Mentioned in This Article
1. What is crypto bunker mode?
Bunker mode crypto is a defensive plan proposed by Ethereum researcher Justin Drake in a post on X on Wednesday, October 7, 2026. It asks holders to move funds to fresh addresses whose public keys have never been revealed, in case artificial intelligence breaks the ECDSA signature scheme that protects most blockchains. Several cryptographers and wallet makers now say the plan would not work as intended, and that the threat itself remains unproven.
The disagreement touches one of the most sensitive assumptions in digital assets: that nobody can work backward from a public key to the private key that controls the funds. For years, the usual concern about that assumption was a future quantum computer. Drake's argument adds a second path, in which advances in AI lead to a mathematical shortcut that human researchers have not found.
Drake described his view as a precaution rather than a prediction. He wrote that it is now reasonable to brace for the possibility that the Elliptic Curve Digital Signature Algorithm, or ECDSA, breaks before so-called Qday, the date on which quantum machines become capable of defeating current cryptography. In his worst-case reading, that could happen within months. He cited what he called humbling progress in AI systems as the reason for taking the scenario seriously.
2. What did Justin Drake propose?
Drake recommended a controlled migration of assets into new addresses that have not yet exposed a public key on a blockchain. The logic is straightforward. If an attacker needs a public key to derive a private key, then an address that has never signed a transaction offers less to work with than one whose key is already visible in the public record.
The proposal rests on how different chains handle keys. Some address formats keep the full public key hidden behind a hash until the owner spends from the address. Others, including Bitcoin's Taproot format, place the public key on chain from the start. Drake's plan favors the first group, and it assumes that the hash functions protecting those addresses stay secure even if the signature scheme does not.
He also explained why he considers elliptic curves, which underpin most blockchains, more exposed than hash functions. In his view, the mathematical structure of elliptic curves gives an AI system more room to discover an attack than the comparatively unstructured design of a hash function. He added that AI might speed up quantum computing and might also uncover classical attacks that cryptographers have so far overlooked.
3. Who backs the warning, and who does not?
Matthew Green, a cryptography professor at Johns Hopkins University, gave the concern some support, saying he thinks the world might lose public key cryptography. That remark was about the broader category of tools that includes elliptic curves, not about a specific attack on Bitcoin or Ethereum.
Others reacted with open doubt. Yehuda Lindell, head of cryptography at Coinbase, said he knows of no evidence whatsoever that the decades-old mathematical assumptions behind elliptic curve cryptography have weakened. His position is that the field's confidence in those assumptions has not changed, whatever AI tools can now do in other areas of mathematics.
Lucien Bourdon, a Bitcoin analyst at hardware wallet maker Trezor, made a similar point more bluntly. He said there are no credible published advances against the math behind ECDSA, with AI or anything else. He noted that none of the recent AI-written mathematics papers from OpenAI target ECDSA, though Drake reads that absence as suspicious rather than reassuring.
Bourdon also argued that Drake has not spelled out how the structural weakness he describes would be exploited. "He doesn't say how," Bourdon said. He added that Drake himself labels his timeline a worst case and advises against rushing, which in Bourdon's reading leaves little basis for urgent action.
4. Would moving coins to new addresses actually help?
Critics say the plan has practical gaps even if the premise were accepted. Zach Herbert, chief executive and cofounder of hardware wallet company FoundationHQ, pointed to extended public keys, known as xpubs. A wallet can share an xpub with an app or another third party so that the third party can watch balances. From that single piece of data, anyone can derive every public key the account will ever use, including keys for addresses that have never received a payment.
That means moving funds to a fresh address inside the same account may hide nothing. Herbert warned that if ECDSA became practically breakable, an attacker could recover the matching private keys without ever touching the owner's hardware wallet. In that case the owner's own device offers no protection, because the exposed data lives elsewhere.
Taylor Monahan, founder and chief executive of MetaMask, took the argument further. She said that if elliptic curves break, the damage would reach well beyond token prices, and that a financially motivated attacker would not be stopped by users shuffling coins between addresses. In her words, holding assets in bunker mode would not help.
