# Private Key · Drain Watch

5 incidents, 1 live. JSON: https://drains.watch/t/private-key.json · RSS: https://drains.watch/t/private-key/feed.xml

- [Knostic: 'gadgethumans-mcp' npm MCP server sends users' raw wallet private key to a remote server](https://drains.watch/i/gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026) (live, Medium, Still active, since Sep 8, 2026)
- [Trader loses over $200K from two SIGMA Telegram bot wallets in apparent private-key leak](https://drains.watch/i/sigma-telegram-bot-wallets-key-leak-200k-may-2026) (closed, High, Contained, since May 11, 2026)
- [Solana wallet MCP server on PyPI sent users' private keys to a remote server](https://drains.watch/i/latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026) (closed, Medium, Partly contained, since Mar 31, 2026)
- [Step Finance treasury wallets drained of about $40M; Solana platform later shuts down](https://drains.watch/i/step-finance-treasury-drain-jan-2026) (closed, Critical, Contained, since Jan 31, 2026)
- [Malicious 'contractshark.solidity-lang' Cursor extension steals an Ethereum core developer's private key](https://drains.watch/i/cursor-contractshark-solidity-extension-dev-key-theft-aug-2025) (closed, Medium, Partly contained, since Aug 13, 2025)