Three separate events in nine days have forced the blockchain industry to confront its cryptographic foundations. On October 6, OpenAI disclosed 722 mathematical research results generated by an internal AI model, prompting Ethereum Foundation researcher Justin Drake to call for "bunker mode" — a...
"It is now reasonable to prepare for ECDSA breaking before Q-Day — in the worst case in months not years." — Justin Drake, Ethereum Foundation Researcher
Three separate events in nine days have forced the blockchain industry to confront its cryptographic foundations. On October 6, OpenAI disclosed 722 mathematical research results generated by an internal AI model, prompting Ethereum Foundation researcher Justin Drake to call for "bunker mode" — a controlled migration of funds to addresses with unexposed public keys. On October 13, Coinbase published a paper identifying 6.9 million BTC ($575 billion) sitting behind exposed public keys vulnerable to a future quantum or AI-assisted attack. On October 15, Starknet opened a seven-day governance poll on whether to abandon its Ethereum Layer 2 status entirely and pursue an independent quantum-resistant Layer 1 by 2027 — two years ahead of Ethereum's own target.
The convergence is not coincidental. Google's Quantum AI team published findings in March 2026 showing that breaking Bitcoin wallet cryptography could require fewer than 20 times the resources previously estimated, and moved its internal post-quantum migration deadline to 2029. The U.S. National Institute of Standards and Technology (NIST) anticipates deprecating ECDSA by 2030 and disallowing it by 2035. The question facing every blockchain protocol is no longer whether to migrate but how fast — and whether AI-driven mathematical discovery could compress the timeline further.
October 6–7: OpenAI's math dump. OpenAI disclosed that an internal AI model had generated 722 mathematical research reports covering 372 sets of results across approximately 4,000 unresolved problems. Computer scientist Scott Aaronson stated on October 7 that AI companies had "started, gingerly and discreetly" testing whether their newest models could probe the mathematical foundations of public-key cryptography. Justin Drake responded the same day, urging the crypto industry to "calmly begin planning for bunker mode" — moving assets to addresses that have never broadcast a transaction signature.
October 13: Coinbase's exposure audit. Coinbase, custodian of approximately 5% of all existing BTC, published a paper quantifying the quantum attack surface. The exchange identified 6.9 million BTC in addresses with exposed public keys — wallets that have previously signed and broadcast a transaction, making their ECDSA public keys visible on-chain. At current prices, this represents roughly $575 billion in value at theoretical risk. Coinbase proposed BIP-360 (Pay-to-Merkle-Root) and P2TRv2 as candidate output designs for a post-quantum transition, noting the upgrade "could take years" of testing and coordination.
October 15: Starknet's secession poll. The Starknet community launched a non-binding Snapshot vote on whether to research a transition from Ethereum Layer 2 to an independent Layer 1 blockchain, citing quantum vulnerability in Ethereum's underlying cryptographic stack. Within 24 hours, 293 votes had been cast representing 179.8 million STRK in voting power, with 99.9% backing the "Yes" option. The poll runs through October 22.
The vulnerability is structural. Bitcoin and Ethereum rely on the Elliptic Curve Digital Signature Algorithm (ECDSA) and related schemes (Schnorr signatures, BLS signatures) for transaction authorization and consensus. A sufficiently powerful quantum computer — or an AI model capable of discovering new mathematical shortcuts — could derive private keys from public keys.
The scope of exposure differs by chain:
Bitcoin: Coinbase's analysis identified 6.9 million BTC (~32.8% of the 21 million maximum supply) behind exposed public keys. These are addresses that have signed at least one outbound transaction, exposing their public key to the network. Addresses that have only received BTC and never sent a transaction keep their public keys hidden behind a hash, offering a layer of protection.
Ethereum: The consensus layer uses BLS signatures to aggregate votes from hundreds of thousands of validators. KZG commitments, which underpin Ethereum's data availability layer, rely on elliptic curve pairings that are similarly vulnerable. The attack surface extends beyond user wallets to the protocol's consensus mechanism itself.
Broader DeFi: Smart contracts with immutable signing logic cannot be upgraded without redeployment. Protocols holding assets in contracts with fixed ECDSA verification are structurally unable to migrate without user action.
Google's Quantum AI team estimated in a March 2026 whitepaper that breaking Bitcoin's cryptography could require 20 times fewer quantum resources than previous estimates suggested. Google subsequently accelerated its own internal post-quantum migration deadline to 2029.
StarkWare CEO Eli Ben-Sasson framed the L1 proposal as a timing problem. As a Layer 2, Starknet can only be as quantum-safe as Ethereum — its settlement layer. Ethereum's quantum-readiness roadmap targets 2029 for initial upgrades, with full user migration extending years beyond that. Starknet's stated goal is to achieve full quantum resistance by 2027.
The proposal identifies specific Ethereum-linked dependencies that remain quantum-vulnerable outside Starknet's direct control. By becoming an independent L1, Starknet could replace those components with STARK-based cryptography — which relies on hash functions rather than elliptic curves, and is already considered resistant to known quantum algorithms.
The market responded. STRK rallied approximately 80% in the week following the October 8 announcement, reaching $0.126 — its highest level since December 2025. Trading volume hit approximately $720 million in 24 hours against a market capitalization of roughly $890 million. On October 16, STRK added another 15%.
The vote itself is non-binding. A "Yes" outcome authorizes further research only. Any actual transition would require a separate governance process. STRK would remain the native token, and Ethereum bridges would stay open regardless of the vote outcome.
