This paper presents an independent cryptanalytic review of the  Dark Skippy attack  , a method for quickly exfiltrating the master seed (BIP32 seed) from Bitcoin hardware signing devices, announced in Bitcoin Optech Newsletter #315, dated August 9, 2024. Researchers Lloyd Fournier, Nick Farrow, and Robin Linus demonstrated that a malicious signing device with modified firmware is capable of exfiltrating the full entropy of the seed (128 bits for a 12-word mnemonic phrase) with just  two  digital signatures, which can correspond to a single transaction with two inputs. The paper presents a mathematical formalization of the attack model based on ECDSA, an analysis of the vulnerability of weak nonces, and a method for recovering the seed using Pollard’s Kangaroo algorithm. Particular attention is paid to comparison with previous attacks (nonce grinding, Anti-Klepto), analysis of protocol countermeasures and historical examples from cryptanalysis.

Content

• 1. Introduction
• 2. Context and responsible disclosure
• 3. Dark Skippy attack pattern
• 4. Mathematical formalization
• 5. Comparison with historical attacks
• 6. Real-life examples from cryptanalysis
• 7. Countermeasures and exfiltration-resistant signing
• 8. Conclusion

1. Introduction

On August 9, 2024,   a new attack on Bitcoin hardware signing devices, dubbed  Dark Skippy , was announced in the weekly Bitcoin Optech Newsletter #315. [reference:0] The authors, Lloyd Fournier, Nick Farrow, and Robin Linus, presented a method that allows a malicious signing device (e.g., a hardware wallet with compromised firmware) to exfiltrate a user’s master seed with just  two  signatures. [reference:1] This represents a quantum leap over previously known attacks, which required dozens of signatures to extract the seed. [reference:2]

Dark Skippy is a  key  exfiltration attack, in which signature generation code intentionally generates signatures that leak private key or BIP32 seed information.[3] Unlike software wallets, which can easily transmit the seed over the network if malicious code is present, hardware devices without direct internet access present a more difficult target for exfiltration.[4] Dark Skippy demonstrates that even with an air gap and limited communication channels (NFC, SD cards, QR codes), a malicious device can effectively transmit the seed.[5]

In this paper, we present an independent cryptanalytic review of Dark Skippy, including a formal mathematical description of the attack model, an analysis of its relationship to classical ECDSA nonce vulnerabilities, as well as historical context and practical recommendations for protection.

2. Context and responsible disclosure

2.1. Responsible Disclosure

The researchers notified approximately 15 different hardware signing device vendors of the vulnerability through a  responsible disclosure process  [reference:6][reference:7]. This approach aligns with generally accepted standards in the cybersecurity industry and allows vendors to take action before public disclosure.

It’s important to note that Dark Skippy  is not a vulnerability specific to any device or protocol  in the traditional sense[reference:8][reference:9]. Rather, it is  a general method  that can be implemented on any signing device if it runs malicious firmware[reference:10]. At the time of publication, the attack has not been observed in the wild[reference:11].

An example from the history of responsible disclosure:  In 2020, researchers from Kraken Security Labs discovered a vulnerability in Ledger and Trezor hardware wallets related to seed extraction through side-channel analysis under certain conditions. Manufacturers were notified in advance, and patches were released before public disclosure. Dark Skippy continues this tradition, but the scale of the threat is significantly greater, as the attack requires  only two  signatures.

2.2 Previous Work: Key Exfiltration Problem

The problem of key exfiltration from signing devices has been known in the Bitcoin community since at least 2020.  Optech Newsletter #87  (March 2020) discussed a proposal to standardize an exfiltration-resistant nonce protocol[reference:12]. Later,  Newsletter #136  (February 2021) reported the implementation of such methods in two hardware devices[reference:13].

