Dark Skippy

The Dark Skippy exploit lets a malicious signing device leak a wallet's seed by burying it — split into two halves — inside the ECDSA signature nonces it produces. Because each nonce is a small scalar, the public nonce R = k·G is reconstructed from the signature and the nonce is recovered with Pollard's Kangaroo in O(√range) hops. One nonce yields the signing key d = (s·k − z)/r (verified against the on-chain public key); two nonces are the two seed halves. Run the live recovery, or scan a Bitcoin address / TXID — everything runs in your browser.

bitcoin
Enter a Bitcoin address or a 64-character transaction ID (TXID). Balance and stats load for every chain; the transaction graph loads where a keyless explorer is available.
newest for the address (exactly this many are scanned; a single TXID fetches just that one transaction)
Synthesises a Dark Skippy victim and cracks it end-to-end. Keep bits ≤ 32 for an instant result; the on-chain scan (Analyze) uses the same range.
Balance 0 BTC
Received 0 BTC
TX 0 
Instructions:
1. Click "Run live recovery" to synthesize a Dark Skippy victim (a signing key plus two small "seed-half" nonces), produce two real ECDSA signatures, then watch Pollard's Kangaroo recover both nonces, the private key, and the full seed from only the signatures.
2. Or enter a Bitcoin address / 64-character TXID and click Analyze to extract R, S, Z and search each signature's nonce range for a low-entropy (Dark Skippy) nonce.
3. A private key is shown only when it regenerates the on-chain public key, so there are no false positives. Two recovered small nonces reconstruct the wallet's seed halves.
4. The search range (bits) sets how large a nonce the Kangaroo will hop. Real wallets use full-entropy nonces, so a scan correctly finds nothing — the live recovery is where you see the mechanism. An internet connection is needed only for the on-chain scan.
Educational tool. The live recovery runs entirely in your browser: it builds a victim, signs with deliberately small "seed-half" nonces, and recovers everything with Pollard's Kangaroo — proving why a signer that leaks its nonces is catastrophic. The on-chain scan fetches data live from public block-explorer APIs (blockstream.info, with blockchain.info as a fallback) and only reports a key when it regenerates the on-chain public key; nothing is guessed. A real Dark Skippy leak hides 64-bit halves that need the attacker's offline compute, not a web page. Never enter keys for wallets you use.