AI-assisted cryptanalysis puts a premium on crypto networks that can switch signature schemes

What the model found

The hardest evidence in October's argument arrived in July. Anthropic published two cryptanalysis results produced by Claude Mythos, its unreleased model: one against a signature scheme called HAWK, the other an improved attack on reduced-round AES ^[1]. Matthew Green wrote up his reading on his blog the next day ^[1]. The AES work targets a 7-round version of a cipher that runs 10, 12 or 14 rounds in full. Green called it a modest constant-factor improvement on an attack from 2013 ^[7].

HAWK, the more consequential of the two, is a proposed post-quantum signature scheme built on the module Lattice Isomorphism Problem, neither deployed nor adopted by a standard, though Green wrote that it was somewhat far along in evaluation for a future one ^[2][3]. The attack is still exponential time. It roughly halves the scheme's bits of security, and its code ran in a few hours of wall-clock time against a weakened challenge instance supplied for the purpose ^[4][5].

A halving can be repaired: double the key sizes and the security level returns ^[4]. Green wrote that for HAWK, doubling makes the scheme less efficient, and since HAWK is entirely motivated by being more efficient than the alternatives, "that makes the existence of the scheme much harder to justify" ^[4].

The attack invents no new mathematics; it extends tools that were already well known ^[6]. "The TL;DR is that someone just did a much more thorough job applying all of our known tools," Green wrote. "This is the sort of things that attack AIs excel at." ^[6]

Two camps, two bets

Buterin's warning, as CryptoSlate and crypto.news reported it, leans on the history of factoring. Advances such as the general number field sieve made RSA far easier to attack than earlier estimates suggested, and he argued AI could compress decades of comparable progress against lattices into a much shorter period ^[13]. For Ethereum, he said, the long-term "lean" roadmap has moved toward hash-based signatures and proofs and away from lattice designs ^[12].

Hoskinson's Oct. 9 reply goes straight at the analogy. "The factoring analogy is wrong," he wrote ^[15]. In his telling, the sieve grew out of techniques involving arithmetic relationships and smooth numbers, and no comparable mechanism has been demonstrated against the lattice problems under modern post-quantum standards ^[34]. He traced the attack record to the Lenstra-Lenstra-Lovasz reduction algorithm of 1982 ^[15]. ML-KEM and ML-DSA, which NIST approved in August 2024 as FIPS 203 and FIPS 204, carry parameters that he said already account for four decades of gains in lattice reduction and sieving ^[16][17].

"The case against lattices is the GNFS story, a.k.a. a hunch about 'structure,' and a multiplier pulled out of thin air," Hoskinson wrote ^[14]. The multiplier is Buterin's illustrative suggestion that key sizes be multiplied by ten, which Hoskinson called "numerology" ^[18]. His alternative is a rule tied to measurement. In CryptoSlate's summary, a gain in attack efficiency might justify moderately larger parameters, while a fundamental breakthrough could require replacing an algorithm altogether ^[18].

He then turned the structure argument on Ethereum. He cited the old failures of MD5 and SHA-1, which CryptoSlate noted do not establish weaknesses in modern constructions such as SHA-256, and extended the point to Poseidon and Poseidon2, hash functions built for efficient use in zero-knowledge proofs ^[19]. The Ethereum Foundation has funded research into Poseidon's resistance to algebraic attacks, including work using Groebner bases ^[20].

Each camp holds one bet and has correctly identified the other's. Buterin is wagering that hash functions hide less exploitable structure than lattices ^[12]. Hoskinson is wagering that four decades of lattice cryptanalysis have mapped the attack surface well enough to set parameters against it ^[17].

Where HAWK lands

On paper HAWK fits Hoskinson's rule. A measured improvement arrived, and the response Green describes, doubling key sizes, is the parameter change the rule calls for ^[4][18]. It also meets his evidence standard, since there is no new mechanism of the number-field-sieve kind, only known tools applied harder ^[6].

The second point cuts against him as well. The defense that known attacks are already priced in assumes those tools had been applied exhaustively. With HAWK, a model applied them more thoroughly and took roughly half the security from a scheme that was well along in evaluation ^[1][3][4][6].

The episode is not evidence against ML-KEM or ML-DSA. HAWK rests on module-LIP, and Green wrote that the attack does not transfer to Falcon, a related scheme being standardized on a different hard problem ^[2]. None of the reporting here describes a comparable AI result against the two NIST lattice standards.

We think HAWK shows where a halving does its damage: in schemes chosen for efficiency. A scheme with no margin to spare loses its reason to exist, while a scheme adopted for security pays in key size and stays in service ^[4]. The same applies to hashes. SLH-DSA is NIST's hash-based signature standard under FIPS 205, while Poseidon and Poseidon2 are the efficiency-tuned designs, and Poseidon is the one whose resistance to algebraic attack the Ethereum Foundation has paid researchers to test ^[16][19][20].

Hoskinson's strongest point is cost. Steering developers off lattice approaches, he warned, could slow protections already being deployed across internet infrastructure and extend reliance on encryption vulnerable to future quantum computers ^[11]. Hash-based signatures can handle transaction authorization, but lattice techniques also do key encapsulation for encryption, the job ML-KEM was standardized for ^[21][16].

