diff --git a/lib/elliptic/ec/key.js b/lib/elliptic/ec/key.js
index 8aa7451..55bf299 100644
--- a/lib/elliptic/ec/key.js
+++ b/lib/elliptic/ec/key.js
@@ -100,6 +100,9 @@ KeyPair.prototype._importPublic = function _importPublic(key, enc) {
 
 // ECDH
 KeyPair.prototype.derive = function derive(pub) {
+  if(!pub.validate()) {
+    assert(pub.validate(), 'public point not validated');
+  }
   return pub.mul(this.priv).getX();
 };
 
diff --git a/test/ecdh-test.js b/test/ecdh-test.js
index aa28b75..47543b6 100644
--- a/test/ecdh-test.js
+++ b/test/ecdh-test.js
@@ -27,3 +27,17 @@ describe('ECDH', function() {
   test('ed25519');
   test('secp256k1');
 });
+
+describe('ECDH twist attack', () => {
+  it('should be able to prevent a twist attack for secp256k1', () => {
+    var bobEcdh = new elliptic.ec('secp256k1');
+    var malloryEcdh = new elliptic.ec('secp256k1');
+    var bob = bobEcdh.genKeyPair();
+    // This is a bad point that shouldn't be able to be passed to derive.
+    // If a bad point can be passed it's possible to perform a twist attack.
+    var mallory = malloryEcdh.keyFromPublic({ x: 14, y: 16 });
+    assert.throws(function () {
+      bob.derive(mallory.getPublic());
+    });
+  });
+});