‘Bunker Mode’ Won’t Protect Your Crypto, Critics Say

If rising geopolitical tensions weren’t enough cause for concern, now it’s crypto’s turn to go nuclear.

The industry is busy debating a cryptography doomsday scenario in which attackers derive private keys from public keys using a formerly far-fetched, but now potentially credible, AI scenario that places everyone’s crypto at risk.

Ethereum researcher Justin Drake called for “bunker mode” planning last Wednesday, citing “humbling” advances in artificial intelligence that could accelerate the discovery of mathematical attacks and ultimately “break” cryptography:

“IMO it is now reasonable to brace for the possibility that ECDSA [Elliptic Curve Digital Signature Algorithm] breaks before Qday, in the worst case in months not years.”

Drake thinks the industry should begin planning a controlled migration of assets to fresh addresses whose public keys have not been exposed, reducing the information a potential attacker could exploit.

But what is he basing this warning on, and is there genuine cause for alarm?

Is the crypto panic justified?

Drake’s concern is not just whether AI will speed up the arrival of quantum computers able to break cryptography, but that AI systems might also help discover mathematical attacks using classical computing that human cryptographers have missed.

He argues that elliptic curves — the cryptography that underpins most blockchains — may be more vulnerable to such breakthroughs than hash functions because of their greater mathematical structure, which raises the possibility of a classical algorithm breaking elliptic curve cryptography.

Justin Drake wants the industry to plan for bunker mode. Source: Justin Drake

Matthew Green, a cryptography professor at Johns Hopkins University, weighed in on Drake’s assessment, adding fuel to the flames of panic already ripping through the crypto industry.

“I think we might lose public key cryptography,” he said.

Related: Too big to pause: Could an AI slowdown crash the economy?

Not everyone shares their alarm. Coinbase’s head of cryptography, Yehuda Lindell, said that, to his knowledge, there is “no evidence whatsoever” that the decades-old mathematical assumptions underpinning elliptic curve cryptography have been weakened.

Lucien Bourdon, Bitcoin analyst at hardware wallet Trezor, tells Magazine:

“There are no credible published advances against the math behind ECDSA, with AI or anything else.”

He says that none of OpenAI’s recent releases of AI-written math papers contain an attack on ECDSA — although Drake believes that’s cause for suspicion rather than comfort. Drake’s other argument is that elliptic curves have more mathematical structure than hash functions, which could make them easier to break.

“He doesn’t say how,” Bourdon says. “He also calls his timeline a worst-case scenario and tells people not to rush.”

Zach Herbert, chief executive and cofounder of hardware wallet FoundationHQ, tells Magazine that moving funds to fresh addresses may not be enough if an extended public key (xpub) has already been shared with a wallet app or third party.

In that case, “they already have the information needed to derive the public keys you’re trying to hide,” he says.

And as Taylor Monahan, founder and chief executive of Ethereum wallet MetaMask, pointed out, if cryptography breaks, the price of your bags won’t be your only concern:

“If elliptic curves are broken so that any exposed public key leads to compromise and it’s by a financially-motivated hacker whose top priority is to steal crypto, the entire fu**ing world is going to zero. Having your magic internet coins in bunker mode is not going to help you.”

Why moving coins may not be enough

Herbert says xpubs let wallets generate multiple public keys for the same account, including those for addresses that have never been used.

If a wallet app or third party already has that information, moving funds to a fresh address within the same account may not hide the new address’s public key from them.

If ECDSA became practically breakable, “an attacker could recover the corresponding private keys without ever touching your hardware wallet.”

Related: Dragonfly partner rejects ‘bunker mode’ doomerism, calls for proactive blockchain measures

“No, it’s obviously not sufficient protection,” Eli Ben-Sasson, co-founder and chief executive of Ethereum scaling protocol StarkWare, tells Magazine.

“Other than just moving your coins, if you want to use them ever again, you would need to download new kinds of wallets.”

