# Vultisig's August App Updates Halted Retries Tied to Key-Share Flaw

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/41738
Published: 2026-10-27T12:37:22.000Z
Updated: 2026-10-27T12:37:22.000Z
Section: Technology

> ChainSecurity said an attacker who had compromised one signer could use malicious signing messages to infer another device's reusable seed and potentially recover the full private key.

Vultisig's August updates to its iOS and Android apps stopped signing retries after a malicious-party error tied to a flaw that ChainSecurity said could expose a wallet's full private key.

A threshold-signature wallet distributes key shares across devices, which work together to sign transactions. ChainSecurity's Oct. 21 disclosure described an attack that required an attacker to first compromise one signer.

The compromised signer could send crafted messages during a signing attempt and observe whether another device returned an error. Repeated responses could reveal bits of the other device's reusable seed. ChainSecurity said enough information could lead to recovery of that device's key share and the wallet's full private key.

The issue involved the apps' handling of the signing library's malicious-party error. The error instructs the app to abort the signing attempt and ban the participant. Earlier app flows could retry a failed operation as many as three times after that signal, allowing the attacker to continue probing the other signer.

Vultisig merged changes to its iOS and Android apps on Aug. 21. The updates recognize error codes 100 through 109 and stop retries after those errors. The Android update also identifies the device flagged by the error. iOS v1.45.71 is dated Aug. 21, while Android v1.0.118 is dated Aug. 25.

Trail of Bits audited the DKLS23 protocol library in 2024; that review covered the library rather than Vultisig's mobile apps. Vultisig plans to link mobile and desktop app audit reports when they are published. ChainSecurity has not reviewed Vultisig's changes or audited other parts of the protocol.