Ethereum researcher Justin Drake called last Wednesday for the industry to plan a "bunker mode" migration of assets, arguing that advances in artificial intelligence could break elliptic curve cryptography "in months not years" — and a lineup of cryptographers, wallet builders and analysts say the plan would not work as advertised.

Drake's claim, posted alongside his proposal to move funds to fresh addresses with unexposed public keys, rests on the possibility that AI systems accelerate the discovery of mathematical attacks on classical computing that human cryptographers have missed. He wrote: "IMO it is now reasonable to brace for the possibility that ECDSA [Elliptic Curve Digital Signature Algorithm] breaks before Qday, in the worst case in months not years."

Johns Hopkins cryptography professor Matthew Green went further, saying: "I think we might lose public key cryptography." Neither claim comes with a demonstrated attack. That gap between warning and evidence frames the entire debate.

Is there any evidence ECDSA is breaking?

Not according to the specialists. Coinbase head of cryptography Yehuda Lindell said there is, to his knowledge, "no evidence whatsoever" that the decades-old mathematical assumptions behind elliptic curve cryptography have weakened.

Lucien Bourdon, Bitcoin analyst at hardware wallet maker Trezor, was direct: "There are no credible published advances against the math behind ECDSA, with AI or anything else." He noted that none of OpenAI's recent AI-written math papers contain an ECDSA attack — although Drake treats that absence as cause for suspicion rather than comfort.

Bourdon also flagged what Drake's warning leaves unsaid. "He doesn't say how," Bourdon said of Drake's argument that elliptic curves carry more exploitable mathematical structure than hash functions. "He also calls his timeline a worst-case scenario and tells people not to rush."

The takeaway in plain words: a worst-case timeline is not a prediction, and no working attack exists.

Why moving coins may not protect anyone

The operational holes in bunker mode are concrete. Zach Herbert, chief executive and cofounder of hardware wallet firm FoundationHQ, explained that if an extended public key (xpub) has already been shared with a wallet app or third party, migration within the same account achieves nothing. "They already have the information needed to derive the public keys you're trying to hide," he said.

If ECDSA became practically breakable, Herbert added, "an attacker could recover the corresponding private keys without ever touching your hardware wallet."

MetaMask founder and chief executive Taylor Monahan framed the stakes more bluntly. If elliptic curves break, "the entire fu**ing world is going to zero. Having your magic internet coins in bunker mode is not going to help you." A genuine cryptographic collapse would compromise banking and state systems alongside crypto wallets.

Eli Ben-Sasson, cofounder and chief executive of Ethereum scaling protocol StarkWare, called address migration "obviously not sufficient protection." He said users would need entirely new wallet software, and that Ethereum's infrastructure-level signatures, consensus mechanisms and the Kate-Zaverucha-Goldberg (KZG) polynomial commitment scheme used for blob data would all require replacement. "Finally, gas prices would likely also increase dramatically, because a lot of the functionality would break," he added.

The takeaway: moving coins is the easy part of a response that would require re-engineering core protocol layers.

Which chains are actually prepared?

Preparedness varies sharply across networks.

• Bitcoin: Common SegWit addresses (beginning with bc1q) keep public keys hashed until spending, though Taproot addresses expose public keys directly onchain. Any Bitcoin spend exposes the public key in the mempool regardless.
• NEAR Protocol: Users can add a quantum-safe FIPS-204 key to an existing mainnet account in a single transaction without moving assets; the Meteor wallet supports quantum-safe signing. The scheme relies on lattice-based cryptography, which Vitalik Buterin has said may itself be vulnerable.
• Ethereum: A post-quantum roadmap using hash-based signatures and ZK proof aggregation is in development. Buterin's March 2024 post outlined an emergency hard fork that would roll back blocks after mass theft, disable conventional wallet transactions and let users reclaim funds via zero-knowledge proofs of a seed phrase.
• Starknet: Account abstraction lets users switch signature schemes without migrating funds, though the state tree and reliance on Ethereum for security still need work.
• Solana: Public keys are exposed by default, but a network upgrade — with a working proof of concept, undeployed — would let users prove seed ownership via hash-based proof and migrate to a safer scheme, according to Solana Foundation technology vice president Jacob Creech.

Max Shannon, senior research associate at Bitwise Europe, said Buterin's hard fork remains a proposal with "no set timeline," and that users should shift to quantum-safe signatures only "over the long term."

Should holders act now?

Bourdon's advice is to do nothing hasty: "There's nothing to do right now." He warned that "people who rush to move funds make mistakes, and scammers use stories like this one to reach them."

He also noted the incentive structure around the warning itself: Drake's post was accompanied by discussion of Ethereum's move toward the hash-based cryptography Drake recommends. "So the warning about an unproven threat doubles as a pitch for Ethereum's roadmap," Bourdon said. That does not prove Drake wrong; it does mean his framing warrants scrutiny.

Herbert added that holders with old devices, complicated multisignature setups or untouched Bitcoin would not be reached by any software update anyway. "I wouldn't pretend those steps amount to a practical plan for that scenario," he said of the fresh-address approach.

Shannon said Bitwise treats the risk as theoretical for now but "worth being prudent over." No chain has shipped a full post-quantum migration, Ethereum's emergency fork remains a paper proposal without a date, and the first credible test of these plans will come only if — or when — a working attack on ECDSA actually appears.