Crypto security debates have taken an unusual turn: instead of focusing on hacks, scams, or exchange failures, leading researchers are weighing a scenario in which attackers could derive private keys from public keys—using accelerating advances in AI to find mathematical weaknesses faster than human cryptographers.
Ethereum researcher Justin Drake says the industry should prepare for “bunker mode” planning, arguing it may be reasonable to brace for elliptic-curve cryptography (including ECDSA) breaking on a timeline measured in months rather than years. While some experts see the warning as prudent and “humbling,” others dispute the premise, emphasizing that no credible, published attacks against ECDSA have emerged and warning that panic-driven migrations may create new risks.
Key takeaways
- Justin Drake is urging “bunker mode” planning, warning that AI could speed discovery of classical (not quantum) attacks that break elliptic-curve cryptography such as ECDSA.
- Critics point to a lack of credible, published advances against ECDSA and argue the industry has no demonstrated, working break—so rushing address migrations could do more harm than good.
- Hardware-wallet and account-systems details matter: exposed extended public keys (xpubs) or wallet infrastructure may mean “fresh addresses” won’t fully protect funds.
- Some ecosystems are already working on post-quantum and alternative signing approaches, but timelines are uncertain and emergency hard-fork or recovery plans remain proposals.
- Even if mitigation steps exist, they won’t fix every related component (consensus, data commitments, infrastructure signatures), and Bitcoin address practices differ by script type.
Drake’s “bunker mode” warning and the cryptography it targets
Drake’s concern is broader than the far-off threat of quantum computers. In a post on X, he argued that AI could help uncover mathematical attacks that don’t require quantum hardware—potentially undermining the elliptic-curve cryptography used widely across blockchains.
“IMO it is now reasonable to brace for the possibility that ECDSA [Elliptic Curve Digital Signature Algorithm] breaks before Qday, in the worst case in months not years.”
Drake also suggests mitigation planning focused on moving assets to new addresses whose corresponding public keys have not been exposed, limiting what an attacker could exploit. The core assumption behind this approach is that if elliptic-curve schemes become practically breakable, the attacker could use information available from public keys to recover private keys.
Pushback: no evidence of ECDSA being weakened, and “rushing” can backfire
Not everyone sees cause for panic. Cryptography professor Matthew Green weighed in on the stakes, saying he believes public key cryptography could be lost—an assessment that amplified attention around Drake’s warning.
However, Coinbase’s chief of cryptography, Yehuda Lindell, said he is not aware of any evidence that the long-standing mathematical assumptions behind elliptic-curve cryptography have been weakened. Another prominent critique came from Lucien Bourdon, a Bitcoin analyst at hardware wallet Trezor, who told Cointelegraph that there are no credible published advances against the mathematics behind ECDSA, “with AI or anything else.”
Bourdon further cautioned against treating AI-generated math papers as proof of imminent breaks, arguing that even if such work exists, it does not necessarily translate into real attacks against ECDSA.
Drake’s stance also acknowledges uncertainty and frames his timeline as a worst-case scenario. Still, critics say the debate should not be interpreted as a signal to migrate funds immediately—especially because fast, high-stress actions can make users easier targets for scams.
Bourdon’s warning centered on the practical risks of a rushed response: people can make mistakes when hurried, and fraudsters often exploit urgent narratives about “imminent” breakage to reach victims.
Why “moving to fresh addresses” may not solve the underlying problem
Even if exposed public keys are part of the threat model, address rotation alone may not be enough. Zach Herbert, CEO and cofounder of hardware wallet FoundationHQ, argued that extended public keys (xpubs) can undercut the “fresh address” idea. If an xpub has already been shared with a wallet app or third party, they may already have the information needed to derive the public keys you intended to hide.
In that situation, an attacker might not need to observe new receiving addresses onchain to compromise them; the shared xpub could enable derivation of the relevant public keys and, potentially, the corresponding private keys.
Herbert also emphasized that exposure can occur through wallet architecture and account management, not just through addresses on a single chain transaction history. As a result, “bunker mode” planning may involve more than swapping addresses—potentially requiring updates to how wallets manage keys and how devices are operated.
