Over the past few days, discussions about whether AI could potentially break cryptography have sparked a fresh wave of anxiety across the crypto community.
It began on October 7, when Justin Drake called on the blockchain industry to calmly begin planning for “Bunker Mode” to prepare for possible future cryptographic risks.
His central concern is that, as AI becomes increasingly capable of conducting mathematical research, the elliptic-curve cryptography widely used by networks such as Bitcoin and Ethereum could face new forms of mathematical attack even before cryptographically relevant quantum computers arrive.
In his worst-case scenario, such a breakthrough could occur within months rather than years. He therefore suggested that large holders and institutions begin considering an orderly asset migration, reducing the potential risks associated with already-exposed public keys wherever possible.
Vitalik Buterin subsequently joined the discussion.
Interestingly, Vitalik did not dismiss the possibility that AI could accelerate cryptographic research. He went even further, noting that some cryptographic schemes currently considered resistant to quantum attacks could still be affected by future mathematical breakthroughs.
However, when it came to whether ordinary users should immediately move their assets, he warned that the very real losses caused by rushed upgrades and migrations may deserve more attention today than a cryptographic attack that has not yet materialized.
This raises a long-standing question for the entire crypto industry: when the cryptographic assumptions protecting onchain assets begin to face new challenges, how far in advance should public blockchains prepare—and when should ordinary users take action?
1. Where Does the Risk Come From? Understanding the Gap Between an Address and a Public Key
To understand the focus of this debate, we first need to return to the basic account and signature mechanisms used by public blockchains.
In a non-custodial wallet, the private key is the critical credential that controls the assets. More specifically, wallets use digital signature algorithms to prove that a transaction has been authorized by the corresponding key holder without revealing the private key itself.
One of the most widely used technologies is elliptic-curve cryptography, or ECC.
On Ethereum, ordinary externally owned accounts, or EOAs, use ECDSA to sign transactions. Bitcoin’s traditional signature system also makes extensive use of ECDSA, while Taproot uses Schnorr signatures based on the same elliptic curve.
The long-term reliability of these systems depends on an important mathematical assumption: deriving a public key from a private key is easy, but deriving the private key from the public key is practically infeasible using currently known classical computing methods.
We can think of it as a mathematical problem that is easy to verify but extremely difficult to reverse. Anyone on the network can use a public key to verify whether a signature is valid, but they cannot easily calculate the signer’s private key from it.
This asymmetry is one of the foundations of asset ownership on modern blockchains.
There is, however, an easily overlooked detail: the wallet address we see in everyday use is not always the complete public key.
For an ordinary Ethereum EOA, the wallet address is created by hashing the public key with Keccak-256 and taking part of the resulting output. On Bitcoin, common address types such as P2PKH and P2WPKH similarly use designs based on public-key hashes.
This creates an important security distinction.
For an ordinary Ethereum account that has never initiated an onchain transaction—or revealed its public key through some other channel—outside observers will generally see only the hashed wallet address. Because current computing methods cannot feasibly recover the full public key from this address hash, the public key effectively benefits from an additional layer of protection.
Once the account initiates a transaction and submits an ECDSA signature, however, nodes can recover the corresponding public key from the signature data. Since onchain transaction records remain publicly accessible, that public key also remains exposed.
For accounts that use public-key-hash addresses, this means that an account whose public key has never been revealed may face a different level of risk from one whose public key is already public under certain future cryptographic attacks.
That does not mean every blockchain follows the same rules.
A Bitcoin Taproot output, for example, directly contains a visible elliptic-curve public key. Even if the funds in a Taproot address have never been spent, it would be incorrect to assume that its public key remains concealed behind a hash function. Public-key information can also be exposed in advance through address reuse, public signatures, extended public keys, and other channels.
In other words, “never spent from” does not necessarily mean “public key never exposed.” Nor is a newly generated address automatically quantum-resistant.
Once this distinction is understood, the potential challenges posed by quantum computing and AI become easier to examine.
In theory, a sufficiently large and fault-tolerant quantum computer could use Shor’s algorithm to efficiently solve the elliptic-curve discrete logarithm problem, deriving a private key from a public key and thereby threatening signature schemes such as ECDSA and Schnorr.
At present, however, there is no evidence that any quantum computer can practically break the mainstream signature systems used by Bitcoin or Ethereum.
Justin Drake’s concern focuses on another possibility: AI could help researchers discover mathematical shortcuts that existing algorithms have not yet found, even without a cryptographically relevant quantum computer.
As AI has made rapid progress over the past year in mathematical reasoning, algorithm search, and formal proof, some researchers have begun reconsidering whether computational problems tested over decades could one day be reassessed in light of new mathematical discoveries.
