If geopolitical tensions were not already enough to unsettle markets, crypto now has its own nuclear-themed anxiety to contend with. Across the industry, researchers and analysts are debating a cryptography doomsday scenario in which attackers derive private keys directly from public keys — powered by advances in artificial intelligence once dismissed as far-fetched but now treated as potentially credible, and capable of placing everyone’s crypto at risk.

Ethereum researcher Justin Drake called for “bunker mode” planning last Wednesday, citing “humbling” advances in artificial intelligence that could accelerate the discovery of mathematical attacks and ultimately “break” cryptography. “IMO it is now reasonable to brace for the possibility that ECDSA [Elliptic Curve Digital Signature Algorithm] breaks before Qday, in the worst case in months not years,” he wrote. In industry shorthand, “Qday” refers to the hypothetical day quantum computers become capable of breaking the public key cryptography that secures cryptocurrencies.

In Drake’s view, the industry should begin planning a controlled migration of assets to fresh addresses whose public keys have never been exposed, reducing the information a potential attacker could exploit.

But what exactly is the warning based on — and is there genuine cause for alarm?

Is the crypto panic justified?

Drake’s concern is not limited to whether AI will speed up the arrival of quantum computers able to break cryptography. He also worries that AI systems might help discover mathematical attacks executable on classical computers that human cryptographers have missed.

He argues that elliptic curves — the mathematics underpinning the cryptography of most blockchains — may be more vulnerable to such breakthroughs than hash functions because of their greater mathematical structure. That, in turn, raises the possibility of a classical algorithm breaking elliptic curve cryptography — the same tool that lets wallet software sign transactions and prove control of funds.

Matthew Green, a cryptography professor at Johns Hopkins University, added fuel to the panic already rippling through the industry, saying: “I think we might lose public key cryptography.”

Not everyone shares that alarm. Yehuda Lindell, head of cryptography at Coinbase, said that, to his knowledge, there is “no evidence whatsoever” that the decades-old mathematical assumptions underpinning elliptic curve cryptography have been weakened.

Lucien Bourdon, a Bitcoin analyst at hardware wallet firm Trezor, told Cointelegraph Magazine: “There are no credible published advances against the math behind ECDSA, with AI or anything else.”

Bourdon noted that none of OpenAI’s recent releases of AI-written math papers contain an attack on ECDSA — although Drake believes that absence is cause for suspicion rather than comfort. Drake’s other argument is that elliptic curves carry more mathematical structure than hash functions, which could make them easier to break.

“He doesn’t say how,” Bourdon said. “He also calls his timeline a worst-case scenario and tells people not to rush.”

Zach Herbert, chief executive and cofounder of hardware wallet firm FoundationHQ, told Cointelegraph Magazine that moving funds to fresh addresses may accomplish little if an extended public key (xpub) has already been shared with a wallet app or a third party. In that case, “they already have the information needed to derive the public keys you’re trying to hide,” he said.

And as Taylor Monahan, founder and chief executive of Ethereum wallet MetaMask, pointed out, if cryptography breaks, the price of one’s bags would be the least of anyone’s concerns: “If elliptic curves are broken so that any exposed public key leads to compromise and it’s by a financially-motivated hacker whose top priority is to steal crypto, the entire fu**ing world is going to zero. Having your magic internet coins in bunker is not going to help you.”

Why moving coins may not be enough

Herbert explained that xpubs let wallets generate multiple public keys for the same account, including keys for addresses that have never been used. If a wallet app or third party already holds that information, shifting funds to a fresh address within the same account may not hide the new address’s public key from them. If ECDSA became practically breakable, “an attacker could recover the corresponding private keys without ever touching your hardware wallet,” he said.

“No, it’s obviously not sufficient protection,” said Eli Ben-Sasson, co-founder and chief executive of Ethereum scaling protocol StarkWare. “Other than just moving your coins, if you want to use them ever again, you would need to download new kinds of wallets.”

