Dragonfly managing partner Haseeb Qureshi has pushed back against Ethereum researcher Justin Drake's call for users to adopt a "bunker mode" defense against the threat of artificial intelligence breaking cryptographic signatures, labeling the approach "cryptographic doomerism" and arguing that simply migrating tokens to fresh addresses is not a viable long-term solution.
In a Thursday post on X, Qureshi warned that bunker mode would only protect investors' coins as long as they remained in the fresh addresses. "These coins would be worthless if all of the other coins are being hacked and mass-sold," he wrote. Instead, Qureshi urged blockchain networks to adopt proactive measures to protect users in the event that AI models or quantum computers break the cryptographic signatures securing cryptocurrency wallets.
He proposed a "Cryptographic Recovery Mode," a hash-based backup signature plan that users could map to their addresses, enabling validators to force recovery if cryptographic signatures were broken.
The Threat of AI and Quantum Computing to Cryptocurrency
The debate centers on the vulnerability of the elliptic curve digital signature algorithm (ECDSA), which secures most cryptocurrency wallets, including Bitcoin and Ethereum. ECDSA relies on the computational difficulty of deriving a private key from a public key. However, if an attacker can solve the elliptic curve discrete logarithm problem, they could forge signatures and steal funds.
Quantum computers have long been considered a threat to ECDSA because they could potentially run Shor's algorithm to break the encryption. But recent warnings have shifted to artificial intelligence, which some researchers believe could accelerate mathematical breakthroughs that compromise ECDSA much sooner than expected. On Wednesday, Justin Drake warned that rapid AI advancements could break ECDSA "in months, not years," citing a Tuesday OpenAI report on AI's progress in mathematics.
Drake advised users to gradually migrate their funds to fresh wallets where their public key is not exposed, arguing that AI advancements may threaten these holdings before quantum computers. He called this approach "bunker mode."
Ethereum co-founder Vitalik Buterin agreed that the industry should take the risks from "AI-accelerated math seriously" but said that he doesn't recommend users rush to move their funds to fresh wallets.
Scale of the Exposure: Over 31% of Bitcoin Supply at Risk
The potential impact is enormous. According to data from Glassnode, more than 31% of the Bitcoin supply—6.26 million BTC—currently sits in addresses with exposed public keys, making them vulnerable to attacks if ECDSA is broken. Of that amount, about 4.33 million BTC are exposed because of address reuse, while another 1.94 million BTC are exposed through their address format, according to Glassnode co-founder Rafael Schultze-Kraft.
Nearly 1.8 million BTC of the exposed supply is held on cryptocurrency exchanges, meaning 57% of all exchange balances are currently exposed. This concentration on exchanges raises additional concerns, as a successful attack could trigger massive sell-offs and destabilize the entire market.
The exposure is not limited to Bitcoin. Ethereum and other blockchains that use ECDSA are similarly at risk. The widespread use of ECDSA across the crypto ecosystem means that a breakthrough in breaking the algorithm would have catastrophic consequences for the entire industry.
Why 'Bunker Mode' Falls Short, According to Qureshi
Qureshi's critique of bunker mode is rooted in game theory and market dynamics. He argues that even if some users migrate their coins to fresh addresses with unexposed public keys, the overall market would still be flooded with stolen coins from those who did not migrate. "If all of the other coins are being hacked and mass-sold, your coins would be worthless," he wrote. In other words, individual protection is meaningless if the broader system collapses.
Instead, Qureshi advocates for a systemic solution. His proposed Cryptographic Recovery Mode would allow users to create a hash-based backup signature that is mapped to their address. If ECDSA is broken, validators could use this backup to force recovery of funds, preventing attackers from stealing them. This approach would require a coordinated upgrade across blockchain networks but would provide a proactive defense rather than a reactive one.
