Author: hosseeb, Partner at Dragonfly
Compiled by: AididiaoJP, Foresight News
Two days ago, OpenAI released 722 mathematical manuscripts in one go, billed as "the most important moment in the history of mathematics." Long-standing foundational problems that had stumped mathematicians for over a century were cracked one after another, and each problem took only 3 hours of compute. Mathematicians were stunned—they can no longer predict what will happen next.
Now it seems cryptography may be the next target.
Scott Aaronson says OpenAI has already set its sights on breaking cryptography.
It's time for the crypto industry to seriously confront the "mathematical doomsday"—what happens when superintelligent AI clusters turn their attention to foundational cryptography?
Matthew Green said on October 8 in reply to @kmad and @matthew_pines: "I think we might lose public-key cryptography."
Let's be clear: we're not talking about AI accelerating quantum computing. That's certainly possible, but quantum computing requires massive physical engineering, and AI can't pull it off overnight. The process takes time, and it's publicly visible. Preparing for the quantum era is critical, but the path is relatively clear.
We're talking about some unexpected mathematical breakthrough—something that overturns the foundational assumptions of classical cryptography, making it possible for ordinary computers to compute discrete logarithms and thereby break modern public-key cryptography.
This would be a catastrophe of existential proportions.
Justin Drake said on October 7: "Today I call on the blockchain industry to calmly begin planning for 'bunker mode.' My personal recommendation is to initiate a controlled mass migration of assets, moving them to new addresses—addresses where the public key is still hidden behind a hash."
In his now-viral "bunker mode" post, what Justin is essentially advocating is this: save yourself, protect your own token assets. Disaster may befall others, but at least you know you're safe.
This is cryptographic doomerism. It's the equivalent of saying that since you know the apocalypse is coming, you should start stockpiling supplies.
The problem with doomerism isn't its core assessment. There certainly exists some tail risk of a catastrophic failure. You can't simply say the risk is zero.
The problem with doomerism is its prescribed response: if this is true, what should we do?
We cannot know the probability that public-key cryptography has some fundamental weakness. It may be very low, but it is not zero. For the sake of argument, let's assume that possibility is 5%. That means there's a 95% chance everything is fine. We'll write blog posts about it, hem and haw, and ultimately nothing bad happens.
In fact, in that 95% scenario, AI most likely just confirms what we already believed: that public-key cryptography is sound.
But if I told you right now that I have a cryptographic scheme with a 95% chance of protecting your funds, you certainly wouldn't fully trust that scheme. Cryptographers measure security risk by standards where the failure probability is as low as 2^-128—that is, "virtually impossible to fail," not "probably won't fail."
Some will say: yes, but if ECDSA is broken, society faces problems far bigger than blockchain! Think about banks, TLS, certificate authorities—blockchain is the least of your worries.
But you shouldn't take that as comfort. Banks can recover, TLS can recover, certificate authorities can recover. They can redo KYC and switch to new cryptographic standards.
The crypto industry cannot. Once public-key cryptography fails, blockchain cannot recover. In the worst case, anyone can compute anyone else's keys, meaning anyone can take anyone else's money. We don't know who owns what, and we have no way to prove anything. It's no longer cryptocurrency—it's a graffiti wall, and we have to start from scratch.
Therefore, we must insure against this failure. We cannot guarantee that cryptography won't break, but we can guarantee that it won't destroy blockchain. This "optimization" must happen simultaneously at the protocol level and the social level, and it requires immediate action and coordination.
The common saying is "this is not a drill." But in reality, this is an absolutely necessary drill.
We're like those countries that must institute a universal draft and teach everyone to shoot. War may come, and you probably won't be sent to the front lines. But if you are, we need you to be able to become a real soldier immediately.
The opposite of doomerism is a decisive action plan. Don't retreat—prepare to withstand a possible catastrophe, which means we must start making changes now.
Why governance must change
Historically, our confidence in cryptography has been built on a set of social processes.
Cryptographers spend years trying to attack a construction. If it isn't broken, we say it's probably fine. Survive ten years, and we say it's almost certainly fine, and we place absolute trust in it in production. But virtually all cryptographic schemes are slowly broken—attacks improve, security margins shrink, and eventually you have to switch to something better.
