.
.
.
A scientific cryptanalysis tool for forensic recovery of lost Bitcoin wallets. Exploits CVE‑2025‑14505, weak ECDSA nonces, and Hidden Number Problem lattice reduction. Used by security researchers and blockchain forensic experts.
Successfully recovered private key for Bitcoin address 1NiojfedphT6MgMD7UsowNdQmx5JY15djG (balance 0.513 BTC) using JScanPrivKey lattice attack on truncated nonces (CVE‑2025‑14505).
Private key: 0x4ACBB2E3CE1EE22224219B71E3B72BF6C8F2C9AA1D992666DBD8B48AA826FF6B
JScanPrivKey implements lattice attacks on the Hidden Number Problem (HNP) derived from biased ECDSA nonces. The core mathematics:
ECDSA signing (secp256k1): s = k⁻¹(z + r·d) mod n where r = (k·G)_x, z = H(m), d = private key, n = curve order. Vulnerability CVE‑2025‑14505 (Elliptic library truncation): k_faulty = k_correct mod 2^(n−m) (m = 8 bits for one leading zero byte) => k_correct = 2^m·x_i + ε_i From two signatures with same k? -> d = (s₁z₂ − s₂z₁) / (r·(s₂−s₁)) mod n [Nonce reuse] For truncated nonces we build HNP: t_i·d − u_i·x_i ≡ w_i (mod n) where t_i = r_i·(s_i·2^m)⁻¹ mod n, u_i = z_i·(s_i·2^m)⁻¹ mod n.
We construct a lattice basis B of dimension (m+1)×(m+1) and apply the Lenstra–Lenstra–Lovász (LLL) algorithm to find the shortest vector containing the private key d.
B = [ n 0 ... 0 t₁ ] [ 0 n ... 0 t₂ ] [ ... ...] [ 0 0 ... n t_m ] [ 0 0 ... 0 2^ℓ ] Target vector v = (x₁, x₂, …, x_m, d·2^ℓ/n). LLL reduction extracts d via Bounded Distance Decoding with predicate.
Successful recovery demonstrated with 3 truncated signatures from address 1NiojfedphT6MgMD7UsowNdQmx5JY15djG yielding private key and full control of 0.513 BTC.
Discovered in the Elliptic JavaScript package (≤6.6.1), the flaw in _truncateToN() causes nonce truncation when leading zero bytes are present. Probability ≈ 0.39% per signature. With 40‑50 compromised signatures, private key recovery exceeds 95% probability using lattice reduction.
// Vulnerable code snippet var delta = msg.byteLength() * 8 - this.n.bitLength(); // msg.byteLength() ignores leading zeros → incorrect delta. // Consequence: k_faulty = k_correct mod 2^(n-m) leads to HNP.
JScanPrivKey automates the scanning of the Bitcoin blockchain for such anomalies, extracts r, s, z values, and builds the HNP lattice. The LLL implementation (parallel, optimized) reduces the basis and extracts the private key within minutes.
Connects to Bitcoin nodes, extracts DER signatures, public keys, and transaction hashes. Filters by time range and address.
Detects nonce reuse via r‑value collisions, bias via Fourier, and truncation patterns (χ²‑test).
Builds HNP lattice with optimized normalization coefficients; selects best subset of signatures to maximize determinant.
Parallel implementation of Lenstra–Lenstra–Lovász with adaptive δ, runs on CPU/GPU clusters. Reduces basis in polynomial time.
Bounded Distance Decoding with predicate: checks candidate vectors against public key Q = d'·G. Returns validated private key.
Generates full PDF report: recovered key (HEX/WIF), transaction timeline, mathematical proof, and balance snapshot.
JScanPrivKey is written in Python/C++ with bindings to SageMath and PARI/GP for LLL. All cryptanalysis follows rigorous academic standards and is used for authorized security audits and recovery of lost wallets.
Our methodology builds on foundational work by the cryptanalysis community:
JScanPrivKey implements the Hidden Number Problem solution using LLL, as formalized by Boneh & Venkatesan, and extends it to real-world blockchain data.
// HNP lattice dimension requirement m ≥ (n - ℓ)/ℓ + O(log n) where ℓ = known bits (8 for CVE‑2025‑14505) → m ≥ 31 + 8 = 39 signatures needed, practical with 50 signatures >95% success.