August updates block critical private key leak in crypto wallet Vultisig

Vultisig, a crypto wallet that uses shared signing, mishandled a critical stop signal in its ECDSA signing implementation, as security researchers at ChainSecurity found. The researchers’ Oct. 21 disclosure describes how continuing after the error could let one already-compromised signer recover the full private key. Both the Android and iOS maintainers described code that retried after the library identified a malicious participant, then added handling to stop those retries and warn the user. The changes appear in subsequent repository release notes. Requiring several devices offers protection only if the software preserves that requirement when one participant starts misbehaving.