Great research and security disclosure by
@npub1j8d6...26k2 @npub1xh89...gst6 and Robin Linus. Here's what you need to know about the "Dark Skippy" vulnerability:
1. Hardware signing devices insert random values called 'nonces' every time they sign Bitcoin transactions.
2. Weak nonces (values that are not sufficiently random) can allow an attacker to mathematically brute-force the private key from the signatures alone, just by analyzing transactions on the public blockchain.
This is a well-known class of attack. "Dark Skippy" is a new technique which makes it easier to grind the private key from weak nonces.
What are the conditions required for the attack? The attack requires either:
1. Loading malicious firmware onto the device, which generates weak nonces.
2. A bug in the vendor's official firmware that produces weak nonces.
How do I protect myself from this type of attack?
1. Order hardware signing devices straight from the vendors, if possible. The more direct, the lower the likelihood of tampering.
2. Use hardware vendors that have tamper-resistant mechanisms in place, such as tamper-evident sealed bags, firmware attestation, etc.
3. Use hardware where you can easily verify the integrity of the source firmware and its updates.
4. Use hardware that follows security standards in generating nonces. One such standard is RFC6979 (deterministic nonces).
5. Verify the authenticity of the firmware every time you upgrade. (Tip: bookmark the vendor website to avoid phishing).
6. Avoid updating firmware unless you absolutely have to. Use another device if you want to experiment with firmware features that you don't actually need for your main stash.
7. Use multisig, preferably multi-vendor multisig. This alone significantly increases the difficulty of executing the attack.
Multisig versus Anti-exfil
You might have heard that "anti-exfil" is a way to prevent the above attack. In short, anti-exfil describes a security technique which combines entropy from the hardware signing device with entropy from a SECOND DEVICE (typically the host of the companion software wallet) to generate the nonces.
However, there are 2 downsides to this approach. First, there is currently no anti-exfil standard, so you'd have to trust that the vendors implement anti-exfil correctly. Secondly, since anti-exfil changes the way a signature is generated, i.e., asking for entropy from a second device for every single transaction, it is not compatible with the way most Bitcoin wallets work today, and therefore introduces a UI/UX challenge.
Until anti-exfil has a well-defined standard and wider wallet compatibility, we recommend multisig as the more practical approach. Fundamentally, multisig achieves the same goal as anti-exfil: it also requires entropy from a second device to authorize each Bitcoin transaction. Multisig can also add entropy from more than just 2 devices, if you so choose (3-of-5 multisig, for example). Last but not least, multisig has been used for 10+ years in Bitcoin, battle-tested (securing hundreds of billions worth of Bitcoin), and at this point has been very well standardized (PSBT, BSMS, Output Descriptors, to name a few standards).
Hence, use multisig if you are concerned about Dark Skippy.
In conclusion, while the "Dark Skippy" vulnerability highlights potential risks in hardware signing devices, users can significantly mitigate these risks by following best practices in device procurement and usage, and by implementing multisig setups. Stay informed, verify your devices and firmware, and consider multisig for enhanced security of your Bitcoin holdings.
P.S. A common question is: “Does adding a passphrase to my seed phrase protect me against Dark Skippy and similar types of attacks?” The answer is no. Since nonce-based key grinding works against the master private key, not the seed phrase, adding a passphrase will NOT protect you against this class of attack.
View quoted note →
Bitcoin has always supported spending rules (multisig, time delays), but they were complex and risky to implement.
Miniscript structures these rules like Lego blocks, making advanced custody safe, simple, and verifiable.
We didn't just add a few pre-baked scripts.
Nunchuk now supports *generalized* Miniscript. You can create any policy supported under standard Bitcoin rules.
Use our friendly templates, or craft custom spending rules if you're advanced.
Complex policies involving multiple parties require coordination. Doing this over insecure channels (email, messengers) is a major security risk.
Nunchuk solves this. Our E2EE Group Wallets now support Miniscript out of the box.
The entire setup is encrypted, with built-in chat for secure coordination.
This combination lets you build wallets that adapt to real life needs, such as:
🧊 Timelocked inheritance plan
🏛️ Business treasuries with layered approvals & fallbacks
🤝 Non-custodial escrow for OTC trades
👻 Private multi-party wallets that look like single-sig on-chain
You have options.
Prefer simple and widely compatible? Use Native SegWit.
Want advanced privacy and efficiency?
• Taproot hides unused spending branches.
• MuSig2 aggregates multiple signers into one signature (key path or script path).
The choice is yours.
We support major hardware vendors today:
Native SegWit Miniscript: COLDCARD, Tapsigner, Blockstream Jade, Ledger, Specter DIY
Taproot Miniscript: COLDCARD, Ledger, Specter DIY
MuSig2: Software keys only (for now).
More coming as vendors ship support.
Zooming out: These tools (verifiable policies, secure collaboration, advanced scripting) are the primitives of a new financial system.
Fair, open, and anchored to sound money.
Download the Nunchuk app and give it a try.
🤖 Android: https://play.google.com/store/apps/details?id=io.nunchuk.android&hl=en
🍎 iOS: 
