Bunker Mode: The Race to Protect Crypto From AI and Quantum Computers

The Week Crypto’s Math Got Scary

For a decade, crypto’s doomsday scenario has had a name: Q-Day, the day a quantum computer becomes powerful enough to work out private keys from public ones. The comfort was that Q-Day looked years away, and everyone would see it coming.

Then, in the space of three days in October 2026, a different question took over crypto: what if the shortcut comes from an AI, not a quantum computer, and arrives with no warning at all?

1. October 6

   OpenAI publishes 722 mathematical manuscripts produced by an AI model it hasn’t released, with proofs for many of them checked by computer.¹

2. October 7

   Justin Drake, a researcher at the Ethereum Foundation, calls on the industry to plan for bunker mode.² The same day, Europol publishes two reports warning that exposed public keys are crypto’s weak point.³

3. October 8

   Coinbase’s head of cryptography calls Drake’s post “a really bad take.”⁴ Vitalik Buterin says there’s a “good chance” AI math will hurt some cryptography within two years.⁵ Glassnode counts more than 6 million BTC behind visible public keys,⁶ and bitcoin slips below $83,000.⁷

4. October 9

   Cardano founder Charles Hoskinson accuses Buterin of a hunch dressed up as a threat.⁸

Nothing was hacked that week. No coins were stolen. But one of the most respected researchers in crypto had said, in public, that the math holding up trillions of dollars might not last as long as everyone assumed. Here is what he actually said, why experts are split, and what you can do about it without panicking.

What Justin Drake Actually Said

Drake’s post opened like this:

“Today I call upon the blockchain industry to calmly begin planning for ‘bunker mode’. My personal recommendation is to set in motion a controlled mass migration of assets to fresh addresses, i.e. addresses whose pubkeys remain hidden behind a hash.”

His scenario is specific. “Broken” doesn’t mean a theoretical crack. It means someone can recover a private key from a public key in about a week on hardware money can buy, such as a large GPU cluster. He argued it’s reasonable to prepare for that happening to ECDSA before any quantum computer does it, “in the worst case in months not years.”⁹

He gave four reasons for taking it seriously:

1. AI math is moving fast. The trigger was OpenAI’s release the day before. Several long-standing conjectures have reportedly fallen to AI-assisted work.¹⁰
2. Elliptic curves have structure. The curves behind ECDSA are elegant algebraic objects, and structure is what attackers exploit. Hash functions are designed to have as little as possible.
3. Quantum ideas leak into classical ones. Fast quantum algorithms have, in the past, inspired fast ordinary ones. In 2018, Ewin Tang, then an 18-year-old student, found an ordinary algorithm that erased the exponential speedup promised by a celebrated quantum algorithm for making recommendations.¹¹
4. Not every result gets published. Drake pointed to how few cryptography results appeared among OpenAI’s 722, and raised the possibility that breakthroughs in this area are being held back. That part is speculation, and he presented it as such. There is precedent, though: in 2012, researchers found that Flame, spy software widely believed to have been built by a government, had forged a Microsoft certificate with a cryptographic attack nobody had published.¹²

His advice was aimed first at the biggest holders. Exchanges and custodians, starting with Binance, Bitbank, Robinhood, Bitfinex and Tether, should move the bulk of their funds to addresses that have never signed anything. If a bunker address ever signs, move the rest to a new one, which can come from the same seed phrase. Systems that sign constantly, such as price oracles and the security councils that control rollups, should switch to a fresh key after every signature or add a hash-based signature such as SPHINCS.

And he was emphatic about one thing: don’t panic. A rushed migration would do more harm than good. He even pointed out what some now call “Satoshi’s shield”: roughly 20,000 early Bitcoin addresses, each holding 50 BTC with its public key exposed, would be the first targets of any attacker. Wallets holding less than 50 BTC sit behind that queue.

In the long run, Drake wants crypto to run on hash-based cryptography only, rather than elliptic curves or lattices, and he wants Ethereum’s roadmap, which already heads that way, to speed up.

Why Your Public Key Is the Weak Spot

To see why “fresh addresses” help, you need the three-part chain behind every Bitcoin and Ethereum wallet.

