Ethereum Foundation researcher Justin Drake told the crypto industry on October 7, 2026 to start planning for what he called “bunker mode.” His warning: artificial intelligence, not a quantum computer, might be the thing that finally cracks the elliptic-curve signatures protecting Bitcoin and Ethereum wallets. Drake’s timeline was blunt. In the worst case, he said, a break could arrive “in months not years,” years ahead of the large-scale quantum machines most of the industry has been bracing for.
The statement landed hard because Drake is not a fringe voice. He works inside the Ethereum Foundation on the protocol’s long-term security roadmap, and his warning arrived alongside fresh data on just how many coins would be exposed if he is right. Estimates reviewed by CoinDesk put the vulnerable share of the Bitcoin supply somewhere between 6.7 million and more than 8.1 million BTC, depending on how an address qualifies as exposed. At Bitcoin’s current circulating supply, that range covers roughly a third of all coins ever mined.
This is a bitcoin quantum computing threat story with a twist: the clock everyone assumed they had may be shorter, and the reason is not better qubits. It is better math, produced faster by AI systems chewing through number theory. That shift matters for custodians, exchanges, hardware wallet makers, and anyone holding bitcoin quantum computing threat exposure in an old, reused address.
What Justin Drake actually said on October 7
Drake’s argument did not start with quantum hardware roadmaps. It started with a string of recent AI-assisted breakthroughs in pure mathematics that, in his telling, should worry anyone relying on number-theoretic cryptography. “Recent days have been humbling for human mathematical intuition. Long-held, unquestioned hypotheses have fallen,” Drake said, a point he used to argue that the assumptions underpinning elliptic-curve cryptography deserve fresh scrutiny (Cointelegraph).
He went further, singling out the specific cryptographic primitive Bitcoin and Ethereum both depend on for every transaction signature. “Elliptic curves feel especially vulnerable to superintelligence,” Drake said, according to reporting from Cryptonews.net. That line is the crux of the debate. Drake is not claiming someone has broken ECDSA. He is claiming that AI-accelerated mathematical research narrows the gap between theoretically breakable and practically breakable faster than most roadmaps assumed, and that gap could close before fault-tolerant quantum computers even exist.
Crucially, no practical attack on a live Bitcoin or Ethereum private key has been demonstrated. Drake’s statement is a risk-management call, not a breach disclosure. But it reframes the post-quantum conversation the industry has been having for years, dating back to early research into quantum-resistant Bitcoin address formats.
Why ECDSA is the pressure point
Every Bitcoin and Ethereum transaction is authorized by ECDSA, the Elliptic Curve Digital Signature Algorithm. A wallet’s private key signs a transaction, and the network verifies that signature against the wallet’s public key. The security of that scheme rests on a hard math problem: given a point on an elliptic curve, finding the secret number used to generate it should take an impractical amount of computation.
Quantum computers threaten that assumption through Shor’s algorithm, which can, in theory, solve the underlying discrete-logarithm problem far faster than classical hardware. That threat has been well understood for years, which is why Ethereum’s own documentation states plainly that quantum computers will eventually be able to break the cryptographic methods securing Ethereum and most other digital systems (ethereum.org). What Drake’s warning adds is a second, faster-moving attack path: AI systems finding mathematical shortcuts that erode ECDSA’s security margin well before a quantum computer is large enough to run Shor’s algorithm at the needed scale.
Not every address carries equal risk. A Bitcoin address only reveals its public key once it sends a transaction. Addresses that have only ever received funds keep their public key hidden behind a one-way hash, which gives them an extra layer of protection that already-spent-from addresses lack. That distinction, hash-protected versus publicly exposed, is the entire basis for the current debate over how many coins are actually at risk.
How many bitcoins are actually exposed
Two competing estimates are driving the current discussion, and they disagree by more than a million BTC because they define exposure differently.
The conservative estimate from Fireblocks
Fireblocks’ research team has pointed to exposed public keys as the single biggest factor in Bitcoin’s quantum and AI risk, citing figures that put roughly 6.7 million to 7 million BTC behind public keys already visible on-chain (crypto.news). That number counts coins sitting in addresses that have moved at least once, which permanently reveals the public key tied to that address on the blockchain.
