Loading story…
Researchers showed that ECDSA implementations can fail catastrophically when nonce handling or cryptographic execution leaks even tiny amounts of information. The LadderLeak paper demonstrated private-key recovery from less than one bit of nonce leakage by exploiting side-channel weakness in ECDSA implementations that use the Montgomery ladder, and reported that several OpenSSL versions were vulnerable. The attack combined probabilistic leakage of the nonce’s most significant bit with improved Hidden Number Problem techniques to recover keys on curves including sect163r1 and NIST P-192.
Related reporting highlighted broader implementation risk across hardware and software cryptography stacks, including surveys of deterministic ECDSA per RFC6979 in open-source libraries such as Mbed TLS, GnuTLS, and OpenSSL, checks for RFC6979 support in smart-card and HSM environments, and a separate report of memory corruption in the Java Card Runtime Environment (JCRE) that could affect unpatchable HSM devices and expose private keys. Together, the references show that weak nonce generation, side-channel leakage, and hardware runtime flaws can all undermine ECDSA key protection even when standard cryptographic algorithms are used.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
The paper "LadderLeak: Breaking ECDSA With Less Than One Bit Of Nonce Leakage" was published as Cryptology ePrint Archive Paper 2020/615. It described a new side-channel vulnerability class affecting ECDSA implementations using the Montgomery ladder and reported that several recent OpenSSL versions were vulnerable to practical key-recovery attacks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
hardenedvault.net
Open sourcehardenedvault.net
Open sourcehardenedvault.net
Open sourceeprint.iacr.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports and research references describe Bitcoin wallet compromise scenarios in which weak, reused, or low-entropy ECDSA nonces allow attackers to recover private keys from public signatures. Several sources tie the risk to the so-called **Phantom Curve** and **Dark Skippy** attack patterns, claiming that malicious firmware or flawed random-number generation in hardware and software wallets can leak enough signing material for key recovery after as few as two transactions. Related writeups also connect the issue to broader entropy failures, including alleged hardware-wallet weaknesses such as `CVE-2025-27840`, and to historical examples like the PlayStation 3 signing flaw, Android OpenSSL wallet compromises, and weak web-wallet RNG implementations. The references also promote tools such as **KeySilentLeak** and other blockchain-scanning projects that purportedly analyze Bitcoin signatures for nonce bias, reuse, or reduced entropy and then apply methods including Pollard’s Kangaroo, lattice techniques, and other discrete-logarithm attacks to reconstruct wallet secrets. While some claims are framed as demonstrations involving specific Bitcoin addresses and recovered funds, the underlying security concern matches established cryptographic research showing that biased or repeated nonces can expose keys at scale from passive blockchain analysis. Recommended mitigations across the sources include adopting **RFC 6979** deterministic nonce generation, auditing PRNG and entropy sources, enforcing secure boot and firmware verification on hardware wallets, and hardening devices against nonce exfiltration and other signing-side attacks.
Jun 29, 2026
OpenSSL disclosed **CVE-2018-0737**, a low-severity cache-timing side channel in RSA private-key generation affecting versions before `1.0.2p` and `1.1.0i`. Three non-constant-time execution paths, including `BN_gcd`, could leak sensitive state to an attacker able to run a precisely timed cache attack on the same physical system while a key is generated, potentially allowing recovery of the newly generated RSA private key. Researchers demonstrated recovery through the `BN_gcd` path at an approximately 30% success rate across more than 10,000 cluster trials. OpenSSL incorporated fixes into `1.0.2p` and `1.1.0i`, with patches also available through upstream commits `349a41da1` and `6939eab03`. Exploitation requires stringent local or adjacent-system access and observation at the moment of key generation, limiting practical exposure; keys generated and retained in hardware security modules are not affected. Red Hat issued fixes for affected RHEL 7 and later systems and JBoss Core Services products.
Aug 29, 2026
Researchers demonstrated that **remote timing attacks** against OpenSSL could recover long-term private keys from general-purpose servers, overturning the assumption that such side channels were only practical against local devices. One line of work showed that OpenSSL `0.9.7` systems using RSA without blinding—including deployments such as **Apache `mod_ssl`** and **stunnel**—leaked enough information during CRT-based decryption to extract a `1024-bit` RSA private key with roughly **1 million to 1.4 million queries** in about **two hours** under typical conditions. The leakage stemmed from timing differences tied to Montgomery extra reductions and the choice between Karatsuba and normal multiplication, and the attack was shown to work across processes, virtual machines, and routed campus networks.
Jun 29, 2026