DEV Community

Eze
Eze

Posted on

drainscan v0.2.0: entropy detection and real-time watch mode for leaked web3 keys

#python #security #web3 #opensource

Two months ago a wallet with $2.3M was drained because someone committed a private key to a public repo years earlier. Generic scanners had flagged the file — as one more "possible secret" nobody triaged.

drainscan takes a different approach: it understands web3 keys. v0.1 detected EVM keys, Solana base58 secrets, Phantom JSON exports, and checksum-validated BIP-39 mnemonics, then derived the exposed address offline so you know which wallet leaked without transmitting anything.

What v0.2.0 adds

1. Entropy detection (with per-line dedup)

Exact patterns can't catch everything. Foreign-chain keys (Cosmos, Sui, Near), hex-encoded ed25519 seeds, or sharded keys all look like generic high-entropy blobs.

The new detector computes Shannon entropy per token:

def shannon_entropy(s):
    counts = Counter(s)
    n = len(s)
    return -sum((c / n) * log2(c / n) for c in counts.values())
Enter fullscreen mode Exit fullscreen mode

The threshold matters. My first attempt used 4.2 bits/char — and silently matched nothing, because hex strings max out at exactly 4.0 (16 symbols → log₂16). Base58 tops out around 5.86; natural language sits at ~2.5–3.2. The right threshold is 3.6: above prose, below both encodings' ceilings, and combined with a key-context requirement (private_key, wallet, seed...) to kill noise.

One design rule I care about: a line is never double-reported. If the exact detector already classified that hex blob as an EVM key, entropy stays quiet on it. One pass at low confidence feeds both filtering and dedup — no double I/O.

2. Watch mode 

drainscan watch ~/projects --interval 5
Enter fullscreen mode Exit fullscreen mode

Baseline scan on start, then poll and report only NEW leaks, timestamped. Pure stdlib — mtime polling, no watchdog dependency, works anywhere Python does. Useful for download folders, CI artifact drops, or that teammate who keeps pasting wallets into Slack exports.

Try it 

pip install git+https://github.com/ezequiellich44-cmd/drainscan.git
drainscan scan .
Enter fullscreen mode Exit fullscreen mode

Exit code 1 on high-confidence findings means CI blocks the build automatically. There's also drainscan hook . for local pre-commit enforcement.

MIT licensed, offline-first, your key material never leaves the machine.

Top comments (0)