AI 'Challenges' Cryptography? Web3 Must Prepare in Advance, But Should Never Rush Migration

The long-term security assumptions of cryptography are being re-evaluated, but preparing in advance and rushing migration are never the same thing.

Written by: imToken

Recently, discussions about "AI potentially breaking cryptography" have indeed sparked a wave of panic in the Crypto community.

The issue originated on October 7, when Justin Drake called on the entire blockchain industry to calmly start planning for "Bunker Mode" to address potential cryptographic risks in the future.

His core concern is that as AI continues to advance in mathematical research, the elliptic curve cryptography widely used in networks like Bitcoin and Ethereum may face new mathematical attack methods before truly capable quantum computers emerge.

In his worst-case scenario, relevant breakthroughs could even be measured in "months rather than years," hence he suggests that large holders and institutions should consider orderly migration of assets to minimize the potential risks posed by exposed public keys.

Subsequently, Vitalik Buterin also joined the discussion.

Interestingly, Vitalik did not deny that AI could accelerate cryptographic research; he even further proposed that certain cryptographic schemes believed to be resistant to quantum attacks might also be affected by future mathematical breakthroughs.

However, regarding whether ordinary users should immediately migrate their assets, he emphasized that the real losses caused by hasty upgrades and migrations might be more concerning than the yet-to-happen cryptographic attacks.

This also raises a long-standing question troubling the entire crypto industry: When the underlying cryptographic assumptions protecting on-chain assets begin to face new challenges, how far in advance should public chains prepare, and when should ordinary users take action?

1. Why is there a risk? First, understand the distance between "address" and "public key"

To understand the focus of this discussion, we first need to return to the most basic account and signature mechanisms of public chains.

As is well known, in non-custodial wallets, the private key is the key credential for controlling assets. Technically, wallets prove that a transaction has indeed been authorized by the corresponding key holder through digital signature algorithms without revealing the private key.

The most typical example is elliptic curve cryptography (ECC).

Taking Ethereum as an example, ordinary external accounts (EOA) use ECDSA to generate transaction signatures, while Bitcoin's traditional signature system also widely uses ECDSA, and Taproot employs Schnorr signatures based on the same elliptic curve.

These schemes can operate reliably over the long term, relying on an important mathematical assumption: It is very easy to compute a public key from a private key, but it is nearly impossible to derive a private key from a public key using currently known classical computational methods.

We can understand this as a mathematical problem that is easy to verify but extremely difficult to reverse-solve. Anyone on the network can use the public key to verify whether a signature is valid, but cannot easily deduce the signer's private key from it.

It is this asymmetry that forms the important foundation of modern blockchain asset ownership.

However, there is an easily overlooked detail: the "wallet address" we commonly see is not always the complete public key.

Taking an ordinary EOA in Ethereum as an example, the wallet address is an identifier generated by taking a portion of the public key after hashing it with Keccak-256, while in Bitcoin, common address types like P2PKH and P2WPKH also use designs based on public key hashes.

This creates an interesting security difference.

For an Ethereum ordinary account that has never initiated an on-chain transaction and has not publicly disclosed its public key information through other means, the outside world can usually only see the hashed wallet address. Since existing computational methods find it difficult to reverse-engineer the complete public key from the address hash, the public key is effectively protected by an additional layer.

However, once this account actively initiates a transaction and submits an ECDSA signature, nodes can recover the corresponding public key based on the signature information. Given that on-chain transaction records are publicly available for a long time, this information will also continuously be exposed to the outside world.

This means that for accounts using public key hash addresses, the risk levels may differ when facing certain future cryptographic attacks between those that have not exposed their public keys and those that have.

It is important to emphasize that this does not mean all public chains follow exactly the same rules.

For example, Bitcoin's Taproot outputs themselves contain visible elliptic curve public keys, so even if a Taproot address has never actively spent funds, it cannot simply be assumed that its public key remains hidden behind the hash function; moreover, some public key information may also be prematurely exposed through address reuse, public signatures, extended public keys, or other means.

Therefore, "not having transferred assets" does not necessarily equate to "the public key has not been exposed," and a new address does not inherently possess quantum resistance.

Understanding this difference makes it easier to see the challenges posed by quantum computing and AI.

Theoretically, a sufficiently large and error-correcting quantum computer could efficiently solve the elliptic curve discrete logarithm problem using this algorithm, deriving the private key from the public key, thereby threatening ECDSA, Schnorr, and other signature systems.

However, to date, there is no evidence that mainstream signature systems used by Bitcoin or Ethereum can be practically broken by quantum computers.

Justin Drake's concern this time is that beyond quantum computers, the focus is on AI potentially helping humans discover shortcuts to solutions that existing mathematical algorithms have not found, especially as AI has made continuous progress in mathematical reasoning, algorithm search, and formal proofs over the past year, some researchers have begun to rethink whether those computationally difficult problems that have been tested for decades could be reassessed due to new mathematical discoveries.

