The warning, and the shrug#
On October 7, Ethereum Foundation researcher Justin Drake posted a call for the industry to “calmly begin planning for ‘bunker mode’”. His worry is not quantum computers this time. It is AI. He wrote that it is now reasonable to brace for ECDSA, the signature scheme behind Bitcoin and Ethereum wallets, breaking before quantum computers arrive, “in the worst case in months not years.” By break he means recovering a private key in about a week on hardware you can rent today, like a large GPU cluster.
Hours later Vitalik Buterin answered: “I don’t recommend anyone scramble to move their funds to new wallets today.” Milk Road re-aired a conversation about the whole episode this week, and the host lands on Vitalik’s side. Don’t panic, nobody is coming for your $200 MetaMask wallet, and crypto is the trust layer AI agents will need anyway.
I think both camps are right about different people. Most holders should not panic. But the thing Drake is asking for is small, cheap, and mostly a habit Bitcoin users were told to keep years ago. If you hold a meaningful amount on an address whose public key is already on-chain, you can fix it with one transaction. The odds of the scary scenario barely matter when the fix costs about as much as a stamp.
What actually set this off#
The video compresses the timeline, so here is what happened, checked against the primary posts.
The trigger was OpenAI’s math dump, not Navier-Stokes. On October 6, OpenAI published 722 manuscripts from an unreleased internal model, grouped into 372 result families. Drake’s post the next day cites that release, plus the fall of the n log(n) bound for integer multiplication, the 3SUM conjecture, and May’s AI disproof of the Erdős unit distance conjecture, which he called “our warning shot.” He never mentions Navier-Stokes. He also points out that the release contained strikingly few cryptography results, which he reads as suspicious, not reassuring.
The Navier-Stokes claim is a month older and still a claim. On September 8, OpenAI said a system of coordinating agents, with “on the order of 10,000” running at once in the winning group, had produced a proof that a forced 3D fluid can blow up in finite time, with a Lean formalization. That is a big deal if it holds. It is not an officially solved Millennium Prize Problem. The Clay Institute requires publication, two years, and broad acceptance first, OpenAI says it won’t claim the prize, and at least one paper argues the Lean version does not match the written proof. It is also fluid dynamics, not cryptography.
The “100 problems” figure is OpenAI’s own September claim. OpenAI said then that its model had resolved more than 100 long-standing open problems. The October release is the paper trail, and it is not spotless: OpenAI withdrew three manuscripts a day later over a sign error and revised 14 others.
The honest summary: AI is producing serious math faster than anyone planned for. Nobody has shown an attack on Bitcoin or Ethereum keys. Drake is betting that the first fact makes the second one temporary.
What an exposed public key is#
Your wallet has a private key, which signs, and a public key, which lets everyone check the signature. Going from private to public is easy. Going backward is the problem the whole system bets is impossible.
Most Bitcoin addresses do not show the public key. They show a hash of it. Until you spend, an attacker has nothing to work on, even with a perfect elliptic-curve attack, because they would first have to reverse the hash. Hashes are exactly the kind of math Drake and Vitalik both trust more.
The key becomes public in a few ways:
- You spent from the address and kept using it. Spending puts the public key on-chain. Any coins still sitting on that address, or sent to it later, are now behind an exposed key. Project Eleven’s data says this is most of the problem.
- Very old P2PK outputs. Many 2009 to 2011 mining rewards, including the coins attributed to Satoshi, put the public key directly in the output.
- Taproot (addresses starting bc1p). This one surprises people. A Taproot output shows its public key from the moment it receives coins, no spend needed. Some commentary this month said the opposite. Project Eleven’s report counts every Taproot output as exposed, and that matches how Taproot works.
- Ethereum accounts that have ever sent a transaction. Ethereum lets anyone recover the sender’s public key from a signed transaction. Your main account, the one you approve tokens and use DeFi with, has been exposed since its first transaction. Project Eleven’s report cites a Deloitte analysis that over 65% of ETH sits in exposed addresses.
Project Eleven’s 2026 report put about 6.9 million BTC behind exposed keys as of February, roughly a third of supply, and its tracker has since passed 8 million. Treat those as upper-bound estimates from a company that sells post-quantum security. The direction is clear either way: most exposed bitcoin is exposed because of reuse, which is a habit, not a law of physics.
Who should actually move#
Move, carefully, soon: large holders, funds, treasuries and exchanges with cold storage on reused or Taproot addresses. Drake addressed big players by name, including Binance, Robinhood, Bitfinex and Tether. Also load-bearing signers like oracles and L2 security councils, which he says should consider rotating keys with every signed message.
Worth doing when convenient: anyone with long-term savings on an address that has already sent coins, or on a bc1p address. As Vitalik put it, “If it’s easy for you, do it.”
Low priority: small balances. Drake himself says wallets under 50 BTC get partial cover from “Satoshi’s shield”, the roughly 20,000 exposed early addresses attributed to Satoshi, holding 50 BTC each, that make far juicier first targets. If your coins sit on an exchange, the keys are the exchange’s problem, so ask them what they are doing about it.
How to do it on Bitcoin#
- Check your exposure. In your wallet’s address or coin list, look for addresses that have both sent and still hold coins, addresses you have received to more than once, and anything starting with bc1p. A block explorer shows whether an address has ever sent.
- Make a fresh receive address in the same wallet. Use a native SegWit address (bc1q) that has never been used. Drake suggests the new address can come from the same seed phrase, and in a standard HD wallet, an exposed key on one address does not expose its siblings.
- Verify, test, then send. Check the address on your hardware wallet’s screen, not just your computer. Send a small amount first, confirm it arrived, then move the rest. At this morning’s fastest mempool rate, a simple one-input sweep costs around 20 US cents. Merging many old coins into one transaction costs more and links them publicly, so weigh the privacy trade-off.
- Leave it alone. In Bitcoin a spend uses up the whole coin, and good wallets send change to a new address. The danger is leftovers or new deposits landing on an address that has already signed, so never reuse an address.
How to do it on Ethereum#
Ethereum is harder because accounts are meant to be reused. The practical version is two accounts: a fresh vault address that receives but never sends, and a working account for approvals, swaps and DeFi. Move savings into the vault and leave it there. You can send ETH and tokens into an address without it ever signing. For multisigs, Vitalik’s advice is to collect confirmations off-chain, so signer signatures never hit the chain. If ECDSA falls early, the multisig degrades to a 1-of-1 held by whoever gathered the signatures, instead of anyone being able to take the money.
Why panic is the wrong move#
There is no demonstrated attack. Coinbase’s head of cryptography, Yehuda Lindell, called Drake’s warning “the very definition of FUD”, because it cannot be proven wrong and has no evidence behind it. Vitalik takes the risk more seriously than Lindell does, and still warned: “I personally have lost more money in botched migrations than I have lost in all hacks combined.”
That line is the real risk for most people this month. A rushed migration means wrong addresses, addresses copied from a poisoned transaction history, and fake “bunker mode” wallet upgrades asking for your seed phrase. No legitimate migration ever needs your seed phrase typed into a website. If something is pushing you to move everything tonight, that is the attack.
The host’s bigger point, that crypto is the trust layer AI agents will need, only works if the signatures keep holding. That is why I think the calm version of Drake’s advice deserves a yes. Not because ECDSA is about to fall, but because a hidden key costs nothing to keep hidden, and the people building the post-AI cryptography need time. Ethereum’s lean roadmap is already going hash-based for that reason.
Spend 20 minutes this week checking which of your addresses have ever signed. If your savings sit behind an exposed key, move them once, slowly, with a test transaction first. Then get back to ignoring the timeline.