input script 1


r = 6bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a

s1 = a044b38e8264a1c928ddd28b4657aa7109d1ea30e911208c7ce57abcb1451fe6

input script 2


s2 = 75e41da2596619e837af69cdf80933e519abd736210677970a6ac23a3709ee2e

Raw tx 1


calculating z1

replace the input with the corresponding output script


then do sha256(sha256(modified transaction))

z1 = 9ffb92bc05a398e3177b12fcdac5308d316b6bd6cc00365177711dc4e3f10e64

Raw tx 2


calculating z2

replace the input with the corresponding output script


then do sha256(sha256(modified transaction))

z2 = 539bcbcddc3fff95aa262d01b8a909504958b371b813cb71a457efebb41c398e

priv key calculation,it not given correct address and priv anything wrong

posting the r , s1 , s2 , z1 , z2 below


it given 18MRDftXYkGqzo9hvcdnUs7yaPXrD1DXsq address


trans 1 address = 19owWJcPbTEe1mVYer1ymnbduJDza9jpRH

trans 2 address = 1FRDgmxVrUUNiiB7GN3NNcJDEEXtFB22rm

what's wrong

  • 2
    All of the encoding/decoding/math you show above looks correct to me, as are the z values you calculated. I don't understand your final question, though. Are you trying to derive a private key from just the information above (which isn't possible despite the reused k values because the private keys differ)? May 31, 2015 at 14:25

3 Answers 3


Calculating the private key from a signature (r and s) requires that you know the message (to calculate the "z" value) and the "k" value (which is used by the signer to derive the r value via a trapdoor function).

Calculating the "k" value (needed above) requires two signatures (you need two s values) which sign two different messages (you need two z values) using the same private key and the same r (therefore the same k) value.

In your question, you reference two transactions signed by different private keys (which you know by noticing their public keys differ), and therefore you do not have enough information to correctly calculate the k value.

In the other similar question you recently asked, the two transactions were signed by the same private key (and they have the same r & k), so in that case it is possible to calculate the private key. (The service you linked to appears to calculate it correctly, however it doesn't display the uncompressed address.)

  • k=5930f1a23e39c1a223ea2fb086cbcabbdf0d09e70ba0aed342ff0f5318a542f0 priv1=5JbfQE5fTXHZxWZ8qBDRR1z6S9hAvdzPEGEWGQgn1LJRTuNtaqG priv2=5JEzySX3zHQyH4ccLNMjNzmZNJ9MoHXBfW8g4MRaPBJ3u6dH1V2
    – amaclin
    Jun 1, 2015 at 15:45
  • 1
    Yes, but you're "cheating" :). You're using additional broken signatures from the blockchain, I'm answering only the specific question asked. (Also your k is wrong, k = a6cf0e5dc1c63e5ddc15d04f79343542dba1d2ffa3a7f1687cd34f39b790fe51.) Jun 1, 2015 at 17:48

Answering your question: "what's wrong"?

For each transaction you can write down an equation:

x*r + m = s*k

where x is the private key, r and s the signature. m the message hash, k the signing secret. All calculations are modulus the group order.

You are looking at two transactions with the same 'r'. You could write equations for those two like this:

x1*R + M1 = S1*k
x2*R + M2 = S2*k

Here I use UPPER case letters to indicate the known values, and lower case to indicate the unknowns.

The problem is that you end up with two equations with three unknowns. This cannot be solved at this point.

There is however a solution for this particular case:

graph of R and pub.x values

Here I created a graph where each node has the first 8 digits of the r-value and x-coord of the pubkey.

The red node indicates the r-value you are interested in. Square boxes indicates a public-key, round/oval nodes are the r-values. The Arrows indicate a signature using that pubkey.

You can see the green arrows form a loop in the diagram.

These form four transactions as follows:

t1: r1, pub1
t2: r1, pub2
t3: r2, pub2
t4: r2, pub1

from that you can derive four equations in four unknowns, which you can solve:


Then from there you can follow all the chains and find all the other keys.

Note that this is only a small part of this network, in total there are 1814 related transactions.

A side note, that 2coin.org link no longer works, but you can do the same calculations on this page ( by me ): https://rawcdn.githack.com/nlitsme/bitcoinexplainer/aa50e86e8c72c04a7986f5f7c43bc2f98df94107/ecdsacrack.html


I have found as bellow:

r = 0x6bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a
s1 = 0xa044b38e8264a1c928ddd28b4657aa7109d1ea30e911208c7ce57abcb1451fe6
s2 = 0x75e41da2596619e837af69cdf80933e519abd736210677970a6ac23a3709ee2e
z1 = 0x9ffb92bc05a398e3177b12fcdac5308d316b6bd6cc00365177711dc4e3f10e64
z2 = 0x539bcbcddc3fff95aa262d01b8a909504958b371b813cb71a457efebb41c398e

K = GF(p)

K((z1s2 - z2s1)/(r*(s1-s2)))

result dec: 8921113496817264148701652880922087877926656286340189747525982520215619494205

result hex: 13b92bda88a3f2dbac6032865bf56eed68eea22d4461c77404ad79c49697e13d

  • It would help if you added a couple sentences to explain what you did differently than the asker.
    – Murch
    Jul 25, 2021 at 16:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.