Key takeaways

  • Claude traced the seeds behind NIST P-192, P-224, P-256, P-384 and P-521 to the C library's lrand48 random-number generator, seeded with a Unix timestamp, according to an October 16, 2026 report.
  • The finding undercuts a 26-year suspicion that the NSA's unexplained seeds concealed a backdoor, but it does not make ECDSA less secure.
  • Ledger co-founder Nicolas Bacca joked "Checkmate Satoshi," while Blockstream CEO Adam Back blamed the NSA for never publishing reproducible generation steps.
  • Bitcoin's use of secp256k1 rather than P-256 is back in focus, with Coinbase wallet lead Pete Kim saying the choice was heavily influenced by backdoor fears.

What happened

Claude discovered the origins of the NIST P-192, P-224, P-256, P-384 and P-521 seeds in under half an hour, with the result reported on October 16, 2026. The seeds were not the output of any hash algorithm at all. They came from the C library's lrand48 random-number generator, seeded with a Unix timestamp.

The result drew immediate reaction from figures across the industry. Bacca, co-founder of Ledger, commented in an X post after Claude revealed the origins of the ECDSA curve, saying "Checkmate Satoshi" in what appears to be a playful statement. Adam Back, CEO of Blockstream, weighed in on the discussion, saying, "That's the NSA's fault for not revealing the reproducible steps to generate their NIST published curves." Bacca replied, "Right, but it still made a good joke."

The technical backdrop matters here. In 2000, NIST incorporated the P-256 curve into standards, with parameters derived from hashing a 160-bit seed. The seed was provided by the NSA, and its origin was never explained, so speculation about backdoors never stopped. For 26 years, cryptographers had suspected the NSA's mysterious encryption seeds might conceal a backdoor — a suspicion that the new finding makes considerably less plausible.

Market context

The discovery lands in a long-running argument about trust in cryptographic constants. Bitcoin's pseudonymous creator, Satoshi Nakamoto, chose secp256k1 rather than the NSA's P-256 curve when founding Bitcoin. According to Coinbase wallet lead Pete Kim, that choice of secp256k1 over r1 (P-256) in Bitcoin and Ethereum was heavily influenced by the fear of an NSA backdoor. "turns out there is no backdoor after all," Kim wrote, commending Anthropic.

In reaction to the milestone, a crypto user pointed out that the reason Satoshi did not choose the NSA's P-256 curve came back into discussion following the Claude reveal, noting that what was cracked in 30 minutes is not just a number but rather 26 years of global internet paranoia. Some believe Satoshi probably chose secp256k1 instead of the NSA's P-256 because of this mystery, as it might be easier to trust the number 7 — the coefficient in secp256k1 — than the coefficient in P-256.

That framing captures the actual stakes. The episode is less about a broken algorithm than about how unexplained parameters shape engineering decisions for decades. A curve nobody can reproduce is a curve nobody can fully trust, and Bitcoin's design reflected that caution.

Why it matters

The direct security implications are narrower than the headlines suggest. Claude traced the NIST P-curve seeds to a 1990s random-number generator seeded with timestamps, but Bitcoin never used those curves. This discovery makes backdoors less plausible but does not make ECDSA less secure. In other words, the finding removes a long-standing suspicion without weakening the cryptography that Bitcoin and Ethereum actually rely on.

For readers with a technical background, the distinction is important. The P-curves remain in wide use across standards and systems outside Bitcoin, and the new evidence suggests their parameters were generated by an ordinary, if poorly documented, process rather than deliberately constructed to hide a weakness. That is a meaningful update to the historical record, not a change to the security assumptions of deployed systems.

The secondary effect is reputational and cultural. The "Checkmate Satoshi" joke and Back's pointed criticism of the NSA both point at the same underlying issue: reproducibility. Back's comment frames the 26-year suspicion as the NSA's own fault for not revealing the reproducible steps used to generate its published curves. That is a critique of process, and it applies well beyond this one case.

What to watch

  • Whether the lrand48 and timestamp explanation is independently verified and documented, since the claim currently rests on Claude's discovery as reported.
  • Whether NIST or the NSA responds to the finding, and whether any reproducible generation steps are published retroactively.
  • Whether the result shifts discussion around other unexplained cryptographic constants that have attracted similar suspicion.
  • How the Bitcoin community treats the secp256k1 versus P-256 narrative now that the original justification is weaker, even though Bitcoin's curve choice remains unchanged.