AI cryptanalysis warnings push blockchains toward hash-based backup signatures

The AI-produced cryptanalysis under this week's argument is two results Anthropic published in July, both generated by Claude Mythos, a model the company has not released ^[27]. One targets HAWK, a proposed signature scheme still under evaluation. The other targets a weakened AES ^[28][32]. Emin Gun Sirer, founder and CEO of Ava Labs, said on October 9 that there have been no confirmed exploits ^[12][14].

What the model found

HAWK is a post-quantum signature proposal built on the module Lattice Isomorphism Problem, and it is not deployed or adopted by any standard ^[28]. Matthew Green wrote in a July blog post that it was still "somewhat far along in the process of being evaluated for a future standard" ^[28]. It is related to Falcon, which is being standardized. Green wrote that the attack does not transfer to Falcon, which rests on a different hard problem ^[28].

The attack recovers keys but still runs in exponential time. It roughly halves HAWK's bits of security, so doubling key sizes could in theory fix it ^[29]. That fix costs efficiency. Since HAWK exists to be more efficient than the alternatives, Green wrote, the fix makes the scheme "much harder to justify" ^[29]. The working code ran in a few hours of wall-clock time against a weakened challenge instance built for the purpose, not against the parameters proposed for deployment ^[30].

The AES result attacks a 7-round variant. The full cipher runs 10, 12 or 14 rounds depending on key size ^[32]. Green called it a modest constant-factor improvement on work from 2013. Of the attack's operation count, and its need for a real encryptor to produce chosen-plaintext encryptions under its secret key, he wrote: "Neither of these things is remotely practical in the real world." ^[32]

For the lattice dispute, what matters is how the HAWK attack was built. Green wrote that it invents no new mathematics and extends tools that were already well known ^[31]. "The TL;DR is that someone just did a much more thorough job applying all of our known tools. This is the sort of things that attack AIs excel at," he wrote ^[31].

One result, two readings

Charles Hoskinson's test for changing cryptography is measurement. Responding to Vitalik Buterin on October 9, the Cardano founder called Buterin's illustrative idea of multiplying key sizes by ten "numerology." He argued that parameters must be adjusted according to measurable improvements in attack algorithms ^[20][19]. In CryptoSlate's account, a gain in attack efficiency might justify moderately larger parameters, and a fundamental break could require replacing the algorithm ^[19]. The HAWK attack is a case of the first kind: a measured loss of about half the security bits, answerable with larger keys ^[29].

The same result also fits Buterin's warning. The Ethereum co-founder argued that AI-assisted mathematics could find weaknesses in lattice-based cryptography that conventional research has missed. He compared the risk to integer factorization, where new methods made calculations much easier than earlier estimates suggested ^[17]. In our view, a model applying known tools more thoroughly than the field had is close to what he describes ^[31].

Hoskinson rejects the comparison. "The factoring analogy is wrong," he wrote, arguing that the factoring gains came from specific techniques that have not been demonstrated against the lattice problems used in modern cryptography ^[20]. He cited attack research going back to the Lenstra-Lenstra-Lovasz lattice reduction algorithm of 1982 and later improvements in sieving. He said current lattice parameters already account for those advances ^[21]. "The case against lattices is the GNFS story, a.k.a. a hunch about 'structure,' and a multiplier pulled out of thin air," Hoskinson wrote ^[22].

The HAWK result does not settle the dispute. It hit a non-standard scheme and did not carry over to Falcon ^[28]. None of the reporting on this week's argument cites an AI result against ML-KEM or ML-DSA, the lattice schemes NIST approved in August 2024 ^[25].

Hoskinson's rule works if attack gains arrive slowly enough for standards to follow. Green argued on Twitter, in a post quoted by Simon Willison, that they may not: "The problem here is that the speed of AI producing surprises, and the speed of human beings replacing standards (even with the very best AI assistance) are just orders of magnitude different. You only recover from a surprise like this if you do the preparation in advance." ^[35] He put figures on it. "I think there is a 1% chance we live in Minicrypt, and a 15% chance we functionally lose confidence in our existing public-key encryption algorithms," Green wrote ^[33]. Minicrypt, Willison noted, is Russell Impagliazzo's hypothetical world in which public-key encryption is impossible ^[34].