The same hedge at every level of alarm

Green presented his October estimate as a deliberate worst case. "Everyone is very concerned about being respectable, so I'm going to be the goofball who raises worst-case possibilities," he wrote on Twitter, as quoted by Simon Willison ^[33]. "I think there is a 1% chance we live in Minicrypt, and a 15% chance we functionally lose confidence in our existing public-key encryption algorithms." ^[8] Minicrypt is Russell Impagliazzo's hypothetical world in which public-key encryption is impossible ^[9].

His remedy is about timing. "The problem here is that the speed of AI producing surprises, and the speed of human beings replacing standards (even with the very best AI assistance) are just orders of magnitude different," Green wrote. "You only recover from a surprise like this if you do the preparation in advance." ^[10]

Emin Gun Sirer, founder and chief executive of Ava Labs, is far calmer about the math. "We will see AI exploiting system-level bugs long before ECDSA goes away," he said on Oct. 9 ^[24]. Ava Labs, whose Avalanche chain authorizes transactions with secp256k1 ECDSA, is nonetheless weighing a "cryptographic recovery mode" proposed by Haseeb Qureshi, and an internal group is exploring hash-based approaches ^[25]. Sirer said there have been no confirmed exploits and no immediate changes are coming to the protocol, and he gave no timeline ^[26].

Qureshi, Dragonfly's managing partner, dismissed Justin Drake's "bunker mode" warning as "cryptographic doomerism" and then designed the backup ^[27]. His version is a hash-based backup signature that users map to their addresses, so that validators can force recovery if signatures are broken ^[28].

Drake is the most alarmed. "It is now reasonable to brace for the possibility that ECDSA breaks before qday, in the worst case, in months, not years," he wrote, citing an OpenAI report on AI's progress in mathematics ^[22]. He advised users to migrate gradually to fresh wallets whose public keys are not exposed ^[22]. Buterin said the industry should take the risks from "AI-accelerated math seriously" but does not recommend that users rush to move funds ^[23].

Sorted by remedy, the disagreement narrows. Green's preparation in advance, Ava Labs' backup study and Qureshi's recovery mode all amount to a second option readied before it is needed, and Buterin's hash-based roadmap is a switch made early ^{[10][25][28][12]}. Hoskinson wants a switch triggered by measured attacks ^[18]. Drake's advice is the only one that puts the work on individual holders ^[22].

The holder's hedge and the network's

Qureshi's objection to Drake is about market structure. Coins in a fresh address are protected only while they stay there, and they would be "worthless if all of the other coins are being hacked and mass-sold," he wrote ^[27].

Glassnode puts a size on the other coins: 6.26 million bitcoin in vulnerable addresses, more than 31% of supply ^[29]. About 4.33 million are exposed because addresses were reused, and moving them to a fresh address ends the exposure; another 1.94 million are exposed through their address format ^[30]. So roughly 69% of the exposed supply can be fixed by whoever controls the keys moving the coins ^[37]. Nearly 1.8 million of the exposed coins, about 29% of them, sit on exchanges ^[31][38]. Glassnode's figure that 57% of exchange balances are exposed implies exchanges hold about 3.2 million bitcoin in total ^[31][39].

A holder who moves coins protects a key. The price of those coins still depends on a pool of exposed supply above 31% of all bitcoin, and close to 1.8 million of that pool moves only when a custodian decides to move it ^[27][29][31]. Qureshi's design puts the recovery trigger with validators ^[28]. Crypto Briefing noted that swapping or supplementing the cryptography under a live chain requires coordination across developers, validators, wallet providers and users ^[32].

What we think, and what would make it wrong

Lattice parameters may simply hold, with attacks improving at the measured pace Hoskinson describes; the backup schemes would then be insurance never claimed, and the real loss would be whatever deployment slowed while developers argued ^[11][17]. A surprise could instead land in efficiency-tuned hashes such as Poseidon, and Ethereum's roadmap would then be the single bet that failed ^[19][20]. And Sirer may have the order right, in which case wallets, libraries and node software deserve at least as much attention as the cryptography, as Crypto Briefing put it ^[24][36].

We think the evidence supports valuing a network's prepared path to a second scheme above its choice of first scheme. HAWK shows that known tools, applied by a model, can strip a scheme's economic case without breaking it, and Green's point is that standards cannot be replaced at the speed such results arrive ^[4][6][10]. The counter-thesis is Hoskinson's, and it has weight: moving early slows deployment, the measurement rule already handled HAWK, and in his account Buterin has not identified a credible new attack that would justify abandoning lattice methods ^[11][18][35].

The view fails if a break can be answered after it happens. A network with no backup registered that swapped schemes inside the window of a live attack would show Green's speed gap to be smaller than he says, and advance preparation overpriced ^[10].

So far the hedge is research and proposals. The record shows an internal hash-based group at Ava Labs, Qureshi's recovery-mode proposal and Ethereum Foundation funding for Poseidon cryptanalysis, while Sirer said no immediate protocol change is coming ^{[25][28][20][26]}.