The wider estimate from the Bitcoin Risq List
A separate tracking effort, the Bitcoin Risq List, classified more than 8.1 million BTC as quantum-vulnerable in its September 14 update, a figure cited in reporting dated October 8. The gap between that number and Fireblocks’ range comes down to methodology rather than a confirmed loss of funds. Neither estimate implies an active theft. Both describe a pool of coins that would be first in line if ECDSA were ever practically broken.
| Source | Estimated BTC exposed | Definition used | Date reported |
|---|---|---|---|
| Fireblocks research | ~6.7M–7M BTC | Addresses with publicly visible keys from a prior spend | Oct. 9, 2026 |
| Bitcoin Risq List | 8.1M+ BTC | Broader quantum-vulnerable address classification | Sept. 14, 2026 update, reported Oct. 8 |
| Shattered.io prior BIP-360 coverage | ~7M BTC | Exposed public-key addresses, earlier quantum-risk framing | 2026, earlier report |
| NIST PQC exposure tracking | Value cited as $469B exposed | Dollar value of holdings in exposed addresses | 2026, earlier report |
Both figures describe the same underlying bitcoin quantum computing threat but frame it from different angles, coin count versus classification criteria. Either way, the exposed pool runs into the millions, which is why Drake’s call for a mass migration strategy landed as more than an academic exercise.
Inside bunker mode: the migration Drake is proposing
Drake’s recommendation is narrower than it sounds. “Today I call upon the blockchain industry to calmly begin planning for ‘bunker mode,'” he said, a framing picked up widely after the October 7 statement (Coin360). The specific action behind the phrase is a controlled move of funds into addresses that have never broadcast a transaction, keeping their public keys hidden behind a hash. “My personal recommendation is to set in motion a controlled mass migration of assets to fresh addresses, i.e. addresses whose pubkeys remain hidden behind a hash,” Drake said.
That is a real mitigation, not a cosmetic one. An attacker who cannot see a wallet’s public key has nothing to feed into even a theoretical cracking method. But Drake and other researchers are careful to note the limits. Moving coins to a fresh address reduces exposure today, it does not make Bitcoin’s protocol quantum-resistant going forward, and the underlying ECDSA signature scheme remains unchanged. Anyone who later spends from that fresh address exposes its public key all over again, restarting the clock.
That caveat is also why bunker mode has split opinion inside the industry rather than winning universal backing. Coverage from Coin360 framed the reaction as splitting crypto security experts, with some cryptographers pushing back on the urgency of Drake’s timeline even while agreeing with the underlying math. The disagreement is less about whether ECDSA could eventually be broken and more about whether months is a realistic worst case or a deliberately alarming framing meant to force faster protocol action.
Bitcoin’s protocol fix is still just a proposal
Here is the part of this bitcoin quantum computing threat story that makes Drake’s warning harder to dismiss. Bitcoin does not yet have a deployed, consensus-level fix. The leading candidate, BIP-360, would introduce a post-quantum-resistant address type known as P2QRH alongside existing formats, but it remains a proposal working through Bitcoin’s famously slow, consensus-driven upgrade process. There is no activation date, no locked specification, and no guarantee the exact scheme ships as currently drafted.
That slowness is a deliberate feature of Bitcoin’s governance, not neglect. Changes that touch consensus rules require broad agreement across miners, node operators, and wallet providers before they can activate, a process that has historically taken years even for far less contentious proposals. The practical effect, though, is that Bitcoin’s defense against a quantum or AI cryptanalysis break currently lives almost entirely at the user level: move coins to unexposed addresses, use fresh keys, and wait for a protocol-level fix with no confirmed timeline.
Ethereum’s head start, and what it actually covers
Ethereum’s response looks further along, at least organizationally. The Ethereum Foundation formed a dedicated Post-Quantum Security team in January 2026, treating migration planning as an active engineering problem rather than a someday concern. According to the foundation’s own quantum-resistance roadmap, current work includes testing hash-based validator signatures, new proof systems, and post-quantum interoperability across multiple client implementations.
