Quote from: Willisius on December 12, 2014, 03:04:13 AM

Do you think the majority of the reused "R' values issue has been resolved? If so could you explain how you were able to identify which addresses had the reused R value and how to calculate the private key from the public key?

(maybe you could delay releasing such information until after the flawed transactions slow down a little bit more)

A reused R value is easily identified. Just go through the blockchain data extract the r values (the first part of the signature), put them into a set and, if it was already in this set before, print it out. You need a set with more than 100 million elements, but this is technically not so difficult to manage.

I have two lists of addresses, broken and endangered, the latter contains all addresses that were used in connection with an reused R value or are equal to an R value (R is very similar to a public key). The money of the broken list is now swiped except for some dust; less than 10 mBTC in total. But there is still some money in the addresses of the endangered list. Nonetheless, these addresses should be considered compromised and I think with a bit of brute force it should be possible to break them. At least these users should have been warned by now, since blockchain also has these lists.

I detectected a bit more than 1500 transactions with reused R values since Dec.7 (some of them are related to another problem that is going on since September). My guess is that statistically there should be about 500 additional transactions with a weak R value, where the R value was never reused; but this is pure guesswork. These should also be considered compromised, but I have no way to detect them, so the users cannot be warned directly. Also newly generated keys should be considered compromised, even if they had no transactions at all. So if you used blockchain in that time-window consider yourself affected even if you are not in one of my lists.