A few days ago, Ethereum core researcher Justin Drake called on the industry to prepare to enter "bunker mode" and move assets to new addresses whose public keys have not yet been exposed. He worries that mathematical breakthroughs brought by AI could cause ECDSA, a widely used digital signature algorithm, to face practical attacks before the quantum threat materializes. In the worst case, holders may have only months.

When prices fall, people can still discuss valuations and cycles. Once the security of private keys is called into question, the issue becomes: can the money in a wallet still truly be considered one's own? This shakes the very foundation of cryptocurrency.

Whistleblowing

The scenario Drake fears is that AI finds mathematical methods humans have not yet discovered, allowing attackers to recover wallet private keys from public information using existing hardware. He describes "cracking" quite specifically, for example using large GPU clusters to recover a target private key in about a week.

The quantum threat requires corresponding hardware capabilities. The risk brought by AI points to algorithmic breakthroughs: if a mathematical problem once considered difficult to solve has a more effective method, the original computational cost will decline. Defenders were originally waiting for quantum computers, and now they also have to guard against changes in classical algorithms themselves.

Elliptic curves have rich mathematical structure, which is why Drake is especially worried about them. Could solutions humans have not yet found be discovered by more powerful AI? Can the security experience accumulated in the past still provide the same guarantees for the future?

Vitalik's response also takes this possibility seriously. He further extends the concern to lattice cryptography, including post-quantum schemes such as ML-DSA. These schemes also rely on specific mathematical problems being difficult to solve; if AI-accelerated research changes the solution methods, the security margins provided by existing parameters will also need to be reassessed.

Therefore, the label "quantum-resistant" is not enough to answer all AI risks. Vitalik prefers using hash-based constructions in applicable signatures and proofs to reduce dependence on complex mathematical structures. He also reminds that public-key encryption has harder-to-handle limitations and cannot directly follow this route.

There are also many people who oppose Drake's statement, with the main rebuttal being that Drake's claim of "months" is too alarmist.

NEAR founder Illia acknowledges that AI is challenging people's understanding of mathematical complexity, but has not yet seen a substantial change in the timeline for practical attacks on elliptic curves. He is especially worried that complex migration operations will expose holders to new risks, and advocates making cryptographic replacement a routine capability.

Cryptography researcher Sean Bowe criticized the gap between the intensity of the warning and the new evidence. Experts need to help non-expert holders deal with uncertainty; overly urgent language can leave people at a loss and also undermine the credibility of subsequent risk communication.

Public keys for 30% of BTC are already exposed

While it is still disputed when an attack might become feasible, the scale of assets that need to be addressed can already be measured.

Glassnode researcher Rafael put the figure at about 6.26 million BTC whose corresponding public keys are already visible on-chain, accounting for 31.2% of issued supply, up from 24.8% in early 2021.

To understand why this portion of BTC is exposed, it is necessary first to distinguish between public keys and private keys.

Private keys are used to generate the digital signatures that authorize transfers, while public keys allow the network to verify signatures. Public keys being public is inherently consistent with the design of cryptographic systems, and security depends on an attacker finding it difficult to derive the private key from the public key. If a sufficiently powerful quantum computer changes that, already-public public keys would become attack material.

Some BTC addresses initially show only a hash digest of the public key on-chain, temporarily not revealing the public key itself. But when the holder spends funds, the public key is revealed. If the money is then left under the control of the same key, or if funds continue to be received there, those balances correspond to an already-public public key.

This is the exposure caused by address reuse. According to Rafael's tally, this portion is about 4.33 million BTC. Moving funds to suitable new addresses whose public keys remain hidden behind hashes can reduce current long-term exposure.

Another roughly 1.94 million BTC is different: the public keys are directly exposed by the script type. Early P2PK recorded public keys directly on-chain, and Taproot outputs also expose public keys. Even if such funds have not yet been spent, the public keys are already visible. Handling them requires considering the structure used by the address, not just whether the address has been used.

Exchanges are a relatively large actionable group. Among tagged exchange holdings, about 1.79 million BTC have visible public keys, accounting for 57% of these holdings, up from 55% in May. Since the May report, the overall exposed stock has increased by about 222,000 BTC, while new BTC supply over the same period was only about 64,000 BTC.

