Hacker News Reader

Comment by Sayrus | Hacker News Reader

> When a community member inquired about how long it took for the funds to be drained, the Web3 founder responded that it took just two minutes for someone to withdraw the funds.

The public events API is delayed by 5 minutes[1]. Unless someone was actively scraping his profile rather than doing large scans on GitHub, this is not possible.

[1] https://docs.github.com/en/rest/activity/events?apiVersion=2...

View on HN

They don't need to proactively scan all of GitHub to exploit this kind of mistake, just active accounts that are known to be involved with cryptocurrency.

GitHub even lets you find them easily: https://github.com/search?q=language%3ASolidity&type=users

I didn't read that to mean a literal two minutes. Based on his style of writing that was quoted in the article and the nature of his mistake I don't think he's reporting an in-depth postmortem on the situation, although I didn't bother going to twitter to take a closer look. He probably didn't even realize his mistake within two minutes.

Given the obvious incentive, I expect multiple groups to be scraping simultaneously, out of sync with each other.

Also, I expect anyone working on high-value systems to be under more targeted scraping.

Note he didn't commit his keys by mistake, but rather made a private repo public. Don't know if that makes a difference.

Committing keys is a mistake.

In my mind yes, but he seems to have done it on purpose. At least he was aware of it.

A delay or just that it polls every 5 minutes?

It's delayed. You can poll it continuously and you get live events "from 5 minutes ago".

They're on Twitter with a crypto symbol in the username, you really think targeting is outlandish?

"$40k became 'untraceable' while being reported as lost" /s

Reply on news.ycombinator.com