The cryptocurrency industry is debating a potential cryptographic threat in which artificial intelligence could accelerate the discovery of mathematical attacks on the elliptic curve digital signature algorithm (ECDSA) that secures most blockchains.
Ethereum researcher Justin Drake warned last week that the industry should begin planning for "bunker mode" — a controlled migration of assets to fresh addresses with unexposed public keys. Drake argued that recent AI advances could help discover mathematical attacks that human cryptographers have missed, potentially breaking elliptic curve cryptography in a worst-case scenario of months rather than years.
Drake's concern centers on whether AI might help find classical computing attacks rather than only accelerating quantum computing timelines. He contends that elliptic curves may be more vulnerable to such breakthroughs than hash functions due to their greater mathematical structure.
Experts Divided on the Threat
Cryptography professor Matthew Green of Johns Hopkins University acknowledged the risk, stating "I think we might lose public key cryptography." However, other security experts disagreed with the urgency.
Coinbase's head of cryptography, Yehuda Lindell, said there is "no evidence whatsoever" that mathematical assumptions underpinning elliptic curve cryptography have been weakened. Lucien Bourdon, Bitcoin analyst at hardware wallet Trezor, noted that "there are no credible published advances against the math behind ECDSA, with AI or anything else." Bourdon added that recent AI-written math papers from OpenAI contain no attacks on ECDSA.
Bourdon also cautioned that panicked fund migrations pose practical risks. "People who rush to move funds make mistakes, and scammers use stories like this one to reach them," he said.
Limitations of Moving Coins
Security experts identified significant limitations in the proposed "bunker mode" strategy. Zach Herbert, chief executive of hardware wallet FoundationHQ, noted that moving funds to fresh addresses may not protect users if extended public keys (xpub) have already been shared with wallet applications or third parties, as attackers would already have the information needed to derive new public keys.
Taylor Monahan, founder of Ethereum wallet MetaMask, pointed out that if cryptography breaks, individual coin protection would be irrelevant: "If the entire fu**ing world is going to zero," moving coins to "bunker mode" offers no meaningful protection.
Eli Ben-Sasson, chief executive of Ethereum scaling protocol StarkWare, stated that moving coins alone would be insufficient. Users would need new wallet types, and infrastructure-level impacts would extend beyond signatures to consensus mechanisms and other systems.
Bitcoin Address Types and Exposure
Bitcoin offers some built-in protections through different address types. Common SegWit addresses beginning with bc1q keep public keys hidden until coins are spent. However, Taproot addresses expose public keys directly onchain. Additionally, every Bitcoin transaction exposes the public key in the mempool, creating a potential attack window.
Blockchain-Specific Preparations
Some blockchain networks are already developing post-quantum solutions. NEAR Protocol allows users to add a quantum-safe FIPS-204 key to existing accounts without moving assets. Ethereum is developing a post-quantum roadmap using hash-based signatures and zero-knowledge proof aggregation, with an emergency hard fork proposal outlined in March 2024.
Starknet's account abstraction architecture enables users to switch signature schemes without migrating to new addresses. Solana has a working proof of concept allowing users to prove seed ownership through hash-based proofs and migrate to safer signature schemes, though the upgrade has not been deployed.
Scrutinizing the Warning
Bourdon cautioned that Drake's warning should be examined in context, noting that Drake's recommendations align with Ethereum's moves toward hash-based cryptography. "So the warning about an unproven threat doubles as a pitch for Ethereum's roadmap," Bourdon said, though he noted this does not necessarily prove Drake wrong.
Max Shannon, senior research associate at Bitwise Europe, stated there is no set timeline for quantum-safe transitions. Bitwise is not currently worried about the theoretical risk but considers it "worth being prudent over."
Despite the debate, no working attack on ECDSA has been demonstrated, and significant risks accompany rushing to move funds.
