Pinned post
Great discussion today at the Ethereum Forward Defence Summit with @drakefjustin : the first open roundtable on “Bunker Mode.”
The question: what if AI breaks elliptic-curve crypto before quantum computers do? And what should you do about it today?
Quick caveat before the notes: this is a fast write-up from my own recording of the session. I’ve cleaned it up but haven’t fully fact-checked my transcription, so take the details with a grain of salt.
The premise
We believe breaking discrete log on elliptic curves takes ~2^(n/2) work. Per Justin, that’s a belief, not a proof, and recent results suggest a sub-exponential attack exists in theory. Not practical (“the constants are galactic”), but the intuition took a hit. I haven’t seen the result published; treat this as his claim.
So the threat isn’t just Q-day. It’s every AI model generation between now and Q-day, maybe 10 of them. Each is a fresh roll of the dice on someone finding a faster attack on ECDSA. And a lab that found one might not publish it, since it would be a matter of national security.
Why might it already exist quietly? Aug–Oct were described as the most productive months in the history of math. OpenAI alone put out 722 manuscripts on hundreds of open problems. Yet none of the published results touch cryptography. The EF is working to get a definite answer on whether discrete log is already broken.
Can’t AI just prove discrete log is hard? Proving that would also prove P≠NP. Don’t hold your breath. What you can prove is hardness in the “generic group model,” where the attacker only sees a black box. But real curves aren’t black boxes. They have structure, and structure is exactly what a strong attacker exploits.
Bunker Mode, in one line: don’t expose your public key.
Sounds odd, it’s “public.” But if an attacker can break discrete log, your public key is your private key. An address that has never sent a tx has only revealed a hash of the key, not the key itself.
How to do it: move funds to a fresh address that has never made a transaction. One tx per asset, or one batched tx if your wallet supports it. Keep your seed phrase. Same wallet, same 12 words. Your seed is post-quantum secure. That’s it. For a savings wallet you rarely touch, it’s 10 minutes of work.
Why this works, in one chain:
seed → private key → public key → address (hash of pubkey)
ECDSA breaks the private→public step. The seed and the hash are fine. “No exposed pubkey” + “seed as fallback” covers you.
Three scenarios
1️⃣ Shave a few bits. Already happening in public: the curvesma.sh challenge squeezes out fractions of a bit per day, and we’re already a few bits under 128. 10–20 bits lost = fine.
2️⃣ An n/3 attack instead of n/2: ~128 → ~85 bits. A very powerful nation state could just about pull it off.
3️⃣ Practical breaks, live on chain.
Scenario 2 is the “memetic break.” Keys aren’t falling left and right, but confidence in ECDSA collapses. Breaking one key might cost ~$10M and months of GPUs. Response: accelerate migration. Anyone holding millions in one exposed address goes into the bunker.
Scenario 3 is the nightmare. Proposed answer: halt the chain, stop accepting ECDSA signatures, let people recover with a “proof of seed,” a proof of knowledge of your mnemonic. A manual, social intervention. Total mayhem, but recoverable for mnemonic-based accounts.
“What about MPC custodians with no mnemonic?” If you’re running MPC, you’re sophisticated enough to never reveal your public key in the first place. Coinbase was cited as already doing this. Big custodians with exposed keys are first on the chopping block.
A detail I didn’t know
Bitcoin and Ethereum use secp256k1, which has extra internal structure (the GLV endomorphism). Phones and secure enclaves use P-256, which doesn’t. So a break could hit crypto without hitting the rest of the internet.
That changes the incentives. If only k1 breaks, it’s no longer a national-security secret. For an AI lab heading toward an IPO, publishing it could be a fantastic ad for their math abilities.
Side note on lattices: some worry all the structure in lattice crypto could also be exploited by a mathematical superintelligence. That’s a big reason Ethereum L1 is going hash-based only. And since blockchains are mostly signatures with very little encryption, hash-based covers almost the whole attack surface.
Consensus layer
Because of BLS aggregation, solving a single discrete log could let an attacker slash every validator at once. Easy mitigation: disable slashing and run on an honest-majority assumption for a while, like Solana.
For stakers: validators could pre-register post-quantum keys today via a simple smart contract. No hard fork needed. In an emergency, the contract gets deployed and everyone registers ASAP.
