Author: imToken
Over the past few days, discussions about "AI potentially breaking cryptography" have genuinely stirred up a wave of panic in the Crypto community.
The matter originated on October 7, when Justin Drake called on X for the entire blockchain industry to calmly begin planning for "Bunker Mode" to address potential future cryptographic risks.
His core concern is that, as AI continues to advance in mathematical research, the elliptic curve cryptography widely used in networks such as Bitcoin and Ethereum may face new mathematical attack methods before truly cryptographically capable quantum computers emerge.
In the worst-case scenario he outlined, related breakthroughs might even be measured in "months rather than years," so he suggested that large holders and institutions should be the first to consider orderly asset migration to minimize the potential risks posed by already exposed public keys.
Subsequently, Vitalik Buterin also joined the discussion.
Interestingly, Vitalik did not deny that AI might accelerate cryptographic research, and even further suggested that some cryptographic schemes believed to be resistant to quantum attacks might also be affected by future mathematical breakthroughs.
But on the question of whether ordinary users should immediately migrate assets, he emphasized that the real losses caused by hasty upgrades and migrations may be more worthy of immediate vigilance than cryptographic attacks that have not yet occurred.
This also raises a long-standing question that troubles the entire crypto industry: when the underlying cryptographic assumptions protecting on-chain assets begin to face new challenges, how far in advance do public chains need to prepare, and when should ordinary users act?
I. Why is there risk? First understand the distance between "address" and "public key"
To understand the focus of this discussion, we first need to return to the most basic account and signature mechanisms of public chains.
As is well known, in non-custodial wallets, the private key is the key credential for controlling assets. At the technical level, wallets use digital signature algorithms to prove that a transaction has indeed been authorized by the holder of the corresponding key without disclosing the private key.
Among these, the most typical is elliptic curve cryptography (ECC).
Taking Ethereum as an example, ordinary externally owned accounts (EOAs) use ECDSA to generate transaction signatures. Bitcoin's traditional signature system also widely uses ECDSA, while Taproot adopts Schnorr signatures based on the same elliptic curve.
The long-term reliable operation of these schemes depends on an important mathematical assumption: it is very easy to calculate the public key from the private key, but deriving the private key in reverse from the public key alone is almost infeasible under currently known classical computation methods.
We can understand this as a mathematical problem that is easy to verify but extremely difficult to solve in reverse. Anyone on the network can use the public key to verify whether a signature is valid, but cannot thereby easily infer the signer's private key.
It is precisely this asymmetry that forms an important foundation of modern blockchain asset ownership.
But there is also a detail here that is easily overlooked: the "wallet address" we see in daily use is not always the complete public key.
Taking an ordinary Ethereum EOA as an example, the wallet address is an identifier generated from the public key after Keccak-256 hashing and then truncating part of it. In Bitcoin, common address types such as P2PKH and P2WPKH also adopt designs based on public key hashing.
This creates a very interesting security difference.
For an ordinary Ethereum account that has never initiated an on-chain transaction and has not exposed public key information through other means, the outside world can usually only see the hashed wallet address. Since existing computation methods make it difficult to reverse the full public key from the address hash, the public key is effectively protected by an extra layer.
But when this account actively initiates a transaction and submits an ECDSA signature, nodes can recover the corresponding public key from the signature information. Since on-chain transaction records are public for a long time, this part of the information will also remain continuously exposed to the outside world.
This means that for accounts using public-key-hash addresses, accounts whose public keys have not yet been exposed and those whose public keys have already been exposed may have different risk levels when facing certain future cryptographic attacks.
It should be emphasized that this does not mean all public chains follow exactly the same rules.
For example, Bitcoin's Taproot outputs themselves contain a visible elliptic curve public key, so even if a Taproot address has never actively spent funds, one cannot simply assume that its public key is still hidden behind a hash function; in addition, some public key information may also be exposed in advance through address reuse, public signatures, extended public keys, or other means.
Therefore, "having never transferred assets out" does not necessarily equal "the public key has not been exposed," and a new address does not inherently have quantum-resistant security.
Once this layer of difference is understood, it becomes much easier to look at the challenges brought by quantum computing and AI.
In theory, a quantum computer with sufficient scale and error correction capability could use this algorithm to efficiently solve the elliptic curve discrete logarithm problem and derive the private key from the public key, thereby threatening signature systems such as ECDSA and Schnorr.
But so far, there is no evidence that a quantum computer already exists that can actually break the mainstream signature systems of Bitcoin or Ethereum.
What Justin Drake raised this time is a concern that, beyond quantum computers, focuses on how AI may help humans discover solution shortcuts that existing mathematical algorithms have not yet found. In particular, as AI has continued to make progress over the past year in mathematical reasoning, algorithm search, and formal proofs, some researchers have begun to rethink whether those computational hardness problems tested over decades might be reevaluated because of new mathematical discoveries.
