Jun 8, 2020

Context: I work on an infrastructure for receiving and subsequently moving around BTC, the received BTC is moved to our cold storage, but we have an address for each user which they can deposit to. This address is reused for all their deposits (yes, this is not recommended, but a single recognizable address for a user wasn't and isn't really an issue for us, our target audience is mostly beginners so ease of use was higher on the priority list). Now, the user doesn't have their key, we manage that so we can send the received BTC to different wallets under different situation (cold wallets, trading wallets, etc). Now, after sending a couple of deposits for a particular user on to our cold wallet, it turns out one of those transactions (which are generated and broadcast with the help of libbitcoin) reused an 'r' value that was used for an earlier transaction from the same address, allowing this user to find their own private key and both deposit + withdraw their money, sadly it was credited to their account before we found the issue, but luckily it was only a small amount 😕