Loading story…
A cryptography article has raised new questions about the transparency of the SEC 2 Koblitz curve parameter selection process, including for secp256k1, the elliptic curve used by Bitcoin. The report says a reproducible experiment on the standard generator point G found that dividing the point by 2 yields an unusually short x-coordinate with a shared 152-bit hexadecimal substring that also appears across secp160k1, secp192k1, secp224k1, and secp256k1. The article attributes the observation to earlier work by John Zweng and argues the repeated structure is more consistent with a deterministic but undocumented generation method than with random selection.
The report does not claim a direct break of ECDSA or Schnorr signatures when a single generator is used, but says the finding could affect confidence in how standardized curve parameters were chosen. It highlights potential implications for future multi-generator cryptographic constructions, including Pedersen commitments and confidential transaction designs, where transparent NUMS-style parameter generation is important to avoid hidden structure. The article also says the anomaly can be reproduced with Python and SageMath and appears specific to division by 2 rather than small divisors such as 3, 5, or 7.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-27, Polynonce published a technical article arguing that claims of '12 hidden prime numbers' embedded in secp256k1 constants are not mathematically supported. The article reports direct checks of SEC2 parameters and concludes the theory is pseudoscientific numerology rather than evidence of a cryptographic backdoor.
On 2026-07-27, Polynonce published a Russian-language technical article arguing that secp256k1's parameters were selected deterministically rather than randomly. The article claims 12 hidden prime divisors can be derived from key secp256k1 constants and provides Python, SageMath, Magma, and PARI/GP scripts to inspect and factor those values.
The Polynonce article says John Zweng's 2025 work identified that dividing the standard generator point G by 2 on secp160k1, secp192k1, secp224k1, and secp256k1 yields x-coordinates sharing a common 152-bit hexadecimal substring, suggesting a deterministic but undocumented generator selection process.
On 2026-07-26, Polynonce published an article analyzing the SEC 2 Koblitz curves and reproducing the claimed anomaly with Python and SageMath/Google Colab, while arguing the finding raises transparency concerns for Certicom's parameter generation and future multi-generator cryptographic constructions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
10 references tracked. Mallory keeps watching after this page renders.
polynonce.ru
Open sourcepolynonce.ru
Open sourcepolynonce.ru
Open sourcepolynonce.ru
Open sourcepolynonce.ru
Open sourcegithub.com
Open sourcebitcolab.ru
Open sourcesecg.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers showed that **ECDSA implementations can fail catastrophically when nonce handling or cryptographic execution leaks even tiny amounts of information**. The *LadderLeak* paper demonstrated private-key recovery from less than one bit of nonce leakage by exploiting side-channel weakness in ECDSA implementations that use the Montgomery ladder, and reported that several OpenSSL versions were vulnerable. The attack combined probabilistic leakage of the nonce’s most significant bit with improved Hidden Number Problem techniques to recover keys on curves including `sect163r1` and `NIST P-192`. Related reporting highlighted broader implementation risk across hardware and software cryptography stacks, including surveys of **deterministic ECDSA per `RFC6979`** in open-source libraries such as **Mbed TLS, GnuTLS, and OpenSSL**, checks for RFC6979 support in smart-card and HSM environments, and a separate report of **memory corruption in the Java Card Runtime Environment (JCRE)** that could affect unpatchable HSM devices and expose private keys. Together, the references show that weak nonce generation, side-channel leakage, and hardware runtime flaws can all undermine ECDSA key protection even when standard cryptographic algorithms are used.
Aug 16, 2026
Multiple reports and research references describe Bitcoin wallet compromise scenarios in which weak, reused, or low-entropy ECDSA nonces allow attackers to recover private keys from public signatures. Several sources tie the risk to the so-called **Phantom Curve** and **Dark Skippy** attack patterns, claiming that malicious firmware or flawed random-number generation in hardware and software wallets can leak enough signing material for key recovery after as few as two transactions. Related writeups also connect the issue to broader entropy failures, including alleged hardware-wallet weaknesses such as `CVE-2025-27840`, and to historical examples like the PlayStation 3 signing flaw, Android OpenSSL wallet compromises, and weak web-wallet RNG implementations. The references also promote tools such as **KeySilentLeak** and other blockchain-scanning projects that purportedly analyze Bitcoin signatures for nonce bias, reuse, or reduced entropy and then apply methods including Pollard’s Kangaroo, lattice techniques, and other discrete-logarithm attacks to reconstruct wallet secrets. While some claims are framed as demonstrations involving specific Bitcoin addresses and recovered funds, the underlying security concern matches established cryptographic research showing that biased or repeated nonces can expose keys at scale from passive blockchain analysis. Recommended mitigations across the sources include adopting **RFC 6979** deterministic nonce generation, auditing PRNG and entropy sources, enforcing secure boot and firmware verification on hardware wallets, and hardening devices against nonce exfiltration and other signing-side attacks.
Jun 29, 2026
Post-quantum security researchers warned that public reporting is becoming an unreliable measure of progress toward cryptographically relevant quantum computers, after high-profile disclosures on Shor-based attacks against elliptic-curve cryptography exposed tensions between openness and national-security concerns. Oratomic publicly released resource estimates and a responsible-disclosure statement for fault-tolerant quantum cryptanalysis, while Google published `ECDLP-256` resource estimates only after consulting the U.S. government and withheld the underlying circuits behind a zero-knowledge proof. The disclosures were presented as evidence that publication decisions around quantum cryptanalysis are becoming sensitive in their own right, with U.S. export controls, executive actions, and other intervention mechanisms cited as tools that could further limit what becomes public. Google’s partial-disclosure approach quickly unraveled: André Schrottenloher independently reconstructed the concealed circuits, and Trail of Bits reportedly forged a proof by exploiting bugs in Google’s prover code, undermining the attempt to reveal results without fully exposing implementation details. Commentaries tied those events to a broader warning that future breakthroughs may be selectively disclosed or kept secret altogether, echoing older intelligence-era norms around cryptanalytic advances. For defenders, the practical message was to stop using public quantum milestones as the trigger for post-quantum migration and instead treat published capability as a lower bound while accelerating cryptographic inventory, dependency mapping, and migration planning.
Jul 12, 2026