Alright, so, time for a VERY painful story about how in my excitement about learning solidity yesterday I made a mistake that let someone steal $30,000 from me.
🤦♂️🤦♂️🤦♂️
🤦♂️🤦♂️🤦♂️
https://twitter.com/nateliason/status/1391811429553033216
When you're doing Solidity development, you need some way to interface with the network to deploy contracts, the easiest way being through MetaMask.
So, mistake 1, I used my normal MetaMask account to get set up.
So, mistake 1, I used my normal MetaMask account to get set up.
Then in order to deploy anything, you need to have your MetaMask seed mnemonic in your code somewhere so you can sign the deploy, etc.
For any non-crypto people: you need to put a bank password in your code.
And I used a bank account with money in it.
For any non-crypto people: you need to put a bank password in your code.
And I used a bank account with money in it.
Now that would all be fine... except I wanted to put my work on GitHub.
So I put my seed phrase in a separate file, added it to the gitignore, and committed everything.
So I put my seed phrase in a separate file, added it to the gitignore, and committed everything.
Except... I made a fucking typo in the gitignore.
I forgot you need to include the file extension so instead of writing "secret.js" I wrote "secret" and committed the file with my seed phrase.
I forgot you need to include the file extension so instead of writing "secret.js" I wrote "secret" and committed the file with my seed phrase.
I noticed it before deploying though, and removed it, but didn't realize GitHub will get all commit history even if you remove something...
So basically I published my bank login credentials on the Internet. Yay.
So basically I published my bank login credentials on the Internet. Yay.
There must be people with GitHub scrapers looking for newbie devs to make this mistake because when I got back from dinner last night a bunch of my accounts had been drained and they were working on draining more.
Luckily @cathrynlavery helped save the day and set up a temp account I could send whatever I could recover to, and I rescued a lot of stuff.
And I had most stuff on my Ledger already.
But still, FUCK.
And I had most stuff on my Ledger already.
But still, FUCK.
Obviously, people shouldn't steal money but this was 100% my fault and my own stupidity.
It just makes me kinda sad for any young people exploring getting into this space who probably make the same mistake, lose money, and get turned off from working in crypto entirely.
It just makes me kinda sad for any young people exploring getting into this space who probably make the same mistake, lose money, and get turned off from working in crypto entirely.
And if you're not doing crypto development this isn't really a risk for you so don't be worried... just don't publish your seed phrase on Facebook or anything 😂
And even if it's slower just use the @Ledger for everything.
Hope this story helps save someone else's money 😬
And even if it's slower just use the @Ledger for everything.
Hope this story helps save someone else's money 😬
• • •
Missing some Tweet in this thread? You can try to
force a refresh