Bitcoin developers, led by researcher Christine Kim, published a post-quantum security roadmap with a December 2029 completion target — aligning with Google's timeline. The plan includes four components:
BIP-360 (Pay-to-Merkle-Root): A new output type that could accommodate post-quantum signature schemes without requiring a complete protocol redesign. Coinbase identified this as the most promising near-term approach.
SHRINCS: A scheme to compress post-quantum signatures, addressing the significant size increase that hash-based and lattice-based signatures introduce. Current post-quantum signature candidates produce signatures 10-100x larger than ECDSA.
Lifeboat: A contingency mechanism to protect funds if ECDSA is broken before the migration is complete.
Dropkick: A protocol-level mechanism to facilitate migration of existing funds to quantum-safe addresses.
The challenge is Bitcoin's consensus model. Any change to transaction validation rules requires a soft fork, which historically takes years of community debate. The SegWit upgrade (2017) and Taproot upgrade (2021) each took multiple years from proposal to activation.
Ethereum's quantum defense strategy is embedded in "The Splurge" — the final phase of the protocol's multi-year upgrade roadmap. Vitalik Buterin has described the approach as a "Ship of Theseus" defense: gradually replacing individual cryptographic components with quantum-safe alternatives while the overall system continues operating.
Key elements include:
Account Abstraction: Enables flexible verification routines for accounts, allowing users to opt into post-quantum signature schemes for their wallets without a protocol-level hard fork. Buterin has cited "switching to quantum-resistant cryptography and rotating out old keys" as explicit motivation for account abstraction.
BLS-to-STARK Migration: The consensus layer's BLS signatures and KZG commitments would need replacement with STARK-based or lattice-based alternatives. Research is ongoing; both approaches face efficiency challenges at Ethereum's validator scale (currently over 900,000 validators).
Timeline: Ethereum mainnet will not have native post-quantum signature support until at least 2028, according to updated roadmap details. Full user migration would extend years beyond initial deployment. NIST anticipates deprecating ECDSA by 2030 and disallowing it by 2035.
Buterin has estimated a 20% probability of a quantum threat emerging before 2030, while noting that quantum computers cannot yet "handle meaningful calculations" that would pose a genuine risk.
On October 15, Buterin pivoted focus toward zkEVM security, declaring the "speed race" for zero-knowledge proofs "definitively won" and identifying three security priorities: mathematical accuracy of proofs, predictable proving costs, and cryptographic reliability of underlying proof systems. The timing suggests the Ethereum leadership views the quantum and AI threats as reasons to accelerate formal verification of critical infrastructure.
The OpenAI disclosure introduced an element that had not featured in prior quantum-threat analyses: the possibility that AI-driven mathematical discovery could find weaknesses in cryptographic assumptions before quantum hardware matures.
Matthew Green, a cryptographer at Johns Hopkins University, estimated a 15% probability that existing public-key encryption algorithms could lose confidence due to AI-discovered vulnerabilities. This is a minority view but not a fringe one — Green is a widely cited authority in applied cryptography.
The opposing position comes from Yehuda Lindell, a professor at Bar-Ilan University and head of cryptography at Coinbase, who stated there is "no evidence whatsoever" that the mathematical assumptions underpinning elliptic curve cryptography have weakened. Lindell's argument is that solving hard mathematical problems and breaking specific cryptographic constructions are distinct challenges.
Buterin endorsed the concern in principle but cautioned against rushed action, extending the warning to include lattice-based cryptography — the same class of algorithms that NIST has standardized as quantum-resistant replacements. If AI could threaten elliptic curve assumptions, it could potentially threaten lattice assumptions as well.
No AI model has demonstrated the ability to break any widely used cryptographic scheme. The concern is anticipatory, not empirical.
The blockchain industry's response is split along a clear line:
Prepare now, migrate gradually: This camp includes Coinbase (proposing BIP-360), Justin Drake (calling for bunker mode), and StarkWare (pursuing L1 independence). Their argument is that consensus-level changes to Bitcoin and Ethereum take years to implement, and the window for orderly migration may be shorter than assumed.
No evidence of imminent threat: This camp includes Coinbase's own head of cryptography Yehuda Lindell, and multiple academic cryptographers. Their argument is that no quantum computer or AI model has demonstrated practical capability against deployed cryptographic systems, and that premature migration carries its own risks — including bugs in new, less-tested post-quantum schemes.
The positions are not mutually exclusive. Even those who see no imminent threat generally support beginning research and standardization work. The disagreement is over urgency and resource allocation, not direction.
The blockchain industry's cryptographic foundations were designed in an era when quantum computing was decades away and AI could not solve graduate-level mathematics. Both assumptions are now under revision. Google's 2029 internal migration deadline, NIST's 2030 deprecation timeline, and OpenAI's 722 mathematical results have compressed the planning horizon from "someday" to "this decade."
The response is fragmenting. Starknet is attempting to move first by abandoning Ethereum's cryptographic dependency. Bitcoin developers have published a roadmap but face the protocol's inherent resistance to rapid change. Ethereum is pursuing a gradual replacement strategy that depends on components (account abstraction, STARK-based commitments) still under active development.
The economic stakes are quantifiable: $575 billion in Bitcoin alone behind exposed keys, plus an unquantified but substantial amount in Ethereum validator signatures, DeFi smart contracts, and cross-chain bridges. The timeline is not. Whether the threat arrives in 2029, 2035, or later remains a function of physics and mathematics that no governance vote can accelerate or delay.