Fresh wallets protect one holder at a time

Justin Drake opened the week's argument on October 7 ^[4]. "It is now reasonable to brace for the possibility that ECDSA breaks before qday, in the worst case, in months, not years," the Ethereum researcher wrote, citing an OpenAI report on AI's progress in mathematics from the previous day ^[2][1]. He advised users to move funds gradually to fresh wallets whose public keys are not exposed ^[3]. Buterin said the industry should take the risks from "AI-accelerated math seriously," but that he does not recommend rushing to move funds ^[5].

Glassnode's count shows how far that advice reaches. It puts 6.26 million BTC, more than 31% of supply, in addresses with exposed public keys ^[9]. About 4.33 million of those are exposed through address reuse, and moving them to a fresh address ends the exposure. Another 1.94 million are exposed through their address format, Glassnode co-founder Rafael Schultze-Kraft wrote ^[10]. The reuse category, where a move closes the gap, is about 69% of the exposed total ^[37]. Nearly 1.8 million exposed coins, about 29% of the total, sit on exchanges, and 57% of all exchange balances are exposed ^[11][38].

Haseeb Qureshi, managing partner at Dragonfly, called Drake's "bunker mode" warning "cryptographic doomerism" and said moving tokens to fresh addresses was not a real solution ^[6]. His objection is market-wide. Coins in a fresh address stay protected only while they sit unmoved, he wrote, and would be "worthless if all of the other coins are being hacked and mass-sold." ^[7]

The fallback that has backers

Qureshi's alternative is what he called a "Cryptographic Recovery Mode." Users would map a hash-based backup signature to their addresses, and validators could force recovery if signatures were broken ^[8]. We think the design depends on timing. The mapping has to be registered while ECDSA still holds, because after a break a registration signed with the old key could come from the attacker ^[8].

Ava Labs is weighing Qureshi's proposal, and Sirer said an internal group is exploring hash-based approaches as a precaution ^[13]. Avalanche relies primarily on ECDSA over the secp256k1 curve ^[15]. Sirer said no immediate changes are coming to the protocol ^[14]. His own threat model puts software ahead of mathematics. "We will see AI exploiting system-level bugs long before ECDSA goes away," he said ^[12].

Ethereum's long-term "lean" roadmap has already moved toward hash-based signatures and proofs and away from lattice designs, Buterin said ^[18]. The approach has a NIST standard: SLH-DSA, a hash-based signature scheme, separately standardized as FIPS 205 ^[25]. Because hash-based schemes rest on hash functions, a break in elliptic-curve math would not automatically break them, Crypto Briefing noted ^[16].

Hoskinson disputes that hash-based designs are safer by default. He cited the failures of MD5 and SHA-1 as evidence that hash functions can carry exploitable structure, though those failures do not establish weaknesses in SHA-256 ^[24]. He applied the same argument to Poseidon and Poseidon2, hash functions designed for zero-knowledge proofs, whose resistance to algebraic attacks the Ethereum Foundation has funded research into ^[24]. Any switch has a coordination cost. Swapping or supplementing the cryptography under a live blockchain needs developers, validators, wallet providers and users to move together, Crypto Briefing wrote ^[36].

Where the hedge stops

Each hash-based fallback in this week's argument is a signature scheme. Hash-based signatures can authorize transactions; in CryptoSlate's description, key encapsulation for encryption is something lattice techniques support ^[26]. Of the three NIST standards in the dispute, ML-KEM is the only one that establishes shared secrets, and it is lattice-based. ML-DSA and SLH-DSA are signature schemes ^[25][39].

Green's 15% estimate concerns public-key encryption ^[33]. Hoskinson's warning lands on the same side. He argued that retreating from lattices could slow protections already being deployed across internet infrastructure and prolong reliance on encryption that future quantum computers could break ^[23].

Read together, the posts agree on one control: something in place before a break. Drake wants fresh keys, Qureshi a registered backup, Sirer a precautionary hash-based track, Green preparation done in advance ^{[3][8][13][35]}. They split on which primitive to stand on and on whether holders should move coins now ^[5][7]. Hoskinson's preparation is deploying the lattice standards now, with parameters adjusted as attacks are measured ^[19][23]. For an operator running signing keys outside crypto, we think the control that carries over is a second signature path on different math, and NIST has standardized one as FIPS 205 ^[25]. On the encryption side, this week's argument offers ML-KEM and Green's 15% ^[25][33].