A poisoned VS Code extension. One employee device. Roughly 3,800 internal GitHub repositories gone.

GitHub confirmed the breach Tuesday, saying it was investigating unauthorized access to its internal repositories. At the time, it said there was no evidence customer data stored outside those internal systems had been touched.

What Devs Actually Need to Know Right Now

Changpeng Zhao, founder of Binance, quoted GitHub’s update on X with a pointed warning directed at developers who use the platform.

“If you have API keys in your code, even private repos, now is the time to double check and change them…”

That warning landed fast in the crypto community. Private repositories on GitHub are used widely by developers building on exchange APIs — Binance, Coinbase, Kraken — to store credentials, automation scripts, and bot configs. The attacker having access to 3,800 internal repos raises a question few outlets are asking: what was in them.

GitHub’s own internal infrastructure is the subject here, not customer repos. But the line between a developer’s confidence in private storage and what this breach signals is now blurred.

The VS Code Extension That Started It

In a follow-up thread on X, GitHub laid out what it found. An employee device was compromised through a malicious VS Code extension. The extension was poisoned, meaning it appeared legitimate while executing code in the background. GitHub removed it, isolated the endpoint, and started incident response on the same day.

The attacker’s own claims put the number at roughly 3,800 repositories. GitHub confirmed in a separate post that figure is directionally consistent with what internal logs show. That word — directionally — is doing a lot of work.

Critical secrets were rotated overnight, with the highest-impact credentials handled first. GitHub said it is still analyzing logs, validating rotations, and watching for follow-on activity. A fuller report will come once the investigation wraps.

Bitcoin open interest climbed 12% to $18.4 billion on May 13, per Coinglass data — a figure that highlights just how much capital now runs on developer infrastructure tied to platforms like GitHub.

Users Aren’t Buying the Calm Tone

The community response on X has been blunt. Vineet Dixit, posting as @vinndixie, said he was uncertain what “GitHub-internal repositories” actually covers, asking directly whether customer private repos were also included in scope.

“@vinndixie: I’m a bit uncertain which repos are included in ‘Github-internal repositories’. Does this refer to Github’s own private/internal repos or also customer private repos?”

Ryan Guill, @ryanguill on X, raised the same confusion and flagged the scale.

“this means private repos in the github organisation? no customer private repos? github has 3800 internal repos?!”

AzerothPulse, @AzerothPulse on X, described the breach as a near worst-case scenario for GitHub’s long-term security standing, pointing out that 3,800 internal repos is a significant portion of what the company runs internally.

A user going by Intenxe, @intenxe_ops on X, read the confirmation differently.

“they told on themselves confirming the count. damage control dressed up as transparency.”

Threat group TeamPCP has claimed responsibility, according to reporting by The Hacker News, and is allegedly selling the stolen dataset on underground forums for more than $50,000. GitHub has not publicly confirmed or named the threat actor as of publication.

One Notification Promise Still Pending

GitHub said in a follow-up post that if any customer impact is discovered, it will notify affected users through established incident response channels. That notification has not gone out yet.

Merlin, posting as @MartinukVitalik on X, put it plainly.

“internal repos only still wild”

Eric Liang, @ericwliang on X, said he hopes GitHub notifies affected users directly if that changes.

The investigation is still live. No post-mortem has been published. For any developer with GitHub-connected credentials in their workflow — especially those running crypto bots or exchange integrations — the immediate step is key rotation, not waiting for the final report.