There are plenty of weak curves. See djb's safecurves project. Maybe the NSA found an unknown type of weakness.
There are now multiple cryptographers on this thread (not counting me; I'm not a cryptographer) explaining why this is now utterly implausible.
alt Hacker News
There are now multiple cryptographers on this thread (not counting me; I'm not a cryptographer) explaining why this is now utterly implausible.