2. No Essential Disagreement Between Justin and Vitalik

Clarifying the underlying logic, looking back at the discussion between Justin and Vitalik, it becomes apparent that their judgments are not entirely opposed; they simply assign different priorities to different risks.

First, let's look at Justin Drake.

Traditionally, the evolution of cryptographic systems is often a lengthy process. After all, identifying potential risks, formulating new standards, completing engineering implementations, and achieving compatibility and coordination among public chains, wallets, exchanges, custodians, and hardware devices can take years or even longer.

Not to mention that decentralized networks like Bitcoin and Ethereum, which are large in scale and require extensive coordination, cannot typically complete underlying upgrades through a single version update like ordinary software.

Justin's concern is precisely that this lengthy upgrade cycle may not keep pace with the speed of future mathematical research breakthroughs.

For example, if AI indeed helps researchers find new cryptographic attack methods in the future, then even without waiting for quantum computers to possess practical cracking capabilities, the existing elliptic curve signature systems may be threatened ahead of time.

Once such a breakthrough actually occurs, the migration window available to public chains and wallet ecosystems may be much shorter than previously anticipated.

Therefore, his standpoint is to take precautions, emphasizing that exchanges, large institutions, and users holding substantial assets should start considering future risk-hedging paths now.

This includes taking stock of addresses with already exposed public keys, orderly transferring some long-held assets to new addresses with unexposed public keys, and minimizing unnecessary signatures and address reuse in subsequent usage.

From a technical perspective, this advice is indeed reasonable—if future attacks rely on deriving private keys from public keys, then reducing the exposure of public keys in advance could potentially buy more defense time under specific conditions.

However, the problem is that transferring funds to new addresses with unexposed public keys does not equate to completing a true post-quantum cryptographic migration.

As long as the new address still uses traditional signature schemes like ECDSA, its underlying security assumptions have not fundamentally changed; once a transaction is initiated using that address, the public key may still be exposed again; if the attack capability is strong enough, even the brief window between transaction broadcasting and confirmation could become a new risk.

In other words, this is a transitional risk mitigation measure, not a final solution that can solve the problem once and for all. More importantly, reducing potential risks from a cryptographic perspective does not necessarily mean it is safer from an actual asset management perspective.

This is also where Vitalik places particular emphasis.

Under currently known technical conditions, there is still a lack of feasible practical attack methods to directly recover ECDSA private keys from public keys, but during the asset migration process on-chain, losses caused by address errors, key backup failures, malicious authorizations, or other operational issues are real risks that can occur every day.

Vitalik even mentioned that the losses he suffered due to migration configuration errors were greater than those caused by hacker attacks.

For ordinary users holding only a small amount of ETH, migrating assets may simply involve creating a new address, backing up keys, and initiating a few transfers; but for users who have long participated in DeFi, staking, cross-chain interactions, or managing funds through multi-signature wallets, the situation becomes much more complex.

Assets may be spread across different networks, some funds may still be in staking or lending protocols, and old addresses may still have permissions for smart contract administration, fund withdrawals, or other critical operations.

If one were to conduct a large-scale asset migration just because of news about "AI potentially breaking wallets," it could instead lead to irreversible losses due to transferring to the wrong network, misusing cross-chain tools, signing malicious transactions, or operational errors in multi-signature setups.

Not to mention that once the market begins to spread panic about "wallets being about to be cracked," various impersonations of official anti-quantum upgrade links, asset protection tools, and so-called migration services may also emerge.

It is worth noting that Vitalik's caution does not mean he holds a conservative attitude towards upgrading underlying cryptography.

On the contrary, he also believes that the mathematical advancements brought by AI deserve serious research, and even reminds the industry to re-examine some post-quantum schemes based on lattice cryptography, to avoid assuming that an algorithm labeled as "quantum-resistant" can withstand all future mathematical breakthroughs.

When conditions allow, he also tends to consider more cryptographic structures based on hash functions and adopt more conservative security parameters for other schemes.

Therefore, Justin and Vitalik cannot simply be categorized as radical and conservative factions; there is no essential deep-seated contradiction between the two.

3. From Public Chain Upgrades to Wallet Migration: How Far Have We Come in True Quantum Resistance Preparation?

Many users may ask: Since there are long-term risks in underlying cryptography, can wallets directly upgrade me to a "quantum-resistant wallet"?

Simply updating the wallet app is not enough.

Because for blockchain, cryptographic upgrades involve not only how private keys are generated and how transactions are signed, but also whether the entire network can recognize and verify the new signatures, and whether existing accounts can transition smoothly.

In fact, even without this discussion triggered by AI, mainstream public chains and cryptographic research institutions have already begun preparing for the post-quantum era.

