In Biased Nonce Sense: Lattice Attacks against. Weak ECDSA Signatures in Cryptocurrencies Joachim Breitner and Nadia Heninger use a lattice based algorithm to recover private keys from signatures in the Bitcoin chain that were produced by insecure signers that generated biased nonces.

One large category of insecure signature that they discovered were 5,863 signatures between July 26, 2014 and June 1st, 2015 that were used in multisignature scripts where the nonces were only 64-bits in size. In the paper when a single key was used multiple times to sign multiple messages (which could be multiple inputs on a single transaction) with a small difference between the nonces their algorithim was able to determine the actual nonces used and the private keys with high probability.

Using a small nonce in multiple signatures is just an especially simple case of having a small difference. Small nonces could also be attacked with simpler brute force search approaches without requiring multiple signatures but the paper's approach was much faster than brute force. Their approach was also able to attack a number of 110 - 160 bit nonces which were used, a range that would have made a brute force search less realistic.

The authors were unaware of the origin of the 64-bit nonces but "hypothesize that this may be a faulty implementation intended for multifactor security, such as a hardware token".

What do we know about the actual origin of these signatures?

In Biased Nonce Sense: Lattice Attacks against Weak ECDSA Signatures in Cryptocurrencies Joachim Breitner and Nadia Heninger use a lattice based algorithm to recover private keys from signatures in the Bitcoin chain that were produced by insecure signers that generated biased nonces.

One large category of insecure signature that they discovered were 5,863 signatures between July 26, 2014 and June 1st, 2015 that were used in multisignature scripts where the nonces were only 64-bits in size. In the paper when a single key was used multiple times to sign multiple messages (which could be multiple inputs on a single transaction) with a small difference between the nonces their algorithm was able to determine the actual nonces used and the private keys with high probability.

Using a small nonce in multiple signatures is just an especially simple case of having a small difference. Small nonces could also be attacked with simpler brute force search approaches without requiring multiple signatures but the paper's approach was much faster than brute force. Their approach was also able to attack a number of 110 - 160-bit nonces which were used, a range that would have made a brute force search less realistic.

The authors were unaware of the origin of the 64-bit nonces but "hypothesize that this may be a faulty implementation intended for multifactor security, such as a hardware token".

What do we know about the actual origin of these signatures?