Just to add my personal opinion of the Wallet Fiasco...
There's no evidence that GitHub has been hacked...
So whoever posted the 'rogue file' must have had prior access to the account.
And the reason for the hack is probably more compromising than the BTG team care to admit.
Not dumping a Virus, or Rootkit, as they've suggested.
The major weakness of HD (Hierarchical Deterministic) wallets is that they rely on a 'seed' value to generate every address that they are capable of.
Compromise this, and you can access the private keys generated by every copy of the 'rogue' wallet.
And then steal the contents of every address generated by that seed.