Biased Nonce Sense: Lattice Attacks against Weak ECDSA Signatures in Cryptocurrencies

Evidence record

Breitner and Heninger analyzed historical Bitcoin, Ethereum, Ripple and internet-service signatures and recovered private keys under biased or reused ECDSA nonce conditions. Section 5.4 reports 302 distinct Bitcoin keys recovered from short or correlated nonces, while Section 6 documents Ethereum cases. This is primary evidence of implementation-conditioned key recovery, not a general curve discrete-logarithm break or an AI result.

Read the original source ↗

Claim-level citations (4)

• supportsCan AI recover a wallet private key? The proof that is still missing: In the same historical study, one Ethereum signing key was recovered from five signatures sharing a 192-bit nonce prefix and three further keys were compromised by exactly reused signature nonces; these were scheme-implementation weaknesses rather than AI-enabled recovery from a healthy public point.

  Financial Cryptography 2019 preproceedings, Section 6 Ethereum, Results and analysis, paragraphs on 256-bit nonce with 192-bit prefix and repeated nonces; PDF page 13

• supportsCan AI recover a wallet private key? The proof that is still missing: In the 2019 Bitcoin biased-nonce study, 280 of 302 recovered Bitcoin ECDSA keys belonged to the 64-bit nonce category, and 279 of those 280 had been used with multisignature addresses; the study counted 6,026 signatures using the vulnerable nonce patterns across all recovered keys. A compromised signing component does not alone establish that the spending threshold was met.

  Section 5.4 Results and analysis, first two paragraphs and Table 1, PDF page 9: 302 keys, 6,026 vulnerable nonce signatures, 64-bit row 5,863 signatures / 280 distinct keys / 279 multisignature keys

• supportsCan AI recover a wallet private key? The proof that is still missing: Breitner and Heninger reported recovering 302 distinct Bitcoin private keys from short or correlated ECDSA signing nonces in historical blockchain signatures, using a September 13, 2018 Bitcoin snapshot containing 975,560,082 signatures from 446,605,479 distinct public keys; this demonstrated exploitable nonce flaws, not a general discrete-logarithm break.

  Financial Cryptography 2019 preproceedings, Section 5.1 (Bitcoin snapshot, block 541244) and Section 5.4 Results and analysis (302 distinct recovered Bitcoin keys); PDF pages 8-9

• supportsCan AI recover a wallet private key? The proof that is still missing: The 2019 study explains that reusing the same ECDSA nonce across signatures on two different message hashes under the same key permits algebraic recovery of the nonce and long-term secret key, while sufficiently short or correlated nonce values can permit lattice-based private-key recovery from multiple signatures without defeating the general elliptic-curve discrete logarithm problem.

  Section 3.3 Elementary attacks on ECDSA, PDF page 5, and Section 4.5 Breaking ECDSA with the hidden number problem, PDF page 7