Does Claude's ECDSA discovery put Bitcoin at risk?

Two different meanings of seed

An elliptic curveElliptic curve (secp256k1)The curve y² = x³ + 7, whose maths turns a private key into a public key that ordinary computers cannot reverse efficiently. supplies the maths used to create and check digital signaturesDigital signature (ECDSA, Schnorr)Proof, made with a private key, that the owner approved a payment. Anyone can check it; practical forgery is infeasible under current assumptions., which prove that someone authorised a message or payment. Everyone using a particular curve shares its mathematical parameters. Those numbers are public.

Some curves are chosen by feeding a number called a seed through a fixed calculation. The seed is published too, so anyone can check the calculation. The mystery was how the US standards body NIST's seeds had been picked in the first place, as cryptographer Filippo Valsorda explained when he offered a bounty for their origins in 2023.

A wallet seed has a different job. It is secret information from which a wallet derives private keysPrivate keyThe secret number that lets you spend your bitcoin. Whoever knows it controls the coins, so it must never be shared., the numbers that let you spend your coins. BIP-32 describes how one seed can produce a whole family of keys. Recovering the recipe for a public curve does not recover those wallet secrets.

The clue was the computer's clock

For years, researchers pursued a story about a joke. Jerry Solinas, the NSA mathematician associated with the seeds, had recalled a phrase along the lines of “Give Bob and Jerry a raise”. Valsorda's bounty invited people to test possible phrases against the published numbers.

Anthropic reports that Claude found a different explanation: a common 1990s random-number generator, lrand48, started with a value from the computer's clock. Its method reproduces the seeds of five NIST curves using dates between May 1997 and April 1998. The P-256 seed appears on the 1,842nd attempt in one such run.

That gives researchers a recipe they can test. Anthropic argues it leaves less room for deliberately weakened choices, but it does not answer everything: some apparently suitable candidates were skipped, and the origins of several curves' starting points remain unexplained.

Bitcoin's curve is a separate choice

Bitcoin uses secp256k1, a different curve named in BIP-32. In Standards for Efficient Cryptography 2 (SEC 2), its equation is y² = x³ + 7. The standard lists its parameters directly, without the seed-based construction used for the NIST curves in this discovery.

The useful question is which curve a system uses. Sharing a signature method such as ECDSA does not mean sharing every mathematical parameter. Explaining the origin of NIST's numbers changes neither Bitcoin's curve nor the private keys wallets use with it.

The separate quantum result

Anthropic published another result on 16 October, about designs for calculations a quantum computerQuantum computer (qubit)A computer that uses quantum physics to solve some problems far faster than ordinary ones. Its working parts are called qubits. could perform. One design uses 17 times fewer operations than the smallest previous design, at the cost of 12% more qubits, the computer's quantum bits. It improves a calculation used within elliptic-curve arithmetic.

That comparison concerns part of a larger algorithm. It does not demonstrate a machine recovering a Bitcoin private key, or a 17-fold speedup of a complete attack. The work was checked in software. It belongs to the longer debate about future quantum computers, which is covered in our article on quantum theft and proposals to restrict old coins.