An unreleased Anthropic AI model has broken a post-quantum signature scheme in approximately 60 hours, reviving a question that Bitcoin developers have not yet resolved: when should the network begin migrating to quantum-resistant cryptography?

The finding poses no immediate threat to Bitcoin. HAWK-256 was never deployed by the network, and no existing wallets are affected. However, the result alters a critical assumption underpinning Bitcoin's post-quantum roadmap — namely, that AI is making it faster and cheaper to test, and potentially break, advanced cryptographic systems.

What Mythos Did to HAWK — and What It Cost

On July 28, Anthropic announced that its Claude Mythos Preview model — currently available to a select group of approved users — discovered a previously undocumented attack on HAWK-256, the last remaining lattice-based signature candidate in NIST's third round of post-quantum cryptography evaluation. NIST, the U.S. Commerce Department agency that sets federal cryptographic standards, has been conducting this multi-year competition since 2016; algorithms it selects are typically adopted not only by U.S. government systems but by enterprises and protocols worldwide.

The AI identified a hidden symmetry in HAWK's design that human experts had overlooked. The discovery reduced the algorithm's effective security by approximately fifty percent and lowered the anticipated computational effort required from around 2^64 to 2^38 operations. According to Anthropic's research blog, the attack took roughly 60 hours and cost about $100,000 in computation. It was carried out by a researcher without formal cryptographic training.

The cryptography community responded swiftly. Sophie Schmieg of Google stated, "Basically with this paper, HAWK is dead." Matthew Green of Johns Hopkins University noted that while the research contained no groundbreaking mathematics, it represented a novel combination of existing techniques. Ars Technica reported that the creators of HAWK withdrew the algorithm from public circulation the following day.

Why Every Bitcoin Wallet Remains Untouched

The result has no bearing on Bitcoin's current security. Bitcoin relies on ECDSA over the secp256k1 elliptic curve, which is entirely unrelated to HAWK. The algorithm was never implemented in Bitcoin, any other blockchain, or commercial software. Its failure occurred during the review process — precisely the kind of scrutiny intended to expose flaws before deployment.

Bitcoin's anticipated post-quantum migration had already bypassed HAWK entirely. In February 2026, the Bitcoin Improvement Proposal repository received BIP-360, which introduces a new output type called P2QRH. This output type employs ML-DSA — itself a lattice-based scheme, sharing the same mathematical family as HAWK — and SLH-DSA, a hash-based signature, both of which NIST finalized in 2024 following years of public evaluation. Additionally, BIP-361 was submitted in April 2026 by Jameson Lopp and collaborators, proposing a gradual phase-out of ECDSA in Bitcoin. HAWK was not included in either proposal.

The Test That Determines When Migration Begins

As discussed by TFTC, the central question is whether AI-assisted cryptanalysis could eventually compromise the algorithms Bitcoin plans to adopt — ML-DSA or SLH-DSA. The fact that HAWK, also lattice-based, fell to an AI-driven attack gives that question added weight, even though ML-DSA and HAWK differ structurally and have undergone separate analyses. If either candidate were found to be vulnerable before the network completes its migration, the strategy of waiting for mature standards may no longer hold.

The economics of cryptanalysis are also shifting. Anthropic has demonstrated that meaningful cryptographic analysis can now be conducted in approximately 60 hours for about $100,000, making this type of testing far more repeatable. Intelligence agencies such as the NSA and GCHQ are almost certainly conducting similar work behind closed doors, meaning public findings likely lag behind classified results.

Researchers have drawn parallels between this case and that of SIKE (Supersingular Isogeny Key Encapsulation), another post-quantum contender that survived years of analysis before being broken in under an hour on a laptop in 2022. AI appears to be accelerating this pattern.

Why the Timeline Keeps Compressing

AI-assisted cryptanalysis is shrinking the expected timeframe for when quantum attacks might become practical. Forrester's 2026 quantum security report reinforces this assessment, warning that the emergence of new algorithms can compress security timelines "overnight" by reducing the computational resources needed to solve complex encryption problems. The firm projects significant security threats associated with Q-Day by 2030.

Google has similarly accelerated its own efforts, setting a target of retiring RSA and elliptic-curve cryptography from its internal systems by 2029 and urging other companies to follow suit.

For Bitcoin, the stakes are substantial. Analysts cited by TheStreet estimate that approximately 6.7 million Bitcoins — worth nearly $600 billion — reside in wallets that could potentially be compromised by a sufficiently powerful quantum computer. A study called Quantum Horizon reports that around 2.3 million Bitcoins would be permanently lost in the event of a quantum attack, while estimating a one-in-six probability of a quantum computer capable of breaking current cryptography being operational by 2035. The authors argue that Bitcoin's primary challenge is no longer hardware development, but whether the network can complete a successful transition before such technology materializes.

What Cryptography Does Bitcoin Use?

Bitcoin employs several cryptographic primitives, each serving a distinct purpose. Notably, Bitcoin does not encrypt transactions. Instead, it depends on cryptography for authentication, integrity, and consensus.

The concern is that Bitcoin's signature schemes — ECDSA and Schnorr — are theoretically vulnerable to a future quantum computer running Shor's algorithm. Developers and researchers are therefore exploring pathways for Bitcoin to adopt post-quantum signature schemes, such as hash-based or lattice-based alternatives, through future protocol upgrades. Any such migration would demand broad consensus across the Bitcoin ecosystem — involving miners, wallet developers, exchanges, and full node operators — given its far-reaching implications for wallets, transactions, and consensus rules. Achieving that consensus is historically slow; Bitcoin has no central authority to mandate changes, and contentious upgrades risk chain splits.

The HAWK attack did not affect Bitcoin directly, as the network does not use HAWK. Nevertheless, the result demonstrates how AI can accelerate cryptanalysis and reduce the time required to evaluate — or break — emerging cryptographic schemes. Taken together with recent advances in quantum algorithms, these developments underscore the urgency of the ongoing efforts by Bitcoin developers to prepare for a post-quantum future.