Crypto scam after revealing private key

Question

Could somebody explain me how I was scammed? A couple of days ago I deployed my first code on Github where I forgot my metamask private key. I only had a coin in staking that lost 95% of it's value after airdrop and I didn't pay a lot attention to it. So I deployed all the code with hardhat etc., tried how it worked and deleted it from Github. In result I had 0 in my metamask but they didn't touch this WSGB coins - Wrapped SGB that were delegated.(I don't understand why) I transfered 30 sgb to my wallet to pay fees to unwrap SGB and to send them to another wallet. But this 30 sgb disappeared and in a second WSGB disappeared to. (Frankly speaking I didn't know that I could simply transfer WSGB, I thought that it's a delegated coin that I can't move without unwrapping)

This is a transaction number from SGB network if it's interesting 0x42b92c1df06948e31b32b0de07919ff5ace0684d614177f22bebfa0b3f2ff0fc

As I understand they are listenenig events in my wallet and then transfer everything I receive. Is it possible to "unsubscribe" from this scammers in such cases?

Answer 1

Well, technically, you did not get scammed. Like the old saying "not your private key, not your coins". Whoever has the private key is the 'owner' of the coins. You and the 'hacker' have the key now, which makes both of you the owners of the coins in that account, unfortunately.

A private key with coins/tokens in mainnet should never see the light of the day. If it is revealed, even for a split second, it is compromised and should not be used ever again.

You said you pushed it to GitHub and then deleted it. Did you "delete" it from GitHub with a new commit or you do rewrote the history to actually remove the commit that added it?

Like:

git reset --soft HEAD~1

That will actually delete the previous commit from existence and rewrite history, so you will need to force push.

If you simply removed the key from the file and then pushed a new commit, it is still in the GitHub commit history. You need to undo that commit and push that, so it effectively removes that commit from the commit history.

There are hackers that have bots running all day long looking for leaked private keys to steal funds. And yes, they probably have a bot listening to changes on your account to steal funds.

So, I suggest you forget about that account. If you have some funds and tokens still, move them to another account and don't use it anymore.