Your private key is a huge random number. Your wallet turns it into a public key using elliptic curve multiplication, which is easy forwards and, as far as anyone knows, impossible backwards. Your address is a hash, a kind of fingerprint, of that public key.

Here’s the catch. Every time you sign something, your signature reveals your public key. On Ethereum, anyone can recover the public key from a signature; on Bitcoin, the public key is included when you spend. After your first transaction, your public key is on the blockchain forever.

Today that’s harmless. Going from a public key back to the private key is the elliptic curve discrete logarithm problem, and the best known method, an algorithm called Pollard’s rho, needs around 2¹²⁸ steps for Bitcoin’s curve.¹³ Even a vast fleet of computers would need far longer than the age of the universe. A “break” would mean someone finds a shortcut.

If that shortcut ever appears, every exposed public key becomes a target. An address that has only ever received funds is different: its public key is still hidden behind the hash. To steal from it, an attacker would have to break the hash too, and hash functions are built from completely different, deliberately structureless math. That is the whole idea of a bunker.

When does your address reveal its public key?

One more trap: reusing addresses. If an address has spent once and then receives more funds, the new funds sit behind a key that’s already public.

How Much Crypto Is Already Exposed?

The day after Drake’s post, on-chain analytics firm Glassnode put numbers on the problem. About 6.26 million BTC, or 31.2% of the supply, sits behind public keys that are already visible on-chain. The share has been creeping up for years, from 24.8% in early 2021, and it grew by another 222,000 BTC between May and October 2026.⁶

Glassnode’s research splits that exposure into two kinds, and the difference matters.¹⁴

• Structural exposure, about 1.9 million BTC: coins in output types that reveal the key by design. Most of it is in the earliest pay-to-public-key coins, including those often attributed to Satoshi Nakamoto, around 1.1 million BTC by one widely cited estimate.¹⁵
• Operational exposure, more than 4 million BTC: coins in addresses that were reused after they had already spent. This is the fixable kind. Moving the coins to fresh addresses removes it.

Exchanges hold about 1.79 million of the exposed coins, and the split between them is striking. About 10% of Coinbase’s bitcoin sits behind exposed keys, compared with 83% at Binance. Fidelity, which holds roughly 375,000 BTC, has 2% exposed, and the bitcoin held by the US, UK and El Salvador governments shows none. Glassnode stresses that this measures how addresses are used, not an immediate risk, and says it shouldn’t be used to judge any custodian.

Other counts land in the same range. Project Eleven, which tracks exposed bitcoin addresses, counted about 6.9 million BTC in February 2026,¹⁶ and a 2025 report by Chaincode Labs estimated that 20% to 50% of all bitcoin could be vulnerable, depending on the assumptions.¹⁷

Ethereum’s exposure is harder to count, because every Ethereum account that has ever sent a transaction has revealed its public key. A March 2026 paper from Google Quantum AI estimated that more than $100 billion is exposed in Ethereum’s 1,000 largest wallets and at least 70 major smart contracts controlled by admin keys alone.¹⁸ Long-term holdings in addresses that have only ever received are the exception.

Road One: Quantum Computers

The classic threat is Shor’s algorithm, published in 1994. On a large enough quantum computer, it works out a private key from a public key quickly. Elliptic curve keys are short compared with RSA keys, so they are among the first things such a machine could break.

What changed is the size of “large enough.” In 2022, researchers estimated it would take about 13 million physical qubits to crack a Bitcoin key in a day.¹⁹ In March 2026, a Google Quantum AI team, whose co-authors include Drake himself and Stanford cryptographer Dan Boneh, estimated that Bitcoin’s curve could be broken with fewer than 500,000 physical qubits, in minutes.²⁰

Google didn’t publish its circuits. In the name of responsible disclosure, it released a zero-knowledge proof that its numbers hold up, without revealing how.²⁰ About two months later, a French researcher published open circuits of similar cost anyway.²¹ Other designs trade speed for size: a team from Caltech and the startup Oratomic estimated that about 26,000 neutral atoms could do the job in a few days,²² and IonQ estimated that about 20,000 trapped-ion qubits could do it in about 26 days.²³