II. There is no essential disagreement between Justin and Vitalik
Having clarified the underlying logic, if we look back at the discussion between Justin and Vitalik, we will find that their judgments are not completely opposed; they simply assign different priorities to different risks.
Let us first look at Justin Drake.
Traditionally, the replacement of cryptographic systems is often a long process. After all, from identifying potential risks and formulating new standards to completing engineering implementation, and then to compatibility and coordination among public chains, wallets, exchanges, custodians, and hardware devices, it often takes years or even longer.
Not to mention decentralized networks as large as Bitcoin and Ethereum that require extensive coordination, where underlying upgrades usually cannot be completed with a single version update like ordinary software.
What Justin worries about is precisely that this long upgrade cycle may not keep pace with future breakthroughs in mathematical research.
For example, if in the future AI really helps researchers find new cryptographic attack methods, then even without waiting for quantum computers to have practical cracking capability, existing elliptic curve signature systems may also be threatened in advance.
And once such a breakthrough truly occurs, the migration window left for public chains and the wallet ecosystem may be far shorter than previously imagined.
Therefore, his standpoint is to take preventive measures and emphasize that exchanges, large institutions, and users holding large amounts of assets should now begin thinking about future hedging paths.
This includes taking stock in advance of addresses whose public keys have already been exposed, orderly transferring some long-term holdings to new addresses whose public keys have not yet been exposed, and minimizing unnecessary signatures and address reuse in subsequent use.
Technically speaking, this suggestion does have its rationality - if future attacks depend on deriving private keys from public public keys, then reducing the exposure surface of public keys in advance may, under certain conditions, buy more defensive time.
But the problem is that transferring funds to a new address whose public key has not yet been exposed does not equal completing a true post-quantum cryptographic migration.
Because as long as the new address still uses traditional signature schemes such as ECDSA, its underlying security assumptions have not fundamentally changed. Once the address is used to initiate a transaction, the public key may still be exposed again; if the attack capability is strong enough, even the brief window after a transaction is broadcast and before confirmation may become a new risk point.
In other words, this is a transitional risk mitigation measure, not a final solution that can solve the problem once and for all. More importantly, reducing potential risk from a cryptographic perspective does not mean it is necessarily safer from the perspective of actual asset management.
This is also what Vitalik particularly emphasized.
Under currently known technical conditions, directly recovering an ECDSA private key from a public public key still lacks a feasible practical attack method, but losses during on-chain asset migration caused by address errors, key backup mistakes, malicious approvals, or other operational problems are real risks that can occur every day.
Vitalik even mentioned that his losses due to migration configuration mistakes were greater than losses caused by hacker attacks.For ordinary users who hold only a small amount of ETH, migrating assets may simply mean creating a new address, backing up keys, and initiating a few transfers; but for users who have long participated in DeFi, staking, cross-chain interactions, or even manage funds through multisig wallets, the situation is far more complex.
Assets may be scattered across different networks, some funds may still be in staking or lending protocols, and old addresses may also hold smart contract admin, fund withdrawal, or other critical operational permissions.
If you temporarily carry out a large-scale asset migration just because you saw the news that "AI may crack wallets," you may instead suffer irreversible losses due to transferring to the wrong network, misusing cross-chain tools, signing malicious transactions, or making multisig operational mistakes.
Not to mention that once the market begins to spread panic that "wallets are about to be cracked," various links claiming to be official quantum-resistant upgrades, asset protection tools, and so-called migration services may also appear.
It is worth noting that Vitalik's caution does not mean he holds a conservative attitude toward underlying cryptographic upgrades.
On the contrary, he also believes that the mathematical advances brought by AI deserve serious study, and even reminds the industry to re-examine some post-quantum schemes based on lattice cryptography, so as to avoid assuming that an algorithm can withstand all future mathematical breakthroughs simply because it has been labeled "quantum-resistant."
When conditions permit, he also tends to give more consideration to cryptographic structures based on hash functions, and to adopt more conservative security parameters for other schemes.
Therefore, Justin and Vitalik cannot really be simply classified into radical and conservative camps; there is no essential deep contradiction between the two.
III. From public chain upgrades to wallet migration: how far has real quantum-resistant preparation actually come?
Many users may ask: since there are long-term risks in the underlying cryptography, can wallets directly help me upgrade to a "quantum-resistant wallet"?
Updating the wallet app alone is not enough.
Because for blockchain, cryptographic upgrades involve not only how private keys are generated and how transactions are signed, but also whether the entire network can recognize and verify new signatures, and whether existing accounts can transition smoothly.
In fact, even without this discussion triggered by AI, mainstream public chains and cryptographic research institutions had already begun preparing for the post-quantum era.
