The NSA curve seed mystery is solved: no backdoor found, and Bitcoin was never affected

What the mystery was

In 2000, the US standards institute NIST published the FIPS 186-2 digital signature standard, which included a set of recommended elliptic curves, five of them over prime fields: P-192, P-224, P-256, P-384 and P-521. The curve coefficients were derived with a SHA-1 hash of a "seed", a set of numbers meant to prove that nobody had picked the curve by hand. This approach is called verifiably random.

The catch was in the seeds themselves. They came from the US National Security Agency, and nobody ever explained where they came from. The story went that their author, NSA employee Jerry Solinas, had hashed a joke phrase and later forgotten it. Solinas died in early 2023, leaving no one to ask.

As long as the NSA was seen simply as a strong team of mathematicians, people looked the other way. That changed in 2013, when the Snowden documents tied the agency to a backdoor in another NIST standard, the Dual_EC_DRBG random number generator, and NIST pulled it from its recommendations. After that, the question of what might be hidden in the curves started to sound serious.

Why people suspected a backdoor

In 2014, cryptographers Daniel Bernstein, Tanja Lange and their co-authors published a paper with a telling name, "BADA55": how to rig a curve standard if you are the villain. The argument is simple. If nobody can explain a seed, its author could have tried millions of seeds until a curve turned up with a weakness only they knew about. The SafeCurves site, run by the same authors, flagged P-224, P-256 and P-384 as "manipulatable" curves for years.

There was no proof of a backdoor, but no refutation either. Meanwhile, half the internet was built on P-256: HTTPS, passkeys and WebAuthn logins, the secure chips in iPhones and Android phones. In 2023, cryptographer Filippo Valsorda and colleagues offered a $12,288 bounty to whoever recovered the origin of the seeds, and promised to triple it if the money went to charity.

What was found

On October 15, 2026, a team of ten Anthropic employees claimed the bounty, and their report came out on October 16. The work was done by the company's internal research model. According to the report, it was deliberately not given the "forgotten phrase" hint, since people had been digging in that direction for years with no result.

The answer turned out to be duller than the legend. There was no phrase: the seed wasn't derived by hashing a sentence and was taken straight from the generator's output. The seeds are simply the output of lrand48, a standard pseudorandom number generator from the drand48 family that shipped with every Unix system of the 1990s. The generator was seeded with the current time, and the seeds in question turned up among the first few thousand candidates.

Along the way, the team also recovered the seeds of several curves from the old banking standard ANSI X9.62 and of four NIST binary curves. The scripts that regenerate all the numbers are public, and Valsorda independently rewrote the algorithm and confirmed the match.

Why this clears the suspicion

The real question was always how much freedom the author had, more than where the numbers came from. To rig a curve around a secret weakness, you have to try a huge number of options. In 2017, Bernstein and Lange described how a curve could be rigged to fall into a hypothetical class of weak curves, and the author would have needed about 70 bits of freedom in choosing the seed.

Now, by Valsorda's count, even if you allow any second of 1997–1998 and any of the first 16 suitable candidates, the author had barely 30 bits or so to play with. That is far too little to deliberately pick a weak curve or plant a backdoor that only the NSA could use. The researchers themselves stress that this is neither a break nor a new attack on the curves, and nothing needs to change.

Valsorda called it the end of the "rehabilitation" of the NIST curves. He adds a caveat too: in time they may well be replaced by post-quantum signatures anyway.

What remains unclear

• Skipped candidates. For P-256, candidate 876 of the same run also fit, yet candidate 1,842 was chosen. For P-224, three suitable candidates were skipped. Why remains unexplained.
• Base points. How the starting points were chosen for most of the curves is still unknown.
• One binary curve. The seed of the B-163 curve could not be recovered.

None of this hides a backdoor, since the author still had too little freedom. But for a perfectly transparent standard, these questions would be worth closing.

What about Bitcoin

Bitcoin was never part of this story. Satoshi Nakamoto chose a different curve rather than P-256, secp256k1 from the SEC 2 standard. Its equation is about as simple as it gets, y² = x³ + 7. There are no random seeds to explain, which is why SafeCurves rates it "somewhat rigid": not everything is explained, but the unexplained parts give the author almost no freedom.

Satoshi never publicly explained why he picked it. But today the choice looks far-sighted: secp256k1 spread to Ethereum, Litecoin, Dogecoin and TRON, and Zcash transparent addresses run on it too. If you hold bitcoin and want to trade it on a no-KYC crypto exchange, the curve under your keys is the same one as in 2009.

Other networks went their own way. Solana and TON use Ed25519, while Monero uses the same curve as Ed25519, but with its own ring signatures that hide the sender. If transaction privacy matters to you, beyond the strength of the signature, you can exchange bitcoin for Monero and get coins whose blockchain shows neither amounts nor addresses.

P-256 did make it into crypto after all, through the back door of convenience. In December 2025, the Fusaka upgrade added native verification of signatures on this curve to Ethereum. That made smart wallets cheaper to run, the kind where you approve a transfer with a passkey, meaning a fingerprint or Face ID, without a seed phrase.

What this means for your keys

The news is reassuring where it matters most: the author had almost no way to secretly rig the curves behind HTTPS and passkeys. But it also carries a side lesson.

Generators of this kind are predictable: if you know roughly when one was started, you can reproduce its outputs. For a curve standard that's no problem, since the seeds are meant to be public anyway. For wallet keys it is fatal: in 2023 this is how wallets created with the Libbitcoin Explorer tool were drained, in what became known as the Milk Sad case. Its generator was also seeded with the system time. That's why a seed phrase should only be created by a reliable wallet on your own device, never by a "phrase generator" on a website. We covered what to do with it next in our guide on how to store a seed phrase.

How to switch coins without an account

If this story makes you want to keep part of your savings in a coin with privacy by default, you don't need a centralized exchange for that. On VertEXchange, swaps work without registration, email or phone number: you pick a pair, paste your wallet address and see the rate and the amount you will receive before you send anything. Coins go straight to your address, and the service doesn't hold them.

• The fixed rate holds for about 15 minutes while your transfer is confirmed.
• You can add a refund address, where coins will be returned if the swap doesn't go through.
• Personal fields of an order are deleted 24 hours after it completes, and your swap history is stored only in your browser.
• Support chat is available on every page, and issues are resolved by the swap code.

If you hold stablecoins, you can buy bitcoin with USDT TRC20 straight to your own address.

FAQ

Was there an NSA backdoor in the P-256 curve?

There is no evidence of one, and the main suspicion has been lifted. The curve's seeds turned out to be the output of an ordinary generator started in 1997, and the author had too little freedom to deliberately tune the curve around a secret weakness.

Does this affect Bitcoin?

No. Bitcoin uses the secp256k1 curve with simple fixed parameters and no unexplained seeds. NIST curves are not used in Bitcoin.

Who solved the mystery?

Ten Anthropic employees, with the help of the company's internal research model. The report came out on October 16, 2026, and cryptographer Filippo Valsorda independently verified the result.

Who got the bounty?

The tripled amount of $36,864 went to ISRG, the organization that runs the free Let's Encrypt certificates.

Do I need to change my keys or wallet?

No. The researchers state plainly that this is neither a break nor a new attack. What matters is something else: create your seed phrase only with a reliable wallet, never with generators on websites.