How can there be insecure elliptic curves if the discrete logarithm problem is hard? The discrete logarithm problem is the mathematical trap door function underpinning elliptic curve cryptography. If it's naturally hard to climb back through the trap door, how can there be insecure elliptic curves?

Any answer would be most beneficial for me if it remained light on the math, if that's at all possible.
Discrete Logarithm on elliptic curves is hard in the following sense: on an $n$-bit curve, solving DL has cost $2^{n/2}$. Thus, this is infeasible only as long as $n$ is large enough to make that cost prohibitive. A 256-bit curve is large enough; a 60-bit curve is not.

Also, some curves have a special structure which can be leveraged to compute DL faster. Notably:


If the curve order is not prime or does not have a big prime factor, then DL is easier (the same applies to normal non-curve DL).
Some curves have a low embedding degree, which allows for converting DL on the curve into a comparatively easier DL in the multiplicative subgroup of a finite field extension. This is very heavy in maths. If the curve is somewhat weakened but not too much, then it can still be safe while allowing computation of a pairing, an algebraic operation which is useful for some complicated cryptographic protocols (e.g. identity-based encryption).
Some curves make it easier to implement them securely, e.g. without leaking secret information through side channels.


Generating a new curve entails trying out equation parameters and checking that the resulting curve is not one of the known “bad cases”. In practice, a non-prime order is the most frequent case; for 256-bit curves, you need to try a hundred curves or so before getting one with a prime order. Curves with a low embedding degree are extremely rare, and easy to check for.