Which to be perfectly honest, is a stupid thing to assert.  If you think about it for a minute you'll see that it really is not possible for employees of an organization to get away with stealing the org's bitcoin, any more than they can get away with draining their traditional bank accounts.

If they use multisig, and the bitcoins disappear, the blockchain will show who signed.  Organizations aren't so idiotic that they wouldn't bother to record whose keys are whose.  They'll see Bob and Mallory signed the 2/3 and stole the funds, Bob and Mallory are arrested.  They may say "we were hacked" but they can save it for the judge.

Now, in the case of bitcoin, Bob and Mallory can refuse to cooperate so the org might not get their money back.  But I don't see what's tempting about this crime, seems like a dumb thing to do.

US is spying on its ally?

One of these: http://safecurves.cr.yp.to/bada55.html

Heh... And he probably didn't even make sure the other guys had backed up their private keys prior to executing the transactions, either.

I remember someone telling a story that happened at a golf club or something (was it Antonopulous?). Not sure if true, but it goes like this: he sent a large chunk of coins (thousands worth a million $ or so) to the next guys phone and then around the table and back to him. Apparently it made quite an impression on the attendees to hold a million worth of Bitcoin on their gadgets for a short period of time. It's a slight bit risky and takes some balls to do this, but it sure gets people to think.

I understand that secp256k1's p has the form

     2^256 - 2^32 - x

because this is a sort of generalized Mersenne prime and the "32" means that  modular reductions can be carried out efficiently with 32-bit words.

But I still don't understand why x = 977.  Mathematica tells me that there were lots of choices:

 

Why not 263 = 2^8 + 2^2 + 2^1 + 2^0?  It's the smallest.

Earlier in the thread it was pointed out by TierNolan that 977 is the closest choice smaller than 1024, but why does 1024 matter?  For example, 487 is closer to 512 than 977 is to 1024.  

They've already been explained in this thread.  In summary:

The first constant we care about is p; TierNolan already explained that one.  It's the largestsmallest prime that satisfies: p = 2^256 - 2^32 - t where t < 1024

From that we can explain b.  If we're searching for the smallest combination of a and b that results in a prime order elliptic curve, a = 0 and b = 7 is the first one.  I don't know the specifics on why a and b should be small (probably GLV optimization), but they aren't suspicious regardless.

N is just the order of the elliptic curve; no explanation needed.

The last piece of the puzzle is the choice for G.  Since the order of the elliptic curve is prime, we can pick any point on the curve (except infinity), and get a group with the same order (i.e. there are no subgroups).  Why SECG picked the particular G they did is unexplained.  However, there is no reason to believe any G is weaker or stronger than any other G (against a compliant ECDSA verifier).  I would guess that either G is totally random, or it has sentimental meaning to the author(s).

Since the curve is not weak to any publicly known attacks, and the constants are not suspicious, then what else are we looking for with regards to secp256k1?

Muscle Power.   

Very true but we aren't comparing junior miners and large miners.  This is more of a comparison of panning for gold vs barrick.

You CAN when the cost of the labor approaches 0.  in the future: Buy commodity miner, hook up to thermostat, power, and internet.  Done.

What you are describing is a mis-pricing of investment/expenses.  Just because a regular home miner severely undervalues his time invested in maintaining the equipment or the heat generated, those factors aren't immune to the economics of scale.  Eventually the huge hot ASIC box gets thrown out because it barely breaks even while for the industrial miner a huge hot ASIC box is just a small expense line in one of 1000s running in a huge warehouse.  Also there is no excess electricity.  Either it is subsidized somehow ie someone else is footing the bill or again the cost is simply mis-priced by the miner and eventually that cost will come to the forefront and the small time miner will be pushed out by larger commercial players.  You can't escape the benefits of division of labor.