Taking Ethereum as an example, its quantum resistance preparations have already involved multiple levels.

In addition to ECDSA used by regular accounts, the BLS signatures used in validator consensus, KZG commitments related to data availability, and certain zero-knowledge proof systems all involve cryptographic structures that will need to be reassessed or upgraded in the future.

To address this, the Ethereum Foundation has established a dedicated Post-Quantum Security research team and is exploring new signature and proof schemes for the consensus layer through technologies like leanXMSS and leanVM.

At the account level for regular users, account abstraction offers another path worth noting. Unlike the traditional EOA's signature verification mechanism tightly bound to the underlying protocol, account abstraction and interchangeable signature verification mechanisms are expected to allow user accounts to adopt different signature algorithms in the future, thus reserving more flexible space for post-quantum upgrades.

For example, the currently discussed EIP-8141 is related to Ethereum's native account abstraction and is expected to become an important foundation for supporting more flexible signature verification in the future. However, its specific deployment timeline and final implementation method still await further community discussion and testing.

In contrast, Bitcoin faces different challenges.

Due to its UTXO model, along with the complexity of historical address types and some early assets being dormant for long periods, Bitcoin must consider not only new signature algorithms and output structures but also how to migrate a large number of existing assets. Currently, community-related drafts are still in the proposal and coordination stage.

Additionally, some other public chains have already begun to attempt more direct engineering implementations. For instance, NEAR announced in July 2026 that its mainnet upgrade has supported post-quantum signatures based on FIPS 204, providing accounts with the ability to add quantum-safe keys.

Of course, supporting a certain type of post-quantum signature does not mean that the entire public chain and all its accounts, applications, and infrastructure have completed the quantum migration.

Putting these developments together, it becomes clear that the real challenges facing the industry are diverse. They include not only the need for new cryptographic schemes to be theoretically secure but also considerations of signature size, on-chain verification costs, node performance, hardware compatibility, and whether a large number of existing accounts can transition smoothly.

And these changes at the protocol layer will ultimately affect the wallets that users use every day.

For multi-chain non-custodial wallets like imToken, future cryptographic upgrades cannot simply be a straightforward version update:

• On one hand, wallets need to gradually adapt to new account and address types, key management methods, transaction signing, and verification mechanisms as different public chains upgrade. This may also involve compatibility with hardware wallets, smart contract accounts, and multi-signature systems;
• On the other hand, wallets need to translate complex underlying technical changes into operations that ordinary users can understand. If a certain public chain officially supports a new post-quantum signature scheme in the future, what users truly care about is whether their original addresses can still be used, whether they need to create new accounts, whether existing mnemonic phrases and hardware devices are compatible, and how to handle the Tokens, NFTs, staked assets, and DeFi positions they already hold;

Some of these issues can be gradually resolved through wallet product capabilities, while others must wait for public chain protocols, smart contracts, and the entire ecosystem to provide support.

This is also why the more complex the underlying security upgrades, the more the migration process on the user side needs to undergo thorough testing, rather than hastily launching a so-called "one-click quantum resistance" entry.

So at this stage, what should ordinary users do?

• First, there is no need to immediately transfer all assets just because of this discussion. There is currently no evidence that the signature algorithms of mainstream public chains have been practically compromised. It is especially important to be cautious of unfamiliar links and migration tools that spread under the guise of "quantum resistance upgrades." Any operation that requires importing mnemonic phrases, private keys, or induces signing unknown transactions should be approached with high caution;
• Second, for large and long-term held assets, users can start to consciously improve their address management habits. For example, understanding the public chains and address types they are using, reducing unnecessary repeated use of high-value asset addresses and signing operations. If it is indeed necessary to adjust the asset storage structure, users should first confirm wallet and network compatibility, ensure proper key backups, verify receiving addresses, and reduce migration risks through small tests and batch operations;
• Finally, and perhaps the most easily overlooked point: whether a wallet will support post-quantum signatures in the future and whether users need to migrate assets today are two different questions;

Conclusion

In the world of blockchain, we build trust through mathematics and code.

From this perspective, for an open financial network that hopes to carry trillions of dollars in assets long-term, no one can guarantee that a cryptographic scheme deemed secure today will not need adjustments in the coming decades.

However, this does not mean that every breakthrough in cutting-edge research requires ordinary users to immediately rearrange their assets.

Cryptographic researchers need to focus on the worst-case scenarios, public chain developers need to design new security mechanisms in advance, wallet teams need to provide reliable support for future upgrades and migrations, and ordinary users need to avoid making hasty decisions based on unverified information, all while truly understanding the risks involved.

There is no need to assume that a crisis is imminent, nor to underestimate the inevitability of evolution. Stay alert and operate cautiously.

For every holder, this is the best way to face the unknown.