In the early 2000s, Certicom and/or NSA developed Dual_EC_DRBG, a pseudorandom number generator built out of public-key elliptic-curve cryptography—which these days ‘everyone’ knows means built with a back door (after all, that's what a private key is!). At the time, however, elliptic-curve cryptography had a certain mystique around it, and many people fell into a common trap: the misconception that a rich mathematical theory like RSA makes a problem harder than an ad hoc construction like AES, when really it is exactly the opposite—it is much easier to make something like AES hard to break; the rich mathematical theory is needed only for the back door (public-key cryptography), and requires larger keys and worse performance to conceal it.
We know that Certicom knew about the back door in Dual_EC_DRBG because Dan Brown and Scott Vanstone patented it in 2005 (under the euphemism of ‘key escrow’), but these days patents have completely inverted their role as a forum for dissemination and become a forum for obfuscation instead (and I don't know when the patent application was first made public), so like the purloined letter nobody bothered to read it. So, despite this disclosure, and despite smelling something fishy early on, NIST didn't connect the dots and in 2006 adopted Dual_EC_DRBG in Special Publication 800-90A, the United States federal government standard for pseudorandom number generation.
The first problem the public academic community noticed was that Dual_EC_DRBG is just a lousy uniform bit generator. It wasn't long before someone publicly pointed out the back door design at the CRYPTO 2007 rump session, and then made noise about it in popular press. Nevertheless, Elaine Barker of NIST sent Bruce Schneier a stern rebuke for suggesting that there might be a back door, and the algorithm remained in the standard despite its obvious fishiness to every cryptographer on the planet who followed it.
Meanwhile, NSA bribed RSA, Inc. 10m USD to use Dual_EC_DRBG by default in the RSA-BSAFE cryptography library used commercially by various enterprises too big to care about fiddly little details like ‘cryptographic back doors’. It also wound up in Juniper's ScreenOS firmware—with nonstandard base points, suggesting a different back door from the standard one codified in NIST SP800-90A. To this day, nobody has publicly explained whose back door it is.
The charade lasted until joint reporting on Edward Snowden's disclosures by the New York Times, ProPublica, and the Guardian in September 2013 revealed smoking-gun memos that NSA had a program to deliberately sabotage cryptography standards. This convinced the world, and even NIST, that Dual_EC_DRBG is bad news.
For more information and references, see the Project BULLRUN Dual_EC web site, particularly a detailed chronicle of the background and history until 2015, and the timeline at the Wikipedia article on Dual_EC_DRBG.