They don't need to proactively scan all of GitHub to exploit this kind of mistake, just accounts that are known to be involved with cryptocurrency.

GitHub even makes it easy to find them: https://github.com/search?q=language%3ASolidity&type=users

Given the obvious incentive, I expect multiple groups to be scraping simultaneously, out of sync with each other.

Also, I expect anyone working on high-value systems to be under more targeted scraping.

A delay or just that it polls every 5 minutes?

It's delayed. You can poll it continuously and you get live events "from 5 minutes ago".

"$40k became 'untraceable' while being reported as lost" /s

They're on Twitter with a crypto symbol in the username, you really think targeting is outlandish?

Note he didn't commit his keys by mistake, but rather made a private repo public. Don't know if that makes a difference.

Committing keys is a mistake.

In my mind yes, but he seems to have done it on purpose. At least he was aware of it.

I didn't read that to mean a literal two minutes. Based on his style of writing that was quoted in the article and the nature of his mistake I don't think he's reporting an in-depth postmortem on the situation, although I didn't bother going to twitter to take a closer look. He probably didn't even realize his mistake within two minutes.