[SECURITY] Possible leaked wallet credential — please rotate immediately

[victoriguerrero2369-gif]

Hello,

This is an automated security alert from a public-data leak monitor.

A potential cryptocurrency private key or wallet seed phrase appears to have
been committed to a public Git repository. If this is your wallet, please:

1. Move ANY funds out of this wallet IMMEDIATELY using a key you control.
2. Stop using this key — it must be considered fully compromised.
3. Rotate any other secrets that may be in the same commit (.env vars, etc).
4. Force-push history rewrite or delete the repo — note that anyone who
   cloned the repo already has the key.

The leak was found at:

Repository: moneybutton/bsv
File path: lib/ecdsa.js
Line: 393
Commit: bb8dba7e550ffcf5ffedc18d2936538ac9019704
Permalink:

bsv/lib/ecdsa.js

Line 393 in feab6d5

'7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D576E7357A4501DDFE92F46681B20A0',

For dedup tracking: leak fingerprint c66132c32b9dba3f (session-salted, non-reversible).
The leaked secret matches the masked form: 0x7fffff…REDACTED…20a0

Derived addresses (these are public information, no action required from us):
ethereum: 0x3B3c67F57f74CE72a02978b0492620b1a661DA43
bitcoin: 1LVAsnUyEtJgZ9HzLfbtiJZuZMzHLX1n6k

Activity status (yes/no per chain, no balance lookup):
ethereum: active
bitcoin: active

This notification was sent BEFORE any balance lookup or any other action on the
wallet. The sender has NOT accessed the wallet and DOES NOT possess the key in
any persistent form.

If you did not create this commit, please forward this to your security team
or to the wallet/exchange whose product is in this repo.

This is a one-shot notification. We will not contact you again about this leak.