2

Last week a single Ethereum account in my wallet was hacked. When I send ETH to it, within 2 blocks the hacker-bot uses my private key and sends 0.0009 ETH to another account and then maxes out the gas price to send out the rest. See

https://etherscan.io/tx/0xcd94255c0060d36b2c047f1e2a2bbb4d8e1e4fbf21282a60f4e535871c7771cd

My other accounts from that seed phrase were untouched. I'm trying to figure out how the hacker got my private key, and have to consider several possibilities: someone logged into my computer, one of my servers where the private key was unencrypted within files, an interaction via MetaMask, etc. Is there a place that outlines the most common ways private keys are stolen, some sort of protocol I can work through?

Note: I discovered that I posted a file on GitHub with the account's address and private key. Anyone reading that could then access the account. Shame on me. At least now I know how someone could have gotten the private key, which is very comforting because not knowing was rather spooky.

Browse other questions tagged or ask your own question.