In ECDSA the signer picks k in the range 1…n−1, computes the point kG and takes its x-coordinate modulo n as r; then s = k⁻¹·(z + r·d) mod n, where z is the truncated message hash and d the private key (FIPS 186-5 §6.4.1). Because s is linear in both k and d, learning k for a single signature is enough to solve for the private key: d = (s·k − z)·r⁻¹ mod n. FIPS 186-5 §6.3 therefore requires a fresh k for every signature, protected like the key itself.
Reuse is just as fatal and easy to detect: two signatures under one key with the same r give k = (z₁ − z₂)·(s₁ − s₂)⁻¹ mod n, and then d. This is how the PlayStation 3 signing key was extracted in 2010 and how many blockchain wallets have been drained. A nonce does not even have to repeat: a few bits of bias or leakage per signature, collected over enough signatures, let lattice reduction solve the hidden number problem and recover the key.
Modern libraries derive k deterministically from the private key and the message hash (RFC 6979, allowed by FIPS 186-5 §6.3.2) or use a hedged variant that mixes fresh randomness into the same derivation. EdDSA builds the idea into the algorithm: the Ed25519 nonce is SHA-512 of a secret key half and the message (RFC 8032 §5.1.6). The nonce reuse checker looks for repeated r values across a set of signatures.
Outside signatures, “nonce” means any value used once: the 96-bit IV of AES-GCM, the OpenID Connect nonce claim, ACME's Replay-Nonce header. Those need uniqueness and freshness, not secrecy; the signature nonce is unusual in needing both.