Buterin backs 'bunker mode' as AI math threatens crypto keys
OpenAI's machine-generated math drop had consequences beyond mathematics today — and the sharpest one landed on wallet security, where Ethereum's most-followed voices are openly debating whether AI has put key cryptography on a countdown.
Ethereum researcher Justin Drake is calling for "bunker mode": a calm, planned migration of funds to fresh, never-used addresses, because he thinks AI-accelerated math could break today's wallet cryptography before quantum computers ever get the chance. In an October 7 post, Drake urged the industry to begin planning the move and said that in the worst case ECDSA could fall "in months, not years," with private keys recoverable in roughly a week on a large GPU cluster. Vitalik Buterin endorsed the concern — adding that the concrete security of lattice-based schemes may also take "serious hits" from the next two years of AI math — but told users not to scramble: he says he has "lost more money in botched migrations than I have lost in all hacks combined." The trigger is OpenAI's release of hundreds of AI-produced mathematical results, which we covered yesterday — OpenAI drops 372 math results, nearly all from one prompt. The sharpest claim belongs to Scott Aaronson, who says AI labs have "started, gingerly and discreetly" probing whether their internal models can break important cryptographic protocols — sourced to his contacts, confirmed by no lab. Our read: nobody should move funds in a panic, but the fact that a serious camp now treats classical key breakage as a timing question rather than a whether question is itself the story.
CrowdStrike says a likely single attacker breached a string of South Korean banks using open-source AI hacking tools — and his own Claude Code logs gave him away. In a report published October 7, the vendor says the operator used ARTEX, a Chinese open-source penetration-testing tool released in July, with DeepSeek v4.1-flash as its primary model, supplemented by GLM-5.3 and Grok 4.6; open directories on the attacker's server exposed Claude Code session histories, ARTEX configs, and enough personal details to sketch a 26-year-old in Guangdong — though CrowdStrike stops short of attributing the operation to any named group, assessing at moderate confidence only that the actor is "likely a Chinese speaker and financially motivated." More than 25,000 records were taken from Shinhan Bank alone, and the model stack matters: this is exactly the shift we tracked in Deep Dive — AI turned exploit development into a compute problem. We covered the Korean government's probe yesterday — Korea probes AI agents in bank hacks as president cites 'signs' — today's forensics explain how one person, renting the frontier, pulled it off.
OpenAI and Meta both want a ".agent" domain: ICANN's first new web-address round since 2012 is an AI land grab. Reveal Day on October 7 logged 1,615 applications from 481 applicants — ten bidders want .agent (including OpenAI and Meta), seven want .agi, six want .asi, and OpenAI alone filed for 15 strings against Meta's 21. At roughly $227,000 per application, the AI brands staking their claim isn't cheap, and nothing gets delegated before 2027 — but the bidding pattern says the labs now treat "agent" as core brand territory, not a passing term.
What to watch: whether any lab confirms — or firmly denies — Aaronson's crypto-probing claim, and how wallet makers and standards bodies answer the bunker-mode call.
Is "bunker mode" sane caution, or panic that just spreads the risk around? Tell us in the comments.
