Biased-Nonce Lattice Attack

Paste a Bitcoin address (or a transaction ID) to extract each input's ECDSA signature components — R, S, Z — then recover the private key from a nonce bias of 1 to 256 bits. When a timing or cache side-channel (Minerva / LadderLeak) leaks bits of every nonce, enough signatures from one key turn that bias into a Hidden Number Problem, solved by building a Boneh–Venkatesan lattice and running LLL reduction. The tool sweeps the full 1–256 bit range: a huge leak (192+ bits) recovers from just 1–2 signatures, while a small bias (8–16 bits) needs many (~16–32). Every hit is verified against the on-chain public key. The heavy lattice math runs in your browser, in a background worker.

bitcoin
Enter a Bitcoin address or a 64-character transaction ID (TXID). Balance and stats load for every chain; the transaction graph loads where a keyless explorer is available.
newest for the address (more transactions = more signatures from one key; big leaks recover from 2, a small bias needs up to ~32)
Both bias models (MSB and LSB) and a ladder of small bias sizes (8–16 bits) are swept automatically. Recovery needs many signatures from a single key; every hit is verified against the on-chain public key.
Balance 0 BTC
Received 0 BTC
TX 0 
Instructions:
1. Enter a Bitcoin address (recommended) or a 64-character TXID. Addresses with many transactions work best — the attack needs many signatures from one key.
2. Signatures are grouped by public key. For each key with enough signatures, an HNP lattice is built and LLL-reduced, sweeping small MSB and LSB nonce biases (8–16 bits).
3. A private key is shown only when it regenerates the on-chain public key, so there are no false positives. A small per-signature bias needs roughly ceil(256 / bias-bits) signatures — about 16 for a 16-bit bias, up to ~32 for an 8-bit bias.
4. An internet connection is required to fetch transaction data from public block explorers. The lattice math itself runs offline, in a background worker.
Educational / read-only tool. Transaction data is fetched live from public block-explorer APIs (blockstream.info, with blockchain.info as a fallback). Key recovery only succeeds when a signer's nonces carry a small, consistent bias (a Minerva / LadderLeak timing side-channel) across enough on-chain signatures — it demonstrates why even a few leaked nonce bits are catastrophic once you have many signatures. Every result is verified against the on-chain public key; nothing is guessed. Never enter keys for wallets you use.