2. Justin and Vitalik Do Not Fundamentally Disagree
Once the underlying mechanics are clear, the discussion between Justin and Vitalik looks less like a direct disagreement. They are largely assigning different priorities to different risks.
Consider Justin Drake’s position first.
Cryptographic transitions have traditionally been lengthy processes. Identifying a potential vulnerability, developing a new standard, completing the engineering work, and coordinating compatibility across public blockchains, wallets, exchanges, custodians, and hardware devices can easily take years.
For decentralized networks as large as Bitcoin and Ethereum, where upgrades require broad coordination, replacing foundational cryptography is not something that can be completed through an ordinary software update.
Justin’s concern is that this extended upgrade cycle may not be able to keep pace with future breakthroughs in mathematical research.
If AI were to help researchers discover a new cryptographic attack, existing elliptic-curve signature systems could face a threat before quantum computers become capable of breaking them in practice.
Once such a breakthrough appeared, the migration window available to public blockchains and wallet ecosystems could be much shorter than previously expected.
His position is therefore precautionary. Exchanges, major institutions, and large asset holders should begin considering contingency plans now rather than waiting until a practical attack emerges.
That could include identifying addresses whose public keys have already been exposed, gradually moving some long-term holdings to fresh addresses whose public keys have not yet been revealed, and reducing unnecessary signatures and address reuse.
From a technical perspective, this recommendation has some merit. If a future attack depends on deriving private keys from exposed public keys, reducing public-key exposure in advance could provide additional time for defense under certain conditions.
But moving assets to a fresh address with an unrevealed public key does not constitute a genuine migration to post-quantum cryptography.
As long as the new address still relies on a traditional signature scheme such as ECDSA, its underlying security assumptions remain unchanged. Once that address initiates a transaction, its public key may be exposed again. If the attacking capability is powerful enough, even the brief period between transaction broadcast and confirmation could become a new attack window.
This is therefore a transitional risk-mitigation measure, not a permanent solution.
More importantly, reducing theoretical cryptographic exposure does not necessarily make asset management safer in practice.
This is the point Vitalik particularly emphasized.
Under currently known technical conditions, there is still no practical method for directly recovering an ECDSA private key from a public key. By contrast, users lose onchain assets every day through incorrect addresses, faulty key backups, malicious approvals, and other operational mistakes.
Vitalik even noted that he had personally lost more from migration configuration mistakes than from hacks.
For an ordinary user holding a small amount of ETH, moving funds may involve little more than creating a new address, backing up the key, and making several transfers. The situation becomes far more complicated, however, for users who have long participated in DeFi, staking, or cross-chain activities—or who manage funds through multisig wallets.
Their assets may be distributed across several networks. Some funds may still be deposited in staking or lending protocols. Old addresses may retain smart contract administrator privileges, withdrawal rights, or other critical permissions.
If users launch a large-scale asset migration simply because they have seen a headline claiming that “AI may break wallets,” they may instead suffer irreversible losses by selecting the wrong network, misusing a bridge, signing a malicious transaction, or making an error during multisig coordination.
Worse still, once panic spreads around claims that wallets are about to be compromised, scammers are likely to distribute fake post-quantum upgrade links, asset-protection tools, and migration services.
Vitalik's caution does not mean that he takes a conservative stance on upgrading the underlying cryptography.
On the contrary, he also believes that the mathematical progress enabled by AI deserves serious attention. He has even urged the industry to reassess some lattice-based post-quantum schemes rather than assuming that an algorithm labeled “quantum-resistant” will automatically withstand every future mathematical breakthrough.
Where possible, he favors giving greater consideration to cryptographic structures based on hash functions and using more conservative security parameters for other approaches.
Justin and Vitalik therefore should not be reduced to an “aggressive” camp and a “conservative” camp. They do not fundamentally disagree.
Justin is emphasizing the long lead time required for protocol and ecosystem preparation. Vitalik is emphasizing that preparation at the system level does not mean ordinary users should rush into an immediate migration.
3. From Protocol Upgrades to Wallet Migration: How Far Has Post-Quantum Preparation Progressed?
Many users may now be asking: if foundational cryptography faces long-term risks, can a wallet app simply be upgraded into a “quantum-resistant wallet”?
Updating the wallet app alone is not enough.
For a blockchain, a cryptographic migration affects more than private-key generation and transaction signing. The entire network must be able to recognize and verify the new signatures, while existing accounts must be given a safe path to transition.
Even before the recent debate around AI, major public blockchains and cryptographic research organizations had already begun preparing for the post-quantum era.
Ethereum’s preparations, for example, already span several layers.
