THE QUANTUM INTELLIGENCER

This week, Justin Drake of the Ethereum Foundation advised the blockchain industry to prepare for a contingency that has long stood in the shadow of the quantum question: artificial intelligence, not a quantum computer, may be the first instrument to undo the elliptic curve signatures on which Bitcoin and Ethereum depend. He urges a controlled mass migration of digital assets to fresh wallet addresses, a posture he calls 'bunker mode.' The immediate occasion is the release on 6 October of 722 mathematical manuscripts generated by an unreleased OpenAI model, which Mr Drake describes as 'mathematical superintelligence'. His benchmark for a successful break is the recovery of a private key in about a week on readily available hardware such as a large GPU cluster, and he allows that a worst case might arrive within months, not years. None of this establishes that ECDSA has been broken. No public research indicates a break, and the OpenAI manuscripts reported no practical attacks on cryptographic systems. The mechanism, nevertheless, is worth the attention of prudent engineers. A wallet that has signed a transaction has placed its public key on-chain; an attacker who could invert that key would take every balance remaining at the address. Fresh addresses keep their public keys concealed behind a cryptographic hash. Vitalik Buterin has endorsed the general concern while advising against any scramble to move funds today, and he judges that there is a good chance lattice-based candidates could face serious hits within two years. The mathematics suggest preparation is warranted; they do not yet suggest flight. Several figures from the week give the precaution a mechanical scale. Europol, reporting this week, judged that blockchains themselves cannot be cracked by quantum computing because of the strength of their hash functions, and identified wallets as the primary point of exposure; the agency counted approximately 6.04 million bitcoin, about 30.2 per cent of total supply, with exposed public keys as of May. The same report concluded that pre-emptive migration is the only viable remedy, a conclusion that accords with Mr Drake's own. Mr Drake draws attention to what he calls 'Satoshi's shield': roughly 20,000 exposed addresses tied to Bitcoin's pseudonymous creator, each holding about 50 BTC, which he expects would be targeted first in any attack. His alarm was sharpened by an earlier OpenAI demonstration in which 10,000 autonomous agents worked in parallel and solved the Navier-Stokes equation in 88 hours. In July, Anthropic reported that its Claude Mythos Preview model improved the best-known attack on HAWK, a post-quantum signature candidate submitted to NIST, reducing its effective key strength by 50 per cent in 60 hours; HAWK has not been deployed in production. The Ethereum Foundation has already moved on the institutional side, establishing a dedicated post-quantum security team earlier this year and steering its draft roadmap toward hash-based cryptography and formal verification. None of these figures indicates that ECDSA has been broken; they describe, rather, the terrain a successful break would occupy. Let the record be precise about the standing of the documents in evidence. The 722 manuscripts were posted to a public repository by the laboratory that generated them; they have not been certified by the field, and they carried no practical attack on a cryptographic system. A manuscript in circulation is a claim awaiting verification, not a result to be entered in the ledgers. The same may be said of Anthropic's July report on HAWK, a post-quantum candidate not yet deployed in production; the laboratory described its own model improving a known attack, and the field has yet to confirm or refute the account. None of this diminishes the documents as warnings. It fixes their weight. The prudent engineer plans for the possibility of a break while withholding belief from the claim itself. A preprint is a bid for attention; a finding is what survives it. The week's warnings are best preserved in the speaker's own words. “It is now reasonable to brace for the possibility that ECDSA breaks before qday,” Mr Drake wrote, defining a successful break as the recovery of a private key in about a week on a large GPU cluster. The appearance of the 722 manuscripts, he continued, had been “humbling for human mathematical intuition,” with “long-held, unquestioned hypotheses” fallen. His counsel on remedy was equally measured. “A rushed migration would do more harm than good,” he cautioned, recommending that large and sophisticated holders move first and smaller balances follow. He said he would be “pushing for maximum defensive acceleration” on the Ethereum Foundation's post-quantum roadmap. Vitalik Buterin, the Ethereum co-founder, replied in a quieter key. “I don't recommend anyone scramble to move their funds to new wallets today,” he wrote, while allowing a “good chance” that lattice-based systems face “serious hits” within two years. The two statements sit comfortably together: alarm over the mechanism, sobriety about the response. Neither claims a break, and both fix the weight of the precaution. The prudent engineer will want the exact wording preserved in the archive, because the distinction between bracing for a possibility and scrambling today is the entire argument. Let the ledger state plainly what the week does not establish. No private key has been recovered from a public key, no signature scheme has been inverted in practice, and no manuscript in the OpenAI release reported an attack on a deployed system. The Navier-Stokes exercise demonstrated an interesting computational performance, not a cryptanalytic capability, and the July result on HAWK reduced the effective strength of a candidate not yet in production, which is not the same as breaking it. Mr Drake's 'bunker mode' is therefore not a report of an event but a discipline adopted in advance of one. It establishes a contingency, an inventory of exposure, and a sequence of migration. It does not establish that any address has been drained, any key found, or any timeline fixed. That is the difference between a precaution and a casualty list. Let the scope of each demonstration be marked, since scope is where these warnings lose or keep their force. The 722 manuscripts are numerous but narrow in kind: they range over algebra, theoretical computer science, and mathematical logic, and none reported an attack on a deployed signature scheme. The earlier Navier-Stokes exercise is likewise a single demonstration, striking for its speed of 88 hours and for the parallel labour of 10,000 agents, but it is not a general method for the equation, still less a method for inverting elliptic curves. The Anthropic report on HAWK is narrower still: one signature candidate, not yet in production, measured by the laboratory that trained the model, which reports a halving of effective key strength in 60 hours. To call these results narrow is not to dismiss them. It is to say what they cover and what they do not: a body of mathematical manuscripts, a single computational exercise, and one attack improved against one candidate. Each is a signal, and the prudent engineer will not mistake a signal for a map. —Ada H. Pemberley Dispatch from The Prepared E0