Protocols & Policy · Security
Drake says it is now reasonable to brace for the signature scheme behind most bitcoin and ether wallets to break, in the worst case within months, citing AI's progress in math. Critics who answered him on X said he showed no evidence of a break.
Justin Drake wants the crypto industry to start hiding its public keys.
In a long post on X at 10:14 a.m. ET on Wednesday, Drake called on "the blockchain industry to calmly begin planning for 'bunker mode'" [1]. His plan is "a controlled mass migration of assets to fresh addresses, i.e. addresses whose pubkeys remain hidden behind a hash" [1]. By 11:48 p.m. ET the post had about 2.9 million views, 11,427 likes and 1,188 quote posts [1].
In January, Drake announced the Ethereum Foundation's new post-quantum team on X, writing "We've formed a new Post Quantum (PQ) team" [2]. His X profile reads "Bitcoin security researcher" [1]. Le Coin has not confirmed his current role with the foundation.
His recommendation has two steps. He wrote that holders should consider moving "the bulk of their funds" to addresses that have never signed a transaction, and that after signing from one, they should move what is left to a new address, "possibly generated from the same seed phrase" [1]. He wrote that this "does not require new cryptography or new wallets" [1].
He asked for a slow pace twice. "Don't rush," he wrote, adding that "a rushed migration would do more harm than good," and later: "Again, please do not rush." [1]
His main reason is AI. He wrote that "Yesterday's OpenAI drop made it clear that mathematical superintelligence is upon us" [1]. OpenAI's public GitHub repository, created on Oct. 6, holds 722 math manuscripts produced by "an unreleased internal OpenAI model," and it says "Some of the unformalized results could have issues" [4]. Drake defined a "break" as "fast private key recovery (e.g. in one week) on available hardware (e.g. a large GPU cluster)" [1].
He said oracles and layer-2 security councils should consider rotating keys with every signed message or adding hash-based signatures such as SPHINCS [1].
A crypto wallet has a private key, which signs, and a public key, which anyone can use to check a signature. The danger Drake describes is someone working backward from a public key to the private key.
Many addresses don't show the public key at first. On Bitcoin, a standard P2PKH address is a hash of the public key. The full public key goes on chain only when the owner spends, alongside the signature [5]. An Ethereum address is the last 20 bytes of a Keccak-256 hash of the public key [6].
So an address that has never sent anything has only exposed a hash. Drake's bet is that hashes will hold up even if elliptic curves don't [1]. There are exceptions. Taproot outputs on Bitcoin put a 32-byte public key in the output itself, not a hash [7]. One post quoted below, from @w_s_bitcoin, told people not to use Taproot wallets.
Most Bitcoin signatures use ECDSA on an elliptic curve called secp256k1 [5]. Taproot spends use a different scheme, Schnorr signatures, on the same curve [7]. Ethereum keys also come from ECDSA [6]. The long-known threat is quantum. In a paper posted in 1995, Peter Shor described a quantum method for factoring and discrete logarithms, two problems that "have been used as the basis of several proposed cryptosystems" [10]. Drake's post does not define "qday." In an interview posted on ethereum.org, asked whether Q-Day is "the day in which quantum computers can break our signature schemes like ECDSA," Drake answered, "Yeah exactly" [12]. NIST has a draft plan for moving off quantum-vulnerable algorithms [9]. In 2024 it published a hash-based signature standard, SLH-DSA, which is based on SPHINCS+ [8].
Drake's new claim is that the break might come from ordinary computers first, helped by AI. He wrote that elliptic curves "carry rich structure," while "hashes are designed to minimise algebraic structure" [1]. He pointed to recent results on integer multiplication, the 3SUM problem and the Erdős unit distance conjecture [1]. None of the three is about elliptic curves.
Ethereum's draft roadmap, maintained by the foundation's architecture team, already lists "centuries-long cryptographic security, via hash-based schemes" as a goal [3]. Drake wrote: "Those timelines must now be revisited and accelerated" [1].
These are selected replies and quote posts.
Critics:
Yehuda Lindell (@LindellYehuda), who lists himself as head of cryptography at Coinbase, at 9:01 p.m. ET: "To my understanding, there is no evidence whatsoever pointing to a break of decades old hardness assumptions like elliptic curve cryptography." link
Coinjoined Chris (@coinjoined), who lists himself as co-founder and CEO of Seedor and Bitsurance, at 2:35 p.m. ET: "No new attack is presented here. No complexity bound has changed." He added that "address reuse is bad practice regardless" and that "Exchanges are probably the most conspicuous offenders" link
Chris Ries (@chrisries), who works on post-quantum at Circle per his profile, at 8:26 p.m. ET: "The quantum threat is very real, but must be met with methodical planning and coordination (certainly not 'bunker mode')." link
Dankrad Feist (@dankrad), whose profile lists him as a researcher at Tempo and formerly at the Ethereum Foundation, at 10:29 p.m. ET: "If elliptic curves are broken so that any exposed public key leads to compromise ... your coins are going to zero. Having them in bunker mode is not going to help you." link
@mert, CEO of Helius per his profile, at 8:49 p.m. ET, pitched Zcash and added: "no, do not move your funds no matter what chain youre on" link
Support and middle ground:
@Raullen, who lists himself as a co-founder of IoTeX, at 12:15 p.m. ET: "Fully support Justin's call to action." link
@w_s_bitcoin at 3:31 p.m. ET: "Don't reuse addresses. Most individuals already avoid this; it's mostly large institutions that still do it." The post added: "don't use taproot wallets." link
Both sides agreed on one point: don't reuse addresses. @coinjoined called reuse "bad practice regardless," and @Raullen listed "Stop Reusing Addresses" among his takeaways.
Some answered with jokes.
@GwartyGwart wrote at 5:34 p.m. ET: "I thought bunker mode was when you log off for a year after bullposting eigenlayer" link
These are statements made on X. Le Coin has not verified the claims in them.
Did Drake say ECDSA is broken? No. He said it is "reasonable to brace for the possibility" [1].
Holding the Corner.
Not financial advice.