quote: We urgently need "AI safe" cryptography, not "quantum safe" cryptography — a point many in crypto are completely missing at their peril. Undeniably, AI is already here today, while cryptographically-relevant quantum computers that might break our traditional cryptography are still years away, according to impartial expert estimates. Justin's post below, indirectly highlights the problem with the current industry stampede to "quantum safe" cryptography. As I shall explain, the real reason for this unwise stampede is that the networks involved want to sell tokens by riding the quantum narrative, and it has nothing to do with good technical stewardship, or trying to protect users from harm. If what I'm saying is true, this is a big deal for the industry, and therefore I challenge those promoting quantum safety to a healthy debate. Here's the core problem that we actually need to worry about imo: AI is now coming for mathematicians, just like it came for even the most advanced software engineers. Nothing will now be the same. Every day, AI is showing that long-held mathematical assumptions (what we think of as "laws of math") are actually false. This is very important for the crypto industry. This Scientific American article covers recent advancements for the interested: https://www.scientificamerican.com/article/openai-unleashes-hundreds-more-math-results-upon-a-field-already-in-shock/ At its core, cryptography relies on mathematical assumptions that doing this or that is incredibly hard, and can only be achieved by brute force, such that if sufficient bits (0s and 1s) are used by a cryptography scheme, forging a signature to unlock and steal someone's balance of digitial assets, say, would require trillions of years of work by all the computers on earth. If AI can show these kinds of assumptions are incorrect, then new math can be devised to shortcut the work that makes affected cryptography schemes safe. Therefore, to maximize our chances of staying safe, we need our networks to use cryptography schemes that depend on mathemaatical assumptions that have the least chance of being found incorrect by AI. Justin rightly points out that even ECDSA isn't completely safe, and that some bitcoin owners might want to take protective measures. However, the focus on the potential dangers to ECDSA will accidentally obscure a critical point for many readers, which is that the schemes that are most likely to be safe, will be those that have been around the longest, which have benefited from the most years of analysis by mathematicians and cryptographers, and ECDSA is one. This far, ECDSA has benefited from decades of analysis by a worldwide army of researchers, and while this doesn't provide a guarantee that ECDSA is safe, it provides good reason to believe it has a decent chance of being safe from AI. The same is not true of the new "quantum safe" cryptography schemes. They involve new assumptions that the world has had only a fraction of the time to analyze, and complex algorithms that can have hidden flaws that can be used to break them, rather like there are shortcuts that can be used to quickly solve a Rubik's cube — and AI recently exploited exactly such a weakness to attack the HAWK post quantum scheme, see https://www.anthropic.com/research/discovering-cryptographic-weaknesses Listen to what Dan Boneh @danboneh, a world-famous cryptographer, and Head of Secure Computing at Stanford University, recently said: "if you try to aggressively move to a post quantum architecture, like for example by 2029, I think that would be a mistake for blockchain, I think we need to take our time, and the reason is that a hasty transition to post quantum, in my mind, is more likely to cause a catastrophic bug, than we'll be attacked by a quantum computer." https://youtu.be/F-HG87VJj_k?t=0 Maybe in the future, we will measure the safety of mathematical assumptions using the amount of energy that has powered the AI that's analyzing them, multiplied by IQ efficiency, divided by domain complexity (I'm not proposing exactly this, my fingers just invented this nonsense as I typed, but you get the idea!). We have not reached that future yet though. We can't say that a quantum safe cryptography scheme is sound because AI analysis has done thousands of person years of human research for us. So what gives, and why are networks constantly trumpeting their implementation of the latest post-quantum scheme, when cryptographically quantum computers seem years away, if doing so is playing fast and loose with user safety? The unvarnished truth is that it's driven by a primary desire to sell tokens. All markets are driven by hype, but the crypto industry has taken this to another level. Often (but not always), rather than reward genuine technological utility, progress, and mainstream potential, our markets reward those slotting into the latest narrative wave driving the "crypto casino". This is why there are so many multi-billion dollar vaporware networks romping up and down industry league tables, which, imo, is something we need to fix. Thus, although switching networks to post quantum schemes today apparently makes no technical sense, and puts users at risk, for those behind the networks transitioning early to post quantum cryptography schemes it makes great sense, because it helps them sell tokens and extract capital from crypto markets. Of course, this casino isn't fair, and is tilted in the favor of hidden orchestrators, which everyone who has been in crypto long enough already knows. Narratives, including the quantum safety narrative, are prompted by massive, semi-decentralized, hidden marketing machines, that incorporate everything from industry press owned by vested interests, astroturf armies on social media, paid mainstream PR, and influencers. The machines are wielded by coalitions of big money blockchain investors who have taken their positions ahead of time and will dump at the top of the pump. Needless to say, the problem for those riding these narratives, who are not part of the chosen circle, is that they can't control where the narrative is going, nor when it might suddenly end (like the NFT craze). From my perspective, it's all part of the fast money cynicism and short-termism that harms our industry every day and puts users at risk. But enough metaphysical philosophizing about crypto narratives. I call out to the leaders of the big networks that are pumping quantum safety claims, who regularly post pictures of their logos next to quantum computers, with the aim of messaging that they are sci-fi and advanced, who find ways of making a new quantum announcement almost every single day: I challenge you to explain your actual technical reasoning, your analyses of the relative risks involved, and explain exactly how your choices protect users in the face of AI advancements. We all deserve to hear the answers, and debate of this kind is exactly what our industry needs. It is, btw, what it was originally built on. Here's to hoping that the assumptions underpinning ECDSA aren't incorrect, and that's why the army of researchers failed to find anything in the decades they were looking. Let's also hope that AI discoveries help us make our crypto even safer. And, best of luck too to those being migrated to new post quantum schemes ahead of time... | Today I call upon the blockchain industry to calmly begin planning for "bunker mode". My personal recommendation is to set in motion a controlled mass migration of assets to fresh addresses, i.e. addresses whose pubkeys remain hidden behind a hash. Holders, starting with large and sophisticated ones, should consider moving the bulk of their funds to addresses that have never signed a transaction. And when they do sign one, they should also move remaining funds to a new address (possibly generated from the same seed phrase). Don't rush. While I believe there is cause for action a rushed migration would do more harm than good. Don't panic either. Moving assets to protected addresses is a simple, preventative step which does not require new cryptography or new wallets. IMO it is now reasonable to brace for the possibility that ECDSA breaks before qday, in the worst case in months not years. By "break" I mean fast private key recovery (e.g. in one week) on available hardware (e.g. a large GPU cluster). Recent days have been humbling for human mathematical intuition. Long-held, unquestioned hypotheses have fallen. This includes the n log(n) bound for integer multiplication and the 3SUM conjecture. In hindsight, May's unexpected disproof of the Erdős unit distance conjecture was our warning shot. Yesterday's OpenAI drop made it clear that mathematical superintelligence is upon us. They say there are weeks where decades happen. We are about to live through weeks where centuries of mathematical progress happen. Could our magic 64-byte ECDSA signatures be too good to be true? Was it just security through obscurity all this time? Elliptic curves feel especially vulnerable to superintelligence. Curves carry rich structure, with room for fancy tricks like Schoof, Frobenius, pairings. (By contrast, hashes are designed to minimise algebraic structure.) Separately, as Ewin Tang can attest, an efficient quantum algorithm sometimes foreshadows an efficient classical one. We should be open to the possibility of a classical counterpart to Shor that breaks elliptic curves and RSA at once. Also noteworthy is the striking under-representation of cryptographic breakthroughs among the 722 mathematical results OpenAI published. I've witnessed first-hand the US government censoring academic quantum cryptanalysis results. Backroom interventionism is my base case. I urge large, sophisticated actors to lead by example. Project11's "risq list" (bitcoin-risq-list.projecteleven[.]com) is a great tracker of exposed BTC pubkeys. Binance, Bitbank, Robinhood, Bitfinex, and Tether have an opportunity to harden their cold storage. Next month I'll address institutions in London in a live Q&A (forum.ethereuminstitutional[.]org/london-2026). Again, please do not rush. Wallets holding under 50 BTC enjoy partial cover from "Satoshi's shield", i.e. his 20K exposed addresses that hold 50 BTC each. Load-bearing signers like oracles and L2 security councils should consider rotating ECDSA pubkeys with every signed message and/or multi-signing with a hash-based schemes like SPHINCS. Exiting bunker mode safely will require post-AI cryptography. My inclination is to go all-in on hash-based cryptography and avoid structured mathematical assumptions entirely, whether from curves, lattices, or isogenies. A single battle-tested hash (e.g. from the SHA or BLAKE families) yields plausible post-AI security. The Ethereum roadmap on strawmap[.]org fully embraces hash-based cryptography with end-to-end formal verification as a response to the quantum threat. Those timelines must now be revisited and accelerated in light of mathematical superintelligence. I'll be pushing for maximum defensive acceleration.(Historical earnings: For fiscal 2027 Q2 (period ended 2026-07-26), NVIDIA reported basic EPS of 4.87, diluted EPS of 4.85, net income of USD 118.010 billion, and revenue of USD 177.837 billion. In the prior-year period (ended 2025-07-27), basic EPS was 1.85, diluted EPS was 1.84, net income was USD 45.197 billion, and revenue was USD 90.805 billion. For fiscal 2027 Q1 (period ended 2026-04-26), basic EPS was 2.4, diluted EPS was 2.39, net income was USD 58.321 billion, and revenue was USD 81.615 billion. Consensus expectations: For fiscal 2027 Q3 (event date 2026-11-17), consensus EPS estimate is 2.5253 and revenue estimate is USD 111.318 billion. For fiscal 2027 Q4 (event date 2027-02-23), consensus EPS estimate is 2.7989 and revenue estimate is USD 127.381 billion.)