Loading story…
Multiple reports and research references describe Bitcoin wallet compromise scenarios in which weak, reused, or low-entropy ECDSA nonces allow attackers to recover private keys from public signatures. Several sources tie the risk to the so-called Phantom Curve and Dark Skippy attack patterns, claiming that malicious firmware or flawed random-number generation in hardware and software wallets can leak enough signing material for key recovery after as few as two transactions. Related writeups also connect the issue to broader entropy failures, including alleged hardware-wallet weaknesses such as CVE-2025-27840, and to historical examples like the PlayStation 3 signing flaw, Android OpenSSL wallet compromises, and weak web-wallet RNG implementations.
The references also promote tools such as KeySilentLeak and other blockchain-scanning projects that purportedly analyze Bitcoin signatures for nonce bias, reuse, or reduced entropy and then apply methods including Pollard’s Kangaroo, lattice techniques, and other discrete-logarithm attacks to reconstruct wallet secrets. While some claims are framed as demonstrations involving specific Bitcoin addresses and recovered funds, the underlying security concern matches established cryptographic research showing that biased or repeated nonces can expose keys at scale from passive blockchain analysis. Recommended mitigations across the sources include adopting RFC 6979 deterministic nonce generation, auditing PRNG and entropy sources, enforcing secure boot and firmware verification on hardware wallets, and hardening devices against nonce exfiltration and other signing-side attacks.
Track how attackers are adapting to this technology.
18 events from the most recent confirmed update back to the earliest known activity.
Cryptou published an article explaining that reusing the same ECDSA nonce across two Bitcoin signatures allows algebraic recovery of the nonce and then the private key, resulting in full wallet compromise.
A Cryptou article published research describing KeySilentLeak, a framework for identifying weak Bitcoin signatures and recovering wallet keys from nonce reuse or low-entropy nonce generation. It also referenced the 2024 Dark Skippy hardware-wallet attack concept and a case study involving address 1MikxkAoAQWGBsh6pzsaiHdXAktzzj6Rnt.
Polynonce published an article describing KeySilentLeak as a research cryptanalysis tool for exploiting ECDSA nonce weaknesses such as nonce reuse, predictable nonces, and low-entropy randomness to recover Bitcoin private keys. The article also referenced historical weak-wallet cases including the Milk Sad issue in Libbitcoin Explorer 3.x.
AttackSafe published an analysis of the Dark Skippy attack as a hardware-wallet-focused exploitation of weak ECDSA nonces, claiming two signed transactions can leak enough seed entropy for recovery using Pollard’s Kangaroo. It also described KeySilentLeak and a worked example involving address 1MikxkAoAQWGBsh6pzsaiHdXAktzzj6Rnt.
A GitHub repository under CryptoDeepTools titled "50PhantomCurveAttack" was published, describing Dark Skippy-style low-entropy nonce exploitation and the KeySilentLeak tool for recovering Bitcoin private keys from weak signatures.
CryptoDeepTech published an article analyzing Dark Skippy-style low-entropy nonce attacks in hardware wallets and presenting the KeySilentLeak tool for detecting weak nonce patterns and recovering private keys. The article also described a case study involving Bitcoin address 1MikxkAoAQWGBsh6pzsaiHdXAktzzj6Rnt.
Key3 published an article alleging a "Spectral Fountain" attack in which predictable or weakly seeded PRNGs could make Bitcoin private keys and ECDSA nonces recoverable, and tied the risk to hardware wallets and an alleged entropy issue tracked as CVE-2025-27840. The article also cited claimed demonstrations by CryptoDeepTech involving wallet access recovery and blockchain validation.
Keyhunters published an article describing the "Phantom Curve Attack" as an ECDSA nonce-reuse weakness where two signatures with the same nonce or r value can expose a Bitcoin private key. The article linked the issue to weak RNGs, faulty implementations, and reported wallet-compromise claims.
Keyhunters published an article describing broad cryptocurrency risks from weak private-key generation, insufficient entropy, and flawed PRNG behavior, and tied these to alleged wallet compromises and a claimed wallet recovery holding 21.88992388 BTC. The article also referenced an alleged ESP32-related issue tracked as CVE-2025-27840.
Keyhunters published an article titled "Phantom Nonce," describing a fatal ECDSA vulnerability and private-key recovery threat for lost Bitcoin wallets. This marked public promotion of the nonce-related attack narrative.
B8C TECH published a page titled "BingSec256k1," indicating public release or disclosure of a secp256k1-related project relevant to Bitcoin cryptographic security research.
Polynonce published an article on incorrect private-key generation, systemic vulnerabilities, and secp256k1 order-calculation errors as threats to the Bitcoin ecosystem. This expanded public reporting on Bitcoin key-generation weaknesses.
A GitHub repository titled "Private-key-Debug" was published, covering incorrect private-key generation, system vulnerabilities, and secp256k1 order-calculation issues affecting Bitcoin security.
Keyhunters published an article focused on cryptographic vulnerabilities related to incorrect generation of Bitcoin private keys. The publication marks public discussion of systemic key-generation weaknesses affecting the Bitcoin ecosystem.