Nobody has a machine that can do it. Google’s Willow chip, unveiled in December 2024, has 105 qubits.²⁴ A Caltech team has held 6,100 atoms in a single array, but that showed it could keep qubits steady, not that it could compute with them.²⁵ Even the most advanced machines run only a few dozen error-corrected “logical” qubits, against the roughly 1,200 an attack would need. Europol’s October report said the timing of a code-breaking machine remains uncertain, and it did not claim that today’s quantum computers can break crypto.³

Forecasts vary. In the Global Risk Institute’s latest survey, experts rated a code-breaking quantum computer “quite possible (28-49%) within the next 10 years, and likely (51-70%) in the next 15.”²⁶ Project Eleven puts its baseline for Q-Day in 2033, with 2030 as an optimistic case and 2042 as a pessimistic one.²⁷ Google has set 2029 as the deadline for moving its own products to post-quantum cryptography.²⁸

Even the hype has been instructive. In April, a researcher won a 1 BTC prize for breaking a 15-bit elliptic curve key on IBM quantum hardware.²⁹ A 15-bit key has about 33,000 possible values; a Bitcoin key has about 10⁷⁷. Within days, other researchers showed that random guesses produced the same answer.³⁰ Real quantum computers can’t break real keys yet. The progress is on paper, in the estimates, and that is exactly why people are nervous.

The bunker’s blind spot: spending

Bunker mode protects coins at rest. It can’t fully protect the moment you spend them, because spending reveals the public key. Google’s team estimated that a fast quantum computer, prepared in advance, could derive a key roughly 9 to 12 minutes after it appears, giving it about a 41% chance of beating a Bitcoin transaction into a block.³¹

That’s a future problem for spending, not storage, and it’s why blockchains will eventually need new signature schemes rather than just careful habits. In Drake’s AI scenario, where recovering a key takes about a week, a transaction that confirms in minutes would be safe.

Europol also pointed out something the quantum and AI scenarios share: the threat is to exposed public keys, not to blockchains themselves. Hash functions, which secure mining and addresses, are comparatively resistant to quantum attacks. The best known quantum attack on a hash only gives a square-root speedup, which is nowhere near the collapse ECDSA would suffer.

Road Two: AI That Does Math

Drake’s twist is that you might not need a quantum computer at all. If an AI finds a better ordinary algorithm for the elliptic curve problem, the GPUs that already exist would be enough. Nobody would need to build a science-fiction AGI for that. It would be enough for an AI to get very good at one thing: finding shortcuts in math.

It would have to be quite a shortcut. Remember the 2¹²⁸ steps of the best known attack. By our rough estimate, a week on a million top-end GPUs adds up to around 2⁷⁰. Closing that gap takes a method hundreds of quadrillions of times faster than anything known today. That isn’t an optimization. It’s a new idea.

It has happened before

In 2022, two schemes that had reached the final rounds of the US government’s search for post-quantum standards collapsed, and neither attack needed a quantum computer. Cryptographer Ward Beullens broke Rainbow, a signature scheme, and summed up the result in his paper’s title: “Breaking Rainbow Takes a Weekend on a Laptop.”³² Months later, Wouter Castryck and Thomas Decru of KU Leuven broke SIKE, weeks after it had advanced to the competition’s fourth round. Their first version recovered a key in about an hour on a single processor core; the refined one takes about ten minutes. The key ingredient was a theorem published in 1997.³³

Those schemes were young, while the math behind Bitcoin’s curve has survived four decades of attacks. But cryptographers took the lesson to heart: one insight can turn a problem that would outlast the universe into an afternoon’s work.

