Lattice-free half-half attack on Bitcoin and Ethereum

This report analyzes a weakness in certain ECDSA nonce generation schemes (notably a “half-half” method) and demonstrates that the authors’ Polynonce algebraic attack can recover private keys from signatures produced with that flawed nonce construction; they ran the attack on a Bitcoin blockchain dump and recovered 110 private keys (no non-zero balances found), discuss relations to prior lattice attacks that can recover keys from biased nonces (including single-signature attacks), and publish tooling and results for further analysis.