This pace has never been fast for blockchain: migrations can take years, and social consensus can keep up with cryptographic changes.
But this premise is now shaking. We are about to face cryptanalysts stronger than any human, examining these schemes with a rigor never seen before. There are probably only a few thousand truly qualified cryptanalysts in the world, and that number is about to explode by orders of magnitude.
Everything humanity has accumulated in cryptanalysis over the past 40 years may amount to less than what AI will do next. Work that used to take a decade could be done in months. Or even overnight.
The pace that blockchain governance has grown accustomed to simply won't work in that environment.
This is wartime for cryptography, and peacetime norms no longer apply. We must be able to act extremely fast, because things can change extremely fast. If social consensus can no longer keep up with the speed of technological and cryptographic change, then social consensus must adjust immediately.
But won't that cause panic?
Vitalik said on October 8: "I don't recommend anyone rush to move their funds to a new wallet today. But we should take seriously the risks that AI-accelerated mathematics poses to cryptography, and minimize our exposure not just to quantum-vulnerable cryptography, but also to potentially AI-vulnerable cryptography."
Panic isn't the answer either. I agree with Vitalik: if you encourage people to panic, they're more likely to suffer losses in a rushed migration, which is worse than the actual risk of ECDSA keys being intercepted.
So-called "bunker mode" isn't a real way out either. You individually move your keys to a new address, and maybe you're safe. But then what? The crux of bunker mode is this: your coins can't move. As long as you don't move them, it protects you. But if the entire chain collapses, what good is it that you alone are safe? If everyone's coins are being stolen and dumped, your coins are worthless too. Even if your address is intact, what does it matter?
No, the solution must be systemic. Encouraging people to fend for themselves doesn't solve the problem.
At the same time, the claim that "the most important thing is for everyone not to panic" is becoming increasingly untenable. We should state the risks honestly and directly, get people to take them seriously, and push them to act.
This keeps reminding me of the Cold War. During the Cold War, Western societies were repeatedly told: nuclear war could break out. For most people, civil defense drills seemed useless—hiding under a desk won't stop a nuclear bomb. But precisely because everyone participated in the drills, society as a whole truly understood the severity of the risk. Political winds shifted toward avoiding war at all costs, while fallout shelters were built just in case. And in fact, we did come close to nuclear war several times. We were truly lucky. The Cuban Missile Crisis and the story of Stanislav Petrov both show: the probability is not zero.
On the cryptography question, we may get lucky. Probably we will, but we should be prepared in case luck is not on our side.
So how must governance change?
1) In a crisis, speed matters more than decentralization. Chains that can coordinate quickly will have the advantage. Decentralized social consensus is inherently mismatched with ultra-fast technological change. Governance mechanisms must adjust as quickly as possible. Even if that means loosening decision-making rules, even if that means giving validators more power, so be it. Potential crises require fast and decisive responses.
2) The entire ecosystem must mobilize. Not just protocol developers—wallets, exchanges, RPC providers, applications, asset issuers, and end users all need to move in lockstep, with the whole ecosystem responding together.
3) Plans must be made in advance. If things have already collapsed and there's still no plan, it will be too late.
The market will be watching which chains take this seriously. I've already received inquiries from large investors who understand why this is alarming and want to know whether our entire industry has an answer.So, let's give an answer.
Cryptographic Recovery Mode
I propose that every major blockchain get a mechanism online as soon as possible, which I call "Cryptographic Recovery Mode." This is a nuclear-war-level contingency to be activated only in the worst case.
The rough idea is as follows:
In the next protocol upgrade, add a completely new, extremely simple hash-based public key system. (Hash-based signatures rely on the fewest cryptographic assumptions.) This is Cold War-level minimalist cryptography. This scheme is slow and expensive, and extremely cumbersome to use. We don't want to touch it at all—as long as we can choose something else, almost anything is better. But if we really have to use it, the chain will slow to a crawl, and DeFi will basically be paralyzed.
But it works. Technically it works, and that's better than not having it.
Everyone uses this crappy signature scheme to create a backup key. All users will be guided to establish an association between their normal address and this hash-based backup key. At first it's optional, and after a few months it becomes mandatory. Once enforced, you cannot sign new transactions with your ECDSA key until you have set up your hash-based backup key. Without a backup key, transactions will simply fail.
