AI and Cryptography: The Crypto Community Debates Proactive Measures Against Future Risks

In recent days, discussions about "AI potentially breaking cryptography" have sparked widespread panic in the crypto community.

The situation originated on October 7, when Justin Drake called on the entire blockchain industry to calmly begin planning for "Bunker Mode" to address potential cryptographic risks in the future.

His primary concern is that as AI's capabilities in mathematical research continue to advance, elliptic curve cryptography, widely used in networks like Bitcoin and Ethereum, could face new mathematical attacks before truly cryptographically capable quantum computers emerge.

In his worst-case scenario, the relevant breakthrough could occur on the scale of months rather than years, so he recommends large holders and institutions prioritize an orderly migration of assets to minimize potential risks associated with exposed public keys.

Subsequently, Vitalik Buterin also joined the discussion.

Interestingly, Vitalik did not deny that AI could accelerate cryptographic research; he further suggested that some cryptographic schemes believed to be resistant to quantum attacks might also be affected by future mathematical breakthroughs.

However, when it comes to whether ordinary users should immediately migrate their assets, he emphasized that the real losses caused by hasty upgrades and migrations may be more worthy of immediate caution than potential cryptographic attacks that have not yet occurred.

This also raises a long-standing issue across the crypto industry: how far in advance should public blockchains prepare when the underlying cryptographic assumptions protecting on-chain assets begin to face new challenges, and when should ordinary users take action?

To understand the focus of this discussion, we first need to revisit the fundamental account and signature mechanisms of public blockchains.

It is well known that in non-custodial wallets, the private key is the critical credential for controlling assets. Technically, the wallet uses digital signature algorithms to prove that a transaction has been authorized by the corresponding key holder, without ever exposing the private key.

Among these, the most typical is elliptic curve cryptography (ECC).

Using Ethereum as an example, ordinary externally owned accounts (EOAs) generate transaction signatures using ECDSA; Bitcoin’s traditional signature system also widely uses ECDSA, while Taproot employs Schnorr signatures based on the same elliptic curve.

These schemes can operate reliably over the long term, relying on a key mathematical assumption: it is very easy to compute a public key from a private key, but reversing the process—deriving the private key from the public key alone—is practically infeasible with any known classical computational methods.

We can think of it as a mathematical problem that is easy to verify but extremely difficult to solve in reverse: anyone on the network can use the public key to verify whether a signature is valid, but cannot easily deduce the signer’s private key from it.

It is precisely this asymmetry that forms a fundamental basis of modern blockchain asset ownership.

But there’s another subtle detail often overlooked: the “wallet address” we see in daily use isn’t always the full public key.

For example, with a standard Ethereum EOA, the wallet address is generated by taking a portion of the Keccak-256 hash of the public key. Similarly, common Bitcoin address types such as P2PKH and P2WPKH also use a public key hash-based design.

This creates an interesting security difference.

For a standard Ethereum account that has never initiated an on-chain transaction or publicly disclosed its public key through other means, outsiders can typically see only the hashed wallet address. Since current computational methods make it extremely difficult to reverse-engineer the full public key from the address hash, the public key is effectively protected by an additional layer of security.

However, when this account initiates a transaction and submits an ECDSA signature, the node can recover the corresponding public key from the signature. Since on-chain transaction records remain publicly accessible indefinitely, this information will continue to be exposed to the outside world.

This means that for accounts using public key hash addresses, the risk level may differ between cases where the public key has not yet been exposed and those where it has been exposed, when facing certain future cryptographic attacks.

It is important to emphasize that this does not mean all public blockchains follow exactly the same rules.

For example, a Taproot output itself contains a visible elliptic curve public key, so even if a Taproot address has never spent funds, it cannot be assumed that the public key remains hidden behind a hash function; additionally, partial public key information may be exposed in advance through address reuse, public signatures, extended public keys, or other means.

Therefore, "having never withdrawn assets" does not necessarily mean "the public key has not been exposed," and a new address does not inherently possess quantum resistance.

Understanding this difference makes it easier to grasp the challenges posed by quantum computing and AI.

Theoretically, a quantum computer with sufficient scale and error correction capability could use this algorithm to efficiently solve the elliptic curve discrete logarithm problem, derive private keys from public keys, and thereby threaten signature schemes such as ECDSA and Schnorr.

However, as of now, there is no evidence that quantum computers capable of actually breaking the mainstream signature systems used by Bitcoin or Ethereum exist.

Justin Drake's concern this time focuses on AI, beyond quantum computers, potentially helping humans discover shortcuts to solving problems that current mathematical algorithms have not yet found—especially as AI has made continuous progress over the past year in areas such as mathematical reasoning, algorithm search, and formal proof. Some researchers are now reconsidering whether computationally hard problems, which have been tested for decades, might be reevaluated due to new mathematical discoveries.