Eli Ben-Sasson, cofounder and chief executive of StarkWare, which builds an Ethereum scaling protocol, answered the question directly. Moving coins, he said, is obviously not sufficient protection. Even after a move, holders would need new kinds of wallets to use their funds again, since the signature type they rely on would no longer be trustworthy.
5. How far would a break of ECDSA reach?
Ben-Sasson stressed that the consequences would not be limited to wallet signatures. On Ethereum, a break would also hit signatures at the infrastructure level, the consensus mechanisms that validators use, and the KZG polynomial commitment scheme used to handle blob data. He said gas prices would probably climb sharply because so much functionality would stop working.
That wider view changes what a sensible response looks like. A holder who relocates coins protects, at most, the narrow question of who can spend from a given address. It does nothing for the shared machinery that every user depends on, and it does not restore confidence in a network whose basic checks have failed.
Bitcoin offers some partial protection depending on the address type. Common SegWit addresses that begin with "bc1q" conceal the public key until the owner spends. Trezor wallets generate a fresh receiving address for each payment to limit reuse. Even so, whenever bitcoin is spent, the public key appears in the mempool, the waiting area for unconfirmed transactions, and that creates a window in which an attacker with the right capability could act.
Bourdon's advice was to do nothing for the moment. He said a panicked migration produces mistakes and attracts scammers, and that there is nothing to do right now. That caution echoes a general rule in wallet security: hurried transfers, wrong addresses and fake support offers have caused real losses in past scares.
6. Which networks are preparing defenses?
Chains differ widely in how they approach the problem, because their account models differ. NEAR Protocol, which positions itself as an AI-focused network, allows users to add a quantum-safe key that follows the FIPS-204 standard to an existing account in a single transaction, without moving assets. Wallets such as Meteor support quantum-safe signing. That approach relies on lattice-based cryptography, which Vitalik Buterin is reported to worry could also prove vulnerable.
Ethereum is developing a broader post-quantum roadmap built on hash-based signatures and the aggregation of zero-knowledge proofs. It is meant to cover transaction signatures, consensus and data security. An emergency recovery plan also exists on paper. In a March 2024 post, Buterin described a hard fork that would roll back blocks after a mass theft, disable ordinary wallet transactions, and let users reclaim funds by proving ownership of their seed phrase through a zero-knowledge proof.
Max Shannon, a senior research associate at Bitwise Europe, said that proposal has no set timeline. No working attack exists yet, he noted, but users should move toward quantum-safe signatures over the long term.
Starknet takes another route. Its account abstraction lets users change signature schemes without migrating funds, and Ben-Sasson said the core technology need not change because the system accepts any signature scheme. Other components, including parts of the state tree and the reliance on Ethereum for security, still require work.
Solana publishes public keys by default, so switching addresses would gain nothing there. Users who want protection can move funds to a post-quantum vault such as Winter Wallet. Jacob Creech, vice president of technology at the Solana Foundation, said Solana users would not need bunker mode if the signature scheme became breakable. A network upgrade could let users prove ownership of their seed through a hash-based proof and migrate to a safer scheme. A proof of concept exists on GitHub, but the upgrade has not been deployed.
7. Should crypto holders be worried now?
Most of the people quoted said the risk is theoretical for the moment. Shannon said Bitwise is not worried about it at present, though he called it worth being prudent over. Prudence, in this context, means following the research and upgrade plans for the chains one holds rather than relocating funds.
Herbert described the fresh-address approach as a thought experiment rather than a practical plan. Holders with old devices, complex multisignature arrangements or Bitcoin that has sat untouched for many years would not be covered automatically by a routine software update, which is an additional reason a one-size-fits-all emergency step is hard to design.
Bourdon urged readers to consider who is making the warning and why. Drake's call, he said, doubles as an argument for Ethereum's hash-based roadmap, so a warning about an unproven threat also works as a pitch for a particular solution. That does not prove Drake wrong, but it is context for weighing the claim.
The state of the evidence is clear enough. No published work shows that ECDSA is close to failing, and the people who build wallets and study cryptography for a living mostly see no sign of it. Rushing to move funds carries risks of its own. If the underlying cryptography ever did fail, relocating coins would be the easiest part of the response, with new signature schemes and network-level changes carrying the real burden.