GOBALANCE FLAW LETS ATTACKERS HIJACK .ONION ADDRESSES BY RECOVERING TOR-FORMAT KEYS

Summary from the TLDR InfoSec newsletter

A GoBalance signing bug lets an attacker recover a site's Tor-format master key from one public descriptor, with which they can then redirect that .onion address to a controlled site.