Anthropic said on October 16 that a Claude research model reconstructed the unexplained origins of five elliptic-curve seeds supplied to U.S. standards bodies in the late 1990s. The team matched the published values to output from lrand48, a C-library pseudorandom-number generator initialized with Unix timestamps. That finding offers a reproducible answer to a long-running question about how widely used cryptographic parameters were chosen. It does not reveal a private key or show that a wallet has been compromised.

Why the seeds drew scrutiny

The Elliptic Curve Digital Signature Algorithm, or ECDSA, lets a user prove control of a private key without disclosing it. NIST adopted several standardized curves for digital signatures, including P-256. The seeds used in specifying some curves were public, but their origin was not explained when they were provided by the National Security Agency. That absence of a documented selection process prompted researchers to ask whether the parameters might have been chosen for a hidden property. Suspicion, however, was never proof of a backdoor.

Related reporting: Google's Willow Cuts Magic-State Errors, but Bitcoin Risk Remains Distant

According to Anthropic's technical account, the model first recognized a pattern associated with lrand48, then worked backward through the generator's state. The team says five NIST prime-curve seeds, along with five examples from the ANSI X9.62 standard, fit the same process. For P-256, the standardized seed appeared at the 1,842nd candidate in a timestamp-seeded sequence. Anthropic published code intended to let others reproduce the result. CoinDesk independently reported the discovery on October 17 and emphasized that the underlying numbers had always been public.

What it means for digital assets

The distinction between a public curve seed and a wallet's secret key is crucial. Anthropic says the finding is not a new attack or weakness in the NIST curves; in its view, the simple and reproducible generation method makes a deliberately planted weakness less plausible. A weak generator would be dangerous if it were used to create an individual wallet's private key. That is not what this investigation found. Users of systems built on these NIST curves are not being told to rotate keys because of the report.

Nor is this a Bitcoin-specific flaw. Bitcoin's developer documentation identifies secp256k1 as its signature curve, rather than the NIST P-256 curve whose seed Anthropic reconstructed. The result also should not be confused with recent research on future quantum-computing risks to blockchain signatures. A sufficiently capable quantum computer would pose a separate challenge regardless of how these older public seeds were generated; no such Bitcoin key-breaking machine has been demonstrated.

The remaining questions

Anthropic's work does not settle every historical choice. The researchers say some mathematically viable candidate curves were skipped, without a known reason. They also could not recover one binary-curve seed or explain how the base points for P-224, P-256, P-384 and P-521 were selected. Those limits matter: a reproducible seed-generation recipe improves transparency, but it does not establish the full decision record of the original standards process. For developers and financial institutions using elliptic-curve signatures, the immediate consequence is better provenance for a set of public parameters, not a required software patch.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.