What AI can do now

What’s new is who might find the next insight. AI models have moved from math competitions to math research remarkably quickly. In 2025, systems from Google DeepMind and OpenAI reached gold-medal level at the International Mathematical Olympiad.³⁴ In May 2026, an OpenAI model disproved a conjecture about distances between points that Paul Erdős posed in 1946. Mathematician Daniel Litt called it “the first example of a result produced autonomously by an AI that I find exciting in itself.”³⁵

Then came October 6. OpenAI’s 722 manuscripts, organized into 372 families of related results, were produced by an internal model and published on GitHub. OpenAI was careful: the results are at different stages of verification, only some have computer-checked proofs, and some may contain errors.¹ An independent audit of an earlier batch of OpenAI’s results found no confirmed substantive errors in the main theorems it examined, while noting that review depth varied.³⁶

One subject was missing. Cryptography was “extremely conspicuous by its absence” from the list, wrote Scott Aaronson, a computer scientist at the University of Texas at Austin. He added that he had heard AI companies are quietly testing whether their internal models can break important cryptographic protocols.³⁷ Matthew Green, a cryptographer at Johns Hopkins University, was blunter. Replying to a discussion about whether AI attacks might already exist unpublished, he wrote: “I think we might lose public key cryptography.”³⁸ He later stressed that he knew of no imminent break.³⁹

The closest public example so far is a modest one. In July, Anthropic reported that its Claude Mythos Preview model had found an overlooked symmetry in HAWK, a lattice-based signature scheme in the running for a future post-quantum standard. On a deliberately weakened challenge version, the new attack cut the work needed to recover a key from about 2⁶⁴ operations to about 2³⁸, a few hours on one server. The model also improved an attack on a reduced, seven-round version of AES. Neither result touched the full-strength schemes, and Anthropic said plainly that “neither of these results has a practical impact on today’s computer systems; no production software will have to change as a result.”⁴⁰

AI is working on the quantum road too. On ECDSA.fail, a public leaderboard run by Eigen Labs, humans and AI agents shrank the quantum circuit for one core step of the attack, adding two points on the curve, by 86%, measured in qubits times gates.⁴¹

That is the backdrop to Vitalik Buterin’s warning. His reference point is factoring, the math behind RSA encryption. Decades of progress, from naive methods to the general number field sieve, are the reason RSA keys today need thousands of bits while elliptic curve keys need 256. AI, he suggested, could bring “50 years of math in 2 years,” and he said there’s a “good chance” the security of lattice-based schemes, the leading post-quantum standards, “will take serious hits from the next two years of AI math,” with elliptic curves facing a similar risk.⁵

His conclusion: “Hash-based > lattice-based, in those situations where hash-based is possible at all.”⁵ His advice to holders was calmer: “I don’t recommend anyone scramble to move their funds to new wallets today,” he wrote, adding, “But we should take the risks to cryptography from AI-accelerated math seriously.”⁴²

The Backlash: Prudence or FUD?

Plenty of serious people think Drake got this wrong.

“I wasn’t going to comment since this is a really bad take IMO, but since it’s taken off I feel the need to. To my understanding, there is no evidence whatsoever pointing to a break of decades old hardness assumptions like elliptic curve cryptography.”

Yehuda Lindell, head of cryptography at Coinbase⁴

Lindell went further, calling the migration call “the very definition of FUD” and arguing there’s no evidence elliptic curves are weaker than hash functions. If anything, he noted, hash functions have historically been broken more often. He also said Coinbase is preparing to support hash-based signatures for a quantum era.⁴³

Others attacked the remedy rather than the premise. Dankrad Feist, a former Ethereum Foundation researcher, argued that if elliptic curves break in a way that exposes every public key, the coins would collapse in value anyway, so bunker mode “is not going to help you.” Helius CEO Mert Mumtaz called the post “unnecessarily performative.”⁴⁴

Dragonfly’s Haseeb Qureshi first called Drake’s warning “a very sober call.”⁴⁴ The next day he published an essay titled “Against Cryptographic Doomerism” that sharpened Feist’s point: “Hiding your coins in a bunker won’t save your blockchain.”⁴⁵ If stolen coins flood the market, everyone’s coins lose value. His alternative is a “cryptographic recovery mode” built into each chain: users register hash-based backup keys ahead of time, and the network can switch to them in an emergency.⁴⁶

