Justin Drake, a researcher at the Ethereum Foundation, is calling on the cryptocurrency industry to enter "Bunker Mode": an orderly migration of funds to addresses whose public keys remain hidden. Behind the appeal stands his warning that AI-driven mathematics could break the Elliptic Curve Digital Signature Algorithm (ECDSA) — the scheme Bitcoin and Ethereum use to sign transactions — before quantum computers ever get the chance.

The exposure mechanism is well understood. An address is a hash of the public key, which keeps the key concealed until the first signature reveals it on-chain. If ECDSA were broken, an attacker could therefore derive the private key from any public key that had been exposed in this way.

In March 2026, Drake co-authored a Google Quantum AI paper on quantum attacks against elliptic curve cryptography. He published his call to action on X in October 2026, one day after OpenAI released 722 AI-generated mathematics manuscripts. Drake defines "breaking" as recovering a private key in roughly one week on hardware that is available today, such as a large GPU cluster.

How Bunker Mode Is Meant to Protect Funds

Bunker Mode targets a quirk of ECDSA: the public key only becomes visible at the moment of signing. That means only addresses that have already signed a transaction would be exposed. Drake therefore recommends moving the remaining balance to a fresh address after every signature, if necessary from the same seed phrase. Large and experienced holders should go first, and the move requires neither new cryptography nor new wallets.

At the same time, Drake urges calm. A rushed migration would do more harm than good, which is why he speaks of planning rather than haste. He specifically calls on Binance, Bitbank, Robinhood, Bitfinex and Tether to harden their cold storage. Signers that entire systems rely on — oracles and the security councils of layer-2 networks, for example — should additionally rotate their ECDSA keys for each signed message. As an alternative or addition, he proposes multi-signature setups built on hash-based schemes such as SPHINCS. Project11's "risq list" already tracks exposed Bitcoin public keys and shows which holdings have revealed theirs.

For smaller holders, Drake points to what he calls the "Satoshi's shield" effect. By his account, around 20,000 exposed addresses belonging to Bitcoin creator Satoshi Nakamoto hold 50 BTC each on-chain, and attackers would likely target them first. Wallets holding less than 50 BTC would thus enjoy partial protection. The address count, however, comes from Drake himself, and no independent verification exists.

Why Drake Sees AI Mathematics as the Nearer Risk

OpenAI's release triggered the call. The company posted 722 mathematical manuscripts produced by an unreleased internal model online. They cover around 20 subfields, and some include formal proofs written in the Lean. No independent review of the results exists so far, although OpenAI plans to publish more Lean proofs and fund review programs.

Drake views the recent progress in AI mathematics as a warning shot. He notes that the n-log(n) bound for integer multiplication and the 3SUM conjecture have both fallen, and he adds the disproof of the Erdős unit distance conjecture in May. In his view, elliptic curves are especially vulnerable because they possess a rich algebraic structure — he names Schoof, Frobenius and pairings as the relevant keywords. Hash functions, by contrast, are designed to minimize algebraic structure. It is therefore reasonable, he writes, to prepare for the possibility of ECDSA breaking before Q-Day. In the worst case, he says, that could happen within months rather than years.

Furthermore, citing Ewin Tang, Drake speculates that an efficient quantum algorithm could be followed by a classical equivalent. One possibility, he says, would be a classical version of Shor's algorithm that breaks elliptic curves and RSA at once. He describes the threat with the term "superintelligence," but that wording is his own and not an established finding. As a result, this remains a scenario without a demonstrated attack.

Quantum Risk and AI Risk Are Two Different Scenarios

The Google Quantum AI paper from March 2026 shows how precisely researchers can now quantify the quantum threat. Besides Drake, the co-authors include researchers from the Ethereum Foundation and Stanford. The paper describes two circuits for Shor's algorithm that target the secp256k1 curve. The first requires fewer than 1,200 logical qubits and 90 million Toffoli gates; the second needs fewer than 1,450 logical qubits and 70 million Toffoli gates. A superconducting quantum computer with fewer than 500,000 physical qubits could run the attack in a few minutes — a roughly 20-fold reduction compared with earlier estimates. Google withheld the circuits themselves and instead published a zero-knowledge proof.

No quantum computer today, however, can carry out this attack. Google's Willow chip has 105 qubits, so the gap to a machine with 500,000 physical qubits remains large. Google is targeting 2029 for its own migration to post-quantum cryptography, and it recommends that blockchains make the switch, avoid reusing exposed addresses and consider options for abandoned coins. In March Drake estimated the chance of Q-Day — the day of a successful quantum attack — arriving by 2032 at 10% or more.

What stands out is the asymmetry between the two scenarios. The quantum risk has a known method but no suitable hardware yet. The AI scenario, on the other hand, lacks any known method — yet by Drake's definition, a breakthrough would run on existing GPU clusters. It follows that such a breakthrough would arrive without a hardware signal, unlike the quantum risk, whose progress shows up in qubit counts. That said, Drake applies his time frame of months rather than years explicitly to the worst case only. Tracking the two timelines therefore runs through external markers: qubit counts on the hardware side and, on the AI side, the Lean proof releases and review programs OpenAI has said it plans.

Hash-Based Cryptography as a Way Out for Ethereum

As a way out, Drake wants to go all in on hash-based cryptography and avoid structured mathematical assumptions such as curves, lattices or isogenies. In his view, a proven hash function from the SHA or BLAKE family would provide plausible "post-AI" security. Ethereum's roadmap on strawmap.org already relies on hash-based schemes with end-to-end formal verification, but Drake wants its timelines reviewed and accelerated — a course he calls "maximum defensive acceleration."

Moreover, the Ethereum Foundation formed its own post-quantum team this year. In November, Drake is scheduled to speak to institutions in London as part of a Q&A hosted by Ethereum Institutional. For institutional holders, the discussion first brings cold storage hygiene to the fore, along with the question of which of their addresses have already exposed a public key. Ultimately, Drake's message is to plan calmly rather than migrate in panic.