A YouTube video titled "How to Earn Cash with Math №2 Bitcoin Wallet Restore through Discrete Logarithm Ricci Flow HNP" was published, presenting wallet-recovery concepts tied to discrete logarithm and hidden-number-problem techniques.
A GitHub repository for "bitcoin-scan," described as a Bitcoin client and ECDSA vulnerability scanner, was published. This reflects public release of tooling aimed at identifying Bitcoin-related ECDSA weaknesses.
No Bullshit Bitcoin published a report titled "A New Class of ECDSA Signature Vulnerability Observed in the Wild on the Bitcoin Blockchain," indicating observation of a distinct ECDSA nonce-related weakness affecting Bitcoin signatures in the wild.
An IACR ePrint paper analyzed biased or repeated ECDSA nonces and reported recovering around 300 Bitcoin private keys, plus additional keys across other ecosystems, from public blockchain data and Internet-wide scans. The paper identified several nonce-bias patterns and noted deterministic nonce generation such as RFC 6979 would prevent these attacks.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
19 references tracked. Mallory keeps watching after this page renders.
polynonce.ru
Open sourceattacksafe.ru
Open sourcegithub.com
Open sourcecryptodeeptech.ru
Open sourcegithub.com
Open sourcecryptou.ru
Open sourceeprint.iacr.org
Open sourcecryptou.ru
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers showed that **ECDSA implementations can fail catastrophically when nonce handling or cryptographic execution leaks even tiny amounts of information**. The *LadderLeak* paper demonstrated private-key recovery from less than one bit of nonce leakage by exploiting side-channel weakness in ECDSA implementations that use the Montgomery ladder, and reported that several OpenSSL versions were vulnerable. The attack combined probabilistic leakage of the nonce’s most significant bit with improved Hidden Number Problem techniques to recover keys on curves including `sect163r1` and `NIST P-192`. Related reporting highlighted broader implementation risk across hardware and software cryptography stacks, including surveys of **deterministic ECDSA per `RFC6979`** in open-source libraries such as **Mbed TLS, GnuTLS, and OpenSSL**, checks for RFC6979 support in smart-card and HSM environments, and a separate report of **memory corruption in the Java Card Runtime Environment (JCRE)** that could affect unpatchable HSM devices and expose private keys. Together, the references show that weak nonce generation, side-channel leakage, and hardware runtime flaws can all undermine ECDSA key protection even when standard cryptographic algorithms are used.
Aug 16, 2026
A flaw in **COLDCARD** hardware wallet firmware made some recovery seeds predictable, and attackers used the weakness to steal about **594.48 BTC**—roughly **$38 million**—from around **500 wallets** in a coordinated sweep lasting about **25 minutes**. Reporting tied the theft to wallets created on affected devices, with the losses spread across roughly 500 transactions in three blocks and most of the stolen funds—about **562 BTC**—later consolidated into a single address. The targeted wallets were reportedly **single-signature** wallets holding more than **0.15 BTC** each, and many had been dormant for years. The weakness was traced to firmware logic that failed to properly use the device hardware random number generator and instead relied on a predictable fallback with a **32-bit reseed** mechanism, reducing entropy in generated seeds. Coinkite said the issue affects **Mk3** devices running firmware **4.0.1 and later**, and also affects **Mk4, Mk5, and Q** devices that generated seeds before fixed firmware was released; the company urged users to update firmware, create entirely new seeds, and move funds because updating alone does not repair already weak seeds. Coinkite added that wallets protected with sufficient independent dice-roll entropy or a strong **BIP-39 passphrase** are better protected, while **TAPSIGNER**, **SATSCARD**, and **OPENDIME** are not affected.
Aug 11, 2026
Coinkite disclosed an ongoing security incident in which vulnerable **COLDCARD** firmware generated wallet seeds with weak entropy, allowing attackers to reproduce seeds offline and steal funds. The company said a build and link integration error during its `libNgU` migration caused seed generation to use MicroPython’s non-cryptographic **Yasmarang** PRNG instead of the intended hardware true random number generator, despite `MICROPY_HW_ENABLE_RNG=0` being meant to disable the software path. Coinkite halted shipments, destroyed remaining affected inventory, released patched firmware for newly generated seeds, and warned that seeds already created on vulnerable devices remain at risk; **SATSCARD, OPENDIME, and TAPSIGNER** were not affected. External reporting said the exploitation began rapidly, with Galaxy Research estimating attackers drained **1,367 BTC**—about **$88.6 million**—from **4,385 addresses** across multiple attack waves after an initial 41-minute sweep of 1,082.65 BTC from 1,196 addresses. Coinkite urged users who created seeds on affected firmware without at least **50 independent private dice rolls** and a strong unique **BIP-39 passphrase** to move funds to a new wallet immediately, while preserving affected devices for possible recovery and law-enforcement action. The company also temporarily suspended its normal 120-day customer data blanking process to preserve records for ongoing and anticipated legal proceedings, while allowing customers to request exemption from that retention protocol.
Aug 12, 2026