The NSA's 1990s Backdoor Was Just a Simple Program. Bitcoin's Quantum Bill Is 1.7M BTC and Counting.

Ok wait because this is actually insane. For roughly thirty years, a boring set of numbers buried inside a government encryption standard has been quietly haunted. Everybody in cryptography suspected those numbers were hiding a backdoor. Turns out they came from a pretty basic computer program. Which means they were never random at all.

I've written about crypto long enough to know what "not random" means. It means somebody made a choice.

And here's the part that got me. Bitcoin was never on that list. It's not on the list now. But the exact class of math that got compromised is the same class of math Bitcoin runs on, and that problem hasn't moved an inch.

How the trick worked

The standard was published in 2006 by NIST under the name Dual_EC_DRBG. It was a random number generator, which sounds like the least sexy thing on earth until you remember that every encryption key you've ever generated started life as a random number. If the random number generator is compromised, everything downstream is compromised.

Dual_EC_DRBG used two constants pulled from an elliptic curve. Two giant numbers. Where'd they come from? The standard said, essentially, trust us.

In September 2007, two Microsoft researchers, Dan Shumow and Niels Ferguson, showed a backdoor was mathematically possible if whoever generated those constants kept a secret relationship between them. Read that again. Possible. Built into the spec.

Then June 2013 happened. Documents leaked by Edward Snowden described a $250 million a year NSA program aimed at defeating encryption, and Dual_EC_DRBG was right there in the middle of it. By December 2013, Reuters reported that RSA Security had taken a $10 million secret payment to make the flawed generator the default in its BSafe toolkit. NIST pulled its recommendation in April 2014.

For years, the official defense was that the constants were arbitrary. Just two numbers somebody picked. The new finding that a short computer program reproduces them is the sound of that defense hitting the floor. Arbitrary numbers don't fall out of simple programs.

The backdoor that may never have been used is still a backdoor. That distinction matters more than people want it to.

Bitcoin picked a better curve, and it doesn't save us

Now the part you came for. Bitcoin doesn't run on those NIST curves. It runs on secp256k1, a curve from the SECG standards group in 2000, and one of the reasons people trust it's that its parameters shipped with a documented, reproducible generation method. Anyone can rerun the math and check the output. No trust-us-bro required.

Good. Genuinely good. That's how this should work, and it's a real reason the 1990s crowd should've known better.

But secp256k1 is elliptic curve math, and elliptic curve math has a deadline. Shor's algorithm, published in 1994, eats it. A working quantum computer doesn't chip away at Bitcoin's signatures. It dissolves them.

How big does the machine need to be? Researchers in 2021 estimated 20 million noisy qubits to crack 2048-bit RSA in eight hours. Elliptic curve keys are cheaper to break, well under a million physical qubits with error correction on your side. Google showed off a 105-qubit chip in December 2024. IBM says it wants a fault-tolerant machine by 2029. The gap is enormous and also closing on a schedule people can read.

Here's the number that should keep you up. Roughly 1.72 million BTC sits in early pay-to-public-key outputs, where the public key is already exposed on chain. Add reused addresses, old wallets from 2011 that never moved, and you can push the at-risk pile past 4 million coins depending on who's counting. Nobody's cracking anything today. But every single one of those keys is breakable in a world where the machine exists.

So why does any of this connect to a 1990s spy story? Because both are the same failure mode. Huge amounts of value resting on math nobody re-checked for decades.

My actual take

Two things, and I'll be blunt.

First, any protocol shipping opaque constants in 2025 should be treated as compromised until proven innocent. That's not paranoia, that's the last thirty years of receipts. Ask where the numbers came from. If the answer is a shrug, walk.

Second, Bitcoin's quantum debate is stuck in a dumb place. Half the people yelling loudest are launching a competing chain. The other half are yelling that it's FUD because the machine isn't here yet. Both groups are selling something. Meanwhile the actual work, moving to post-quantum signature schemes, is happening at the speed of a Bitcoin upgrade, which is to say a glacier with a committee.

NIST finalized its first post-quantum standards in August 2024, ML-KEM, ML-DSA, SLH-DSA. The math exists. It's tested. It's not the bottleneck.

The bottleneck is that Bitcoin can't touch the early coins. Satoshi's roughly 1 million BTC sit on exposed keys and no one can move them, because nobody has the private keys, and even if someone did, spending them would be the loudest event in crypto history. That's not a software problem. That's a governance fight nobody's ready to have.

Bestie, your portfolio needs to hear this. If you're sitting on coins from 2013 in an address you've reused, moving them to a fresh wallet with an unspent public key costs you a transaction fee. That's it. That's the whole hedge. Do it while the fee is cheap and nobody's in a hurry.

Because the honest read on all of this is that the NSA story is a win. The math got audited, the backdoor got dragged into daylight, and the standard died. That's the system working.

Bitcoin hasn't had its audit yet. And the clock is running.