The Trillion Dollar Security Project, a separate Ethereum Foundation initiative, frames the stakes in blunt terms. Most software wallets still rely on users safely storing a seed phrase, which in practice pushes many people toward insecure habits like storing that phrase in plaintext, in cloud storage, or on paper. A credible break of ECDSA would not just threaten individual wallets, it could simultaneously expose wallets, smart contracts, and staking keys across the entire network, which is why Ethereum’s security team treats this as a protocol-level migration problem rather than a wallet-by-wallet fix.
Ethereum co-founder Vitalik Buterin added a longer horizon to the conversation on September 27, 2026, outlining a vision in which a fork referred to as Hegotá becomes Ethereum’s last normal upgrade before the network leans fully on zero-knowledge proofs, formal verification, and quantum-resistant security, with a target of 8 to 32 second payment finality by around 2030. That roadmap is aspirational rather than shipped, but it illustrates the gap between Ethereum’s planning posture and Bitcoin’s current reliance on a still-unapproved BIP.
Bitcoin vs Ethereum: comparing the two responses
| Dimension | Bitcoin | Ethereum |
|---|---|---|
| Dedicated security team | No formal equivalent | Post-Quantum Security team, formed January 2026 |
| Protocol-level fix status | BIP-360 (P2QRH), proposal stage, no activation date | Hash-based validator signatures and new proof systems in active testing |
| User-level mitigation available now | Move funds to unexposed, never-spent addresses | Same principle applies to exposed accounts and some contract keys |
| Published long-term roadmap | No officially adopted multi-year quantum roadmap | Roadmap targeting post-quantum, zero-knowledge security by around 2030 |
| Governance speed for consensus changes | Slow, broad-consensus model | Faster iteration via coordinated client upgrades |
The comparison is not a verdict on which chain is safer in absolute terms. Ethereum’s validator and staking architecture introduces its own complexity that Bitcoin does not have to manage. But on the specific question of institutional readiness for an AI-accelerated cryptographic break, Ethereum currently has a named team and a published, if long-dated, plan. Bitcoin has a community debate and a proposal still waiting on rough consensus.
Historical context: this is not Bitcoin’s first quantum scare
Warnings about quantum computers and Bitcoin’s cryptography are not new. NIST finalized its post-quantum cryptography standards, including the ML-KEM and ML-DSA algorithms, work the broader security industry has pointed to for years as the eventual replacement for RSA and elliptic-curve schemes once quantum hardware matures. Earlier reporting on Bitcoin’s exposure put the value of at-risk holdings in the hundreds of billions of dollars under that NIST PQC framing, well before Drake’s AI-specific warning added new urgency to the conversation.
What makes October 2026 different is the compressed timeline. Past quantum warnings assumed a threat that was years, possibly a decade or more, away, tied to the slow, expensive process of scaling error-corrected quantum hardware. Drake’s warning removes that comfortable buffer by introducing a second, software-only attack path: AI-assisted mathematical research that does not need a quantum computer at all, only faster progress on the number theory underneath ECDSA. That is a fundamentally different kind of race, measured in model iterations and research cycles rather than chip fabrication timelines.
Market and industry reaction so far
The immediate market reaction has been measured rather than panicked. No practical attack has been demonstrated, and Drake’s own framing was explicitly a worst-case scenario rather than a confirmed event, which limited the kind of selloff that typically follows a disclosed exploit. Custodians and exchanges with large cold-storage reserves are the most exposed institutional category, since consolidated custody wallets often hold balances in addresses that have transacted before and therefore already carry exposed public keys.
Security researchers broadly agree on one point even where they disagree on timeline: a credible AI-assisted break of ECDSA would not stay contained to Bitcoin and Ethereum. The same signature scheme, or close variants of it, secures a large share of the broader cryptocurrency market, along with TLS connections, code-signing certificates, and other infrastructure outside crypto entirely. That is part of why the warning drew attention well beyond the usual crypto-security audience.
What custodians and wallet providers are doing right now
Exchanges and custodians
Large custodians are the group with the most to lose from a sudden ECDSA break, since their consolidated wallets concentrate huge balances behind a relatively small number of already-exposed public keys. Expect custodians to quietly accelerate internal address-rotation practices, moving dormant reserves into fresh, never-spent addresses, exactly the mitigation Drake described, well ahead of any public announcement.
