August updates block critical private key leak in crypto wallet Vultisig
Summary
ChainSecurity disclosed that Vultisig’s Android and iOS apps could retry ECDSA signing after the DKLS library flagged a malicious participant. With one signer already compromised, repeated exchanges could leak enough information to recover the other share and full private key. The apps treated the critical stop signal as a generic signing failure, undermining the protection of distributed signing. Fixes merged in August recognize malicious-party errors, stop automatic retries, identify the flagged device, and warn users not to use it. The disclosure did not establish a full affected-version or vault-configuration matrix, and ChainSecurity had not reviewed the fixes or audited other parts of the protocol.