Before Dark Skippy, the best known attack required  dozens of signatures  to exfiltrate a BIP32 seed.[reference:14][reference:15] Dark Skippy reduces this number to  two  signatures, which can belong to a single two-input transaction.[reference:16] This means that all of a user’s funds can be vulnerable from the first attempt to spend any amount.[reference:17]

3. Dark Skippy attack pattern

3.1. Prerequisites and requirements for the attacker

To perform a Dark Skippy attack, an attacker must perform the following steps[reference:18]:

1. Compromise the signing device  by loading malicious firmware onto it. This can be achieved through physical access, phishing, supply chain attacks, or exploiting vulnerabilities in the firmware update process[reference:19].
2. Modify the signature function  to use weak, low-entropy values ​​that are fragments of the exfiltrated seed instead of random nonces[reference:20].
3. Monitor the Bitcoin network  (mempool) to detect transactions signed by a compromised device[reference:21].
4. Recover the seed using cryptanalytic methods such as  Pollard’s Kangaroo algorithm  (hence the name “Dark Skippy”)[reference:22].

Remarkably, the attack works even in air-gapped conditions: data is exfiltrated through the signatures themselves, transmitted over open channels (QR codes, SD cards, NFC) [reference:23]. As the authors note, “air-gapping is about as useful as a glass door on a dunny for protecting against a malicious hardware wallet” [reference:24].

3.2. Exfiltration mechanism

In the basic (rudimentary) version of the attack[reference:25]:

• For a 12-word seed (total entropy 16 bytes = 128 bits), the first  8 bytes  are used as a nonce to sign the first input, and the remaining  8 bytes  are used to sign the second input[reference:26].
• The attacker, observing the public components of the signature ( R is the point on the elliptic curve corresponding to the nonce), applies Pollard’s Kangaroo algorithm to recover the secret nonce[reference:27].
• After recovering both nonces, the attacker concatenates them to obtain the full 16 bytes of seed entropy[reference:28].

More sophisticated attack variants may include[reference:29]:

• Blinding  the nonce using a key controlled by the attacker and embedded in the malicious device, allowing only the attacker to extract the seed[reference:30].
• Watermarking  transactions so that an attacker can easily identify them on the blockchain[reference:31].

For the user, the attack is virtually  undetectable  and difficult to forensically analyze[reference:32].

A real-world example:  In 2019, researchers from Kudelski Security demonstrated an attack on Bitcoin Core using weak nonces generated  rand() without proper initialization. As a result, a private key could be recovered from multiple signatures. Dark Skippy is an extension of this idea, but with targeted control of the nonce to exfiltrate  the seed , rather than the private key, of an individual address.

4. Mathematical formalization

4.1 ECDSA and the Role of the Nonce

In the Elliptic Curve Digital Signature Algorithm (ECDSA) used in Bitcoin, the signature for a message  m  with a private key  d  and a base point  G  of order  n  is computed as follows:

(1) Generate a nonce: k ∈ [1, n-1] (random integer)

(2) Calculation of R: R = k · G

(3) r = R _x mod n

(4) Calculation of s: s = k ^-1 · (H(m) + d · r) mod n

where  H(m)  is the cryptographic hash of the message (in Bitcoin, double SHA-256). The pair  (r, s)  constitutes the signature.

The key observation is that  if the nonce  k  becomes known to the attacker, then the private key  d  is easily computed:

(5) Recovering the private key given the nonce: d = (s · k — H(m)) · r ^-1 mod n

4.2. Dark Skippy Attack Model

Let  S  be a 16-byte master seed (for a 12-word BIP39 mnemonic phrase). The malicious device splits  S  into two parts:

(6) Seed partition: S = S ₁ || S ₂ , where |S ₁ | = |S ₂ | = 8 bytes

For the first signature (the first input of a transaction), the device uses:

(7) Nonce for the first signature: k ₁ = S ₁  (as an integer, 8 bytes)

For the second signature (second input) – the remaining part:

(8) Nonce for the second signature: k ₂ = S ₂  (as an integer, 8 bytes)

An attacker, observing the signatures  (r ₁ , s ₁ )  and  (r ₂ , s ₂ )  for the corresponding messages  m ₁  and  m ₂ , knows that  k ₁  and  k ₂  lie in a space of size  2 ⁶⁴  (8 bytes) each. To recover  k ₁  and  k ₂ , Pollard’s Kangaroo algorithm (also known as the lambda algorithm) for the discrete logarithm in the elliptic curve group  is applied   [reference:33].

