Dread's main onion private key exposed: 'Today is a sad day'

Dread¹ administrators HugBunter² and Paris³ have reported today⁴ that the private key for the main onionsite was accidentally exposed in what appears to be the first real security issue that the forum experienced since launch:

Unfortunately, it appears that a recent upload of an updated archive for the GoBalance software, was the wrong package containing, what should have only ever remained local, our onion private key. [..] This [main] domain can be used by whoever has the private key, which opens huge MiTM risks. (HugBunter)

I fucked up. Archived the wrong directory in the incorrect Qube and stupidly uploaded dread’s main onion private key into a gobalance update. (Paris)

Incident overview

Unaffected:
 * servers 
 * user data (at server level)
Compromised:
 * the main domain:
 dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion
 * the mirror:
 dreadlandswkysea676lnblidg3ienxnu2ilzcegxzt3v4hwkhmqz7id.onion
 * user data (possibly via MiTM)
Official recommendation:
 * do not trust compromised domains
 * change passwords
 * stay updated (check daunt.link & tor.watch for new domain listing)

It is worth mentioning that the exposed Dread domain is intermittently displaying a message from at least one other entity⁵ that is currently in control of the private key, which reads:

[Dread2] This domain is now our prize [..] We will run a sharper, more usable project — one where every participant can earn. [..] If you came to figure out what to do next — register, write in the pin, and keep the mirrors. We are not here to finish someone else’s myth. We are here to build a place that does not have to be ashamed of the same mistakes.

The admins are planning a permanent DoS attack on the retired onion to prevent future use. The new Dread address will be published on Daunt.link⁶ and Tor.watch⁷.

This is an ongoing story and the report will be updated when new information is available.

Update 26/10/7: ‘My goal is to put an end to the degenerates’ monopoly on information’ with the new ‘uncensored forum’ project - the ‘conclave’ entity in control of the original Dread domain told Monero Observer; no other information was shared.

Update 26/10/8: second Dread onion mirror (dreadland) was also compromised seemingly due to a 0-day vulnerability in third party software ‘GoBalance’, according to the admins, who admitted that while no hack occured and no data was compromised ‘at server level’, an undetected MiTM attack was still ‘possible’: ‘I recommend making preparations with changing passwords both here and other affected hidden services’⁸.