For a decade, the security world has worked from a simple map.

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Elliptic curves: doomed, eventually, by quantum computers. Lattices: safe. Hashes: safe.

Governments, banks and militaries built their migration plans on it. The plan was to leave the doomed territory before the quantum machines arrived, and to move into the safe territory, chiefly the new lattice-based standards, in time.

This week, that map stopped being reliable.

Not because anything has been broken. Nothing has, and anyone who tells you otherwise is getting ahead of the evidence. It stopped being reliable because a second threat has appeared alongside the quantum one, and it doesn’t respect the same borders. AI systems are now producing new mathematics at a rate no human community can match, and cryptography rests on mathematical assumptions that are believed, not proven.

This piece covers what happened, what two of the most influential figures in cryptocurrency are now warning, why the strongest counter-arguments still matter, and what it means for the three sectors that depend most on cryptography: finance, intelligence and defence.

The trigger: 722 proofs and a conspicuous gap

On 6 October, OpenAI published 722 mathematical manuscripts in 372 families, produced by an unreleased internal model from roughly 4,000 problems, using on average about three hours of ChatGPT Pro compute per result. The claims include the Unique Games Conjecture, Hilbert’s tenth problem over the rationals and a zero-free region for the Riemann zeta function. This publication has covered the release, the reaction from mathematicians and the bottleneck of checking it all.

For cryptographers, the most important results weren’t the famous conjectures. They were the ones that broke long-standing beliefs about how fast things can be computed. As Scott Aaronson catalogued them:

• Integer multiplication below n log n, a barrier many believed was fundamental.
• The Fourier transform below n log n.
• 3SUM in about n^1.9992 time, overturning a half-century-old conjecture that n² was essentially optimal. This came the day before OpenAI’s release, in a paper by Virginia Vassilevska Williams and Josh Alman. The crucial idea came from an Anthropic model, not an OpenAI one.

Then Aaronson noticed something else. Cryptography was conspicuous by its absence from the 722 manuscripts. His sources told him that AI companies have begun, “gingerly and discreetly”, testing whether their internal models can break important cryptographic protocols.

A day of checking has already produced one correction: OpenAI withdrew its claimed proof of the Hodge conjecture for products of K3 surfaces, reportedly over a sign error. These are claims, not settled results. But the direction is unmistakable: assumptions about computational hardness that stood for decades are being tested by machines.

Two threats, one migration

The quantum threat is well understood. A large enough quantum computer running Shor’s algorithm would break RSA and elliptic-curve cryptography, the public-key systems that protect almost everything today. That’s why the world is migrating to post-quantum cryptography. NIST standardised the main replacements in August 2024: ML-KEM for establishing encryption keys and ML-DSA for digital signatures, both lattice-based, plus SLH-DSA, a signature scheme built only from hash functions.

The AI threat is different in kind, and the differences matter more than the similarities.

The difference that matters most is the third row. The quantum threat comes with a visible countdown. The AI threat may not. A government can track quantum hardware progress and set deadlines against it. Nobody can track an algorithm until someone publishes it.

The crypto canary

The first public alarm came from where cryptographic exposure is most visible: blockchains, where public keys sit in the open and the money behind them can be counted.

On 7 October, Justin Drake, a researcher at the Ethereum Foundation, called on the industry to “calmly begin planning for ‘bunker mode'”. His advice: move funds to addresses whose public keys have never been exposed. An address that has never signed a transaction reveals only a hash of its key, so even a broken signature scheme can’t be used against it. “IMO it is now reasonable to brace for the possibility that ECDSA breaks before qday, in the worst case in months not years,” he wrote, defining a break as recovering a private key in about a week on a large GPU cluster. Reporting puts roughly 6 million bitcoin in addresses whose public keys are already exposed.

A day later, Vitalik Buterin, Ethereum’s co-founder, made the more consequential point. He didn’t endorse the urgency: “I don’t recommend anyone scramble to move their funds to new wallets today.” But he moved the threat somewhere the industry had treated as safe:

“The core new area of risk from this viewpoint is, unfortunately, ML-DSA / FHE / lattices.”

