Last week a single Ethereum account in my wallet was hacked. When I send ETH to it, within 2 blocks the hacker-bot uses my private key and sends 0.0009 ETH to another account and then maxes out the gas price to send out the rest. See
My other accounts from that seed phrase were untouched. I'm trying to figure out how the hacker got my private key, and have to consider several possibilities: someone logged into my computer, one of my servers where the private key was unencrypted within files, an interaction via MetaMask, etc. Is there a place that outlines the most common ways private keys are stolen, some sort of protocol I can work through?
Note: I discovered that I posted a file on GitHub with the account's address and private key. Anyone reading that could then access the account. Shame on me. At least now I know how someone could have gotten the private key, which is very comforting because not knowing was rather spooky.