# Bitcoin Developers Propose Deterministic Signing to Expose Wallets That Leak Keys

BIP461 would fix one signature per key and message, letting a holder sign on two devices and compare, turning covert key exfiltration through nonce choice into a detectable mismatch.

- Published: 2026-10-01T05:49:51.228Z
- Canonical: https://polylog.news/crypto/2026-10-01/bitcoin-developers-propose-deterministic-signing-to-expose-w
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CryptoSlate](https://cryptoslate.com/new-bitcoin-upgrade-catches-hidden-key-leaks-hiding-the-exact-fix/), [Bitcointalk (Dev and Technical)](https://bitcointalk.org/index.php?topic=5594832.0)

A Bitcoin Improvement Proposal numbered 461 would standardize a single deterministic signing algorithm for ECDSA (the Elliptic Curve Digital Signature Algorithm), the signature scheme used by pre-Taproot bitcoin addresses, so that a given private key and message always produce [exactly the same signature](https://cryptoslate.com/new-bitcoin-upgrade-catches-hidden-key-leaks-hiding-the-exact-fix/). The [specification](https://github.com/bitcoin/bips/blob/master/bip-0461.md) derives the nonce using RFC 6979, selects a low r value, and normalizes s to its low form.

The security argument is narrow and precise. Under current rules, a signer has freedom in two places: the nonce it picks, and which of two valid s values it returns. A malicious or backdoored signing device can use that freedom as a covert channel, encoding fragments of the private key inside signatures that look entirely valid on chain, a technique published as Dark Skippy. Removing that freedom closes the channel, because a holder can load the same seed into two independent signers, sign an identical message, and compare the results byte for byte. Any difference proves at least one device is not following the specification.

The proposal does not prove malice. A mismatch tells a holder that a device deviates from the standard, not why, and the comparison only works for holders who own two independent signers and take the time to run the test. The proposal also has a side benefit: shorter signatures, at most 70 bytes when encoded in the standard format (DER) instead of 72, which slightly reduces transaction weight across the large installed base of ECDSA spending. Developers are debating the tradeoffs in the usual [developer forums](https://bitcointalk.org/index.php?topic=5594832.0) and in the [Bitcoin Optech](https://bitcoinops.org/en/newsletters/2026/09/25/) review of recent proposals.

The deeper change is to trust structure. Hardware wallets ask users to accept a closed device as the guardian of a secret. Determinism makes that trust checkable without opening the device or reverse-engineering its firmware, a meaningful shift for a self-custody industry that has experienced several entropy and firmware defects in recent years.

## What this means

The mechanism is removing optional randomness from a signing algorithm so that a device's behavior becomes reproducible and therefore testable. The exposed parties are hardware-wallet vendors, whose claims about firmware integrity become checkable by any customer with two devices. Vendors that already use RFC 6979 gain a compliance checkbox at no cost, while vendors that deviate face a cheap public test. This is a standards process, not a consensus change, so adoption depends on wallet and library maintainers rather than on miners. The precedent is the earlier migration to low-s and low-r signing, which spread through wallet software without any fork once the benefits were clear. The desk's read: BIP461 moves through review and into major signing libraries over the coming months, and cross-device signature comparison becomes a standard check in custody audits, one of the few mechanisms that can slow the movement of risk-averse holders from self-custody toward exchange-traded products and custodians. If major vendors decline to commit to a single deterministic scheme, the comparison test stays theoretical and the proposal's practical effect is limited to the signature-size savings.

## What to watch

- Whether named hardware-wallet vendors publicly commit to BIP461 compliance, because the comparison test only has teeth once two mainstream devices claim the same algorithm.
- Whether custody providers and auditors adopt cross-device signature comparison as a standard procedure, which would turn the proposal into a due-diligence requirement rather than a hobbyist check.
- Whether the proposal attracts objections from developers who want to preserve nonce freedom for protocols that depend on it, since that debate decides how fast the specification settles.