Justin Drake, a researcher at the Ethereum Foundation, is calling on the crypto industry to enter Bunker Mode: funds should move in an orderly way to addresses with a hidden public key. Behind the call is his warning that AI-driven mathematics could break the ECDSA signature scheme before quantum computers do.
ECDSA is the scheme Bitcoin and Ethereum use to sign transactions. An address is a hash of the public key and protects it until the first signature reveals it on-chain. If ECDSA were broken, it would thus be possible to derive the private key from the exposed key. In March 2026, Drake co-authored a Google Quantum AI paper on quantum attacks on elliptic curve cryptography. He published his call on X in October 2026. One day earlier, OpenAI had released 722 AI-generated mathematics manuscripts. Drake defines "breaking" as recovering a private key in roughly one week on available hardware like a large GPU cluster.
Subscribe to our newsletter
The best articles of the week, directly delivered into your mailbox.
How Bunker Mode is meant to protect funds
Bunker Mode targets a quirk of ECDSA. The public key only becomes visible at signing, so only addresses that have already signed a transaction would be exposed. Drake therefore recommends moving the remaining balance to a fresh address after every signature, if needed from the same seed phrase. Large and experienced holders should go first. In addition, he says the move needs neither new cryptography nor new wallets.
At the same time, Drake urges calm. A rushed migration would do more harm than good, which is why he speaks of planning, not haste. He specifically calls on Binance, Bitbank, Robinhood, Bitfinex and Tether to harden their cold storage. Signers that entire systems rely on should additionally rotate their ECDSA keys for each signed message. Examples include oracles and the security councils of layer-2 networks. As an alternative or addition, he proposes multi-signature setups with hash-based schemes such as SPHINCS. Project11's "risq list" already tracks exposed Bitcoin public keys and shows which holdings have revealed theirs.
For smaller holders, Drake points to what he calls the "Satoshi's shield" effect. By his account, around 20,000 exposed addresses belonging to Bitcoin creator Satoshi Nakamoto hold 50 BTC each on-chain. Attackers would likely target them first, he says. Wallets with less than 50 BTC thus enjoy partial protection. However, the address count comes from Drake himself, and no independent verification exists.
Why the Ethereum researcher sees AI mathematics as the nearer risk
OpenAI's release triggered the call. The company posted 722 mathematical manuscripts from an unreleased internal model online. They cover around 20 subfields, and some include formal proofs in Lean. No independent review of the results exists so far. Still, OpenAI plans to publish more Lean proofs and fund review programs.
Drake views recent progress in AI mathematics as a warning shot. He points out that the n-log(n) bound for integer multiplication and the 3SUM conjecture have fallen. He adds the disproof of the Erdős unit distance conjecture in May. In his view, elliptic curves are especially vulnerable because they have a rich algebraic structure. As keywords, he names Schoof, Frobenius and pairings. Hash functions, by contrast, are designed to minimize algebraic structure. Drake writes that it is now reasonable to prepare for the possibility of ECDSA breaking before Q-Day. In the worst case, he says, that could happen within months rather than years.
Furthermore, citing Ewin Tang, Drake speculates that an efficient quantum algorithm could be followed by a classical equivalent. One possibility, he says, would be a classical version of Shor's algorithm that breaks elliptic curves and RSA at once. The term superintelligence, which he uses to describe the threat, is Drake's own wording and not an established finding. Consequently, this is a scenario without a demonstrated attack.
Quantum risk and AI risk are two different scenarios
The Google Quantum AI paper from March 2026 shows how precisely researchers can now quantify the quantum risk. Besides Drake, the co-authors include researchers from the Ethereum Foundation and Stanford. Their paper describes two circuits for Shor's algorithm that target the secp256k1 curve. The first requires fewer than 1,200 logical qubits and 90 million Toffoli gates. The second needs fewer than 1,450 logical qubits and 70 million Toffoli gates. A superconducting quantum computer with fewer than 500,000 physical qubits could run the attack in a few minutes. Compared with earlier estimates, that amounts to roughly a 20-fold reduction. Google withheld the circuits themselves and instead published a zero-knowledge proof.
However, no quantum computer today can carry out this attack. Google's Willow chip has 105 qubits. So the gap to a machine with 500,000 physical qubits remains large. Google is targeting 2029 for its own migration to post-quantum cryptography. The company also recommends that blockchains make the switch, avoid reusing exposed addresses and consider options for abandoned coins. In March, Drake estimated the chance of Q-Day by 2032 at 10% or more. Q-Day refers to the day of a successful quantum attack.
What stands out is the asymmetry between the two scenarios. The quantum risk has a known method but no suitable hardware yet. The AI scenario, on the other hand, lacks any known method. Yet by Drake's definition, a breakthrough would run on existing GPU clusters. It follows from this definition that such a breakthrough would arrive without a hardware signal. That differs from the quantum risk, whose progress shows up in qubit counts. That said, Drake applies his time frame of months rather than years explicitly to the worst case only.
Hash-based cryptography as a way out for Ethereum
As a way out, Drake wants to go all in on hash-based cryptography. He wants to avoid structured mathematical assumptions such as curves, lattices or isogenies. Instead, in his view, a proven hash from the SHA or BLAKE family would provide plausible "post-AI" security. Ethereum's roadmap on strawmap.org already relies on hash-based schemes with end-to-end formal verification. Even so, Drake wants its timelines reviewed and accelerated, a course he calls "maximum defensive acceleration."
Moreover, the Ethereum Foundation formed its own post-quantum team this year. In November, Drake will speak to institutions in London as part of a Q&A by Ethereum Institutional. For institutional holders, this first brings cold storage hygiene to the fore. Along with it comes the question of which of their addresses have already exposed a public key. Ultimately, Drake's call is to plan calmly rather than migrate in panic.