The idea of hash-based signatures is not new. Hash-based cryptography is considered quantum-resistant because it relies on the security of hash functions, which are believed to be resistant to quantum attacks. However, implementing such a system on existing blockchains would require significant changes to the protocol and consensus rules.
Broader Industry Efforts to Quantum-Proof Blockchains
The debate comes amid growing efforts to prepare blockchain networks for the threat of quantum computers and advanced AI. In a related development, a Strategy-led group recently pledged $15 million to quantum-proof the Bitcoin network. The initiative aims to support research and development of quantum-resistant cryptographic solutions, including BIP-360, which proposes a new address type that would protect against quantum attacks.
BIP-360, also known as the "Quantum-Resistant Address" proposal, would introduce a new output type that uses hash-based signatures instead of ECDSA. While the proposal is still in its early stages, it represents a proactive step toward securing Bitcoin against future threats. However, implementing BIP-360 would require a soft fork and widespread adoption by wallets and exchanges.
Other projects are exploring similar solutions. Ethereum researchers have discussed the possibility of transitioning to quantum-resistant signatures, but such a change would be complex and time-consuming. The Ethereum Foundation has funded research into post-quantum cryptography, but no concrete timeline has been announced.
The Timeline: When Could ECDSA Break?
The urgency of the debate stems from uncertainty about the timeline. While quantum computers powerful enough to break ECDSA are still years away—often referred to as "Q-day"—the rapid progress of AI has raised concerns that mathematical breakthroughs could accelerate the threat. Drake's warning that ECDSA could break "in months, not years" is based on the possibility that AI models could discover new attacks on the algorithm.
However, not all experts agree with this timeline. Some argue that breaking ECDSA requires solving a well-defined mathematical problem, and AI alone may not be able to achieve this without a fundamental breakthrough. Others note that quantum computers remain the more likely threat, but even then, the timeline is uncertain.
Regardless of the exact timeline, the consensus is that the crypto industry must take proactive measures. Qureshi's call for a Cryptographic Recovery Mode is one such measure, but it is not the only one. Other proposals include increasing the use of multi-signature wallets, using hardware wallets that never expose public keys, and transitioning to quantum-resistant algorithms.
The Role of Exchanges and Custodians
With 57% of exchange balances exposed, centralized exchanges play a critical role in protecting user funds. If ECDSA is broken, exchanges could be prime targets for attackers. To mitigate this risk, exchanges could move funds to addresses with unexposed public keys or adopt quantum-resistant solutions. However, many exchanges are reluctant to make changes that could disrupt their operations.
Some exchanges have already taken steps to protect user funds, such as using cold storage and multi-signature wallets. But these measures may not be sufficient if ECDSA is broken. A coordinated industry response is needed to ensure that the entire ecosystem is protected.
The Path Forward: Proactive vs. Reactive Measures
The debate between Qureshi and Drake highlights a fundamental question: should the crypto industry focus on reactive measures like bunker mode, or proactive measures like Cryptographic Recovery Mode? Qureshi argues that reactive measures are insufficient because they do not address the systemic risk. Drake, on the other hand, suggests that individual action is a practical first step while the industry works on longer-term solutions.
Ultimately, both approaches may be necessary. Users can take steps to protect their own funds by moving them to fresh addresses, while the industry works on implementing quantum-resistant signatures and other proactive measures. The key is to avoid complacency and to recognize that the threat is real, even if the timeline is uncertain.
As the crypto industry continues to evolve, the need for robust security measures will only grow. The rise of AI and quantum computing presents a significant challenge, but it also offers an opportunity to build a more resilient and secure financial system. The decisions made today will determine whether the industry is prepared for the threats of tomorrow.
Qureshi's proposal for a Cryptographic Recovery Mode is a step in the right direction, but it requires careful consideration and collaboration across the industry. Whether it will be adopted remains to be seen, but the conversation it has sparked is already valuable. The crypto community must continue to discuss and develop solutions that protect users and ensure the long-term viability of blockchain networks.
Source:Cointelegraph News