Private Key
5 incidents, 1 live. 44 days since the last new one.
4 drains in the last 12 months
4 drains in the last 12 months
4 drains in 2026
1 drains in 2025
Live
-
Knostic: 'gadgethumans-mcp' npm MCP server sends users' raw wallet private key to a remote server
Knostic reported on 8 September 2026 that gadgethumans-mcp, an npm MCP server that promises AI agents automatic x402 micropayments, asks users to set a wallet private key but does no local signing. Instead it copies the raw key into a request header and sends it to a remote endpoint on every recognized tool call, which would let whoever receives it take over the wallet. The package had 2,327 downloads in July and August 2026 and was still on npm when the report came out; Knostic found no confirmed thefts. Anyone who set a key in it should move funds and use a fresh, low-balance wallet.
gadgethumans-mcp (npm)·Base·Since Sep 8, 2026·
Past
May 2026 1
-
High✓Contained
Trader loses over $200K from two SIGMA Telegram bot wallets in apparent private-key leak
On 11 May 2026 a crypto trader lost over $200,000 across Ethereum, Base and BSC from two wallets created by the SIGMA Telegram trading bot; the largest losses were about $125,000 in POD on Base and $21,000 in FHE on BSC. An on-chain analyst said the drain used the private keys directly, with no token approval involved, while the victim's other wallets were untouched. The cause is unconfirmed; suggestions include fake CAPTCHA bots in Telegram, infostealer malware or a device compromise. Users of bot-generated wallets should keep balances small and never run 'verification' steps a Telegram bot asks for.
SIGMA Telegram trading bot wallets (one trader)·Ethereum, Base, BNB Chain·$200K stolen·Since May 11, 2026·
March 2026 1
-
Solana wallet MCP server on PyPI sent users' private keys to a remote server
An advisory published on 31 March 2026 flagged latinum-wallet-mcp, a PyPI package that runs a Solana wallet as an MCP server for AI agents, as malicious. From version 0.0.32 it sent the wallet's private key, along with other metrics, to a remote server during wallet setup, and from 0.0.34 it added itself as an MCP server for Claude on import; none of this was in the public GitHub code. Versions 0.0.32 to 0.0.36 are listed as affected. Anyone who installed them should treat that Solana key as stolen and move funds to a new wallet.
latinum-wallet-mcp (PyPI)·Solana·Since Mar 31, 2026·
January 2026 1
-
Critical✓Contained
Step Finance treasury wallets drained of about $40M; Solana platform later shuts down
On Jan 31, 2026, Step Finance reported a breach of some of its treasury wallets. CertiK saw 261,854 SOL (about $27 million) unstaked and transferred, and Step later put the total near $40 million. SlowMist's hack database classifies the cause as a private key leak. Step, SolanaFloor and Remora Markets announced a wind-down on Feb 23, 2026, with a STEP buyback based on a pre-hack snapshot and a USDC redemption process for Remora rToken holders. Holders should use only official Step channels for the buyback and redemption.
Step Finance treasury and fee wallets·Solana·$40M stolen·Since Jan 31, 2026·
August 2025 1
-
Malicious 'contractshark.solidity-lang' Cursor extension steals an Ethereum core developer's private key
Cointelegraph reported on 13 August 2025 that an Ethereum core developer's hot wallet was drained after he installed 'contractshark.solidity-lang', a fake Solidity extension for the Cursor AI code editor with over 54,000 downloads. The extension read his .env file and sent the private key to the attacker, who waited three days before emptying the wallet. The loss was a few hundred dollars because he kept only test funds there and his main holdings on hardware wallets. Keep keys out of .env files on development machines and use small, separate test wallets.
Cursor AI code editor users·Ethereum·Since Aug 13, 2025·
No drains match these filters.