demining/phantom-signature-attackCryptanalytic study of CVE-2025-29774 and SIGHASH_SINGLE flaws in Bitcoin's ECDSA implementation, enabling private key recovery via nonce reuse and signature forgery for lost wallet access.
This research paper presents a comprehensive cryptanalytic study of critical vulnerabilities in the Bitcoin protocol’s digital signature implementation, namely the Phantom Signature Attack (CVE-2025-29774) and the fundamental SIGHASH_SINGLE processing error . The study demonstrates that incorrect processing of cryptographic primitives in the transaction signature mechanism creates the conditions for the complete compromise of cryptocurrency wallet owners’ private keys without their knowledge. The attack exploits a legacy bug in the original Satoshi client, in which the system returns a universal hash value of “1” (uint256) instead of rejecting the signature if the number of transaction inputs and outputs does not match.
The practical part of the study involves the use of the KeyFuzzMaster cryptographic tool for systematically identifying vulnerabilities in signature verification code, elliptic curve operations, and transaction hashing functions. Mathematical formulas for private key recovery through nonce (k-parameter) reuse in the ECDSA algorithm on the secp256k1 curve are presented. Cryptographic primitives of the ECDSA (Elliptic Curve Digital Signature Algorithm) algorithm over the secp256k1 elliptic curve are discussed. Digital signatures in Bitcoin perform a triple function: authorization of spending, non-repudiation, and guarantee of transaction integrity.
However, maintaining legacy architectural solutions to ensure backward compatibility has led to the emergence of subtle cryptographic vulnerabilities with potentially catastrophic consequences. Among these, the SIGHASH_SINGLE bug stands out —a fundamental flaw in the signature hash generation mechanism, inherited from the original Bitcoin Core implementation and integrated into the network consensus.
| CVE identifier | Component | CVSS Score | Criticality |
|---|---|---|---|
| CVE-2025-29774 | xml-crypto / SIGHASH_SINGLE | 9.3 | Critical |
| CVE-2025-29775 | xml-crypto DigestValue bypass | 9.3 | Critical |
| CVE-2025-48102 | GoUrl Bitcoin Payment Gateway (Stored XSS) | 5.9 | Average |
| CVE-2025-26541 | CodeSolz WooCommerce Gateway (Reflected XSS) | 6.1 | Average |
Bitcoin uses the secp256k1 elliptic curve defined by the SECG (Standards for Efficient Cryptography Group) standard. The curve is defined by the Weierstrass equation over a finite field:
Curve equation:
y² ≡ x³ + ax + b (mod p)
For secp256k1:
y² ≡ x³ + 7 (mod p), where a = 0, b = 7
The parameters of the secp256k1 curve are determined by the tuple T = (p, a, b, G, n, h):
secp256k1 parameters:
p = 2²⁵⁶ − 2³² − 977 (the prime number defining a finite field)
n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
(the order of the curve point group is the integer order of the generator G)
G = (Gₓ, Gᵧ) — fixed base point (generator)
The ECDSA algorithm uses a private key d to form a signature on a message M. The signing process involves the following mathematical operations:
