What’s the minimal size of a nonce leakage so that the private can be recovered from a single signature ?

There’re a lot of papers on how to recover a private key from a nonce leakage in a ᴇᴄᴅꜱᴀ signature. But the less bits are known the more signatures are required.

Now if I don’t know anything about private key, how much higher order or lower order bits leakage are required at minimum in order to recover a private key from a single signature ?