Once the underlying logic is clarified, revisiting the discussion between Justin and Vitalik reveals that their judgments are not entirely opposed—rather, they simply assigned different priorities to different risks.

First, let's look at Justin Drake.

Traditionally, the transition of cryptographic systems has often been a lengthy process. After all, from identifying potential risks and establishing new standards, to completing engineering implementation, and finally achieving compatibility and coordination across blockchains, wallets, exchanges, custodians, and hardware devices, it can take years or even longer.

Not to mention decentralized networks like Bitcoin and Ethereum, which are large-scale and require extensive coordination—underlying upgrades typically cannot be completed with a single version update, as with ordinary software.

Justin is concerned precisely that this lengthy upgrade cycle may not keep pace with breakthroughs in future mathematical research.

For example, if AI eventually helps researchers discover new cryptographic attack methods, the existing elliptic curve signature system could be threatened even before quantum computers gain practical cracking capabilities.

Once this breakthrough actually occurs, the window for migration to public blockchains and wallet ecosystems may be much shorter than previously anticipated.

Therefore, his position is to prevent problems before they occur, emphasizing that exchanges, large institutions, and users holding significant assets should begin considering future hedging strategies now.

This includes conducting an inventory of addresses with exposed public keys, systematically transferring a portion of long-held assets to new addresses with unexposed public keys, and minimizing unnecessary signatures and address reuse in future transactions.

Technically, this recommendation is sound—if future attacks rely on deriving private keys from public keys, reducing the exposure of public keys in advance could buy additional time for defense under certain conditions.

However, transferring funds to a new address whose public key has not yet been exposed does not equate to completing a true post-quantum cryptography migration.

Because as long as the new address still uses traditional signature schemes like ECDSA, the underlying security assumptions have not fundamentally changed; once a transaction is initiated from this address, the public key may still be re-exposed. If an attacker has sufficient capability, even the brief window between transaction broadcasting and confirmation could become a new vulnerability.

In other words, this is a transitional risk mitigation measure, not a final solution that permanently resolves the issue. More importantly, reducing potential risks from a cryptographic standpoint does not necessarily mean it is also safer from an actual asset management perspective.

This is also what Vitalik emphasized specifically.

Under current known technological conditions, there is still no practical attack method to directly recover an ECDSA private key from its public key. However, losses due to address errors, failed key backups, malicious approvals, or other operational issues during on-chain asset transfers remain a daily real-world risk.

Vitalik even mentioned that the losses he incurred due to migration configuration errors were greater than those caused by hacker attacks.

For ordinary users holding only a small amount of ETH, migrating assets may simply involve creating a new address, backing up keys, and initiating a few transfers; however, for users who have long been active in DeFi, staking, cross-chain interactions, or even managing funds through multisig wallets, the process is significantly more complex.

Assets may be spread across different networks, with some funds still locked in staking or lending protocols, and old addresses may still hold administrative, withdrawal, or other critical operation permissions for smart contracts.

Migrating a large amount of assets on a whim due to rumors about "AI potentially cracking wallets" may result in irreversible losses from sending funds to the wrong network, misusing cross-chain tools, signing malicious transactions, or making mistakes with multisig operations.

Moreover, once market panic spreads about "wallets about to be hacked," various impersonations of official quantum-resistant upgrade links, asset protection tools, and so-called migration services may also emerge.

It is worth noting that Vitalik's caution does not mean he is conservative about underlying cryptographic upgrades.

Conversely, he also believes that the mathematical advances brought by AI warrant serious study, and even cautions the industry to reevaluate certain lattice-based post-quantum schemes, avoiding the assumption that a cryptographic algorithm is inherently secure against all future mathematical breakthroughs simply because it has been labeled "quantum-resistant."

Where feasible, he also tends to favor hash-based cryptographic structures and adopts more conservative security parameters for other schemes.

Therefore, Justin and Vitalik cannot be simply categorized as radical and conservative factions; there is no fundamental deep-seated conflict between them.

Many users may ask: Given the long-term risks in underlying cryptography, can my wallet automatically upgrade to a "quantum-resistant wallet" for me?

Updating the wallet app alone is not enough.

For blockchain, cryptographic upgrades involve not only how private keys are generated and transactions are signed, but also whether the entire network can recognize and verify the new signatures, and whether existing accounts can transition smoothly.

In fact, even before this AI-induced discussion, major blockchains and cryptography research institutions have already begun preparing for the post-quantum era.

