Fnalysis.
Fatal Commit
Researchers found 16.3 million forgotten crypto private keys sitting in public GitHub repos, tied to $574.8 million in losses
A study presented at USENIX Security '26 analyzed 63,004 public GitHub repositories created between January 2015 and May 2025 and extracted more than 16.3 million deduplicated private keys that developers, students, and hobbyists had accidentally, or carelessly, committed to version control. From there, researchers identified 65,340 risky addresses on Ethereum and BNB Smart Chain tied to losses valued at more than $574.8 million.
The reason is as dumb as it is common: while coding or testing contracts, many developers hardcode the private key directly for convenience, then push that code to a public repo without scrubbing it first. All it takes is someone searching the right pattern on GitHub to find the key to the vault. The researchers hit 99.11% precision detecting these cases and have started notifying wallets and exchanges, though the study doesn't say how many of those 65,340 addresses still have funds sitting inside waiting to be drained.
Source: CryptoSlate →Version control, controlling your net worth.