Jameson Lopp, the Casa co-founder and one of Bitcoin’s most vocal advocates of quantum preparation, said the AI threat was being blown out of proportion, and that bugs in wallets and apps are a far more immediate risk.⁴⁷

Charles Hoskinson took aim at Buterin’s argument, calling the case against lattices “the GNFS story, a.k.a. a hunch about ‘structure’” and pointing out that known lattice attacks are already priced into today’s standards.⁸

So who’s right? Honestly, nobody knows, and that’s the point both sides are making in different ways. There is no evidence of a break today. There is also no proof that one is impossible, and the cost of being wrong is total. The fair reading of Drake’s post is not “the sky is falling.” It’s “an emergency exit is cheap to build, so build it before you need it.” The fair reading of his critics is “building it in a hurry is how people lose money.”

What Bitcoin and Ethereum Are Doing About It

Ethereum: a 2029 deadline

The Ethereum Foundation formed a dedicated post-quantum team in January 2026, led by Thomas Coratger, in an announcement made by Drake himself.⁴⁸ In March it launched pq.ethereum.org, a public hub for the plan, with a target of making Ethereum’s base layer quantum-resistant by December 2029.⁴⁹ The design leans on hash-based signatures, the direction Drake and Buterin both favor. For now, ethereum.org’s message to users is that their funds are safe today and that wallet software will guide them through any migration.⁵⁰

Ethereum also has an emergency plan on paper. In 2024, Buterin described how the network could hard-fork if quantum computers started stealing funds: roll the chain back to before the theft, stop ordinary transactions from exposed accounts, and let owners rescue their funds by proving, with a zero-knowledge proof, that they know the seed phrase behind their key.⁵¹ If anything like that ever happens, your seed phrase may be what proves the coins are yours, which is one more reason to keep it safe and offline.

Bitcoin: arguing over Satoshi’s coins

Bitcoin moves more slowly by design. In February 2026, developers merged BIP-360 into Bitcoin’s proposal repository as a draft. It describes a new kind of address, starting with bc1z, that works like Taproot without an exposed key, and it would be the landing spot for future post-quantum signatures.⁵² A second draft, BIP-361, co-authored by Jameson Lopp, goes further. A few years after activation, it would stop accepting today’s signatures entirely, freezing any coins that haven’t moved, with an optional path to recover them by proving knowledge of the seed phrase.⁵³

That freeze is one of the most divisive ideas in Bitcoin, because it would lock up coins whose owners never moved them, including those attributed to Satoshi. The alternative is letting whoever breaks the keys first take them. Neither proposal has been activated, and none is scheduled.

The rest of the world: 2030 and 2035

Outside crypto, the clock is already running. In August 2024, the US National Institute of Standards and Technology (NIST) finalized its first post-quantum standards, including ML-DSA, a lattice-based signature scheme, and SLH-DSA, a hash-based one derived from SPHINCS+, the family Drake suggested for high-value signers.⁵⁴ NIST’s draft transition plan would phase out today’s public-key algorithms, starting with the weakest after 2030, and disallow all of them after 2035.⁵⁵ In June 2026, a US executive order gave federal agencies until the early 2030s to move their most important systems to post-quantum cryptography.⁵⁶ The EU wants its critical infrastructure migrated by the end of 2030,⁵⁷ and BlackRock’s bitcoin ETF lists quantum computing among its risk factors.⁵⁸

The catch for blockchains is size. Every signature is stored forever, and post-quantum signatures are much bigger:

Sizes for the smallest standard parameter sets, from NIST’s FIPS 204 and FIPS 205 and the Falcon specification.⁵⁹⁶⁰⁶¹

That’s the real dilemma behind the hash-versus-lattice argument. The schemes Buterin trusts most are also the bulkiest, which is why Ethereum’s researchers are working on ways to bundle many signatures into one small proof.⁶²

How to Put Your Crypto in Bunker Mode, Calmly

You don’t have to agree with Drake’s timeline to like his checklist. Most of it is good security hygiene anyway, and it costs little. Just don’t hurry. As Buterin put it, “It’s very easy to lose funds from a misconfigured rushed upgrade, so don’t rush anything.”⁴²

