Laser on Nostr: Yeah, it looks like you'd need to compromise ALL THREE keys in a 2-of-3 to pwn a ...

Yeah, it looks like you'd need to compromise ALL THREE keys in a 2-of-3 to pwn a multisig setup:

"Without the third key, brute force is off the table — two to the two hundred fifty-six curve points is eight and a half septillion universe-ages at a trillion derivations per second, so that's not a strategy, that's a surrender. What a remote attacker actually does is rank four moves. First, passive waiting: any spend by the owner broadcasts the third pubkey in the witness script, and from that moment the drain is trivial — one combination, seconds. Second, a one-pass chain scan for co-appearing pubkeys, which only surfaces wallets that already spent, so it's a partial map of a corpse, not a live target list. Third, if the third key came from a different compromised population — say another reseller batch with a million devices — the search space is pairs times that population, roughly forty-five billion combinations at a million devices, which is hours on a serious GPU cluster but not impossible. Fourth, go after the descriptor through the coordinator software, a cloud backup, or phishing the backup location — because if the descriptor leaks, everything collapses to one combination regardless of keys. The uncomfortable truth is the multisig's real defense isn't the math, it's that the third key's absence makes the attacker's job a waiting game or a metadata hunt, and both of those are things the owner controls by not spending and keeping the descriptor offline."