Reducing exposure still cannot replace a complete cryptographic upgrade. Funds whose public keys are temporarily hidden will still face an attack window in the future when they are spent and the public keys are revealed. But these data at least show that part of the industry's defensive work can be done in advance, and its progress can be observed.

Some People Are Giving Up on Crypto Because of This

Such uncertainty has already caused some investors to lose interest.

Trader metavestor stated on Twitter that he has already sold most of his spot holdings. He does not want to suspect every time he sees new developments in AI mathematics research that he might suffer irreparable losses, nor does he want to see an ancient Bitcoin address transfer funds and wonder whether the private key has already been cracked.

He originally entered Crypto as a technological optimist, but now he is more willing to focus on AI and biotechnology. Continuing to hold Crypto makes him feel like he is shorting AI progress. Even if he misses the next bull market, he is willing to accept it; there are other assets available for trading.

"Banks also rely on cryptography" did not eliminate his concerns. In a follow-up explanation, he emphasized banks' security teams and defense capabilities, and also pinned hopes on recourse and government bailouts after major attacks. For on-chain assets, he lacks the same confidence.

An attack does not need to disable all cryptographic systems simultaneously. As long as the cost of recovering a certain address's private key is lower than the value of the assets that can be obtained, attackers have an incentive to try. Whether assets are easy to transfer away, whether attacks are easy to cash out, and whether losses can be recovered will all affect the distribution of risk.

However, there is a counterargument that BTC also faced existential risks in its early days, such as custody, adoption, and regulation, and investors' willingness to bear these risks is precisely part of the source of returns. The existence of risk alone cannot determine whether an asset is worth holding.

Counterarguers also do not agree that government bailouts can be regarded in advance as a guarantee. If trusted institutions generally come under greater attack pressure, the relative value of permissionless money still has room for reassessment. In the view of the counterarguers, Drake's warning will prompt the industry to take preventive measures more seriously, and this change may ultimately turn out to be a good thing.

Some are willing to bear risks that are still difficult to quantify, while others believe the energy cost of continuously monitoring them has already exceeded the expected returns.

However, from an individual deciding to exit to judging that the entire industry has no future, there is still a need to assess what defenders can do.

Rebuilding

Crypto already has some concrete measures to address threats.

Ethereum's EIP-8141 proposal attempts to make account verification programmable, allowing accounts to choose how to confirm transaction authorization and reducing binding to fixed signature algorithms. According to an introduction by Ethereum Foundation member binji, the subsequent roadmap also includes the goal of a minimally viable quantum-resistant L1.

The significance of this kind of cryptographic agility is to leave room for the system to switch verification methods. Long-term asset holding does not have to mean permanently relying on a single set of algorithms chosen today.

Solana's Jacob Creech introduced a recovery path based on secret seeds. Signing keys are derived from seeds, and he hopes legitimate holders can prove they know the seed through a hash proof, then migrate to a new signature scheme.

The NEAR account model described by Illia also emphasizes key management and rotation. According to his introduction, NEAR already supports ML-DSA and plans to add hash-based schemes. Combined with Vitalik's concerns about lattice cryptography, being able to continue adjusting authentication methods is inherently more valuable than merely promising that a certain algorithm is secure.

These paths do not yet guarantee that all funds can complete the upgrade in time. Wallets need to be compatible with new verification methods, institutions need to arrange custody migration, and holders need to preserve their assets during the process. Vitalik specifically warned that he personally lost more money in failed migrations than from hacker attacks. Defense needs to factor in these costs as well.

But AI capabilities will also enter the defensive side. binji mentioned that AI can accelerate cryptographic research and also assist formal verification, allowing implementations to undergo stricter scrutiny. Stronger tools can help find attack methods, but they can also help discover errors and test new schemes.

AI will also enhance impersonation, deception, and social engineering attacks. Even if cryptography is strong enough, people with key permissions will still be targeted. A system that can update its security foundation while reducing the impact of any single person or institution being compromised still has utility in the face of stronger AI.

This is also the reason for remaining relatively optimistic. Technological progress will simultaneously change attack capabilities, defense capabilities, and people's demand for trustworthy systems. One cannot simply fix the latter two and extrapolate attackers' progress all the way to the endgame.

Looking along these changes, cryptographic upgrades and custody migration will become important themes in 2027.

The sense of security in Crypto needs to be rebuilt. A system that can continuously update its security foundation and reduce the concentration of key permissions will only become more valuable in the AI era.

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia