31% of BTC is under threat.

Written by: 0xFacai, Rhythm

Days ago, Ethereum core researcher Justin Drake urged the industry to prepare for "shelter mode," moving assets to new addresses where the public keys have not yet been exposed. He is concerned that mathematical breakthroughs brought by AI could allow practical attacks on ECDSA, a widely used digital signature algorithm, before quantum threats materialize. In the worst case, holders may only have a few months of time left.

When prices decline, people can still discuss valuation and cycles. Once the security of private keys is in doubt, the question changes to: is the money in the wallet still considered one's own? This shakes the very foundation of cryptocurrency.

Whistleblower

The situation Drake worries about is one where AI finds mathematical methods yet undiscovered by humans, enabling attackers to recover wallet private keys from publicly available information using existing hardware. He describes the "cracking" quite specifically, such as using large GPU clusters to recover target private keys in about a week.

Quantum threats require corresponding hardware capabilities. The risks brought by AI point to algorithmic breakthroughs: if a previously considered unsolvable mathematical problem has a more effective solution, the original computational costs will decline. Defenders were originally waiting for quantum computers, but now they must guard against changes to classical algorithms themselves.

Elliptic curves have rich mathematical structures, which is why Drake is particularly concerned about them. Will those solutions yet to be discovered by humans be found by more powerful AI? Can past accumulated security experiences still provide the same assurances for the future?

Vitalik's response also takes this possibility seriously. He extends the concerns to lattice cryptography, including quantum-resistant schemes like ML-DSA. These schemes also rely on specific mathematical problems being hard to solve; if AI-accelerated research changes the solving methods, the security margins provided by existing parameters need to be reassessed.

Thus, the "quantum-resistant" label is not enough to answer all AI risks. Vitalik prefers to use hash constructions in applicable signatures and proofs to reduce reliance on complex mathematical structures. He also reminds that public key encryption has more challenging limitations, making it impossible to directly adopt this route.

Many who oppose Drake's statement argue that his claim of "months" is overly alarming.

Illia, the founder of NEAR, admits that AI is challenging people’s understanding of mathematical complexity but has yet to see a substantial change in the timeline for practical attacks on elliptic curves. He is particularly concerned that complex migration operations pose new risks for holders and advocates making cryptographic updates a regular capability.

Cryptography researcher Sean Bowe criticizes the disparity between the intensity of the warning and new evidence. Experts need to help non-professional holders deal with uncertainty; overly urgent expressions can leave people feeling lost and can damage the credibility of subsequent risk communications.

30% of BTC public keys have been exposed

While there is still controversy over when attacks may become feasible, the scale of assets that need to be handled can already be quantified.

Researcher Rafael from Glassnode provides the figure: about 6.26 million BTC correspond to public keys that are visible on-chain, accounting for 31.2% of the issued supply, up from 24.8% at the beginning of 2021.

To understand why this portion of BTC is exposed, it is necessary to differentiate between public keys and private keys.

Private keys are used to generate digital signatures that authorize transactions, while public keys are used for the network to verify signatures. Public key disclosure aligns with the design of cryptographic systems, where security relies on the attacker’s difficulty in deriving the private key from the public key. If sufficiently powerful quantum computers change this dynamic, publicly available public keys could become a target for attacks.

Some BTC addresses initially displayed only the hash of the public key on-chain, temporarily keeping the public key itself hidden. However, when holders spend funds, the public key becomes exposed. If they then leave the funds under the control of the same key or continue to receive payments there, those balances correspond to an already exposed public key.

This is the exposure that comes from address reuse. According to Rafael's statistics, this portion comprises about 4.33 million BTC. Moving funds to new addresses that still hide the public key behind a hash can reduce current long-term exposure.

In about 1.94 million cases, the situation is different, as the public key is directly exposed by the script type. Early P2PK transactions directly recorded the public key on-chain, and Taproot outputs will also expose the public key. Such funds, even if not yet spent, already have their public keys visible. Handling them requires consideration of the structure of the addresses used, not just whether the address has been used.

Exchanges represent a larger actionable group. Among the marked exchange holdings, about 1.79 million BTC public keys are visible, accounting for 57% of these holdings, up from 55% in May. Since the report in May, the overall exposure stock has increased by approximately 222,000 BTC, while the new supply of BTC during the same period was only about 64,000 BTC.

Reducing exposure cannot replace a complete cryptographic upgrade. Funds temporarily hidden from public keys will still face attack windows when spent or when public keys are revealed in the future. However, this data at least indicates that there is a portion of defensive work the industry can do in advance, and its progress can be observed.

Some have given up on Crypto

This uncertainty has already caused some investors to lose interest.

Trader metavestor stated on Twitter that he has sold most of his spot holdings. He doesn't want to see new AI mathematical research news and wonder if he will incur irreparable losses, nor does he want to speculate whether an old Bitcoin address transfer means the private key has been compromised.

He originally entered Crypto as a technical optimist but is now more inclined to focus on AI and biotechnology. Continuing to hold Crypto makes him feel like he is shorting the progress of AI. Even if he misses the next bull market, he is willing to accept it as there are other assets to trade.

The notion that "banks also rely on cryptography" hasn't alleviated his concerns. In a follow-up explanation, he emphasized the security teams and defense capabilities of banks, and hoped for recourse and government assistance after significant attacks. For on-chain assets, he lacks the same confidence.

Attacks do not need to cause all cryptographic systems to fail simultaneously. As long as the cost of recovering a certain address private key is lower than the value of the assets accessible, the attacker has the motive to try. The ease of asset transfer, the ease of monetizing an attack, and whether losses can be recovered will all affect the distribution of risk.

However, there are counterarguments that BTC in its early stages also faced survival risks in custody, adoption, and regulation. Investors were willing to bear these risks, which is part of the source of returns. Risk exists and cannot solely determine whether an asset is worth holding.

Opponents also do not agree that government assistance can be seen as a guarantee in advance. If credible institutions generally face greater attack pressure, there remains room for reassessment of the relative value of permissionless currencies. In the eyes of the opponents, Drake's warning will prompt the industry to take preventive measures more seriously, and such changes could ultimately result in positive outcomes.

Some are willing to take on risks that are difficult to quantify, while others believe the ongoing energy cost of monitoring it has exceeded the expected benefits.

However, from individual decisions to exit, to judging that the entire industry has no future, there still needs to be an assessment of what defenders can do.

Reconstruction

Crypto has already implemented some specific measures to address threats.

Ethereum's EIP-8141 proposal attempts to make account verification programmable, allowing accounts to choose how to confirm transaction authorization and reduce reliance on fixed signature algorithms. According to Ethereum Foundation member binji, future plans also include a target for minimal usable quantum-resistant L1.

The significance of this cryptographic agility is to leave space for changing verification methods within the system. Long-term asset holding does not have to mean forever relying on a single selected set of algorithms.

Solana’s Jacob Creech introduced a recovery path based on secret seeds. Signature keys are derived from the seed, and he hopes legitimate holders demonstrate knowledge of the seed through hashes, subsequently migrating to new signature schemes.

The NEAR account model described by Illia also emphasizes key management and rotation. According to his introduction, NEAR has supported ML-DSA and plans to add hash schemes. Combined with Vitalik's concerns about lattice cryptography, being able to continue adjusting the authentication method is inherently more valuable than simply committing to the security of a certain algorithm.

These paths do not guarantee that all funds will be timely upgraded. Wallets need to be compatible with new verification methods, institutions need to arrange custodial migrations, and holders need to preserve their assets during operations. Vitalik particularly reminds that he personally lost more money in a wrong migration than in hacker attacks. Defenses need to account for these costs as well.

But AI capabilities will also enter the defense. Binji mentioned that AI can accelerate cryptographic research and assist in formal verification, allowing implementations to undergo stricter scrutiny. Stronger tools can help find attack methods, as well as help detect errors and verify new schemes.

AI will also enhance impersonation, deception, and social engineering attacks. Even if cryptography is strong enough, those with key authority will still be targeted. A system that can update its security foundations while minimizing the impact of any individual or institution being compromised remains useful in the face of stronger AI.

This is also a reason to stay relatively optimistic. Technological advancements will simultaneously change attack capabilities, defense capabilities, and the demand for trustworthy systems; one cannot simply fix the latter two and extrapolate the attackers' advancements to a final outcome.

Looking at these changes, cryptographic upgrades and custodial migrations will become important themes by 2027.

The sense of security in Crypto needs to be rebuilt. A system that can continuously update its security foundations and reduce the concentration of key authorities will only become more valuable in the era of AI.