1. Check where you stand. Paste any Ethereum address into our Bunker Wallet Checker. It reads public data on Ethereum, Base, Arbitrum, Optimism, Polygon, BNB Chain and Avalanche and tells you whether the address has ever sent a transaction, has code attached (including EIP-7702 delegations), or has signed token approvals. It only needs the address, never a key.
2. Know what the checker can’t see. Off-chain signatures, like “Sign in with Ethereum” or signed messages, reveal your public key to whoever receives them but leave no trace on-chain. If you’ve signed one with an address, treat it as exposed.
3. Make a fresh address the safe way. A new address from your hardware wallet is ideal. The next address in your existing seed phrase works too, since each one has its own key pair. If you want a separate key, our offline generator is a file you download, verify and open on a computer that never goes online.
4. Move deliberately. Send a small test first, check the full address, not just the first and last characters, and only then move the rest. The move itself is signed by your old address, which is fine: once the funds have left, there’s nothing behind the exposed key.
5. Never sign anything from the bunker. No approvals, no logins, no messages. Keep a separate everyday wallet for those. If the bunker ever signs, move what’s left to a new one.
6. Don’t reuse addresses. On Bitcoin, use a fresh receiving address each time; most modern wallets do this for you.
7. Ask your exchange. If your coins sit on an exchange, its practices matter more than yours. Glassnode’s numbers show that exposure varies hugely from one exchange to the next.

Who Should Move First, and Who Can Wait

The Bottom Line

Bitcoin and Ethereum are not broken, and nobody has shown they can be. What changed in October 2026 is that a few of crypto’s most serious researchers started treating a sudden break as something to plan for, not just something to write papers about.

Bunker mode is a modest idea with a dramatic name: keep the coins you care about in an address that has never shown its public key. If Drake is wrong, you’ve lost an afternoon. If he’s right, that afternoon may be what separates the coins that survive from the ones that don’t.

Start by checking your address. It takes about thirty seconds.

Frequently asked questions

What is crypto bunker mode?

A plan, proposed by Ethereum researcher Justin Drake in October 2026, to move crypto into fresh addresses whose public keys have never been revealed. If the signature math behind Bitcoin and Ethereum were broken, funds in those addresses would still be protected by a hash.

Has AI broken Bitcoin or Ethereum?

No. Nobody has demonstrated an attack on ECDSA, the signature scheme Bitcoin and Ethereum use, and breaking it would take an algorithm vastly faster than any known today. Bunker mode is a precaution against a possible future break, not a response to one.

Is my wallet already in bunker mode?

If the address has only ever received funds and never sent a transaction or signed anything, its public key is still hidden. For Ethereum and EVM addresses, our Bunker Wallet Checker tells you in seconds.

Do I need to move my crypto right now?

Not in a hurry. Both Justin Drake and Vitalik Buterin warned against panic moves, which risk mistakes and scams. Large holders have the most reason to plan now. Everyone else can make it part of normal wallet hygiene.

Can I use a new address from the same seed phrase?

Yes. Each address derived from a seed phrase has its own key pair, so a never-used address from the same seed is a fresh bunker until it signs something.

When will quantum computers be able to break Bitcoin?

Nobody knows. Today’s quantum computers are far too small. In the latest Global Risk Institute survey, experts put the chance of a code-breaking machine within ten years at 28% to 49%, and Project Eleven’s baseline estimate is 2033. The worry is that the machine needed keeps shrinking on paper while real machines keep growing.

Will post-quantum cryptography protect crypto from AI too?

Only if its math holds up. Post-quantum schemes are designed to resist quantum computers, not every clever new ordinary algorithm, as Rainbow and SIKE showed. That’s why Drake and Buterin favor hash-based signatures, which rest on the simplest assumptions, over lattice-based ones.

Are Taproot and Solana addresses safe in bunker mode?

Not in the way bunker mode needs. A Bitcoin Taproot address contains its public key, and a Solana address is the public key itself, so there is no hash to hide behind.

This article is for educational purposes only and isn’t financial or security advice. Moving crypto carries risk; double-check every address and start with small amounts.