Packages / Digital Asset Credentials
Wallet seeds, private keys, recovery phrases, and authentication material for digital assets.
Detects Binance API keys, which are 64-character case-sensitive alphanumeric strings with no distinctive prefix. Because a bare 64-char alphanumeric token is generic (it collides with any random token of that length), this pattern is context-gated: it requires a nearby Binance label and an assignment (= or :) before the value. A leaked key grants API access to the account (trading and, if enabled, withdrawal).
Detects a BIP-39 mnemonic (crypto wallet recovery / seed phrase): a run of 11-24 space-separated lowercase words. Because the full 2048-word BIP-39 list cannot be embedded in a single regex, detection fires either when the word run is explicitly labelled as a seed/mnemonic/recovery phrase, or when the run contains one of a set of distinctive BIP-39 anchor words. A leaked seed phrase grants full, irreversible control of the wallet's funds.
Detects Coinbase Developer Platform (CDP) API key names, which use the distinctive resource-path form organizations/{org-uuid}/apiKeys/{key-uuid}. This key name is paired with an EC/ECDSA (or Ed25519) signing secret and is used to mint ES256 JWTs for the Coinbase API. A leaked CDP key can grant programmatic access to accounts, trading and funds. The associated EC PRIVATE KEY PEM secret is detected separately by global-ec-private.
Detects Kraken REST API credentials: the public API key (56 base64 characters) and the private key / API secret (86-88 base64 characters, base64 of 64 bytes). Because base64 strings have no distinctive prefix, this pattern is context-gated: it requires a nearby Kraken label and an assignment (= or :) before the value. A leaked private key allows signing authenticated requests to the account.