One repeated number gives away the key.

1. Create a wallet

   Generate a random private key and its public key.

   Generate key

2. Sign two transactions

   Every ECDSA signature needs a fresh one-time secret, the nonce k. Our buggy wallet reuses it.

   Message 1 Message 2 Buggy wallet: reuse the nonce Sign both

3. Recover the private key

   Using only the two public signatures and messages:

   k = (z₁ − z₂) / (s₁ − s₂)  mod n
   d = (s₁·k − z₁) / r       mod n

   Recover key

4. Forge a transaction

   Sign something the owner never approved, then check it against their public key.

   Message 3 Forge and verify

Nothing about ECDSA was broken. The implementation was. Try it again with the buggy-wallet box unticked: with a fresh nonce for each signature, recovery is impossible. Failures like this can’t be seen from a dashboard. You find them by tracing where every key and every random number in a system comes from, which is the first thing a Math Break audit does.

• See the audit
• Talk to Joshua