Roadmap
On the current roadmap, G* and H* have nothing post-quantum, I* gets part of the solution, J* the full thing. ~2 years is “an eternity at the speed of AI.” So devs are seriously considering reshaping H* to do it all, hash-based only. Some think it could ship in 4–6 months.
An emergency would be a sufficient reason to speedrun the migration, but not a necessary one. If devs ship hash-based crypto in 4 months, that doesn’t mean a break exists. Worst case, Ethereum shows it can ship fast, and PQ is a competitive narrative anyway.
Upside: the L1 devs are suddenly aligned. Usually governance is everyone pushing their own EIP. In the last few days everyone converged “almost magically” on getting this done. The technical bottleneck is shrinking with AI. The social one remains, and the PQ/AI meme turns out to be a very potent coordination mechanism.
Spiciest take of the session: Zcash
Justin called it “the number one worst place to put your funds when it comes to post-quantum.” Its proofs lack post-quantum soundness. Forge the proofs → mint arbitrary ZEC → slowly bleed the most liquid privacy pool without being noticed.
To be fair, Zcash has post-quantum privacy (who paid whom stays hidden). That’s valuable. But privacy isn’t soundness. He also argued the Tachyon upgrade (2027) adds more quantum-vulnerable cryptography. Zcash’s own roadmap claims the opposite, with PQ signatures targeted for January 2027, so expect pushback on this one.
StarkWare got credit for betting on hash-based STARKs early, and being right. But its accounts reportedly still use elliptic-curve signatures, not SPHINCS+. The goal now: freeze Ethereum’s “lean signature” standard so L2s, hardware wallets, MPC providers and other chains can adopt it, the way Satoshi set the k1 standard.
Practical questions
“Isn’t bunker mode itself risky?” Treat it like any payment: no rush, no panic. Sleep on it, double-check, then send to yourself. And don’t download some shiny new “post-quantum wallet.” Keep the one you have.
(Related: the tampered-Ledger story from October, ~$90M drained via devices sold by a Southeast Asian reseller. Worth noting those implants stole the seed phrase itself, so bunker mode wouldn’t have helped there. Buy hardware direct.)
Ideal wallet UX: a pop-up saying “migrate to a post-quantum address derived from your mnemonic?” → one click → done. Wallets need the standard finalized first (hopefully weeks, maybe a couple of months). The libraries are formally verified end to end, so integration should be light work.
“But the migration tx exposes my pubkey.” True. You’re exposed while it sits in the mempool. Get it all included within a block or two. If a key takes weeks to break, you’re fine. If it takes seconds, fall back to ECDSA-off + proof-of-seed recovery.
One question went unanswered: how do you bunker if you need to stake or use DeFi? Open problem for now.
Bunker mode is meant to be proactive. Do it calmly now, not when Vitalik tweets something scary. The real danger in a memetic break is panic: people see “discrete log broken” headlines and dump into fiat when a key still costs $10M and months.
The “shield of Satoshi”
About 20,000 early Bitcoin addresses, mostly attributed to Satoshi and lost keys, hold 50 BTC each with the public key exposed. An attacker goes for Zcash first, then a few whales, then those. At ~1 week per key, that’s 20,000 weeks of cover. Under 50 BTC (~$5M) in one address? You can probably do nothing. Custodians: shield your keys.
A security panelist added a sobering note: the bigger near-term risk is plain bad opsec. “8 out of 10 companies think they have a good security posture. 9 out of 10 have zero.” His estimate: at least 10% of crypto orgs are already compromised, with attackers inside and waiting for the right moment to cash out.
Want to see who’s most exposed? risqlist.org → btc.risqlist.org and eth.risqlist.org
Want to help find out how close we actually are? Check out ecdsa.fail, a benchmark arena for cracking ECDSA. Run your autoresearch harness, verify against the benchmark, and submit your score. It’s an Eigen Labs / Yukon project with a public leaderboard, so instead of guessing whether the labs have something, the community can measure bit by bit how far the attacks move. Newer challenges (including the curve-smash one from the “shave a few bits” scenario above) live on yukon.org. If you have GPUs, a harness, or just math brain, go contribute. ecdsa
TL;DR
Don’t expose your public key
Fresh address + same seed = bunker
No rush, no panic, no new “PQ wallets”
Custodians first
Ethereum is pushing to go hash-based, fast
Help measure the threat at ecdsa.fail
First-ever Ethereum Forward Defence Summit, done. 🫡
The question: what if AI breaks elliptic-curve crypto before quantum computers do? And what should you do about it today?
