This is so absurdly simple and yet devastating. Reading some of the comments on the Github issue you posted, this stood out (I don't know anything about lucky7coin):
> So disappointing such code was not reviewed by Vern and team before running it on the server where damage could result.
So this code was actually put into production somewhere at some point -- wow. And cursory code review and compiling from source will do absolutely nothing here.
That often expands into hundreds of thousands of lines though. It's more routine to go backdoor-hunting in binaries; you've given me the interesting idea of running `strings` on the binary and looking for anything that's not in the source.
> So disappointing such code was not reviewed by Vern and team before running it on the server where damage could result.
So this code was actually put into production somewhere at some point -- wow. And cursory code review and compiling from source will do absolutely nothing here.