Difference between Bitcoin private key space and secp256k1 modulo

Question

I've read online that the group order for the Bitcoin secp256k1 curve is:

0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141

Its decimal is:

115792089237316195423570985008687907852837564279074904382605163141518161494337

However, the modulo for the secp256k1 curve is the prime number:

0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F

Its decimal is:

115792089237316195423570985008687907853269984665640564039457584007908834671663

These numbers are almost identical. Since the secp256k1 curve has no subgroups, its cofactor is 1. Does that mean that by accident there are almost as many points on the curve as the modulo to compute it?

Or are these the same numbers and one is wrong?

Answer 1

Does that mean that by accident there are almost as many points on the curve as the modulo to compute it?

It is not an accident.

The number of points on an elliptic curve over a finite field is always close to the size of that field, by Hasse's theorem. Specifically it says that the difference between the number of points on the curve (excluding the point at infinity) and the size of the field is at most twice the square root of the field size.

Or are these the same numbers and one is wrong?

No, they are distinct.

The numbers can be computed using the following Sage code:

>>> F = GF(2**256 - 2**32 - 977) # secp256k1 field
>>> E = EllipticCurve(F, [0,7])  # secp256k1 curve
>>> F.order() + 1 - E.order()
432420386565659656852420866390673177327
>>> int(sqrt(F.order())
340282366920938463463374607431768211455