Taking Ethereum as an example again, its quantum-resistant preparation already involves multiple levels.
In addition to the ECDSA used by ordinary accounts, the BLS signatures used for validator consensus, the KZG commitments related to data availability, and some zero-knowledge proof systems all involve cryptographic structures that will need to be re-evaluated or upgraded in the future.
The Ethereum Foundation has established a dedicated Post-Quantum Security research team for this purpose, and is exploring technologies such as leanXMSS and leanVM to provide new signature and proof schemes for the consensus layer.
At the account level for ordinary users, account abstraction provides another path worth watching. Unlike traditional EOA signature verification mechanisms, which are tightly bound to the underlying protocol, account abstraction and replaceable signature verification mechanisms are expected in the future to allow user accounts to adopt different signature algorithms, thereby preserving more flexible room for post-quantum upgrades.
For example, EIP-8141, which is still under discussion, is related to Ethereum native account abstraction and is expected to become an important foundation for supporting more flexible signature verification in the future. However, its specific deployment time and final implementation method still await further community discussion and testing.
By contrast, the challenges facing Bitcoin are different.
Because it uses the UTXO model, and because historical address types are complex and some early assets have long been dormant, Bitcoin must not only consider new signature algorithms and output structures, but also solve the problem of how to migrate a large number of existing assets. Relevant community drafts are still in the proposal and coordination stage.
In addition, some other public chains have already begun attempting more direct engineering implementation. For example, in July 2026, NEAR announced that its mainnet upgrade already supports ML-DSA post-quantum signatures based on FIPS 204, providing accounts with the ability to add quantum-safe keys.
Of course, supporting a certain post-quantum signature does not mean that the entire public chain and all its accounts, applications, and infrastructure have already completed quantum-resistant migration.
Putting these developments together, it becomes clear that the real difficulties facing the industry are diverse. They include not only that new cryptographic schemes must be sufficiently secure in theory, but also that signature size, on-chain verification cost, node performance, hardware compatibility, and whether a large number of existing accounts can transition smoothly must all be taken into account.
And these changes at the protocol layer will ultimately land on the wallets users use every day.
For a multi-chain non-custodial wallet like imToken, future cryptographic upgrades cannot possibly be just a simple version update:
On the one hand, wallets need to gradually adapt to new account and address types, key management methods, transaction signing and verification mechanisms as different public chains upgrade, and may also involve compatibility with hardware wallets, smart contract accounts, and multisig systems;
On the other hand, wallets also need to translate complex underlying technical changes into operations that ordinary users can understand. Suppose that in the future a certain public chain officially supports a new post-quantum signature scheme. What users really care about is only whether their original address can still be used, whether they need to create a new account, whether existing mnemonic phrases and hardware devices are compatible, and how the Tokens, NFTs, staking assets, and DeFi positions they already hold should be handled;
Some of these problems can be gradually solved through wallet product capabilities, while others must wait for support from public chain protocols, smart contracts, and the entire ecosystem.
This is also why, the more complex the underlying security upgrade is, the more the user-side migration process needs to undergo sufficient testing, rather than temporarily launching a so-called "one-click quantum-resistant" entry point.
So at this stage, what exactly should ordinary users do?
First, there is no need to immediately move all assets just because of this discussion. There is currently no evidence that the signature algorithms of mainstream public chains have actually been broken. In particular, be vigilant against unfamiliar links and migration tools spread under the name of "quantum-resistant upgrades." Any operation that asks you to import mnemonic phrases or private keys, or induces you to sign unknown transactions, should be treated with extreme caution;
Second, for large, long-term holdings, you can begin to consciously improve address management habits. For example, understand the public chain and address type you are using, reduce unnecessary repeated use and signing operations for high-value asset addresses, and if you really need to adjust the asset storage structure, first confirm wallet and network compatibility, make key backups, verify receiving addresses, and reduce migration risk through small-amount tests and batch operations;
Finally, and most easily overlooked: whether wallets can support post-quantum signatures in the future and whether users need to migrate assets today are two different questions;
In conclusion
In the world of blockchain, we build trust through mathematics and code.
From this perspective, for an open financial network expected to carry trillions of dollars in assets over the long term, no one can guarantee that cryptographic schemes secure enough today will not need adjustment in the coming decades.
But this does not mean that every breakthrough in frontier research requires ordinary users to immediately rearrange their assets.
Cryptographic researchers need to focus on the worst possibilities, public chain developers need to design new security mechanisms in advance, wallet teams need to provide reliable support for future upgrades and migrations, and ordinary users need to avoid making hasty decisions based on unverified information on the basis of truly understanding the risks.
There is no need to assume that a crisis is already at hand, nor to underestimate the inevitability of evolution. Stay clear-headed and act prudently.
For every coin holder, this is the best way to face the unknown.