Can we retrieve his private key using his public key in ECC?
On ECC, the private key is a value $k$ in the range $[0,q-1]$ where $q$ is the order of the group generated by a point $G$, with $q$ a prime number, and $Q = kG$ is the public key.

The best known algorithm to solve this is Pollard's rho algorithm which runs asymptotically in $O(\sqrt{q})$.

In your situation, part of $k$ is known, except the $72$ least significant bits. Writing $k = k_12^{72} + k0$ with $0 \leq k_0 &lt; 2^{72}$, then $k_1$ represent the known bits and $k_0$ the unknown part you are looking for.

We have
\begin{array}{rcl}
Q &amp; = &amp; kG \\
&amp; = &amp; (k_12^{72} + k_0) G \\
&amp; = &amp; k_12^{72}G + k_0 G
\end{array}
So $k_0G = Q'$ where $Q'= Q - k_12^{72}G$ is known. Now, instead of looking for $k$ in the range $[0, q-1]$, you are looking for $k$ in the range $[0, 2^{72} - 1]$ which has a much much smaller size.

For that, you can look at Pollard's kangaroo algorithm which can search for the discrete logarithm in the subset $[0, 2^{72} - 1]$ in an asymptotically complexity $O(\sqrt{2^{72}})$ which is $O(2^{36})$ and is feasible.