Low order calculated as: 142393661588618631124367558329129831721258921133329965251678624050800531446149513211695563794469400071298339844826774992453856440487613232814046884710002004308110224877166547666596889228843713919855121125886525144407485343940156
Base point after scaling: (51625506863060491577657288757181147576313939976966412237861325982245450729022*z^2 : 49221422808436841396470345893403624465052376179251603819877718257495916669156 : 1)
Target point after scaling: (110974968763117171622808860036105470024737559947254951736159563904722056600050*z^2 : 45554962652940387360842202629183926818175847992039505756191562188071661519508 : 1)
Target point coordinates: (110974968763117171622808860036105470024737559947254951736159563904722056600050*z^2 : 45554962652940387360842202629183926818175847992039505756191562188071661519508 : 1)
Found matching scalar i = 1166
Found matching scalar i = 9737

can you explain how to recover private key. Huh

If we can do this with fixed real public key we can recover private key,

give me example value and code ,recover private key

Target point is

G = E(0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798, 0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8)

X = 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798
Y = 0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8

what is a priv of you secp257k1 loint ?

what is a benefit of this "attack"?

It can recover private key for 10 - 15 minutes.

Maybe, but, you know what sach code have many " false-positives" methods

Can you please show example with recover privkey in range 2**80 ?

With random points we can easily recover but with fixed not yet.

show example with 2**80 ?

If will be valid coordinates it can easily recover up to 256 bits (secp256k1)

show example ?

You are right in twist curve but these are isomorphic curves.

explaint what your code is do ?

your code change order of a curve this is very good

you code find priv this is good too

.....

explain more what your code do ?

Great question this is for recover private key secp256k1 easily. Not need Lattice Attacks and others.

G_twist = W(x_G, y_G) # This may not be valid; you need to go ensure y_G is valid for W
how to get valid

I can easily find valid Y coordinate but valid point must be for isomorphic curve (iso)

G is a basepoint ? If it, why you not generate simpe base point for new curve ?