Researchers from UC San Diego and Inria demonstrated that temporary access to a raw, unpadded RSA signing oracle can eventually enable offline signature forgery without extracting the private key from a hardware security module. The work, described in IACR ePrint 2026/2131 by Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger and Emmanuel Thomé, required 2^32 signing requests—more than 4.3 billion—and consumed 1,380 CPU core-years over five calendar months. The algorithm dates to 2007, but the researchers' implementation demonstrated the attack against a real 1,024-bit RSA setup. The experiment disabled certified FIPS mode and used a researcher-controlled test key, so it does not represent a break of properly padded RSA using PKCS#1 v1.5 or RSA-PSS. The finding does not apply to Bitcoin or Ethereum transaction signing, which uses elliptic-curve systems. It does, however, highlight risks in APIs, approval workflows and automated services authorized to use custodians' keys, including systems that intentionally expose raw signing capabilities. The researchers estimate that RSA with a signing oracle provides 15 to 30 fewer security bits than factoring-based estimates for typical 1,024- to 4,096-bit keys; forging a selected signature after precomputation required about 180 CPU core-years in their model.