Could AI Crack Bitcoin's Locks? What Both Sides Say

On a podcast taped this month, investor Chamath Palihapitiya described the heist he thinks someone will eventually try. Point an AI at "Satoshi's wallet," break the math, "drain the wallet and then go short and then tell people that you did it." Asked whether Bitcoin is finished, he said: "I just think it's capped and then I think eventually it gets hacked and then it goes to zero." (He also said he holds Bitcoin only indirectly, through stock in Digital Currency Group.) His co-host Alexander Wissner-Gross added that Anthropic's recent cryptography post shows "frontier models can probably achieve astonishing inversion attacks against crypto systems." That exchange is on the October 21 episode of Moonshots, at about 1:48.

It was the loudest version of a worry that has been building since early October. Here's what's real in it, and what isn't.

Two different locks

Bitcoin uses two kinds of math, and they get mixed up a lot.

• SHA-256 is a hash. Miners use it to build blocks, and addresses use it to hide your public key. Breaking it wouldn't hand anyone your coins.
• ECDSA (on a curve called secp256k1) is the signature. It's how you prove you own an address when you send from it. If someone could work backward from your public key to your private key, they could sign for you. That's the lock everyone is actually arguing about.

So the realistic version of the heist isn't "break SHA-256." It's "recover private keys from public keys that are already visible."

What set this off

On October 7, Justin Drake, a researcher at the Ethereum Foundation, posted that it's "reasonable to brace for the possibility that ECDSA breaks before qday, in the worst case in months not years." Q-day is the day a quantum computer can do it. His reason was the speed of AI progress in math, including OpenAI's release of hundreds of solved math problems this month. By "break" he meant recovering a private key in about a week on hardware that exists, such as a large GPU cluster. He suggested what he called "bunker mode": move funds to fresh addresses that have never sent a transaction, so their public keys stay hidden.

A week later, on October 16, Anthropic's Frontier Red Team published a post showing that its Claude model had traced how the official US government curves (NIST P-256 and its siblings) were generated in the late 1990s. That solved a long-running mystery about where the curves came from. It's the "ECDSA announcement" the podcast meant. But Anthropic's own post says: "This is not a cryptographic break, new attack, or weakness in the ECDSA curves." And: "There is no action to be taken." It also wasn't about Bitcoin's curve. Bitcoin uses secp256k1, not the NIST curves.

The case for worrying

• Math is moving fast. On the October 15 Moonshots episode, Wissner-Gross put it simply: "crypto depends on math being hard," and AI is starting to make hard math solvable. Later in the show he said, "It's not quantum that's going to disrupt you. It's AI solving math."
• Upgrades are slow. Even if a fix exists, getting a whole network to agree on new signatures takes years. Wissner-Gross argued that gap favors attackers.
• Quantum estimates keep shrinking. In March, Google Quantum AI estimated that breaking the curve Bitcoin uses could take fewer than 500,000 physical qubits running for minutes. That's fewer than earlier estimates, though still far beyond any machine that exists today.
• Some serious people share the worry. Vitalik Buterin said the risk is real, while warning against rushing. Johns Hopkins cryptographer Matthew Green shared Drake's concerns, The Block reported.

The case against panic

• No one has shown an attack. Yehuda Lindell, Coinbase's head of cryptography, said there is "no evidence whatsoever" that the decades-old math behind elliptic curves has weakened, and called the alarm FUD (fear, uncertainty and doubt). His point: an AI that proves hard theorems hasn't shown it can solve the specific problem ECDSA rests on.
• Experts on wallets agree. Trezor analyst Lucien Bourdon noted that no credible published research has undermined ECDSA's math, The Block reported.
• Rushed moves cost money too. Buterin said he doesn't recommend scrambling to move funds, and that botched migrations have cost him more than hacks.
• Defenders get AI too. A Moonshots co-host pushed back on air: AI can also find stronger cryptography, so "it becomes an arms race," and that race "goes in both directions."
• There's a middle path. Dragonfly's Haseeb Qureshi argued that moving coins only protects them while they sit still. He proposed a "cryptographic recovery mode," a hash-based backup signature that networks could add in advance and switch on if ECDSA ever fell.

Which coins would be exposed first

Your public key is hidden behind a hash until you spend from an address. After that, it's on the blockchain for anyone to read. Glassnode co-founder Rafael Schultze-Kraft counted about 6.26 million BTC, roughly 31% of supply, at addresses with visible public keys, up from 24.8% in early 2021, The Defiant reported.

• About 4.33 million BTC is exposed because addresses were reused: people received again at an address they had already spent from.
• About 1.94 million BTC is exposed by address type. That includes roughly 1.71 million in very old "pay to public key" outputs, around 1.1 million of them linked to Satoshi Nakamoto, and about 222,000 BTC in Taproot outputs.

Address reuse is the part ordinary holders control. Most modern wallets hand you a fresh address every time you receive. Exchanges hold coins for you, so how exposed they are depends on their own setup, not yours.

Bitcoin developers have a draft fix in the works. BIP-360 would add a new kind of address designed to resist quantum attacks. It has been merged as a draft proposal. It isn't active, and there's no date for it.

Where that leaves things

Nobody can say whether AI will ever crack ECDSA, or when. The people raising the alarm and the people pushing back are reading the same evidence, and that evidence doesn't include a working attack. What we can say is that a break, if one ever came, would hit old and reused addresses first, and that a network upgrade would take years to roll out. Watch for one thing in the meantime: scammers love a scary headline. A message telling you to "migrate your wallet now" through a link is a scam, not the fix. Real upgrades arrive as wallet software updates and network proposals like BIP-360, argued over in public for years.

Sources: Anthropic Frontier Red Team, ECDSA curve origins (Oct 16, 2026), Justin Drake on X (Oct 7, 2026), The Block: industry split over Drake's warning, The Block: Buterin warns against hasty migrations, Decrypt: AI may break encryption before quantum, The Defiant: Glassnode counts 6.26M exposed BTC, Google Research: quantum resource estimates, Bitcoin Magazine: BIP-360, Moonshots podcast, Oct 21 episode, Moonshots podcast, Oct 15 episode.