I want to open this question from overflow since it was closed and I experience the same problem.

This account "0x87C02eeacB08c11aFBb821798DB2F4cCcd8F9E3d" has been stealing many goerli and main net accounts. Example of goerli transaction:

my machine is Linux ubuntu desktop and I have my disk encrypted. I need a pointer how to find security hole in my system. Also need to use this as placeholder for victims of the same EOA or similar nature

  • 1
    How did you generate the private key for the 0x13AeB3c8D30fb1a69F32736688af68D49582E3CF address. Did you generate it yourself or did you use an (default) account generated by hardhat, etc. Did you ever put the PK into .env file and pushed it to github? Feb 2, 2023 at 14:22
  • 1
    the most common problem is you are using an exposed seed phrase or a not real - or very old version of metamask. phrases from hardhat, ganache, and some other old tools are not random and can be recalculated
    – Majd TL
    Feb 2, 2023 at 14:24
  • If you need G-Eth give me the public key of a not compromised private key or seed phrase and I can send you 2 when I have time.
    – Majd TL
    Feb 2, 2023 at 14:27
  • I generate my PK from metamask. I put it in .env but never push it to github.
    – ethereal1m
    Feb 2, 2023 at 15:29
  • 1
    are you using vim and pushed an env.swp file? Feb 2, 2023 at 16:36


Browse other questions tagged or ask your own question.