Every exchange will also start generating backup keys for its own addresses. Coinbase, Metamask, and Ledger will notice that you don't have a backup key and will prompt you to create one before you sign. That way, everyone has a fallback. Of course, we'll still keep using ECDSA in normal times.
We pre-set an emergency switch. If disaster strikes and AI discovers a vulnerability in ECDSA, validators can reach consensus, activate the emergency plan, and enter crisis mode. No protocol upgrade is needed; the switch can be activated by validator vote alone.
Once the switch is activated, all addresses enter Cryptographic Recovery Mode. At that point ECDSA has already failed. Completely failed.
Then what?
By then, the chain will be a mess. Nothing will run, and it will be almost unusable—but technically, it can still run. Developers will have to start figuring things out: how big the damage is, which cryptography is still intact, and how to transition to a new chain so that performance returns to an acceptable level. At least for now, everyone's balance is still safe, and there is a way to recover.
What about those who didn't manage to migrate in time? It is almost certain that a substantial portion of addresses will be left behind.
People who still hold their mnemonic phrase can at any time generate a hash-based zero-knowledge proof of the mnemonic phrase (similar to @VitalikButerin's 2024 proposal) and assign themselves a new hash-based address. If their address has never signed any transaction (so-called "bunker mode"), then recovery using a zero-knowledge proof is simple.
But many people simply cannot do this. For them, the countdown has already begun. To recover, the only path is this: they must both generate an ECDSA signature and solve a proof-of-work hash puzzle in order to unlock the address and move the assets out. The difficulty of this puzzle adjusts according to the amount of native token held in the address. That is, if you hold 100 ETH, the difficulty is 100N.
But this N grows exponentially. After 1 day it's 100N, after 2 days it's 200N, then 400N, then 800N. Validators can vote to cap N or cap the growth rate, based on the shape of the vulnerability and how they model the risk. Maybe we'll have months, maybe only hours.
It should be noted that in a real attack scenario, this becomes a race. If someone really has found an efficient way to break ECDSA keys, the only advantage the true owner has is this: the attacker must first break the key and then do the proof of work, while the true owner only needs to do the proof of work, and should be faster. This makes large-scale theft difficult to carry out. Once large-scale theft is detected, validators can sharply accelerate the difficulty growth to stop more funds from flowing out (and if things spiral completely out of control, they can also raise the difficulty to infinity and permanently freeze all vulnerable coins).
I'm certainly missing many key details. This is just a proposal, and I am neither a cryptographer nor a protocol designer. But the general idea is: similar mechanisms should be implemented on every blockchain as soon as possible.
The market will soon demand this. Given what is happening in mathematics, every blockchain needs a backup recovery plan, and consensus must be reached in advance—so that when the moment really comes, no one is still arguing about how the transition should proceed.
In a crisis, speed is everything.
In this situation, we must not miss the point by chasing perfection. If OpenAI is pushing this forward right now, we don't know how soon an unexpected cryptographic breakthrough may appear. The first version of Cryptographic Recovery Mode can be rough (and probably should be rough), but once there is an initial plan, it can be gradually improved. (Note that if a quantum breakthrough suddenly appears, this mechanism also applies. But what it most needs to address is a fundamental break of the underlying cryptography.)
The key is that we should not just debate and fight on Twitter, but actually get to work.
Nothing can be once and for all
A few weeks ago I wrote an article arguing that Zcash should complete its post-quantum migration and then stop changing.
I now retract that statement. When the mathematical foundations beneath our feet are as shaky as they are now, nothing can be once and for all.
Maybe in a few years we will have more confidence in the foundations of cryptography. But right now, everything is still in flux.
This requires us to react faster, trust the judgment of protocol teams more, and be more honest about the trade-offs in front of us. In the end, it is about preserving the security foundation of the entire crypto industry amid rapid technological change.
The "mathematical doomsday" for cryptography is approaching, and we must be prepared.
I want to make one thing clear: most likely nothing will happen, and everything will be fine. AI will devote massive compute to it and eventually conclude that all of cryptography is sufficiently secure.
But we must ensure one thing: even in the worst case, the blockchain remains safe.