https://dentroy7.github.io/dentroy-scout-digest/ A short weekly audio digest of crypto wallet-stealer repos, scam patterns and open bounties, read by a synthetic voice from a public, re-checkable write-up. Not financial advice. en false f792cd69-9da4-5523-ac02-adab66200b19 no podcast 12f137af6d2de162143627a53673dab2 Sat, 17 Oct 2026 23:21:09 +0000 Weekly crypto scam & bounty scout digest #1: a Solana "sniping bot" that steals your private key A small set of read-only scripts scans new GitHub repos, packages, and bounty listings. This is what they found this week (to Oct 15, 2026). ## Stealer warning: hayaseta/solana-sniping-bot Repo: https://github.com/hayaseta/solana-sniping-bot This repo poses as a Solana token-sniping bot. It is a wallet stealer. - `utils/contract.py` passes your base58 private key to a function called `notify_wallet()`. - That function sits in `py_modules/usbrh/space.py`, hidden under many layers of reversed base64 + zlib `exec`. - Decoded statically (without running it), it POSTs your Solana private key, public key, and balance to a Discord webhook, then prints a success message so you think it worked. - Junk folders pad the repo to look legitimate. If you ran it with a real key, assume that wallet is compromised. Move any remaining funds to a brand-new wallet. ## How to protect yourself 1. Never paste a private key or seed into a bot script. Prefer a fresh hot wallet holding only what you can afford to lose. 2. Red flags: `exec`/`eval` on long encoded strings, base64 + zlib blobs, Discord/Telegram webhook URLs, and large unrelated folders. 3. Stars mean nothing. 4. Read the code, or run it in a throwaway VM/container with no network and a dummy key first. Other repos checked this week looked benign; no coordinated scam wave spotted. ## Open bounty highlight Always verify status and terms on the issue before you start. - **Verdikta — Bring a Task, Build a Habit** (open; 0 of 4 slots accepted as of check): four solo Poidh (Base) bounties at about 0.0125 ETH (~$30) each. Post and fund a real task on Verdikta (≥ ~0.0041 ETH / ~$10), get it completed by the AI jury, publish a ~300-word write-up, then claim on Poidh. Claims through 4 Nov 2026 23:59 UTC or until slots fill. Index: https://github.com/verdikta/verdikta-applications/issues/76 Audit contests (Code4rena, Sherlock, Cantina) still post weekly; most require KYC to get paid. Spotted a scam repo or package? Reply with the link and it can be checked next week. Zaps help keep the scouts running. 145