Hardware wallet and self-custody tool makers
Self-custody users face a simpler but less convenient version of the same problem. A wallet that has never sent a transaction keeps its public key hidden, so the practical advice from security researchers has converged on generating new receiving addresses regularly and avoiding address reuse, standard hygiene that this warning has turned into a more urgent recommendation rather than a brand new one.
Where this debate goes next
Five things look likely to shape the next six to eighteen months of this story.
- Expect louder, more public pressure on Bitcoin Core contributors to move BIP-360 out of proposal status, even without a hard activation date attached.
- Expect Fireblocks and independent researchers to keep publishing competing exposure estimates, narrowing the current 6.7M-to-8.1M BTC gap as methodologies converge.
- Expect custodians to start disclosing address-rotation and cold-storage migration practices more openly, treating it as a trust signal for institutional clients.
- Expect continued disagreement among cryptographers over Drake’s months-not-years timeline, with skeptics pushing back publicly even as they adopt the same mitigations privately.
- Expect Ethereum’s Post-Quantum Security team to publish more concrete milestones, given the political pressure created by comparisons to Bitcoin’s slower-moving BIP process.
None of these predictions require a quantum computer to actually arrive. They are reactions to the governance and trust problem Drake’s warning created, regardless of whether the underlying AI cryptanalysis threat materializes on his worst-case timeline.
What this means for everyday holders
For most individual holders, the practical takeaway is narrower than the headlines suggest. If your coins sit in an address that has never sent a transaction, your public key has never been exposed on-chain, and you are already in the safer category. If you have spent from an address before, your public key is permanently visible, and the only mitigation available today is moving those funds to a new, unused address and avoiding reuse going forward.
That is not a fix for the underlying bitcoin quantum computing threat, it is a way to buy time while Bitcoin’s and Ethereum’s protocol-level defenses continue to develop. Anyone managing significant self-custody holdings should treat this as a reason to review address hygiene now rather than waiting for a confirmed incident to force the issue.
Frequently asked questions
What did Justin Drake actually warn about?
Drake, an Ethereum Foundation researcher, said on October 7, 2026 that AI-assisted advances in mathematics could potentially break the ECDSA signature scheme securing Bitcoin and Ethereum wallets “in months not years” in a worst-case scenario, well before large-scale quantum computers arrive.
Has Bitcoin’s encryption actually been broken?
No. Reporting on Drake’s warning explicitly notes that no practical attack on Bitcoin or Ethereum wallet keys has been demonstrated. This is a risk-management warning about a possible future capability, not a disclosed breach.
How many bitcoins are considered at risk?
Estimates range from roughly 6.7 million to 7 million BTC, per Fireblocks research counting addresses with already-exposed public keys, to more than 8.1 million BTC under the Bitcoin Risq List’s broader classification, reported in an October 8, 2026 update.
What is bunker mode?
It is Drake’s term for a precautionary, industry-wide plan to migrate funds from addresses with exposed public keys into fresh addresses whose public keys have never appeared on-chain, reducing the attack surface available to a future ECDSA break.
Does moving coins to a new address fully solve the problem?
No. It reduces exposure today but does not make Bitcoin’s protocol quantum-resistant. The underlying ECDSA scheme is unchanged, and spending from the new address later exposes its public key again.
What is BIP-360 and is it active on Bitcoin?
BIP-360 is a proposed Bitcoin upgrade that would add a post-quantum-resistant address type called P2QRH. It remains in the proposal stage with no activation date and no guarantee it ships in its current form.
How does Ethereum’s approach differ from Bitcoin’s?
Ethereum formed a dedicated Post-Quantum Security team in January 2026 and has published a multi-year roadmap covering hash-based signatures and post-quantum interoperability. Bitcoin’s equivalent fix, BIP-360, is still working through its proposal process with no formal team or timeline attached.
What should everyday crypto holders do right now?
Check whether your holdings sit in addresses that have ever sent a transaction. If so, consider moving funds to a fresh, never-used address, and avoid reusing addresses going forward. This does not fix the underlying cryptography, but it removes your coins from the current pool of publicly exposed public keys.
