# Leaked private keys and seed phrases · Drain Watch

14 incidents, 3 live. JSON: https://drains.watch/t/key-leak.json · RSS: https://drains.watch/t/key-leak/feed.xml

- [Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise](https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026) (closed, Critical, Contained, since Sep 24, 2026)
- [SingularityNET bridge keys abused after cloud breach: 8.72M FET released, billions of tokens minted](https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026) (live, Critical, Partly contained, since Sep 19, 2026)
- [D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron](https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026) (live, Critical, Still active, since Sep 15, 2026)
- [Knostic: 'gadgethumans-mcp' npm MCP server sends users' raw wallet private key to a remote server](https://drains.watch/i/gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026) (live, Medium, Still active, since Sep 8, 2026)
- [Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys](https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026) (closed, Critical, Partly contained, since Jun 8, 2026)
- ['Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included](https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026) (closed, Critical, Still active, since May 27, 2026)
- [StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key](https://drains.watch/i/stablr-1of3-multisig-key-may-2026) (closed, Critical, Partly contained, since May 23, 2026)
- [Trader loses over $200K from two SIGMA Telegram bot wallets in apparent private-key leak](https://drains.watch/i/sigma-telegram-bot-wallets-key-leak-200k-may-2026) (closed, High, Contained, since May 11, 2026)
- [Wasabi Protocol vaults drained of $4.5M after attacker uses a compromised deployer admin key](https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026) (closed, Critical, Still active, since Apr 30, 2026)
- [Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens](https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026) (closed, Critical, Contained, since Mar 21, 2026)
- [IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine](https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026) (closed, Critical, Partly contained, since Feb 21, 2026)
- [Step Finance treasury wallets drained of about $40M; Solana platform later shuts down](https://drains.watch/i/step-finance-treasury-drain-jan-2026) (closed, Critical, Contained, since Jan 31, 2026)
- [Polycule, a Telegram trading bot for Polymarket, hacked for about $230K of user funds](https://drains.watch/i/polycule-polymarket-telegram-bot-hack-jan-2026) (closed, High, Contained, since Jan 13, 2026)
- [Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash](https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025) (closed, Critical, Still active, since Nov 4, 2025)