Ethereum co-founder Vitalik Buterin warned on Wednesday that AI-driven mathematics could erode lattice cryptography, the leading post-quantum replacement for today's signature schemes, within two years — though he cautioned holders against rushing funds into new wallets.

Writing on X, Buterin said most quantum-readiness planning assumes elliptic curves will break while hashes and lattices endure. "But there is a good chance that the concrete security of lattices will take serious hits from the next two years of AI math," he wrote in a post on X.

He named ML-DSA, fully homomorphic encryption and lattices as the key new risk areas, and said the same pressure could cause ECDSA — the signature scheme behind Bitcoin and Ethereum wallets — to fall sooner than expected.

Lattice keys may need to grow tenfold

Breaking RSA keys, after decades of human labor, has now become cheaper, Buterin noted, asking whether bots will soon find similar shortcuts against curves and lattices. If AI delivers 50 years of math in two, lattices would need much larger keys for the same safety; his rule of thumb for long-term security is to multiply key sizes by a factor of 10.

Ethereum's lean roadmap has been hash-only for the past year, with signatures on WOTS or SPHINCS- and no ML-DSA or Falcon. The size gap is significant: a secp256k1 ECDSA signature is about 64 bytes, while NIST's finalized ML-DSA-87 signature is around 4,627 bytes, according to Cryptopolitan. Since signatures are stored on-chain with every transaction, that gap is a real block-space cost for any network adopting the heavier scheme — one reason larger post-quantum signatures remain a hard tradeoff.

Drake's "bunker mode" call followed OpenAI's 722 manuscripts

Buterin was replying to Ethereum Foundation researcher Justin Drake, who on Wednesday called on the industry to "calmly begin planning for 'bunker mode,'" according to Cryptopolitan.

Drake said ECDSA break before q-day, the day quantum computers crack public-key cryptography — in the worst case, months rather than years. His plan is to move funds to addresses that have never signed a transaction, starting with the largest holders, since such addresses conceal the public key behind a hash until the first signature. That concealment is the crux: breaking ECDSA starts from the public key, so addresses that have only ever revealed a hash put nothing on display for an attacker.

Buterin backed fresh addresses only where switching is easy. "I don't recommend anyone scramble to move their funds to new wallets today," he wrote, adding that he has lost more money in failed migrations than in all hacks combined. He also said privacy protocols should keep encrypted notes off the chain and send them via a third party, and that off-chain confirmations help multisig wallets keep signer signatures out of public view.

Drake tied his warning to OpenAI's release on Tuesday of 722 manuscripts from an unreleased internal model, grouped into 372 families, with most proofs written in the Lean language so a computer can verify them.

In July, Anthropic said its Claude Mythos Preview model cut the key strength of HAWK, a post-quantum signature candidate submitted to NIST, by 50% in 60 hours, adding that the outcome does not bear on live systems because HAWK was never deployed. The question both episodes leave open is whether AI-assisted cryptanalysis extends from candidates and unreleased models to the standardized schemes that would secure live funds.

Cryptopolitan reports that, as of May 2026, Europol cited an on-chain count of 6.04 million BTC, about 30.2% of the supply, with visible public keys — the exact exposure that never-signed addresses are designed to shield.