Quick caveat before the notes: this is a fast write-up from my own recording of the session. I’ve cleaned it up but haven’t fully fact-checked my transcription, so take the details with a grain of salt.
The premise
We believe breaking discrete log on elliptic curves takes ~2^(n/2) work. Per Justin, that’s a belief, not a proof, and recent results suggest a sub-exponential attack exists in theory. Not practical (“the constants are galactic”), but the intuition took a hit. I haven’t seen the result published; treat this as his claim.
So the threat isn’t just Q-day. It’s every AI model generation between now and Q-day, maybe 10 of them. Each is a fresh roll of the dice on someone finding a faster attack on ECDSA. And a lab that found one might not publish it, since it would be a matter of national security.
Why might it already exist quietly? Aug–Oct were described as the most productive months in the history of math. OpenAI alone put out 722 manuscripts on hundreds of open problems. Yet none of the published results touch cryptography. The EF is working to get a definite answer on whether discrete log is already broken.
Can’t AI just prove discrete log is hard? Proving that would also prove P≠NP. Don’t hold your breath. What you can prove is hardness in the “generic group model,” where the attacker only sees a black box. But real curves aren’t black boxes. They have structure, and structure is exactly what a strong attacker exploits.
Bunker Mode, in one line: don’t expose your public key.
Sounds odd, it’s “public.” But if an attacker can break discrete log, your public key is your private key. An address that has never sent a tx has only revealed a hash of the key, not the key itself.
How to do it: move funds to a fresh address that has never made a transaction. One tx per asset, or one batched tx if your wallet supports it. Keep your seed phrase. Same wallet, same 12 words. Your seed is post-quantum secure. That’s it. For a savings wallet you rarely touch, it’s 10 minutes of work.
Why this works, in one chain:
seed → private key → public key → address (hash of pubkey)
ECDSA breaks the private→public step. The seed and the hash are fine. “No exposed pubkey” + “seed as fallback” covers you.
Three scenarios
1️⃣ Shave a few bits. Already happening in public: the curvesma.sh challenge squeezes out fractions of a bit per day, and we’re already a few bits under 128. 10–20 bits lost = fine.
2️⃣ An n/3 attack instead of n/2: ~128 → ~85 bits. A very powerful nation state could just about pull it off.
3️⃣ Practical breaks, live on chain.
Scenario 2 is the “memetic break.” Keys aren’t falling left and right, but confidence in ECDSA collapses. Breaking one key might cost ~$10M and months of GPUs. Response: accelerate migration. Anyone holding millions in one exposed address goes into the bunker.
Scenario 3 is the nightmare. Proposed answer: halt the chain, stop accepting ECDSA signatures, let people recover with a “proof of seed,” a proof of knowledge of your mnemonic. A manual, social intervention. Total mayhem, but recoverable for mnemonic-based accounts.
“What about MPC custodians with no mnemonic?” If you’re running MPC, you’re sophisticated enough to never reveal your public key in the first place. Coinbase was cited as already doing this. Big custodians with exposed keys are first on the chopping block.
A detail I didn’t know
Bitcoin and Ethereum use secp256k1, which has extra internal structure (the GLV endomorphism). Phones and secure enclaves use P-256, which doesn’t. So a break could hit crypto without hitting the rest of the internet.
That changes the incentives. If only k1 breaks, it’s no longer a national-security secret. For an AI lab heading toward an IPO, publishing it could be a fantastic ad for their math abilities.
Side note on lattices: some worry all the structure in lattice crypto could also be exploited by a mathematical superintelligence. That’s a big reason Ethereum L1 is going hash-based only. And since blockchains are mostly signatures with very little encryption, hash-based covers almost the whole attack surface.
Consensus layer
Because of BLS aggregation, solving a single discrete log could let an attacker slash every validator at once. Easy mitigation: disable slashing and run on an honest-majority assumption for a while, like Solana.
For stakers: validators could pre-register post-quantum keys today via a simple smart contract. No hard fork needed. In an emergency, the contract gets deployed and everyone registers ASAP.
