Ethereum researcher Justin Drake has sparked a debate that reaches far beyond crypto circles: could AI-accelerated mathematics break the ECDSA signature algorithm before a real quantum computer ever could? Ethereum co-founder Vitalik Buterin disagrees on the urgency — and warns of a different danger: rushed migrations.
Table of Contents
The warning: faster than expected
On October 7, 2026, Justin Drake, a researcher at the Ethereum Foundation, warned that ECDSA (Elliptic Curve Digital Signature Algorithm) — the mathematical foundation underpinning the security of Bitcoin, Ethereum, and virtually every other blockchain — might not fall to a quantum computer first, but to increasingly powerful, AI-assisted mathematics.
By “breaking” ECDSA, Drake means something very concrete: rapidly recovering a private key from a public key — for example, within a week on a large GPU cluster. In the worst case, Drake said, such a scenario could become feasible “in months, not years.”
This assessment matters because the entire “post-quantum security” discussion in the crypto industry has so far rested on one assumption: that there are still years left before specialized quantum hardware becomes large and stable enough to mount real cryptographic attacks. Drake’s thesis challenges that timeline — not because of new quantum chips, but because of the pace at which AI systems can now accelerate mathematical breakthroughs.
ECDSA explained: why a public key is normally safe
ECDSA is the algorithm that digitally signs every Bitcoin and Ethereum transaction. Every wallet holds a key pair: a private key that stays secret and is used to sign transactions, and a public key that is mathematically derived from it and can safely be made public — in theory without risk, because reversing the calculation (deriving the private key from the public one) is practically impossible with classical computers. This one-way function, based on what’s known as the elliptic curve discrete logarithm problem, has been the bedrock of blockchain security for more than a decade.
It is precisely this one-way guarantee that is now being questioned: if AI systems discover new, more efficient mathematical shortcuts for this problem, security would be undermined not by raw computing power but by smarter algorithms — regardless of whether a quantum computer exists at all.
Post-quantum cryptography: the other race
In parallel, the industry has for years been developing so-called post-quantum cryptography — new encryption and signature schemes designed to resist quantum computers as well. A prominent candidate is lattice-based cryptography, which relies on mathematical problems in high-dimensional lattices and underpins standards such as ML-DSA (Module-Lattice-Based Digital Signature Algorithm). These schemes are widely seen as the most likely successors to ECDSA in a quantum-capable future.
Drake’s recommendation: migrate gradually — but correctly
Given the risk he outlined, Drake recommended that crypto holders, especially large ones, gradually move their funds to addresses that have never sent a transaction. The reason: once an address sends its first transaction, its public key becomes visible and exposed on the blockchain — whereas an address that has only received funds and never sent any keeps its public key hidden.
Drake also issued a direct appeal to major centralized players: Binance, Bitbank, Robinhood, Bitfinex, and Tether should strengthen their cold-storage protections, since these platforms manage enormous amounts of user funds and a successful attack on their key management could have catastrophic consequences.
Buterin’s counter-position: the bigger danger is the migration itself
Vitalik Buterin did not dispute Drake’s underlying concern on the merits, but he pushed back hard on the urgency. His argument, condensed to a single line: “I have personally lost more money to bad migrations than to all hacks combined.”
Buterin’s core point: poorly planned, panic-driven key migrations — flawed smart contracts, misconfigured multisig setups, or hastily implemented new signature schemes — have historically carried a greater real-world loss risk than the theoretical threat they were meant to guard against. Rather than reacting with alarmism, he argues for carefully tested, gradual transitions.
As the actual bigger emerging risk, Buterin pointed to lattice-based cryptography itself — the very class of schemes positioned as the post-quantum solution. His reasoning: these algorithms are comparatively new, far less battle-tested than ECDSA, and could harbor undiscovered weaknesses that only surface once deployed at scale.
The numbers behind the debate
How large is the actual exposure risk today? Data from analytics platform Glassnode, cited by Rafael Schultze-Kraft, offers a concrete order of magnitude: 6.26 million BTC — equivalent to 31.2 percent of the entire circulating Bitcoin supply — sits in addresses whose public keys are already exposed.
Broken down, that figure splits into two causes: 4.33 million BTC is exposed due to address reuse (addresses that have sent at least one transaction), and 1.94 million BTC is exposed due to the underlying script type itself. Notably, an estimated 1.1 million BTC of that total is attributed to Bitcoin creator Satoshi Nakamoto — funds that have sat untouched on early addresses for years, and whose public keys would potentially become vulnerable should Drake’s worst-case scenario materialize.
Industry reactions
Drake’s warning triggered a wave of responses from other protocol developers. StarkWare CEO Eli Ben-Sasson proposed turning the layer-2 solution Starknet into an independent layer-1 blockchain to achieve full quantum resistance by 2027 — a radical architectural step that signals how seriously individual projects are now taking the issue.
Zcash developers, operating under the project name Zakura, also responded, pledging to roll out post-quantum signatures starting in January 2027. The urgency is particularly acute for Zcash, since an estimated 70 percent of all ZEC holdings sit in the transparent, unprotected pool of the blockchain — as opposed to the shielded pool, which offers additional privacy and potentially security advantages.
Regulators weighed in promptly too: Europol published two reports on quantum risks to digital assets on October 7. In the United States, it also emerged that the Government Accountability Office (GAO) found, in an audit, that none of the 24 largest federal agencies had fully implemented all three key measures for post-quantum readiness — a sign that the problem extends well beyond the crypto industry.
What this means for crypto holders
The Drake-Buterin debate highlights two legitimate but different risk calculations: acute exposure risk versus operational migration risk. For the vast majority of retail holders, Buterin’s call for caution is likely the more practical takeaway — a rushed, self-executed “quantum protection” transfer to a new address carries a real, high-probability risk of typos, mis-copied addresses, or seed-phrase management errors, whereas the AI-accelerated ECDSA attack described here remains, for now, a theoretical scenario.
For institutional custodians and exchanges holding very large balances on long-dormant, exposed addresses — including Binance, Bitbank, Robinhood, Bitfinex, and Tether, all explicitly named by Drake — the calculus is different: even a small probability-times-impact product already justifies additional investment in cold-storage infrastructure and careful planning of future post-quantum migrations — carefully planned, that is, not panic-driven.
One thing is clear: the clock for an orderly transition to post-quantum signature schemes is already running, regardless of whether Drake’s months-long scenario or a considerably longer timeline turns out to be accurate. Projects like Starknet and Zcash have already responded with concrete timelines — more are likely to follow.