Taking Ethereum as an example, its quantum resistance preparations have already involved multiple layers.

In addition to ECDSA used for standard accounts, BLS signatures for validator consensus, KZG commitments related to data availability, and certain zero-knowledge proof systems involve cryptographic structures that will require future reassessment or upgrade.

The Ethereum Foundation has established a dedicated Post-Quantum Security research team to explore new signature and proof schemes for the consensus layer using technologies such as leanXMSS and leanVM.

At the user account level, account abstraction offers another promising path: unlike traditional EOA signature verification, which is tightly coupled with underlying protocols, account abstraction with interchangeable signature verification mechanisms could enable user accounts to adopt different signing algorithms in the future, providing greater flexibility for post-quantum upgrades.

For example, EIP-8141, which is still under discussion, relates to native account abstraction on Ethereum and is expected to serve as a foundational element for supporting more flexible signature verification in the future; however, its exact deployment timeline and final implementation details remain subject to further community discussion and testing.

In contrast, Bitcoin faces different challenges.

Due to the UTXO model, combined with complex historical address types and a significant amount of early assets remaining dormant for extended periods, Bitcoin must not only address new signature algorithms and output structures but also resolve the challenge of migrating a large volume of existing assets. Currently, related community proposals remain in the drafting and coordination phase.

In addition, other blockchains have also begun attempting more direct engineering implementations. For example, in July 2026, NEAR announced that its mainnet upgrade now supports ML-DSA post-quantum signatures based on FIPS 204, enabling accounts to add quantum-safe keys.

Supporting one post-quantum signature scheme does not mean that the entire blockchain, along with all its accounts, applications, and infrastructure, has completed the quantum-resistant migration.

Putting these advancements together, it becomes clear that the industry's real challenge is multifaceted: new cryptographic schemes must not only be theoretically secure but also balance signature size, on-chain verification costs, node performance, hardware compatibility, and the smooth transition of a large existing user base.

And these changes to the protocol layers ultimately affect the wallets that users use every day.

For a multi-chain non-custodial wallet like imToken, future cryptographic upgrades cannot be merely a simple version update:

• On one hand, wallets need to gradually adapt to new account and address types, key management methods, transaction signing and verification mechanisms as different blockchains upgrade, and may also involve compatibility with hardware wallets, smart contract accounts, and multisignature systems.
• On the other hand, wallets must translate complex underlying technological changes into intuitive actions that ordinary users can understand. For example, if a public blockchain officially adopts a new post-quantum signature scheme in the future, what users truly care about is whether their existing addresses will still work, whether they need to create new accounts, if their current seed phrases and hardware devices remain compatible, and how to handle their existing tokens, NFTs, staked assets, and DeFi positions.

Some of these issues can be gradually resolved through wallet product capabilities, while others require support from the blockchain protocol, smart contracts, and the broader ecosystem.

This is why, the more complex the underlying security upgrade, the more thoroughly the user migration process must be tested, rather than hastily launching a so-called "one-click quantum-resistant" feature.

So, what should ordinary users do at this stage?

• First, there is no need to immediately transfer all your assets solely because of this discussion; there is currently no evidence that the signature algorithms of major public blockchains have been practically compromised. Be especially cautious of unfamiliar links and migration tools promoted under the guise of "quantum-resistant upgrades." Any request to import your mnemonic phrase, private key, or to prompt you to sign unknown transactions should be treated with extreme caution.
• Second, for large or long-term holdings, begin consciously improving your address management practices. For example, understand the blockchain and address types you are using, minimize unnecessary reuse and signing operations for high-value addresses. If you need to adjust your asset storage structure, first confirm wallet and network compatibility, back up your keys, verify receiving addresses, and reduce migration risks by conducting small test transfers and performing operations in batches.
• Finally, and perhaps the most easily overlooked point: whether a wallet will support post-quantum signatures in the future is a separate issue from whether users need to migrate their assets today;



In the world of blockchain, we build trust through mathematics and code.

From this perspective, no one can guarantee that today’s sufficiently secure cryptographic schemes will never need adjustment over the coming decades for an open financial network designed to securely hold trillions of dollars in assets long-term.

But this does not mean that every breakthrough in cutting-edge research requires ordinary users to immediately rearrange their assets.

Cryptography researchers must consider the worst-case scenarios, public chain developers need to proactively design new security mechanisms, wallet teams must provide reliable support for future upgrades and migrations, and ordinary users should avoid making hasty decisions based on unverified information, ensuring they fully understand the risks involved.

Don’t assume a crisis is already here, and don’t underestimate the inevitability of change—stay alert and proceed with caution.

For every holder, this is the best way to face the unknown.