An Anthropic AI model has offered a solution to a longstanding mystery over numbers supplied by the U.S. National Security Agency for elliptic-curve cryptography standards in the late 1990s. According to CoinDesk, the model traced five unexplained seeds to an ordinary random-number generator using timestamps from 1997 and 1998, making a deliberately planted NSA backdoor less likely.
A decades-old question about cryptographic curves
Elliptic-curve cryptography is widely used to protect digital communications and cryptocurrency wallets. In broad terms, it allows a person to prove control of a secret key without revealing that key. The underlying curve acts as a publicly known mathematical framework on which those security systems operate.
In 2000, the U.S. National Institute of Standards and Technology, or NIST, adopted several curves provided by the NSA. The agency did not explain how some of the numbers used to construct those curves had been selected. Those unexplained starting values, known as seeds, were public, but their origin remained unknown.
That lack of disclosure created suspicion that the NSA might have searched through possible values until it found a curve containing a weakness that it could exploit. The concern became more serious after documents disclosed by Edward Snowden connected the NSA to efforts to weaken cryptographic standards. NIST later removed the Dual EC random-number generator, another NSA-linked tool, from its recommendations.
Cryptographers Neal Koblitz and Alfred Menezes examined the issue in a 2015 paper. Security researcher Steve Weis also spent years investigating the seeds, including through public-records requests. NIST said it had no documentation, while the NSA did not provide an explanation. A possible theory involving a forgotten humorous phrase also failed to resolve the puzzle.
In 2023, cryptography engineer Filippo Valsorda and other contributors offered a $12,288 reward for a solution. The potential prize later rose above $36,000 if the money was donated to charity.
Claude identifies a reproducible source
An Anthropic employee recently asked an internal research model to investigate the seeds without giving it the earlier theory about a forgotten phrase. In less than 30 minutes, the model linked all five NIST curve seeds to lrand48, a random-number generator included in older C software libraries.
The model reproduced the sequence used for P-256, one of the widely deployed NIST curves. Its published seed matched the 1,842nd candidate generated using the program and timestamps from 1997 and 1998. The result can now be independently recreated by running the same program.
The finding does not prove every detail of the NSA’s selection process. Anthropic said questions remain over why some usable candidates were skipped and how other components of the curves were chosen. However, the ability to reproduce the published seeds substantially weakens the theory that the agency secretly embedded a vulnerability in the curves.
The distinction between public curve seeds and private wallet keys is important. A predictable random-number generator would be dangerous if it were used to create a secret key: someone who estimated when the key was generated might be able to reproduce it and access the assets it protected. The NIST seeds, however, were public from the outset, so there was no hidden private value for an attacker to recover.
Anthropic said users of the NIST curves do not need to take action as a result of the discovery. The original bounty of $36,864 is due to go to the Internet Security Research Group, the nonprofit organization behind Let’s Encrypt, which provides free security certificates for websites.
Why Bitcoin is a separate issue
Bitcoin was not involved in the NIST seed controversy. Its wallets use secp256k1, a different elliptic curve with a simpler equation. Bitcoin’s curve is defined by two small, fixed numbers, leaving far less flexibility for concealed choices than the P-256 design, which includes a 77-digit number derived from the unexplained seed.
Bitcoin’s use of secp256k1 does not eliminate every possible future cryptographic threat. A sufficiently powerful quantum computer could theoretically derive a private key from a public key exposed on the Bitcoin blockchain, regardless of how the curve was originally selected. Such a machine has not been built, and there is no clear timetable for one.
The source material also notes that Google said its Willow chip had reduced errors by about 40 times in one of the expensive steps that a future quantum attack would require. That development does not mean Bitcoin can currently be cracked, but it illustrates why quantum computing remains a separate subject of discussion for cryptocurrency security.
Current market picture
Moneyiar market data at 21:29 Tehran time on October 17, 2026, showed Bitcoin at $81,188.41, down 0.54% over 24 hours and 2.15% over seven days. Gram (prev. Toncoin) was $1.3581, up 0.43% over 24 hours but down 7.21% over seven days.
Quant stood at $194.34, falling 4.61% in 24 hours and 19.17% over seven days. Compound was $21.3160, down 3.66% over 24 hours and 14.29% over the week. These market movements are provided for context and do not indicate that the cryptographic discovery caused any particular price change.
