Crypto wallet Vultisig has patched a critical private key leakage vulnerability, which previously allowed compromised signers to recover private keys through malicious ECDSA messages. Security research firm ChainSecurity discovered that the wallet incorrectly handled a critical stop signal in its ECDSA signature implementation. This flaw allowed a compromised signer to recover the full private key by sending a large number of malicious ECDSA messages if the application ignored the stop condition. Vultisig merged the fix code for Android and iOS on August 21 and mentioned these changes in subsequent release notes.