The right way to approach this is to stop looking at "all transactions ever" and carve out the earliest clean window where you know the bad RNG was in use and is stationary. That might be a few hundred or a couple thousand sigs, not tens of thousands. Anything after the fix is just poison for your lattice. On the practical side, if this really is tied to a pig-butchering operation with hundreds of millions flowing through, don't assume you're looking at a single hot wallet key that stayed unchanged for years. There are often multiple keys, scripts, services behind the scenes, and the funds you care about may have already been swept to harder targets long ago. Recovering one compromised key (if it's even possible) doesn't unwind the whole scam. I'm not trying to pour cold water on the effort, if you've genuinely found a wallet implementation leaking k and it's still being used, that's a big deal. But the gap between "my GCD plot looks funky" and "we can reliably recover a private key" is huge, and you really want a couple of people who live and breathe lattice attacks to sanity-check this before you burn yourself out chasing ghosts.
The right way to approach this is to stop looking at "all transactions ever" and carve out the earliest clean window where you know the bad RNG was in use and is stationary. That might be a few hundred or a couple thousand sigs, not tens of thousands. Anything after the fix is just poison for your lattice. On the practical side, if this really is tied to a pig-butchering operation with hundreds of millions flowing through, don't assume you're looking at a single hot wallet key that stayed unchanged for years. There are often multiple keys, scripts, services behind the scenes, and the funds you care about may have already been swept to harder targets long ago. Recovering one compromised key (if it's even possible) doesn't unwind the whole scam. I'm not trying to pour cold water on the effort, if you've genuinely found a wallet implementation leaking k and it's still being used, that's a big deal. But the gap between "my GCD plot looks funky" and "we can reliably recover a private key" is huge, and you really want a couple of people who live and breathe lattice attacks to sanity-check this before you burn yourself out chasing ghosts.

The right way to approach this is to stop looking at "all transactions ever" and carve out the earliest clean window where you know the bad RNG was in use and is stationary. That might be a few hundred or a couple thousand sigs, not tens of thousands. Anything after the fix is just poison for your lattice. On the practical side, if this really is tied to a pig-butchering operation with hundreds of millions flowing through, don't assume you're looking at a single hot wallet key that stayed unchanged for years. There are often multiple keys, scripts, services behind the scenes, and the funds you care about may have already been swept to harder targets long ago. Recovering one compromised key (if it's even possible) doesn't unwind the whole scam. I'm not trying to pour cold water on the effort, if you've genuinely found a wallet implementation leaking k and it's still being used, that's a big deal. But the gap between "my GCD plot looks funky" and "we can reliably recover a private key" is huge, and you really want a couple of people who live and breathe lattice attacks to sanity-check this before you burn yourself out chasing ghosts.

The right way to approach this is to stop looking at "all transactions ever" and carve out the earliest clean window where you know the bad RNG was in use and is stationary. That might be a few hundred or a couple thousand sigs, not tens of thousands. Anything after the fix is just poison for your lattice. On the practical side, if this really is tied to a pig-butchering operation with hundreds of millions flowing through, don't assume you're looking at a single hot wallet key that stayed unchanged for years. There are often multiple keys, scripts, services behind the scenes, and the funds you care about may have already been swept to harder targets long ago. Recovering one compromised key (if it's even possible) doesn't unwind the whole scam. I'm not trying to pour cold water on the effort, if you've genuinely found a wallet implementation leaking k and it's still being used, that's a big deal. But the gap between "my GCD plot looks funky" and "we can reliably recover a private key" is huge, and you really want a couple of people who live and breathe lattice attacks to sanity-check this before you burn yourself out chasing ghosts.