Vultisig fixes critical private key leak in shared signing wallet after security researchers' disclosure

Security researchers at ChainSecurity disclosed on Oct. 21 that Vultisig's ECDSA signing implementation mishandled a critical stop signal, allowing a compromised signer to recover the full private key through repeated error responses. The flaw involved an attacker sending many malicious signing messages and observing whether the other signer returned an error, which revealed bits of a reusable internal protocol seed. The August 21 updates to both Android and iOS versions now stop retries and identify the compromised device upon detecting the library's malicious-party error codes 100-109, rather than displaying a generic failure message and retrying up to three times.