A break would affect far more than wallet signatures, he added. Ethereum’s infrastructure-level signatures and consensus mechanisms would also need attention, as would the Kate-Zaverucha-Goldberg (KZG) polynomial commitment scheme used for data in blobs. “Finally, gas prices would likely also increase dramatically, because a lot of the would break,” he said.

On Bitcoin, some address types conceal the full public key behind a cryptographic hash until the coins are spent. If the relevant hash functions remain secure, this could provide an additional layer of protection against an attacker trying to derive a private key from a public key. Taproot addresses, by contrast, expose a public key directly onchain.

Bourdon noted that common SegWit addresses, which begin with bc1q, keep public keys hidden until spending, and that wallets such as Trezor generate fresh receiving addresses to limit address reuse. “There’s nothing to do right now,” he said, adding that a panicked migration will do more harm than good. “People who rush to move funds make mistakes, and scammers use stories like this one to reach them.”

It is also worth noting that any time a Bitcoin is spent, the public key gets exposed in the mempool anyway, providing a window of opportunity for an attack.

Not all crypto assets are created equal

Some blockchains are already preparing for cryptographic threats, although their proposed solutions vary considerably.

On AI-focused NEAR Protocol, users can add a quantum-safe FIPS-204 key to an existing mainnet account in a single transaction without moving their assets, according to its quantum-safe roadmap, and wallets like Meteor support quantum-safe signing. That approach relies on lattice-based cryptography — a technique Ethereum creator Vitalik Buterin has himself worried may also be vulnerable to attack.

Ethereum is developing a broader post-quantum roadmap using hash-based signatures and ZK proof aggregation, covering everything from transaction signatures to consensus and data security. It also has an emergency hard fork and recovery proposal mapped out on paper. In a March 2024 post, Buterin outlined a potential hard fork that would roll back blocks following the onset of mass theft, disable conventional wallet transactions and let users reclaim funds by using zero-knowledge proofs of a seed phrase.

Max Shannon, senior research associate at Bitwise Europe, said that remains a proposal with “no set timeline.” While no one has demonstrated a working attack so far, he said users should switch to quantum-safe signatures “over the long term.”

Starknet’s account abstraction architecture allows users to switch signature schemes without migrating funds to a new address. Ben-Sasson said the core technology would not need to be changed, “because account abstraction means you can take any signature scheme.” Other components would still need attention, however, including parts of the network’s state tree and its reliance on Ethereum for security.

Switching to a new address is not going to help Solana users, as public keys are exposed there by default — though they can migrate funds to a post-quantum vault such as Winter Wallet. Solana Foundation technology vice president Jacob Creech said Solana users would not need to enter “bunker mode” if its signature scheme became breakable. A network upgrade could let users prove ownership of their secret seed using a hash-based proof and migrate their accounts to a safer signature scheme. A working proof of concept exists, he said, though the upgrade itself has not been deployed.

So, should crypto holders be panicking?

Shannon said Bitwise is not worrying about this theoretical risk for now, but that it is “worth being prudent over.”

“We can discuss fresh addresses and xpub exposure as a thought experiment,” Herbert said, “but I wouldn’t pretend those steps amount to a practical plan for that scenario.” Because some people have old devices, complicated multisignature arrangements, or Bitcoin they have not touched in years, he said a software update “would not automatically protect those coins.”

Bourdon urged holders to scrutinize the source, noting that Drake’s warning was accompanied by talk of Ethereum’s moves toward the hash-based cryptography he recommends. “So the warning about an unproven threat doubles as a pitch for Ethereum’s roadmap,” he said.

While that does not prove Drake wrong, there is still no evidence that ECDSA is about to be broken — and plenty of risks involved in rushing to move funds. For now, the things to watch are concrete: whether any credible published attack on ECDSA materializes, and whether post-quantum proposals like Ethereum’s emergency hard fork and Solana’s hash-based seed-proof upgrade move from paper to deployed network upgrades. But if the cryptography underpinning crypto wallets and blockchains does fail, moving coins may be the easiest part of the industry’s response.

Based on reporting by Cointelegraph Magazine.