Eli Ben-Sasson, cofounder and CEO of StarkWare, also pushed back on the idea that the industry’s response would be solved by moving coins. He told Cointelegraph that if cryptography breaks, the changes likely extend beyond wallet signatures. On Ethereum, that could include infrastructure-level signatures, consensus mechanisms, and the Kate-Zaverucha-Goldberg (KZG) polynomial commitment scheme used for data in blobs.
Ben-Sasson added that network-level effects could be severe, suggesting gas costs might rise dramatically if much of the functionality depends on cryptographic primitives that fail.
Bitcoin illustrates how mitigations can vary by design. Some Bitcoin address types conceal full public keys behind cryptographic hashes until spending. Taproot, by contrast, exposes a public key directly onchain. Bourdon pointed out that common SegWit addresses, beginning with bc1q, keep public keys hidden until spending, and that wallets such as Trezor generate fresh receiving addresses to limit address reuse.
Still, the discussion includes an uncomfortable detail for Bitcoin users: whenever coins are spent, the public key becomes exposed in the mempool, potentially giving attackers a window of opportunity for any classical attack against the signature scheme.
Post-quantum efforts differ by chain—and “recovery plans” remain proposals
While the debate rages over urgency and feasibility, some networks are already moving toward quantum-resistant approaches—though the designs and scope vary.
On NEAR Protocol, users can add a quantum-safe FIPS-204 key to an existing mainnet account in a single transaction without moving assets, according to NEAR’s published quantum-safe roadmap. Wallet support such as Meteor is also described as supporting quantum-safe signing, with the approach relying on lattice-based cryptography. Ethereum creator Vitalik Buterin has raised concerns that lattice-based cryptography may also face vulnerabilities, keeping the long-term picture complex.
Ethereum is working on a broader post-quantum roadmap involving hash-based signatures and zero-knowledge proof aggregation. The network also has an emergency hard fork and recovery concept mapped out on paper. In March 2024, Vitalik Buterin outlined a potential hard fork strategy centered on rolling back blocks following mass theft, disabling conventional wallet transactions, and enabling users to reclaim funds using zero-knowledge proofs of a seed phrase—though Bitwise Europe senior research associate Max Shannon described it as having no set timeline and framed it as a proposal rather than an imminent deployment.
Starknet’s account abstraction architecture is another contrast. Ben-Sasson argued that the core idea of account abstraction means signature schemes can be swapped without migrating funds to a new address, though other components still need attention—especially parts of the network’s state tree and the way Ethereum underwrites security.
On Solana, address migration may not be a meaningful response if public keys are exposed by default. Solana Foundation technology vice president Jacob Creech said Solana users would not need “bunker mode” if its signature scheme were to become breakable. He described a potential network upgrade that would allow users to prove ownership of their secret seed via a hash-based proof and migrate to a safer signature scheme, noting that a working proof of concept exists even if the upgrade itself has not been deployed.
Is the threat real enough to act on now?
Bitwise’s Max Shannon said he is not treating the theoretical risk as an immediate concern, but believes it is still worth being prudent about over time. Herbert similarly said that while discussing fresh addresses and xpub exposure may be useful as a thought experiment, those steps do not amount to a practical, complete plan for a cryptographic break.
There are also operational limitations: some users have old devices, complex multisignature setups, or Bitcoin holdings that haven’t been touched in years. In those cases, a software update alone will not automatically protect funds.
Bourdon also pointed to a more pointed critique: Drake’s warning and his discussion of Ethereum’s roadmap appear intertwined, and Bourdon suggested the message could function as a marketing push for roadmap priorities. Even if that interpretation is debated, it reinforces the core issue for readers: without concrete, publicly demonstrated attacks, the right approach is cautious planning—not impulsive migrations.
Where the crypto industry may still agree is on what comes next: if cryptographic primitives ever fail in practice, the industry will need a coordinated response across wallets, protocols, and infrastructure. Address changes could be the easiest part—if they’re relevant at all—while deeper system migrations may prove far more difficult.
For now, the most important watch items are whether researchers move from theoretical risk toward concrete, reproducible attacks, and whether major chains and wallet providers operationalize post-quantum options beyond roadmaps and proposals.
Be the first to comment