Claude Solved a Crypto Mystery and Made Quantum Attacks Cheaper

On October 16, 2026, Anthropic published two research posts on the same day. One answers a 25 year old question about where some of the world's most widely used cryptographic curves came from, and makes them look more trustworthy. The other shows an AI model making quantum attacks on that same family of cryptography much cheaper. Read together, they say something bigger than either one alone: AI now works on both sides of the lock.

The seeds nobody could explain

ECDSA is the most widely used elliptic curve signature standard. NIST adopted it in 2000 in the FIPS 186-2 Digital Signature Standard, with a set of standard curves such as P-256. Each curve was defined from a 20 byte "seed" supplied by the NSA, with no explanation of where those seeds came from. For years, that silence fed suspicion that the curves could have been picked to hide a weakness. A public bounty organized by cryptographer Filippo Valsorda offered money to anyone who could find the answer.

The best rumor, from NSA mathematician Jerry Solinas in 2015, was that the seeds were hashes of a joke phrase like "Give Bob and Jerry a raise." Anthropic employees chased that lead and found nothing. Then one of them asked an internal research model to work out how the seeds were generated, without pointing it at the rumor.

According to Anthropic, Claude solved it in under half an hour. The seeds were not hashes at all. They were output from lrand48, an ordinary random number generator in 1990s C libraries, started from a Unix timestamp. The recovered start times fall between May 1997 and April 1998. P-256, for example, was the 1,842nd candidate produced after a start on August 16, 1997. Anthropic published short code that regenerates the NIST prime curve seeds byte for byte.

A seed anyone can regenerate from a 1997 clock reading leaves very little room for a hidden backdoor.

What it proves, and what it does not

Anthropic is explicit: this is not a break, a new attack or a weakness in the curves, and nobody needs to change anything. It does not prove the curves are unbreakable. What it does is remove the main reason people suspected deliberate tampering. Some questions remain open: a few viable candidate curves were skipped for unknown reasons, one binary curve seed (B-163) is still unexplained, and the base points of P-224, P-256, P-384 and P-521 have not been traced. The $36,864 bounty went to the Internet Security Research Group, the nonprofit behind Let's Encrypt.

The other post: cheaper quantum attacks

The second paper is about quantum circuits. Anthropic gave Claude plain language specifications for eight circuits and an automated evaluator that scores each design. Across all eight, Claude found designs that beat the best published ones, in some cases by an order of magnitude or more.

One of those tasks matters directly for cryptography: elliptic curve point addition, the core step of the quantum algorithm that would recover a private key from a public one. After a 53 hour run with minimal human input, Claude produced a new way to do modular inversion, the most expensive part of that step, inside a quantum circuit. Compared with the smallest previous design, one of its circuits uses 12% more qubits but 17 times fewer gates. Anthropic's own conclusion is that such gains could bring practical quantum computers closer than previously anticipated.

What this means for Bitcoin

One correction first, because social media is already mixing things up. Bitcoin and Ethereum do not use the NIST curves. They use secp256k1, a different curve with no NSA seed. The seed story changes nothing for them. The circuit story does, because a quantum computer running point addition works on elliptic curves in general, whichever one you choose.

That does not mean Bitcoin is in danger tomorrow. Nobody knows when a quantum computer large and reliable enough will exist, and nobody can say how much AI will shorten that wait. But no timeline is not the same as no risk. The posts urging people to move their coins right now miss the point. A fresh address can keep a public key hidden for a while, since the key is revealed when coins are spent. It does not change the protocol, which still relies on signatures a large quantum computer could break. Individuals can protect some funds for a time. The collective problem stays.

The real test is governance

Decentralization is a strength against pressure and arbitrary power. It is also slow when the rules themselves must change: the wider the consensus, the longer it takes to build. Moving a network to quantum resistant signatures means agreeing on a scheme, upgrading software and getting holders to migrate. Technology breakthroughs do not wait for everyone to agree.

The right moment to start that debate is before the threat is usable, not after. Waiting for proof that an attack works is the surest way to run out of time to deploy a fix. The question is not whether Bitcoin will face quantum computing. It is whether it can change its own rules fast enough when it does. See also why Claude hides its reasoning.