Can AI Break Bitcoin? What an Exposed Public Key Means

No public attack recovers a Bitcoin or Ethereum private key from this week’s AI mathematics. As of October 8, 2026, that is the answer to “can AI break Bitcoin?”

Ethereum researcher Justin Drake has asked the industry to plan for a worst case in which a classical break arrives within months. The replies worth keeping did not adopt that clock. Ledger CTO Charles Guillemet said treating a break on that timeline as a planning baseline still looks like FUD. Vitalik Buterin said to take AI-accelerated math seriously, and not to scramble into new wallets.

If that worst case ever becomes real, the practical meaning is narrower than the post. An attacker needs a public key the chain has already published, and a balance still sitting on it.

Key takeaways

• OpenAI’s October 6, 2026 mathematics release does not include an ECDSA or discrete-log break.
• Justin Drake’s “months, not years” line is his personal worst case, posted October 7, 2026. Guillemet called that baseline FUD.
• Vitalik Buterin’s reply was to take AI-accelerated math seriously and to avoid a rushed wallet migration.
• A revealed public key is the target. A hashed, never-spent address gives an attacker nothing to aim at until that address signs.

How likely is an AI break of Bitcoin or Ethereum keys?

Three claims are traveling together. They rest on different evidence.

Has AI already broken ECDSA?

No public result shows that. Drake pointed at OpenAI’s October 6 release of mathematical manuscripts from an internal model, published in the openai/math repository. The set runs to 722 manuscripts. A minority, 162, are formalized in Lean, a language that can check a proof step by step, and outside review is still early. An algorithm that turns a Bitcoin or Ethereum public key into a private key is absent from that release.

Faster mathematical output is a real event. A stolen coin is a different event.

Could ECDSA fall within months?

That is Drake’s worst case, and he labeled it as one. He described a break as fast private-key recovery, for example within about a week, on hardware that already exists, such as a large GPU cluster. He argued elliptic curves are a plausible place for a surprise because they have a lot of algebraic structure, and that a classical cousin of Shor’s algorithm could threaten both elliptic curves and RSA.

Guillemet’s reply is the skeptical one. He granted that recent math results have been humbling, then said a classical ECDSA break in months is a poor planning baseline. A practical private-key recovery on secp256k1, the curve Bitcoin and Ethereum use, would not stay inside those two networks. It would compromise TLS, code signing, and a large share of deployed public-key infrastructure at the same time. He also declined the comfortable exit: hashes look safer because they were built with little algebraic structure, and the same shaken intuition applies to them.

Vitalik Buterin made a related point on October 8. He said the field should prefer hashes where it can, and that the tidy picture is too tidy: curves break, hashes stay safe, lattices stay safe. He said the concrete security of lattice schemes can take serious hits from the next two years of AI math. Hiding a key behind a hash is a sound precaution with a boundary. The hash is another mathematical object.

“Models got better at math” does not, by itself, yield a fast discrete logarithm on secp256k1. Cryptographers have worked on that problem for decades. AI may shorten some of that work over time. A date of this quarter, on a GPU cluster, is a tail scenario Drake is personally willing to plan for.

Are exposed public keys the right thing to watch?

Yes. This claim does not depend on Drake’s calendar. Bitcoin and Ethereum show the network a hash of a key for as long as that key has never signed. The moment the key signs, the public key is on the record. Anyone who can later turn that public key into a private key can move whatever balance is still sitting on it.

BitGo’s public Quantum Resistance Score measures this for Bitcoin. The page’s own FAQ says no existing quantum computer can break Bitcoin’s cryptography. The company’s institutional controls for the same hygiene shipped on July 9, 2026. The mechanism is old. The packaging is new.

A fair summary, as of October 8, 2026: a break on Drake’s clock is a tail scenario with public pushback. Coins left on a key the chain has already published are the coins that scenario would reach. Only the second sentence can be looked up on an address.

What an exposed public key means in practice

Picture two addresses with the same balance.

The first has received coins and never sent any. The chain stores a hash. An attacker who learns how to reverse a public key still has nothing to feed the algorithm.

The second has sent a transaction, or it is a Bitcoin address type that publishes the key as soon as it is created. The public key is in the open. A later break aims there, at the coins that remain.

Moving to a fresh address puts a holder back in the first group until the next signature. Coins left behind on the spent address go back into the second group. Sweeping the remainder is ordinary change hygiene with a new motive. It uses wallets people already have. It does not require a new chain, a new signature scheme, or a new seed.

The speed Drake imagined changes who should care. A recovery that takes about a week misses a payment while it sits in the mempool. Bitcoin blocks arrive about every ten minutes. A week-long attack reaches coins that stay parked on a key the network has already seen.

Click a row. The panel says whether a later break would have coins to move.

Which Bitcoin and Ethereum addresses are already exposed?

On Bitcoin, pay-to-public-key-hash (P2PKH), native SegWit (P2WPKH), and pay-to-witness-script-hash (P2WSH) keep the public key behind a hash until the output is spent. After that spend, the key is public forever, so reused addresses and leftover change stay in the blast radius.

