ECDSA Fault / Bit-Flip Attack

Scan a Bitcoin address (or paste a TXID) to pull the real on-chain signatures (R S Z) and run the fault analysis over every signer’s pairs — a reused nonce (same r) or a single-bit nonce fault leaks the key instantly. Or paste a correct + faulty r : s : z pair offline. A glitch (voltage, clock, laser or Rowhammer) that flips one bit of the secret nonce k, reuses it, or collapses it leaks the key in closed form. Every result is self-verified — the implied nonce must reproduce the signature’s r. Everything runs in your browser.

bitcoin
Fetches the address's on-chain transactions, extracts every ECDSA signature (R, S, Z — legacy & segwit/BIP-143) and runs the fault recovery over each signer's signature pairs. Nonce reuse and single-bit nonce faults are recovered instantly.
transactions (newest first)
runs entirely in your browser — press Ctrl+Enter to recover. 
Instructions:
1. SCAN — paste a Bitcoin address (or a 64-character TXID) and press "Scan signatures". The tool fetches the address's on-chain transactions, extracts every ECDSA signature (R, S, Z — legacy and segwit/BIP-143) and runs the fault analysis over each signer's signature pairs.
2. A reused nonce (two signatures with the same r), a single-bit nonce fault (k_faulty = k ± 2^b), or a collapsed small nonce leaks the private key instantly — verified by reproducing the signature's r.
3. PASTE — for offline demo, type two signatures from the SAME key (a correct one and a faulty one) each on its own line as r:s:z (hex). Optionally add "pub: <hex>" to verify against a public key, and "k: <value>" if the faulty nonce is known.
4. A private key is shown only when it reproduces the signature's r (and the public key, if given) — no false positives.
5. Click "Load example" for a working offline demo.
Educational tool. This demonstrates differential fault analysis (DFA) on ECDSA: when a hardware signer glitches — a voltage/clock/laser fault or a Rowhammer bit-flip — a single corrupted bit of the secret nonce turns one correct and one faulty signature into a full private-key leak, in closed form. It works only on signatures whose nonce was actually faulted (or reused); a clean signature pair recovers nothing. Every result is verified by reconstructing the signature's r; nothing is guessed. Never enter keys for wallets you use.