In addition to the ECDSA signatures used by ordinary accounts, Ethereum must eventually reassess or replace the BLS signatures used by validators, the KZG commitments involved in data availability, and cryptographic components used in certain zero-knowledge proof systems.
The Ethereum Foundation has established a dedicated Post-Quantum Security team and is exploring technologies such as leanXMSS and leanVM to provide new signature and proof mechanisms for the consensus layer.
At the user-account layer, account abstraction offers another promising path.
Unlike traditional EOAs, whose signature-verification mechanism is tightly coupled to the underlying protocol, account abstraction and replaceable verification logic could eventually allow user accounts to adopt different signature algorithms, creating a more flexible path for post-quantum upgrades.
EIP-8141, or Frame Transactions, is currently under discussion as part of Ethereum’s work on native account abstraction. It could become important infrastructure for more flexible signature verification in the future, although its deployment timeline and final implementation remain subject to further community discussion and testing.
Bitcoin faces a different set of challenges.
Because Bitcoin uses the UTXO model, supports several historical address types, and contains large amounts of long-dormant funds, the network must not only consider new signature algorithms and output structures but also determine how existing assets can be migrated. Relevant proposals remain at the drafting and coordination stage.
Other public blockchains have begun pursuing more direct implementations. In July 2026, for example, NEAR announced that its mainnet upgrade had added support for ML-DSA, a post-quantum signature scheme standardized under FIPS 204, allowing accounts to add quantum-resistant keys.
Supporting one post-quantum signature scheme, however, does not mean that an entire blockchain—together with all its accounts, applications, and infrastructure—has completed a post-quantum migration.
Taken together, these developments reveal the variety of challenges the industry must address.
A new cryptographic scheme must be sufficiently secure in theory. Its implementation must also take into account signature size, onchain verification costs, node performance, hardware compatibility, and the orderly transition of a vast number of existing accounts.
All of these protocol-level changes will ultimately reach the wallets that users interact with every day.
For a multichain non-custodial wallet such as imToken, a future cryptographic migration cannot be reduced to a simple version update.
On the one hand, the wallet will need to adapt gradually to new account and address types, key-management methods, and transaction signing and verification mechanisms as different blockchains upgrade. It may also need to maintain compatibility with hardware wallets, smart contract accounts, and multisig systems.
On the other hand, the wallet must translate complex technical changes into a migration process that ordinary users can understand.
If a blockchain officially introduces a new post-quantum signature scheme, users will want practical answers. Can they continue using their existing addresses? Do they need to create new accounts? Will their current seed phrases and hardware devices remain compatible? What happens to the tokens, NFTs, staked assets, and DeFi positions they already hold?
Wallet products may be able to resolve some of these questions. Others will require support from the underlying blockchain protocol, smart contracts, and the broader ecosystem.
The more complex the foundational security upgrade, the more thoroughly the user-facing migration process must be tested. This is not the kind of transition that should be handled through a hastily launched “one-click quantum protection” feature.
So what should ordinary users do today?
First, there is no need to move all assets solely because of this discussion. There is currently no evidence that the mainstream signature algorithms used by major public blockchains have been practically broken. Users should be particularly wary of unfamiliar links and migration tools promoted in the name of “post-quantum upgrades.” Any service asking users to import a seed phrase or private key—or to sign an unclear transaction—should be treated as highly suspicious.
Second, holders of large, long-term positions can begin improving their address-management practices. This means understanding the blockchain and address types they use, avoiding unnecessary reuse and signatures from high-value addresses, and carefully verifying wallet and network compatibility before changing how assets are stored. Any necessary migration should begin with secure key backups, careful recipient-address checks, small test transfers, and staged execution.
Finally, one distinction is easy to overlook: whether wallets will be able to support post-quantum signatures in the future and whether users need to move their assets today are two different questions.
Final Thoughts
In the blockchain world, we use mathematics and code to establish trust.
From this perspective, no one can guarantee that a cryptographic system considered secure today will never need to be changed over the coming decades—particularly if open financial networks are expected to secure trillions of dollars in assets over the long term.
But that does not mean every breakthrough in frontier research should cause ordinary users to immediately rearrange their holdings.
Cryptographic researchers must examine the worst-case possibilities. Public blockchain developers must design new security mechanisms well in advance. Wallet teams must provide reliable support for future upgrades and migrations. Ordinary users, meanwhile, should understand the actual risks and avoid making rushed decisions based on unverified claims.
We should neither assume that the crisis has already arrived nor overlook the fact that continued evolution is inevitable.
Stay clear-headed and proceed carefully.
For every crypto holder, that remains the best way to face an uncertain future.