(9) Discrete logarithm problem for nonce: Find k such that R = k · G, where R is known from the signature and k < 2 ⁶⁴

Pollard’s Kangaroo has complexity  O(√w) , where  w  is the size of the search interval. For  w = 264, ^{the complexity}  is about  232  operations, which is feasible on modern hardware in a reasonable time [reference:34].

After recovering  k ₁  and  k _{2 ,}  the attacker concatenates them:

(10) Seed recovery: S = k ₁ || k ₂

The resulting seed allows an attacker to calculate all child keys using BIP32 and steal all the user’s funds[reference:35].

4.3. Generalization in case of blinding

In a more advanced version of the attack, the device uses blinding:

(11) Blinded nonce: k = S _i ⊕ B, where B is a secret blinding factor built into the firmware

The attacker, knowing  B , recovers  S _i  after extracting  k . This allows the exfiltration to be hidden from third parties who might also attempt to recover the nonce[reference:36].

A real-world example from cryptanalysis (Pollard’s Kangaroo):  In 2020, a researcher under the pseudonym “Jean-Luc PONS” successfully applied Pollard’s Kangaroo to recover a private key from a weak nonce in a Bitcoin transaction (a well-known case of “Nonce reuse vulnerability”). Dark Skippy adapts this method for targeted seed exfiltration.

5. Comparison with historical attacks

Characteristic	Classic nonce grinding	Anti-Klepto (attack)	Dark Skippy
Number of signatures for seed exfiltration	Tens[reference:37]	Tens[reference:38]	2 [reference:39]
Mechanism	Weak/repeated nonces	Modification of the signature function	Intentional seed injection into nonce[reference:40]
Required access	Signature monitoring	Compromised device	Compromised device + surveillance[reference:41]
Detectability	High (nonce anomalies)	Average	Virtually undetectable [reference:42]
Applicability to air-gapped devices	Yes	Yes	Yes [reference:43]

As the table shows, Dark Skippy represents a significant advance in the effectiveness and stealth of key exfiltration attacks.

6. Real-life examples from the history of cryptanalysis

6.1. Attack on PlayStation 3 (2010)

One of the most famous examples of a nonce reuse vulnerability is the PlayStation 3 hack. Sony developers used a fixed  k value  for all ECDSA signatures. This allowed attackers to recover the private key used to sign games and firmware. Dark Skippy uses a similar principle, but with  deliberate  control of the nonce for exfiltration rather than an accidental error.

6.2. Android Bitcoin Wallet Attack (2013)

In 2013, a vulnerability was discovered in the Java random number generator  SecureRandom on Android that caused nonce collisions in Bitcoin transactions. As a result, several users lost funds, as attackers were able to recover private keys from repeated  k . Dark Skippy demonstrates that even with a high-quality RNG, a device can be compromised at the firmware level.

6.3. Nonce Grinding Attack on Hardware Wallets (2020-2021)

Researchers have repeatedly demonstrated that if a hardware device generates a nonce with insufficient entropy or using a predictable generator, the private key can be recovered. However, exfiltrating  the seed  required multiple signatures. Dark Skippy reduces this number to two, making the attack  virtually instantaneous  from the user’s perspective [reference:44].

A practical scenario:  Let’s say a user purchases a hardware wallet with pre-installed malicious firmware (a supply chain attack). During the first transaction (for example, sending 0.001 BTC to an exchange), the device generates two signatures for two UTXOs. The attacker, observing the mempool, recovers the seed within minutes and transfers all the user’s funds to their wallet. The user is unaware of the attack until they attempt to spend the remaining funds.

