Bitcoin, Ether Holders Urged to Enter ‘Bunker Mode’ Over AI Threats

Ethereum researcher Justin Drake has warned the crypto industry to begin preparing for “bunker mode,” arguing that artificial intelligence could potentially break the mathematical protections securing Bitcoin, Ether and tokens built on those networks in the worst-case scenario “in months, not years.”

Drake called on the blockchain industry Wednesday to begin planning for the possibility and encouraged major holders to gradually transfer their assets to new addresses.

Crypto wallets rely on a secret value known as a private key to authorize transactions. A corresponding public key allows the network to verify those signatures. While deriving a public key from a private key is straightforward, reversing that process is designed to require an impractical amount of computing power.

Drake’s concern is that sufficiently capable AI could discover a mathematical shortcut that would allow an attacker to recover private keys using conventional computers, eliminating the need for the quantum machines that the crypto industry has long been preparing against.

Such a breakthrough could potentially expose a significant portion of the crypto market. Millions of bitcoin are held at addresses where public keys are already visible onchain, according to previous CoinDesk reporting. On Ethereum, accounts that have previously sent transactions have exposed their public keys, while stablecoins and tokenized assets issued on the network ultimately rely on the same signature infrastructure.

No practical attack capable of breaking Bitcoin or Ethereum wallet keys has been demonstrated, and CoinDesk found no such attack in the research it reviewed.

AI Is Already Creating Crypto Security Concerns

Drake’s warning came shortly after OpenAI announced Tuesday that it had released 722 mathematical manuscripts generated by an unreleased AI model tested against roughly 4,000 research problems. The company said some of the results included proofs that could be checked computationally, while others had not yet been verified and could contain mistakes.

The manuscripts were produced by the model OpenAI said last month had solved the Navier–Stokes problem, one of the seven Millennium Prize Problems in mathematics. OpenAI said each result required an average amount of computing equivalent to about three hours of ChatGPT Pro reasoning.

Within 24 hours, an independent researcher repeated the computer verification of one result involving a new upper bound on how quickly computers can multiply large numerical grids. The problem has been studied by mathematicians since 1969, and the researcher confirmed that the result held.

Drake argued that the mathematics underlying Bitcoin and Ethereum wallet signatures, known as elliptic curves, contains structured patterns that sufficiently advanced AI could potentially learn to exploit. Hash functions work differently, transforming data into fixed-length digital fingerprints while being deliberately designed to minimize patterns that could be used to reverse the process.

AI-driven attacks against crypto infrastructure have already demonstrated financial consequences.

In December, Anthropic researchers showed that advanced AI models could produce functional exploits targeting simulated versions of real DeFi contracts. In late July, the volunteer Bitcoin Red Team used AI models to analyze 390 Bitcoin software projects in roughly 27 hours, identifying nearly 5,000 potential vulnerabilities, including 85 classified as critical.

On July 30, an attacker began exploiting a five-year-old firmware vulnerability in Coldcard hardware wallets, stealing at least 1,367 BTC. Hardware wallet maker Coinkite said it suspected AI may have played a role in discovering the flaw.

Shortly afterward, BTCPay Server confirmed that attackers had stolen funds from merchants’ Lightning nodes through a vulnerability first identified during an AI-assisted audit. On Aug. 27, Core Lightning developers issued an emergency warning after AI-generated bug reports helped uncover genuine vulnerabilities in the software.

Researchers have also used AI coding agents to optimize part of a calculation involved in a potential future quantum attack, as CoinDesk reported in September. That research still depended on quantum hardware and addressed only one component of the broader attack.

AI Timeline Could Arrive Before Quantum Threat

The timelines for the two threats currently differ significantly. The Ethereum Foundation has targeted December 2029 for transitioning the network to quantum-resistant cryptography.

Drake’s worst-case scenario, however, would see conventional computers capable of breaking wallet cryptography years before that deadline.

Quantum-Resistant Cryptography May Not Be Enough

Ethereum co-founder Vitalik Buterin agreed that the AI-related risk deserves attention but warned that some cryptographic replacements being considered could also face problems.

Several post-quantum systems rely on lattice-based cryptography, which is built around mathematical problems believed to be difficult for both conventional and quantum computers. The approach also forms the foundation of a digital-signature standard approved by the U.S. National Institute of Standards and Technology.

Buterin said on X that advances in AI-assisted mathematics over the next two years could significantly weaken the practical security of lattice-based systems. He argued that if AI manages to compress decades of mathematical progress into only a few years, that progress could potentially include major improvements in methods for attacking lattice cryptography.

Ethereum’s longer-term plans increasingly favor hash-based signatures, which rely on digital fingerprints designed to be difficult to reverse. Buterin believes these systems may offer fewer opportunities for unexpected mathematical shortcuts, although he acknowledged they could still face new forms of attack.

Drake advised sophisticated crypto holders to act first by moving funds to addresses whose public keys have never appeared onchain. Doing so could remove the public-key information that a potential attack would need as its starting point.

Buterin supported limiting public-key exposure where practical but cautioned users against rushing into large-scale migrations. Poorly executed transfers could create new risks and result in losses.

“I personally have lost more money in botched migrations than I have lost in all hacks combined,” Buterin wrote.

About The Author