Dread's main onion private key exposed: 'Today is a sad day'

Dread¹ administrators HugBunter² and Paris³ have reported today⁴ that the private key for the main onionsite was accidentally exposed in what appears to be the first real security issue that the forum experienced since launch:

Unfortunately, it appears that a recent upload of an updated archive for the GoBalance software, was the wrong package containing, what should have only ever remained local, our onion private key. [..] This [main] domain can be used by whoever has the private key, which opens huge MiTM risks. (HugBunter)

I fucked up. Archived the wrong directory in the incorrect Qube and stupidly uploaded dread’s main onion private key into a gobalance update. (Paris)

Incident overview

Unaffected:
 * servers & user data
 
Affected:
 * the main domain (now retired): 
 dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion
 
Official recommendation:
 * do not trust retired domain
 * wait for updates

It is worth mentioning that the exposed Dread domain is intermittently displaying a message from at least one other entity⁵ that is currently in control of the private key, which reads:

[Dread2] This domain is now our prize [..] We will run a sharper, more usable project — one where every participant can earn. [..] If you came to figure out what to do next — register, write in the pin, and keep the mirrors. We are not here to finish someone else’s myth. We are here to build a place that does not have to be ashamed of the same mistakes.

The admins are planning a permanent DoS attack on the retired onion to prevent future use. The new Dread address will be published on Daunt.link⁶ and Tor.watch⁷.

This is an ongoing story and the report will be updated when new information is available.