Roadmap
On the current roadmap, G* and H* have nothing post-quantum, I* gets part of the solution, J* the full thing. ~2 years is “an eternity at the speed of AI.” So devs are seriously considering reshaping H* to do it all, hash-based only. Some think it could ship in 4–6 months.
An emergency would be a sufficient reason to speedrun the migration, but not a necessary one. If devs ship hash-based crypto in 4 months, that doesn’t mean a break exists. Worst case, Ethereum shows it can ship fast, and PQ is a competitive narrative anyway.
Upside: the L1 devs are suddenly aligned. Usually governance is everyone pushing their own EIP. In the last few days everyone converged “almost magically” on getting this done. The technical bottleneck is shrinking with AI. The social one remains, and the PQ/AI meme turns out to be a very potent coordination mechanism.
Spiciest take of the session: Zcash
Justin called it “the number one worst place to put your funds when it comes to post-quantum.” Its proofs lack post-quantum soundness. Forge the proofs → mint arbitrary ZEC → slowly bleed the most liquid privacy pool without being noticed.
To be fair, Zcash has post-quantum privacy (who paid whom stays hidden). That’s valuable. But privacy isn’t soundness. He also argued the Tachyon upgrade (2027) adds more quantum-vulnerable cryptography. Zcash’s own roadmap claims the opposite, with PQ signatures targeted for January 2027, so expect pushback on this one.
StarkWare got credit for betting on hash-based STARKs early, and being right. But its accounts reportedly still use elliptic-curve signatures, not SPHINCS+. The goal now: freeze Ethereum’s “lean signature” standard so L2s, hardware wallets, MPC providers and other chains can adopt it, the way Satoshi set the k1 standard.
Practical questions
“Isn’t bunker mode itself risky?” Treat it like any payment: no rush, no panic. Sleep on it, double-check, then send to yourself. And don’t download some shiny new “post-quantum wallet.” Keep the one you have.
(Related: the tampered-Ledger story from October, ~$90M drained via devices sold by a Southeast Asian reseller. Worth noting those implants stole the seed phrase itself, so bunker mode wouldn’t have helped there. Buy hardware direct.)
Ideal wallet UX: a pop-up saying “migrate to a post-quantum address derived from your mnemonic?” → one click → done. Wallets need the standard finalized first (hopefully weeks, maybe a couple of months). The libraries are formally verified end to end, so integration should be light work.
“But the migration tx exposes my pubkey.” True. You’re exposed while it sits in the mempool. Get it all included within a block or two. If a key takes weeks to break, you’re fine. If it takes seconds, fall back to ECDSA-off + proof-of-seed recovery.
One question went unanswered: how do you bunker if you need to stake or use DeFi? Open problem for now.
Bunker mode is meant to be proactive. Do it calmly now, not when Vitalik tweets something scary. The real danger in a memetic break is panic: people see “discrete log broken” headlines and dump into fiat when a key still costs $10M and months.
The “shield of Satoshi”
About 20,000 early Bitcoin addresses, mostly attributed to Satoshi and lost keys, hold 50 BTC each with the public key exposed. An attacker goes for Zcash first, then a few whales, then those. At ~1 week per key, that’s 20,000 weeks of cover. Under 50 BTC (~$5M) in one address? You can probably do nothing. Custodians: shield your keys.
A security panelist added a sobering note: the bigger near-term risk is plain bad opsec. “8 out of 10 companies think they have a good security posture. 9 out of 10 have zero.” His estimate: at least 10% of crypto orgs are already compromised, with attackers inside and waiting for the right moment to cash out.
Want to see who’s most exposed? risqlist.org → btc.risqlist.org and eth.risqlist.org
Want to help find out how close we actually are? Check out ecdsa.fail, a benchmark arena for cracking ECDSA. Run your autoresearch harness, verify against the benchmark, and submit your score. It’s an Eigen Labs / Yukon project with a public leaderboard, so instead of guessing whether the labs have something, the community can measure bit by bit how far the attacks move. Newer challenges (including the curve-smash one from the “shave a few bits” scenario above) live on yukon.org. If you have GPUs, a harness, or just math brain, go contribute. ecdsa
TL;DR
Don’t expose your public key
Fresh address + same seed = bunker
No rush, no panic, no new “PQ wallets”
Custodians first
Ethereum is pushing to go hash-based, fast
Help measure the threat at ecdsa.fail
First-ever Ethereum Forward Defence Summit, done. 🫡
