Why ECDSA nonces keep breaking — and why quantum entropy fixes it

Every ECDSA signature requires a per-signature random value — the nonce, traditionally called k. If k is reused, biased, or predictable, the private key is algebraically recoverable in microseconds.

This isn't a theoretical attack. It has happened — repeatedly, expensively, and in production.

A short history of wallet randomness failures

Weak randomness has broken wallets at both points where ECDSA needs it: the private key and the per-signature nonce.

• Android Bitcoin wallets (2013) — A flaw in Android's SecureRandom caused nonce reuse in ECDSA signatures. Attackers drained wallets by recovering private keys from two signatures sharing a nonce.
• Profanity (2022) — The vanity address generator used a 32-bit PRNG seed. Attackers brute-forced the seed space and recovered keys. Wintermute lost $160M (CVE-2022-40769).
• Libbitcoin / Milk Sad (2023) — Wallets generated with a Mersenne Twister seeded by time reduced 256-bit key entropy to a brute-forceable range. Over $3.4M drained across multiple chains (CVE-2023-39910).
• Trust Wallet browser extension (2023) — The WASM build fell back to MT19937 with a 32-bit seed when the browser's crypto API was unavailable. Every wallet generated during the affected window was permanently compromised (CVE-2023-31290).

It gets worse: biased nonces

You don't even need full nonce reuse. Breitner & Heninger (FC 2019, "Biased Nonce Sense") demonstrated that partial nonce bias — on the order of a few leaked bits per signature across roughly a hundred signatures — is sufficient for full private key recovery using lattice reduction. On-chain signatures are public records, so the attack applies retroactively to any signer whose nonce generator was biased during the sampled period.

Why CSPRNGs fail

Classical CSPRNGs are deterministic functions of an initial seed. If the seed is weak, cloned, or its state is compromised — via VM snapshotting, entropy pool exhaustion at boot, side-channel leakage, or implementation bugs — every output is predictable to an attacker who knows the seed.

The quantum fix

Quantum random number generators derive their output from physical measurements — single-photon detection, vacuum-state quadrature, or similar quantum processes — rather than from a computed seed. The measurement itself is governed by quantum mechanics, so there is no seed whose compromise propagates into future outputs and no deterministic state an attacker can recover from a subset of the output.

Production QRNG systems do have internal state (buffers, conditioning) and do run algorithms (NIST SP 800-90B health tests, extractors, DRBG amplification) — raw hardware output is typically biased and requires conditioning. What they don't have is the specific failure mode that broke Profanity, Milk Sad, and Trust Wallet: a recoverable root seed from which every future output can be predicted. That is the class of attack QRNG eliminates at the root of the entropy chain.

For ECDSA, QCP can supply the per-signature nonce entropy directly, or — for defense-in-depth — be mixed into an RFC 6979-style deterministic construction: k = HMAC-DRBG(private_key || message, additional_input = QRNG(32 bytes)). This hedged construction gives you both RFC 6979's deterministic uniqueness guarantees and quantum entropy's unpredictability, closing the gap that made each of the failures above exploitable.

EdDSA (Ed25519) is different: it derives its nonce deterministically from the private key and message, so it doesn't take per-signature entropy the way ECDSA does. But the private key itself still depends on entropy at generation time, and hedged EdDSA variants — which mix fresh randomness into the nonce derivation to defend against fault-injection attacks — benefit from the same quantum-rooted entropy source.

The attacks above share a common pattern: they exploit the assumption that classical randomness is good enough. Quantum entropy replaces that assumption with a measured physical process.