README.md

Find leaked privatekey via Bigquery

Since Arbitrum airdrop is approaching, hackers are geared up. Inspired by LiveOverflow, I extracted some shit(maybe not pk, just bunch of hexes) from github repos. Try other DBs please.

Tool

Google Bigquery

Query

SELECT
f.repo_name,
f.path,
DISTINCT(c.pkey)
FROM
`bigquery-public-data.github_repos.files` f
JOIN (
SELECT
id,
REGEXP_EXTRACT(content, r'(?:^|[^a-zA-Z0-9])(0x[a-fA-F0-9]{64})(?:$|[^a-zA-Z0-9])') AS pkey
FROM
`bigquery-public-data.github_repos.contents`
WHERE
REGEXP_CONTAINS(content, r'(?:^|[^a-zA-Z0-9])(0x[a-fA-F0-9]{64})(?:$|[^a-zA-Z0-9])') ) c
ON
f.id = c.id

For your convenience

Result