Back to all stories
Incident Analysis
unshETH Private Key Slip: $375,000 Loss from a Github Post
unshETH Private Key Slip: $375,000 Loss from a Github Post

Project name: unshETH

Project type: Staking

Date of exploit: June 1, 2023

Asset loss: $375,000

Vulnerability: Private key leak

Date of audit report publishing: 03/23/2023

Conclusion: Out of audit scope

Details of the Exploit


unshiETH is a staking platform that allows users to stake ETH and earn yield and swap fees. The exploited contract unshiETH Farm contains users’ unshiETH for farming.

Nature of the Vulnerability

The attacker compromised the private key of the unshiETH, which allows the attacker to withdraw the asset from the protocol.

CertiK Audit Overview

Screenshot 2024-01-08 at 5.10.33 AM

Screenshot 2024-01-08 at 5.11.16 AM


On Jun 01, 2023, the staking platform unshETH was attacked, leading to a loss of around $375,000. According to the unshETH team, they mistakenly leaked their private key to Github, which allows users to withdraw unshETH from the contract. It was due to a human error of the private key management, which should be out of the audit scope.


Other Resources: