Buterin gives AI-driven maths a good chance of weakening ML-DSA within two years

Two years is a short horizon for anyone holding keys, and the obvious response would be to move funds now. Buterin discouraged that, saying large-scale migrations carry their own risks ^[7]. The rest of his list puts the work into signing procedure. Multisig signers should switch to new keys after each operation and collect signatures offchain where possible ^[5], because a public key exposed on-chain gives a future attacker something to work with ^[9]. WOTS, one of the hash-based schemes he named, is built so that each key signs only once ^[11].

The case for hashes comes down to assumptions. Hash-based signatures lean on hash functions for their security ^[12], so progress against the geometry of lattices does not reach them. Lattice schemes were the field's main candidates for resisting quantum attacks ^[18]. If AI-driven maths erodes them first, protocols would be retreating from the tools they had been moving toward. Crypto Briefing cast the warning as a threat that might arrive before quantum computers do ^[17]. Buterin's own horizon, as reported, is two years, and the odds he gave were a "good chance" ^[1].

If AI-assisted cryptanalysis produces nothing material against lattice problems by October 2028 ^[16], protocols that kept lattice schemes at tenfold key sizes ^[3] will have carried ten times the key data ^[15] for protection they did not need. If the weakening arrives on his schedule, the teams that kept encrypted data off-chain are the ones whose privacy survives, since anything posted to a chain stays there permanently ^[4]. If the added risk he flagged for ECDSA ^[2] also materialises, a new parameter set does nothing for funds behind public keys already on chain ^[9].

Buterin was more optimistic a month earlier. In September 2026 he projected that AI-assisted formal verification could benefit cybersecurity ^[19]. Crypto Briefing wrote that AI which helps prove code correct may also help prove that certain encryption is weaker than advertised ^[20].

I think moving Ethereum toward hashes is the right hedge. It removes an assumption, and the multisig changes cost signer time without requiring any funds to move. The counter-case is that a "good chance" is one person's estimate, and the report cites no specific attack behind it. Tenfold keys and a roadmap change are real engineering spend against a risk that may not land. Buterin keeps the majority of his net worth in crypto assets ^[13], so his own money rides on the estimate. The thesis fails if October 2028 ^[16] arrives with no significant published result against lattice schemes such as ML-DSA ^[6].