The NIST curve seeds were a clock. There was no hidden story. That reminded me the DES story. Most blockchains still prove ownership with ECDSA, and will until the post-quantum migration. NIST standardized the EC curves on year 2000. But Bitcoin uses a non-standardized curve: secp256k1. We don't know for sure why he didn't choose the standard curve. The suspicion, that the NIST seed might hide a backdoor is a commonly shared assumption. The cost shows up in Hardware support. Apple's Secure Enclave and Android StrongBox sign NIST P-256, also called secp256r1 ("r1", not "k1"). A Bitcoin key cannot be generated there, and it cannot sign there, same for many secure hardware. A few days ago, Anthropic published where those seeds came from: Claude reveals ECDSA curve origins. They are output from lrand48, the C library generator, started by srand48 from a Unix timestamp. For P-256 the clock is 16 August 1997, 01:52:34 UTC, and the published seed is candidate 1,842. The same generator recovers the other NIST prime curves. The reproduction is a few dozen lines. Large enough quantum computers would break ECDSA on both curves. So we still have to migrate Bitcoin towards PQC. And in the meantime, we know that secp256r1 was not backdoored by the NIST. It might improve our trust in the new PQC standards selected by ... the NIST!