Nicolas Bacca, co-founder of Ledger, commented in an X post after Claude revealed the origins of the ECDSA curve, saying "Checkmate Satoshi" in what seems to be a playful statement.
In under half an hour, Claude discovered the origins of the NIST P-192, P-224, P-256, P-384, and P-521 seeds, with this reported on October 16, 2026. None of them were the results of any hash algorithm at all, but rather the output of the C library's lrand48 random-number generator, seeded with a Unix timestamp.
This remains laudable, as for 26 years, cryptographers had suspected the NSA's mysterious encryption seeds might conceal a backdoor.
Bacca responded, saying, "Right, but it still made a good joke."
In 2000, NIST incorporated the P-256 curve into standards, with parameters derived from hashing a 160-bit seed. The seed was provided by the NSA, and its origin was never explained, so speculation about "backdoors" never stopped.
Satoshi's Bitcoin decision comes into focus
According to Coinbase wallet lead Pete Kim, the choice of secp256k1 over r1 (P-256) in Bitcoin (and Ethereum) was heavily influenced by the fear of an NSA backdoor. "turns out there is no backdoor after all," Kim wrote, commending Anthropic.
In reaction to the milestone, a crypto user pointed out that the reason Bitcoin's pseudonymous creator, Satoshi Nakamoto, did not choose the NSA's P-256 curve when founding Bitcoin but rather secp256k1, came back into discussion following the Claude reveal, noting that what was cracked in 30 minutes is not just a number but rather 26 years of global internet paranoia.
Some believe Satoshi probably chose secp256k1 instead of the NSA's P-256 because of this mystery, as it might be easier to trust the number 7 (the coefficient in secp256k1) than the coefficient in P-256.
Claude traced the NIST P-curve seeds to a 1990s random-number generator seeded with timestamps, but Bitcoin never used those curves. This discovery makes backdoors less plausible but does not make ECDSA less secure.
