Bunker Mode: Can AI Break Elliptic Curve Cryptography?

Every route to breaking Bitcoin's elliptic curve cryptography (ECC) that this series on Bitcoin’s quantum risk has followed runs through a cryptographically relevant quantum computer (CRQC), and the window for such a machine opens around the end of this decade. Until Bitcoin's migration is complete, the main protection holders can practice is keeping their public keys hidden, since an attacker needs to see a key to target it. 

On October 7, Ethereum Foundation researcher Justin Drake argued that AI-driven mathematics could break the same cryptography sooner, with no quantum computer required, and urged holders to hide their keys with far greater urgency. Whether that urgency is justified depends on his reading of recent AI results, and on what moving funds would achieve.

Drake based his argument on OpenAI's groundbreaking release of more than 700 mathematics manuscripts, some proposing answers to long-standing problems that had attracted sustained interest from mathematicians. He infers that the assumption protecting ECC, that a private key cannot in practice be derived from its public key, could be challenged by new mathematical results enabled by AI-assisted research. He considers elliptic curves particularly exposed because their rich algebraic structure gives an attacker more to work with than hash functions, which are designed to have as little structure as possible. 

In Drake’s risk scenario, a break would let an attacker recover a private key from its public key in about a week on existing hardware, possibly within months in his worst case. Because that attack needs a visible key, Drake called for “bunker mode,” a controlled migration of funds to addresses whose public keys remain hidden behind a hash, with any remaining balance moved to a fresh address after each spend. Drake maintains this is his personal opinion and tells holders not to rush or panic.

The cryptographers who responded to Drake’s statement mostly accept that AI is disrupting mathematics, but dispute his inference. Yehuda Lindell wrote that AI proving hard theorems "does not indicate in any way that problems assumed to be hard are not." JP Aumasson added that if the mathematical problem behind ECC is hard, no efficient algorithm exists for any AI to discover.  

That hardness remains unproven, a point Daniel J. Bernstein has long made, and the OpenAI results do not settle it either way.  

There is no doubt that AI can accelerate attacks on cryptography. In July, Anthropic's Claude Mythos Preview found a structural weakness in HAWK, a recent lattice-based signature scheme, prompting its withdrawal from NIST’s post-quantum signature evaluation. More recently, within a week of China publishing its next-generation cryptography candidates, AI-assisted researchers found several critical vulnerabilities, including key recovery.  

As Drake notes, none of the OpenAI manuscripts concerns cryptography. In a release this broad, the omission is striking: it leaves open the possibility that results in cryptanalysis, perhaps a weakening rather than a full break, were kept back. We cannot know what has not been released, or expect complete visibility into such work. That uncertainty is a reason for the protocol work to prepare for the worst rather than wait for more explicit signs of an attack.  

The same logic predates this debate: some Bitcoin developers have already argued for post-quantum signatures even if CRQCs never arrive, since elliptic curve cryptography could be weakened by classical advances, with or without AI.

Even with Drake’s premise unproven, his recommendation can be judged on its own terms. In his one-week scenario, a public key revealed only when coins are spent, as with hashed address formats used once, gives the transaction ample time to finalize before an attacker could derive the private key. In a scenario worse than the one he envisions, an attack fast enough to recover the key before the transaction is confirmed would leave no protection at all.  

Where the protection works, it covers only the holder's own coins. Dankrad Feist argued that if exposed keys across the network were compromised at scale, the coins would go to zero whether or not they sat in bunker mode. That is his prediction, and it echoes my concern about confidence collapsing across the network. 

Moving funds also carries risks of its own. Vitalik Buterin wrote that he has lost more money in botched migrations than in hacks, and absent a demonstrated threat, I think unfamiliar transfer processes may create more risk for many holders than they remove.  

Keeping public keys unexposed remains sound practice, but I don’t expect this form of risk mitigation to be very effective at preserving the value of the network. Only a protocol upgrade and full migration can address that.

A protocol upgrade means choosing what replaces ECC. Drake wants to rely on hash-based cryptography alone, built on battle-tested hash functions, for the same reason he distrusts curves: hashes offer little structure to exploit. Buterin agreed that hashes should be preferred wherever they can be used and expects AI to weaken lattice-based cryptography, the main alternative family, while conceding that public-key encryption cannot be built from hashes alone. Charles Hoskinson replied that lattice parameters already account for decades of attacks, that hash functions such as MD5 and SHA-1 were broken in the past, and that abandoning lattices before any attack exists amounts to panic. 

Buterin's concession sets the limit of the hash-only view, since the wider world relies on lattices to set up encrypted connections. Signatures are a different matter, because hashes can do that job, and for Bitcoin, hash-based signatures were the leading candidate long ahead of this debate.  

Between HAWK's withdrawal and the broken hash functions Hoskinson cites, the record suggests that a design's age and scrutiny matter more than the family it belongs to. That is why cryptographic agility, the ability to replace an algorithm when its assessment changes, was sensible before the OpenAI release and remains so.

None of this changes what Bitcoin holders should do today. No attack on ECC has been shown, and keeping public keys hidden helps against Drake's scenario as much as against a quantum computer too slow to attack a transaction before it confirms. The debate does add weight to finishing the protocol upgrade, since the network as a whole has to change before every holder is protected, and to building it so its cryptography can be replaced again. Calm is warranted here, and so is impatience with the pace of the upgrade. We follow the debate on our Quantum Hub and track it each month in the Quantum Update.