7. Countermeasures and exfiltration-resistant signing

7.1 Existing protocol protections

Exfiltration-resistant signing methods have long been discussed in the Bitcoin community[reference:45]. Currently,  two  hardware signing devices are known to have implemented such methods[reference:46]. These methods require an additional round of communication with the device compared to standard signing[reference:47].

Optech recommends that users storing significant amounts of money in hardware devices protect themselves from compromised hardware or firmware by[reference:48]:

• Exfiltration-resistant signing  — protocols that prevent leakage of key material through signatures[reference:49];
• Using multiple independent devices  (e.g. with multi-signature or threshold signature)[reference:50].

7.2 Proposed countermeasures in the Dark Skippy report

The attack authors proposed several protocol measures that could be integrated into Partially Signed Bitcoin Transactions (PSBT) workflows[reference:51]:

• Mandatory adaptor signatures  require the signing device to provide additional cryptographic evidence of the correctness of the nonce;
• Mandatory nonce proof-of-work  makes it difficult to use weak nonces because it requires computational effort.[reference:52]

However, as the authors note, checking deterministic nonces (e.g., according to RFC 6979)  is not a reliable defense , since a malicious device can behave selectively (e.g., exfiltrate seeds only when the sum is above a certain threshold, or only on the main network)[reference:53].

7.3. Recommendations for users

Based on the analysis of Dark Skippy, the following practical recommendations can be formulated[reference:54]:

1. Verify the authenticity of the device  —purchase hardware wallets only from authorized distributors, and check the packaging and holographic seals for integrity.
2. Verify firmware  – If possible, check the digital signatures of the firmware using the vendor’s public keys[reference:55].
3. Use multi-signature  – distributing funds across multiple independent devices reduces the risk of a single point of failure[reference:56].
4. Stay tuned  —manufacturers may release firmware updates that implement exfiltration-resistant signing[reference:57].

A historical example of an effective countermeasure:  In 2021, Shift Cryptosecurity (the maker of BitBox) implemented the Anti-Klepto protocol, which requires devices to prove that nonces are randomly generated and not tampered with. This was a response to early research on key exfiltration. Dark Skippy demonstrates that such measures are necessary, but not sufficient—  a protocol-specific  protection layer is required on the watch-only wallet side.

8. Conclusion

The Dark Skippy attack  , announced in Bitcoin Optech Newsletter #315, represents a significant advancement in methods for exfiltrating keys from hardware signing devices. Reducing the required number of signatures from dozens to just  a couple  makes the attack virtually instantaneous and extremely difficult to detect.[reference:58]

From a cryptanalytic perspective, Dark Skippy relies on well-known ECDSA vulnerabilities related to the compromise of nonces  k . However, the novelty of this approach lies in  the deliberate  use of the nonce as a seed transmission channel, rather than as a side effect of poor random number generation. Using Pollard’s Kangaroo algorithm to recover the nonce from a 64-bit space makes the attack computationally feasible [reference:59].

It’s important to emphasize that Dark Skippy  isn’t a vendor- or device-specific vulnerability  —it’s a general method that can be implemented in any signing device with modified firmware.[reference:60] Therefore, protection must be built at  the protocol level , with the implementation of exfiltration-resistant signing and additional cryptographic checks.

For the scientific community, Dark Skippy serves as a reminder of the fundamental problem of hardware trust in cryptocurrency systems. Even with air-gapping and physical isolation, the device remains  a trusted third party  for signature generation. Developing formally verifiable signing protocols with exfiltration-proof guarantees remains an open research problem.[reference:61]

Sources

Independent review of Bitcoin Optech. Newsletter #315: Dark Skippy:  https://allbi.ru/independent-review-of-bitcoin-optech-newsletter-315-dark-skippy/

1. A. Chow.  BIP-174: Partially Signed Bitcoin Transaction Format , status Final, created 2017-07-12. GitHub bitcoin/bips.
2. Bitcoin BIP-32: Hierarchical Deterministic Wallets.
3. RFC 6979: Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA).
4. Bitcoin BIP-127: Proof of Reserves; BIP-370: PSBT Version 2; BIP-141: Segregated Witness.