Anthropic Says Claude Solved a 25-Year NSA Cryptography Seed Mystery in Under 30 Minutes

Published October 17, 2026, 13:15 PKT. Based on Anthropic's October 16, 2026 research report "Claude reveals ECDSA curve origins" (primary source), and secondary reporting by CoinDesk, Crypto Briefing and CoinEdition.

Anthropic said on October 16, 2026 that an internal Claude research model solved one of cryptography's longest-running mysteries in under half an hour: where the seed numbers behind the NIST elliptic curves, including the widely used P-256, actually came from. The answer, according to the report, was not a hash of a secret NSA phrase but the output of lrand48, a weak random number generator shipped with 1990s C libraries, seeded with nothing more exotic than a Unix timestamp.

The 871696354 timestamp that seeded P-256

The report describes a reconstruction anyone can now rerun. The generator would be initialized with a Unix timestamp, then draw successive 20-byte candidate seeds: the first 20 bytes are candidate 1, the next 20 are candidate 2, and so on. The published seed behind P-256, the curve under every ES256 signature on a JSON web token, lands at candidate number 1,842 of a run seeded with the timestamp 871696354, which converts to August 16, 1997, at 01:52:34 UTC.

The pattern held across the other prime curves. The seeds for P-192, P-224, P-384 and P-521 all matched lrand48 output from runs initialized with timestamps between May 1997 and April 1998. Five additional ANSI X9.62 example-curve seeds matched the same construction, and Anthropic says each recovered generator state reproduces all 160 seed bits. The binary curve seeds B-233, B-283, B-409 and B-571 also fit the generator; doubling the recovered initialization values gives a timestamp of April 17, 1998, suggesting the original program halved the clock value before seeding.

For the first time, Anthropic says, the report also explains where the base points of P-192 and five related ANSI X9.62 curves came from: the base point x-coordinates can be recreated with the FreeLIP arithmetic package's generator. A base point is the fixed starting value multiplied by a private key to produce a public key, and its selection is separate from the curve seed.

How Claude cracked the case in under 30 minutes

Several Anthropic employees had chased the seeds before and failed, Anthropic said, because they were working from the lead that the seeds were hashes of a humorous phrase. In October 2026, one employee asked an internal research model to investigate without pointing at that clue. The model wrote a scanner to test whether the published seeds matched the output pattern of various 1990s-era generators, and noticed something odd: several seeds had their top bit cleared across all 20 bytes, a pattern that would occur by chance roughly once in 5,810 tries. That pointed to lrand48, which only returns 31 of its 48 bits of internal state.

From there, Claude used lattice reduction, specifically the Lenstra-Lenstra-Lovasz (LLL) algorithm, to recover the hidden state bits, then ran the generator's logic backward until it landed on a value consistent with how the function is normally initialized. Anthropic tested 34 generator-and-output-slice combinations before the pattern locked in. In its recorded reasoning, the model wrote that the result was "astonishing" and paused to check whether it was working inside a simulated test before concluding the numbers were real.

The $36,864 bounty and Filippo Valsorda's verification

The best lead for years had come from Jerry Solinas, the NSA mathematician who reportedly generated the curves, who said before his death in 2023 that the seeds came from hashing a joke phrase, something like "Give Bob and Jerry a raise," and that the archives were gone. In 2023, cryptography engineer Filippo Valsorda and other contributors offered a $12,288 bounty for an answer, rising to $36,864 if the winner donated it to charity. Valsorda wrote the same day as Anthropic's report that the bounty had been claimed, and that he reimplemented the algorithm in Go to verify the claim. Anthropic said the bounty money will go to the Internet Security Research Group, the non-profit behind Let's Encrypt.

Anthropic stresses the results are its own and have not yet been independently confirmed, though it published reproduction code that regenerates every seed.

What it means for Bitcoin and crypto wallets

The finding lands with a twist: the mundane answer is roughly the best outcome cryptographers could have hoped for, because anyone can now rerun the program and get the numbers the NSA supplied. A clock-seeded generator leaves little room for a deliberately planted backdoor, and Anthropic says there is no action to take and nothing to deploy differently. CoinDesk's Shaurya Malwa reported the reaction as "Wow, it's a real discovery."

The same predictability that solved the mystery would be a disaster inside a wallet: CoinDesk noted that a secret key generated with lrand48 could be recreated by anyone who worked out roughly when it was made, giving them everything needed to drain the funds. But the NSA's seeds were public from day one, so there was never a secret to steal. And Bitcoin's own curve, secp256k1, was never on that list of NIST seeds, so Bitcoin's cryptography is unaffected, and its quantum problem hasn't gone anywhere.

The timing adds a note of irony: last week, Ethereum co-founder Vitalik Buterin warned that AI could soon find hidden weaknesses in the cryptography that protects crypto. This week, an AI went looking and found something, but it was a timestamp, not a backdoor.

What Claude still could not explain

Some questions remain. The seed for the binary curve B-163 is still unexplained. The origins of the base points for P-224, P-256, P-384 and P-521, and for the NIST binary curves, are not accounted for. Anthropic also cannot explain why the program passed over some usable candidates, including candidate 876 in the P-256 run, which would also have produced a usable curve; it calls deliberately chosen weak curves implausible given how few candidates were skipped. And it does not know how many timestamp-seeded runs were attempted in total before the published seeds emerged.

This article is news reporting and is not investment advice.

Sources

• Anthropic research report, "Claude reveals ECDSA curve origins," October 16, 2026, primary source: internal research model traced the five NIST curve seeds to lrand48, a 1990s C-library random number generator seeded with a Unix timestamp, in under half an hour; P-256 seed at candidate 1,842 of a run seeded 871696354 (August 16, 1997, 01:52:34 UTC); ten prime-curve seeds map to timestamps between May 1997 and April 1998; four binary seeds fit with a halved-clock interpretation; base-point x-coordinates of P-192 and five ANSI X9.62 curves explained; the finding is not a break of ECDSA and there is nothing to change; reproduction code published; results not yet independently confirmed
• CoinDesk, October 17, 2026, secondary source: "Wow, it's a real discovery" reaction; model questioned whether it was in a simulated test; warning that an lrand48-generated secret key could be recreated and funds drained; NSA seeds public from day one; Bitcoin's secp256k1 never on the NIST seed list, quantum problem unchanged
• Crypto Briefing, October 17, 2026, secondary source: P-256 seed hex C49D360886E704936A6678E1139D26B7819F7E90; timestamps between May 1997 and April 1998; binary curves showing patterns consistent with February 1984 or April 1998 timestamps; $36,864 bounty claimed and donated to the Internet Security Research Group
• CoinEdition, October 17, 2026, secondary source: Vitalik Buterin's warning last week that AI could soon find hidden weaknesses in the cryptography that protects crypto, and the model solving the mystery in about 30 minutes