Two Bitcoin types are visible earlier. Legacy pay-to-public-key outputs publish the key in the output itself. Taproot key-path addresses (P2TR) publish a tweaked public key when they are created, before anyone spends. Taproot uses Schnorr signatures. Legacy types use ECDSA. Both sit on secp256k1, so a break of the curve would still apply. A new address format can still show its key on day one.

On Ethereum, a normal externally owned account that has never sent a transaction shows the network a hash of the public key. Once it sends, the public key can be recovered from the signature. A smart-contract wallet is a different object: the warning covers the keys that sign for it.

Drake also argued that wallets under 50 BTC sit behind what he called Satoshi’s shield: on the order of 20,000 already-exposed outputs of about 50 BTC each, which a rational attacker would work through first. Read that as his priority argument. The first balances in any real scenario are large, exposed, and idle. A small holder gains little from a frantic move. It is not a guarantee.

What is crypto bunker mode?

Bunker mode is Drake’s name for a controlled move of assets onto fresh addresses whose public keys stay hidden behind a hash. He asked large holders to go first: Binance, Bitbank, Robinhood, Bitfinex, and Tether cold storage were his examples. After one of those addresses signs, he recommended moving any remainder to another fresh address, which can come from the same seed. He pointed institutions at Project Eleven’s Bitcoin Risq List, a public tracker of exposed Bitcoin public keys.

He also said a rushed migration would do more harm than good. Guillemet went further on that point. Avoiding address reuse after the first signature is reasonable hygiene, and good wallets already push fresh receive addresses. A mass migration, he said, would create operational mistakes that lose funds with higher probability than the scenario being mitigated. There is already a post-quantum migration to plan. This thread does not need to become a second one.

On October 8, Vitalik Buterin replied in the same thread. He said the industry should take risks to cryptography from AI-accelerated math seriously. He said he does not recommend scrambling into new wallets. Keeping funds on addresses that have never signed is a reasonable precaution when the move is easy. Botched migrations, he noted, have cost him more than hacks. His closing line was “don’t rush anything.” The Block’s account of that reply is the cleanest public summary. The Defiant recorded Guillemet’s pushback.

Should holders move funds this week?

Move when the move is boring. Leave the coins alone when the move means a new seed, a new app, or an address copied out of a reply.

The version that matches the cautious half of the thread looks like this:

• A Bitcoin address has already spent, and sending the balance to a fresh address you already control is operationally easy. Do that, and stop receiving on the old address.
• A wallet returns change to the address that just spent. Point that change at a fresh address.
• A large balance sits on Taproot or on legacy pay-to-public-key outputs. Those keys are already visible. Rotating them is a procedure, done once, in daylight.
• An institution’s cold wallet has signed and still holds the reserve. That is the case Drake was making. Treat it as change management for a business day.

The version that loses coins is the one this thread will attract: a new seed phrase generated because a post said “bunker,” a checker that asks for anything other than a public address, a quantum-safe wallet sold in the replies. BitGo’s own checker warns that it will never ask for a seed phrase, a private key, or a password. A public address is the only input a legitimate lookup needs.

How to check whether a public key is already exposed

The checker above does that lookup for one Bitcoin or Ethereum address. BitGo’s Quantum Resistance Score and Project Eleven’s Risq List answer the Bitcoin version in public too. None of them need a wallet connection.

Developers who need the same fact inside an application can read it from the Tatum Data API. Notifications can fire when a Bitcoin or Ethereum address sends, which is the moment a hashed key becomes a public one. Raw chain reads go through the RPC Gateway. Spend history shows that a key was published. It does not, by itself, catch address types that publish the key on receipt, such as Bitcoin P2TR and pay-to-public-key. On Ethereum, a transaction count above zero is the reliable sign the account has signed. A contract call still publishes a signature when the transfer amount is zero, so an outgoing-only filter can miss it.

• Bitcoin, Litecoin, and Dogecoin: transaction history for a UTXO address, filtered to outgoing transfers. An outgoing transaction means the public key was revealed in the spend.
• Ethereum and other account-based chains: transaction history filtered to outgoing transfers. An outgoing transaction means the account has signed, so the public key is recoverable from the signature.
• What remains spendable on a Bitcoin address: unspent outputs for that address. Exposure matters only where a balance is still sitting on the revealed key.

That lookup reports whether a key has already been published, and whether a balance still sits on it. Present-day safety is a separate question.

Frequently asked questions

Click a question to open the answer.

What this week is for

The OpenAI drop is a reason the field will argue about timelines. It is a weak reason to move a treasury on a Thursday.

Buterin’s posture is the one that survives the pushback: take the math seriously, keep idle coins on addresses that have never signed when that is easy, and refuse the scramble. Guillemet’s addition is that a months-long break of secp256k1 would land on TLS, code signing, and the rest of public-key infrastructure at the same time, and that a stampede creates a loss you can have this week.

Reused addresses publish a key and then keep holding coins with it. That was sloppy before anyone said “bunker,” and it stays sloppy if the break never comes. A hidden key gives an attacker nothing to aim at. A revealed key is a target only after a break that nobody has published.