An artificial intelligence model built by Anthropic needed less than 30 minutes to solve one of cryptography's longest-running mysteries: tracing five unexplained seed values behind U.S. government elliptic curves to an ordinary random-number generator seeded with timestamps from 1997 and 1998.

The numbers had been handed to the U.S. government by the National Security Agency (NSA) in the late 1990s and were long suspected of concealing a backdoor. The finding makes a hidden NSA backdoor considerably less likely and requires no action from users of the NIST curves, though questions remain about how some elements were selected.

Bitcoin was never exposed. The network runs on secp256k1, a simpler curve with little room to conceal a weakness, although sufficiently powerful quantum computers could eventually pose a separate threat.

It took the model about half an hour to produce the answer cryptographers had chased for 25 years.

A lock with an unexplained design

Much of the internet relies on elliptic-curve cryptography, the family of mathematics that also protects bitcoin wallets. It allows someone to prove they hold a secret key without revealing the key itself. The same mathematics secures the encrypted connections browsers negotiate when they load a website.

Picture the curve as a lock design anyone can inspect. Every user holds their own secret key, but all depend on the design being difficult to break.

The lingering question was who chose the mathematics the world would be asked to trust.

In 2000, the U.S. National Institute of Standards and Technology (NIST) adopted a set of curves supplied by the NSA, as recorded in NIST's cryptography history archive. The agency provided the designs without explaining where some of the numbers used to generate them came from. That secrecy became harder to dismiss after the Snowden disclosures linked the NSA to efforts to weaken cryptographic standards, and NIST later removed the associated tool, the Dual EC random-number generator, its recommendations.

The starting numbers, known as seeds, were public. But the NSA never explained how it chose them, fueling years of suspicion that it had tested many alternatives until it found a curve with a weakness only it knew how to exploit. The most paranoid version of the theory held that the NSA had a backdoor into every system that used the standards.

Cryptographers Neal Koblitz and Alfred Menezes examined the controversy in their 2015 paper, “A Riddle Wrapped in an Enigma.” Menezes had helped write the original standard and recalled receiving the seeds from NSA mathematician Jerry Solinas in 1997.

Security researcher Steve Weis spent years searching for an explanation, documenting his efforts and filing public-records requests in 2018. NIST said it had no documentation, and the NSA stopped responding. One promising lead suggested the numbers came from a humorous phrase Solinas had forgotten, sending investigators to comb through possible word combinations.

In 2023, cryptography engineer Filippo Valsorda and other contributors offered a $12,288 for an answer, rising to more than $36,000 if the winner donated it to charity. Solinas had died earlier that year, leaving researchers to work through old recollections and the numbers themselves with no result.

Claude goes digging

Then Claude entered the picture. This month, an Anthropic employee asked an internal research model to investigate, without sharing the old theory that the seeds came from a forgotten phrase.

In less than half an hour, the model traced the five NIST curve seeds to lrand48, a random-number generator found in older C software libraries that was never built for cryptographic use. Claude reproduced the sequence behind P-256, a widely used curve, and found an exact match for its published seed at the 1,842nd candidate.

“This is astonishing: it solves the 25-year-old mystery,” the model wrote in its recorded reasoning, after briefly questioning whether it was working inside a simulated test. “Hmm, is it plausible in reality? As of my knowledge … the bounty was unsolved. … All top bits clear—20 bits, chance 1e-6. So indeed real-world.”

“Wow, it's a real discovery.”

Anyone can now rerun the program and regenerate the numbers the NSA supplied. Anthropic says that makes a hidden weakness much less likely, though the team still cannot explain why the program passed over some usable candidates, or how other parts of the curves were chosen.

That predictability is what allowed Claude to rebuild the numbers, and inside a wallet it would be a disaster. A secret key generated with lrand48 could be recreated by anyone who worked out roughly when it was made, handing them everything needed to drain the funds. The NSA's seeds, however, were public from day one, so there was never a secret to steal.

Where bitcoin fits in

Bitcoin was never part of this guessing game. Its wallets run on secp256k1, a curve built from a simpler equation. Bitcoin's version is defined by two small, fixed numbers that leave almost nothing to adjust, while P-256 carries a 77-digit number that emerged from the NSA's unexplained seed. With so few dials to turn, there is little room for anyone to have quietly built a weakness into bitcoin's curve, a property cryptographers have long cited in its favor. That instinct — parameters whose origins anyone can check, what cryptographers call nothing-up-my-sleeve numbers — has since shaped how newer cryptographic standards are written.

Creator Satoshi Nakamoto never publicly explained why he picked the curve, which was rarely used before bitcoin made it famous. Ethereum later adopted it as well, and bitcoin kept it when its 2021 Taproot upgrade introduced a newer style of signature.

A powerful quantum computer would bring a different danger, as CoinDesk explored earlier this year: such a machine could work backward from a public key visible on bitcoin's blockchain to the secret key behind it, regardless of how the curve was chosen. Hardware advances keep narrowing the gap between that theory and a working attack. Google said this week that its Willow chip cut errors about 40-fold in one of the costliest steps such a machine would need, a development that CoinDesk reported leaves satoshi-era bitcoin facing a bigger quantum threat.

Even so, nobody has yet built a quantum computer anywhere near large or reliable enough to crack a bitcoin key, and there is no clear timeline for when one might arrive. The migration question is already moving without it: NIST published its first post-quantum encryption and signature standards in 2024, the opening step toward eventually replacing today's curves.

Anthropic said in its blog that people using the NIST curves do not need to change anything. After decades of questions about where the seeds came from, anyone can now run the program and retrace its path to the published numbers.

The search had a prize, too. Its $36,864 bounty will go to the Internet Security Research Group, the nonprofit behind Let's Encrypt, which gives websites free security certificates.