He says a break would affect more than wallet signatures, too. Ethereum’s infrastructure-level signatures and consensus mechanisms would also need attention, as would the Kate-Zaverucha-Goldberg (KZG) polynomial commitment scheme used for data in blobs.

“Finally, gas prices would likely also increase dramatically, because a lot of the functionality would break,” he adds.

On Bitcoin, some address types conceal the full public key behind a cryptographic hash until the coins are spent. If the relevant hash functions remain secure, this could provide an additional layer of protection against an attacker trying to derive a private key from a public key. Taproot addresses, by contrast, expose a public key directly onchain.

Creating a P2PKH public key hash to receive payment. Source: Bitcoin.org

Bourdon says common SegWit addresses, which begin with bc1q, keep public keys hidden until spending, and wallets like Trezor generate fresh receiving addresses to limit address reuse.

“There’s nothing to do right now,” he says, adding that a panicked migration will do more harm than good. “People who rush to move funds make mistakes, and scammers use stories like this one to reach them.”

It’s also worth noting that any time you spend a Bitcoin, the public key gets exposed in the mempool anyway, providing a window of opportunity for an attack.

Not all crypto assets are created equal

Some blockchains are already preparing for cryptographic threats, although their proposed solutions vary.

On AI-focused NEAR Protocol, users can add a quantum-safe FIPS-204 key to an existing mainnet account in a single transaction, without moving their assets, and wallets like Meteor support quantum-safe signing. This relies on lattice based cryptography, which Ethereum creator Vitalik Buterin worries may also be vulnerable to attack.

Ethereum is developing a broader post-quantum roadmap using hash based signatures and ZK proof aggregation, that covers everything from transaction signatures to consensus and data security. It also has an emergency hard fork and recovery proposal mapped out on paper.

In a March 2024 post, Vitalik Buterin outlined a potential hard fork that would roll back blocks following the onset of mass theft, disable conventional wallet transactions and let users reclaim funds by using zero knowledge proofs of a seed phrase.

Related: Vitalik Buterin backs crypto ‘bunker mode’ amid rapid AI math advances

Max Shannon, senior research associate at Bitwise Europe, says that remains a proposal with “no set timeline.”

While no one has shown a working attack as of yet, he says users should switch to quantum-safe signatures “over the long term.”

Hardfork in a quantum emergency. Source: Eth Research

Starknet’s account abstraction architecture allows users to switch signature schemes without migrating funds to a new address. Ben-Sasson says the core technology doesn’t need to be changed, “because account abstraction means you can take any signature scheme.”

But he says other components still need attention, including parts of the network’s state tree and its reliance on Ethereum for security.

Switching to a new address isn’t going to help users on Solana, as public keys are exposed by default — though they can migrate funds to a post quantum vault like Winter Wallet.

Solana Foundation technology vice president Jacob Creech said Solana users would not need to enter “bunker mode” if its signature scheme became breakable.

A network upgrade could let users prove ownership of their secret seed using a hash-based proof and migrate their accounts to a safer signature scheme. A working proof of concept exists, he says, though the upgrade itself has not been deployed.

So, should crypto holders be panicking?

Shannon says Bitwise isn’t worrying about this theoretical risk for now, but it’s “worth being prudent over.”

“We can discuss fresh addresses and xpub exposure as a thought experiment,” Herbert says, “but I wouldn’t pretend those steps amount to a practical plan for that scenario.”

Because some people have old devices, complicated multisignature arrangements, or Bitcoin they haven’t touched in years, he says a software update “would not automatically protect those coins.”

Bourdon reminds crypto holders to scrutinize the source, since Drake’s warning was accompanied with talk of Ethereum’s moves toward the hash-based cryptography he recommends.

“So the warning about an unproven threat doubles as a pitch for Ethereum’s roadmap,” he says.

While that doesn’t prove Drake wrong, there is still no evidence that ECDSA is about to be broken, and plenty of risks involved with rushing to move funds.

But if the cryptography underpinning crypto wallets and blockchains does fail, moving coins may be the easiest part of the industry’s response.

Magazine: Crypto lending rises again… but have they solved the risks?