Back to collectionA Malicious Fork Turns Setup Advice into a Security Check
After mainnet launched, Sentry Key operators used a public software repository to set up their nodes. An attacker made a malicious fork of the official open-source Sentry Key repository and inserted phishing code. The first question in the channel had changed from how to start a node to where its software came from.
A creative chronicle combining project history with imagined scenes. Story events are not verification of network activity.
After mainnet launched, Sentry Key operators used a public software repository to set up their nodes. The Night Watchman often answered newcomers' setup questions in the community channel, while A-Zhen provided engineering support on the chain side. Today their problem was not configuration itself: someone was using a lookalike repository to lure operators into installing the wrong code.
An attacker made a malicious fork of the official open-source Sentry Key repository and inserted phishing code. Some node operators installed it by mistake and had their keys stolen. After confirming the incident, the team announced that affected operators would receive replacement keys and pinned the sole official repository address. The Night Watchman paused his usual installation advice and urged people to verify the source. A-Zhen began gathering the information needed for replacements. Public code made participation easier, but an imitation could also enter searches and forwarded instructions.
The first question in the channel had changed from how to start a node to where its software came from. The replacement decision offered victims a route to recovery, but the affected operators still had to be identified and the new keys delivered. The Night Watchman planned to put repository verification ahead of installation in his guidance for newcomers. A pinned address alone could not immediately remove the risk posed by stolen keys.