Some Git source code repositories, including at least 392 from GitHub, have been wiped and replaced with a ransom demand in a possible coordinated attack
Hacker wipes Git repos and asks for Bitcoin. Gives victims 10 days and threatens to release the code.
Context & Ripple Effects
This 2019 incident is the opening move in what has become a decade-long campaign against Git infrastructure: attackers wiped at least 392 GitHub repositories and replaced them with a Bitcoin demand giving victims ten days before the code would be released. At the time it read as opportunistic vandalism aimed at exposed credentials.
The pattern has since escalated rather than faded. Researchers later documented a [[a:849868|repo confusion attack cloning existing repos and seeding them with malware loaders across 100K+ GitHub repos]], and by 2026 the same ecosystem was absorbing automated-commit malware campaigns and direct extortion of major vendors — Grafana refused a ransom after its GitHub environment was breached, while Socket tied TeamPCP's claimed breach to waves of supply chain compromises.
First-order effects
- Victims whose repos were wiped face a hard ten-day clock to restore from local clones or backups or risk public release of their code, since the attacker controls the only intact copy on the remote.
- GitHub-hosted projects that relied solely on the remote as their canonical copy discover immediately whether their backup discipline exists — the attack converts every maintainer without mirrors into a potential payer.
Second-order effects
- Hosting platforms and enterprises are pushed toward treating the forge as an untrusted tier: mandatory off-platform mirroring, credential hygiene for push access, and audit tooling become baseline rather than optional.
- Attackers learn that wiping repos generates headlines but rarely payouts compared with injecting code — a lesson visible in the later shift toward malware-laden commits and vendor extortion like Grafana's breach.
Third-order effects
- If the arc holds, source-code forges consolidate into defended ecosystems where platform-level security posture — not individual repo hygiene — determines exposure, pushing smaller self-hosted Git operators toward managed platforms or hardened mirror chains.
- Extortion against software supply chains becomes a recurring revenue model rather than a one-off crime, forcing regulators and enterprise buyers to treat repository integrity as critical infrastructure.
The trend: Attacks on Git infrastructure are evolving from destructive ransom stunts toward persistent supply-chain compromise and vendor extortion, making repository integrity a standing security discipline.