What does the special form of the base point of secp256k1 allow? The popular ECC parameters secp256k1 are documented in SEC2 as using curve $y^2\equiv x^3+a\cdot x+b\pmod p$ with $a=0$, $b=7$, $p=2^{256}-2^{32}-\mathtt{3d1_h}$, base point $G$ with the apparently haphazard $(x,y)$ coordinates (hex)

79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798
483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8


and order $n=2^{256}-\mathtt{14551231950b75fc4402da1732fc9bebf_h}$, cofactor $h=1$.

However, it turns out that $G$ is $G'+G'$ with $G'$ having $(x',y')$ coordinates (hex)

00000000000000000000003b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63
c0c686408d517dfd67c2367651380d00d126e4229631fd03f8ff35eef1a61e3c


which is easily computable as $\displaystyle\frac{n+1}2\times G$.
The 90 leading zero bits in $x'$ show beyond doubt that this is a deliberate choice. What does it allow (faster computation, attack..)?

As an aside: is it known how $x'$ was chosen? The earliest mentions of that number that I could find are in this answer (January 5, 2015) without mention of its property, and in this challenge (date unknown but it existed on June 5, 2015) where its property is meaningful.

Update: I notice that the generator of secp224k1 is also twice a $G'$ with the very same anomalously small $x'$ as above (this time with 58 leading zero bits, which is still remarkable). I found nothing similar about the generator of secp192k1 or secp160k1. I did not check other SEC curves (but  secp112r1 secp112r2 secp128r1 secp128r2 secp160r1 secp160r2 secp192r1 secp224r1 secp256r1 secp384r1 secp521r1 are reportedly verifiably random, thus nothing similar should occur).



The special form of $G$ seems to allow some perceptible speedup when computing $k\times G$ for arbitrary $k$ by some elementary methods. We can rewrite $k\times G$ as $(2k\bmod n)\times G'$, and the frequent point additions of $G'$ or ($-G'$) occurring in left-to-right binary scan of the scalar multiplier can be sped up a little (at least when using affine, projective or Jacobian coordinates), because multiplication by $x'$ occurs in the point additions, and some of the word multiplications can be skipped.

However, I do not know if the fastest methods used in practice can take advantage of the special form of $G$ (or what these methods are).
One thing we know is that it doesn't allow any special attack.

Let us assume that we knew a special point $G$ that makes computing the discrete log easy, that is, given $xG$, it's easy (or at least, easier than expected) to recover $x$.

Then, given $H$ and $xH$, here's what we could do; we know that $H = yG$ for some $y$ (as $G$ is a generator), and so we can use our special purpose discrete log problem to recover $y$.  Similarly, we have that $xH = zG$ for some $z$, again, we can recover $z$.  So, we have $x(yG) = zG$, or $x = y{-1}z$; that immediately gives us the value $x$.

Hence, if they knew a 'weak point' $G$, that would imply that the entire curve is weak.  Since we don't believe that, we can assume that their special value $G$ is no weaker than any other point (as long as $G$ generators the entire group, which is true in this case)