ECDSA nonce reuse
Every signature needs a fresh random number. Reuse it once — across two transactions — and anyone can recover your private key with grade-school algebra.
The math
Each ECDSA signature uses a one-time random nonce k. The signature's r value is derived only from k, so if the same k signs two different messages, both signatures share the same r. Given two such signatures (r, s₁, h₁) and (r, s₂, h₂):
k = (h₁ − h₂) / (s₁ − s₂) mod n, then d = (s₁·k − h₁) / r mod n
Two equations, one unknown — the private key d pops right out. No brute force required.
Real cases
Android Bitcoin thefts (August 2013)
A flaw in Android's SecureRandom produced repeated nonces across signatures in several Bitcoin wallet apps. Attackers scanned the blockchain for duplicate r values and drained the exposed addresses, prompting an official Bitcoin.org advisory.
Sony PlayStation 3 (2010)
The canonical example: Sony signed PS3 firmware with a fixed nonce instead of a random one. At the 2010 Chaos Communication Congress, the group fail0verflow recovered Sony's master ECDSA signing key from two signatures — the very same math.
The defense
Use deterministic nonces per RFC 6979, which derive k from the message and private key so it is never accidentally repeated. Every reputable modern wallet library does this by default. This mode fetches an address's transaction history and checks for repeated r values.