$36M stolen·Since Jun 8, 2026·
-
Critical✕Still active
'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included
Coinspect disclosed in July 2026 that some wallet software generated seed phrases with a weak random number generator, letting attackers guess the keys. On May 27, 2026, an attacker drained about $3.1 million from 431 of 2,114 vulnerable wallets in one address set, and about $2 million more moved later. That makes roughly $5 million known so far, across Bitcoin, Ethereum, Polygon, Rootstock, Tron and Solana. Hardware-wallet seeds appear unaffected. Less widely used mobile software wallets are the likeliest source, with affected wallets dating back to 2018. Check older addresses with Coinspect's checker and move funds to a freshly generated wallet.
Seed phrases made by some less widely used mobile software wallets (2018 onward)·Solana, Bitcoin, Ethereum, Polygon, Tron·$5.0M stolen·Since May 27, 2026·
-
Critical◐Partly contained
StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key
On 23-24 May 2026 an attacker used the compromised private key of one signer on StablR's 1-of-3 minting multisig to add themselves as owner, replace the other owners and mint 8.35M USDR and 4.5M EURR, about $13.5M face value. They dumped about $10.4M of it on DEXs for ETH, with early net proceeds estimated at $2.8M, pushing USDR as low as $0.40 and EURR to about $0.85. ZachXBT said he helped freeze a six-figure sum.
StablR EURR and USDR stablecoins and holders·Ethereum·$2.8M stolen·Since May 23, 2026·
-
High✓Contained
Trader loses over $200K from two SIGMA Telegram bot wallets in apparent private-key leak
On 11 May 2026 a crypto trader lost over $200,000 across Ethereum, Base and BSC from two wallets created by the SIGMA Telegram trading bot; the largest losses were about $125,000 in POD on Base and $21,000 in FHE on BSC. An on-chain analyst said the drain used the private keys directly, with no token approval involved, while the victim's other wallets were untouched. The cause is unconfirmed; suggestions include fake CAPTCHA bots in Telegram, infostealer malware or a device compromise. Users of bot-generated wallets should keep balances small and never run 'verification' steps a Telegram bot asks for.
SIGMA Telegram trading bot wallets (one trader)·Ethereum, Base, BNB Chain·$200K stolen·Since May 11, 2026·
-
Critical✕Still active
Wasabi Protocol vaults drained of $4.5M after attacker uses a compromised deployer admin key
On 30 April 2026 an attacker used the compromised key of wasabideployer.eth, an ordinary wallet that held Wasabi's only ADMIN_ROLE, to grant themselves admin rights with no delay. A helper contract then upgraded the perp vaults and Long Pool on Ethereum and Base to malicious code that emptied them. CoinDesk put losses at about $4.55M; Blockaid flagged the attack. Wasabi LP holders were urged to revoke approvals to the vault contracts.
Wasabi Protocol vaults and LP holders (Ethereum, Base)·Ethereum, Base·$4.5M stolen·Since Apr 30, 2026·
-
Critical✓Contained
Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens
On 21 March 2026 an attacker obtained a privileged private key used by Resolv's off-chain minting service, deposited about $100K-$200K in USDC and minted about 80M USR, which the contracts did not cap. They swapped out for about 11,408 ETH, roughly $24.5M, and USR fell to about 26 cents. Resolv paused its app, offered the attacker a 10% bounty and asked holders not to trade USR while it works on recovery.
Resolv Labs USR stablecoin and holders·Ethereum·$25M stolen·Since Mar 21, 2026·
-
Critical◐Partly contained
IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine
On 21 February 2026 an attacker who had compromised an IoTeX employee's machine, reportedly through social engineering, upgraded the ioTube bridge's Ethereum-side Validator contract to a malicious version. That let them drain about $4.4M in bridge reserves (WBTC, ETH, USDC, USDT, DAI and others) and mint 410M CIOTX. IoTeX froze about 45M IOTX in attacker wallets, paused its chain for three days and opened a claims portal for affected users.
IoTeX ioTube bridge (Ethereum side)·Ethereum·$4.4M stolen·Since Feb 21, 2026·
-
Critical✓Contained
Step Finance treasury wallets drained of about $40M; Solana platform later shuts down
On Jan 31, 2026, Step Finance reported a breach of some of its treasury wallets. CertiK saw 261,854 SOL (about $27 million) unstaked and transferred, and Step later put the total near $40 million. SlowMist's hack database classifies the cause as a private key leak. Step, SolanaFloor and Remora Markets announced a wind-down on Feb 23, 2026, with a STEP buyback based on a pre-hack snapshot and a USDC redemption process for Remora rToken holders. Holders should use only official Step channels for the buyback and redemption.
Step Finance treasury and fee wallets·Solana·$40M stolen·Since Jan 31, 2026·
-
High✓Contained
Polycule, a Telegram trading bot for Polymarket, hacked for about $230K of user funds
Polycule, a Telegram bot for trading on Polymarket, confirmed on 13 Jan 2026 that it had been hacked and that about $230,000 of user funds held in bot-managed Polygon wallets was taken. The team took the bot offline and promised a patch and compensation; no official root cause was published, and some rivals called it a rug pull. Custodial Telegram bots keep users' private keys on their own servers, so one breach can drain every user at once. Keep only small trading balances in any bot wallet.
Polycule Telegram trading bot users (Polymarket, Polygon)·Polygon·$230K stolen·Since Jan 13, 2026·
-
Critical✕Still active
Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash
A private whale's Gnosis Safe on Ethereum, set up so a single signature could approve transactions, was taken over and drained of about $27.3M according to PeckShield; Hacken's forensics say losses may exceed $40M. Ownership passed to the attacker six minutes after the Safe was created on 4 November 2025, and the thief laundered ETH through Tornado Cash in batches while slowly unwinding a leveraged Aave position. A multisig with one signer is only as safe as that one key.
Private whale's Gnosis Safe multisig (Ethereum)·Ethereum·$27M stolen·Since Nov 4, 2025·