His reasoning was historical. Factoring large numbers naively takes time that grows exponentially with key size. Over decades, mathematicians developed the number field sieve, which brought that down dramatically, which is why RSA keys must be hundreds of bytes long. Buterin asked: what if similar “skeletons in the closet” exist for elliptic curves and lattices, which humans aren’t clever enough to find but AI soon will be? “There is a good chance,” he wrote, “that the concrete security of lattices will take serious hits from the next two years of AI math.”

That’s the heart of it. The world is migrating away from elliptic curves to escape the quantum threat, and towards lattices. Buterin’s argument is that the destination may itself be exposed to the AI threat.

His prescription: use hash-based cryptography wherever possible, be “much more paranoid” about lattice parameter sizes, and, for anything meant to be secure for the long term, consider multiplying key sizes by ten.

The pushback, which matters

The case against panic is strong, and it deserves full weight.

Yehuda Lindell, head of cryptography at Coinbase, called Drake’s warning “the very definition of FUD” and said there is “no evidence whatsoever” that the assumptions behind elliptic-curve cryptography are close to failing. Isabel Foxen Duke, co-author of a Bitcoin quantum-resistance proposal, BIP-360, agreed that classical, AI-driven breaks could reach schemes considered quantum-safe, but cautioned against treating Buterin’s two-year scenario as a deadline. Buterin himself had argued only a month earlier that AI wouldn’t doom crypto security.

And there’s a technical point the alarm skips over. The records that fell this week were broken by tiny margins. Integer multiplication went from n log n to roughly n log^0.9999999999999 n. 3SUM went from n² to n^1.9992. These are remarkable as mathematics, but they’re slivers. Breaking elliptic-curve cryptography would require turning roughly 2¹²⁸ operations into something a GPU cluster can finish in a week. That’s not a sliver; it’s a collapse of the exponent. Nothing published this week shows a collapse of that kind.

The honest framing is narrower than either camp’s. The evidence shows that AI can now overturn hardness beliefs that experts held for decades. It does not show that AI can produce the specific, dramatic kind of improvement that breaks a deployed cryptosystem. The number field sieve is the precedent Buterin cites, and it shows such improvements are possible. It took decades. The open question is whether AI compresses those decades into years.

A reminder that even conservative choices erode

One development this month shows how security estimates move even without AI.

On 1 October, Germany’s federal cybersecurity agency, the BSI, advised organisations not to use Classic McEliece in new developments. Classic McEliece is a code-based scheme derived from a 1978 cryptosystem, and it had long been seen as the most conservative post-quantum choice precisely because it’s so old. Researchers estimated its key recovery cost below its claimed security levels. BSI stressed that no practical attack is possible against its recommended parameters, and said ML-KEM, FrodoKEM and HQC are unaffected.

There’s no suggestion this result came from AI. But it illustrates the point that matters for planning: security levels aren’t fixed facts. They’re estimates that move when someone finds a better attack. And the rate at which people find better attacks is the thing AI is changing.

(A correction to an earlier position: in preparing this series I had described Classic McEliece as the conservative fallback. As of this month, BSI’s advice is to prefer ML-KEM and FrodoKEM instead.)

What I think is happening

This section is my view, not reporting, and it should be read that way.

I think it is plausible that frontier AI labs have produced, or are close to producing, results relevant to cryptography, and have deliberately kept them out of public releases, sharing them with a limited audience instead. That would explain the gap Aaronson noticed in the 722 manuscripts.

There is no evidence that any such result exists. The absence of cryptography papers is consistent with three explanations: results were found and withheld; the labs chose not to pose cryptographic problems at all; or they posed them and found nothing. From the outside, those three are indistinguishable.

But withholding would have strong precedent. IBM and the NSA knew about differential cryptanalysis by about 1974, while designing the DES cipher. It became public only when Eli Biham and Adi Shamir rediscovered it around 1990, and IBM’s Don Coppersmith confirmed in 1994 that the design team had known all along. Britain’s GCHQ invented public-key cryptography in the early 1970s, the equivalents of what the world later called RSA and Diffie–Hellman, and kept it secret until 1997. Keeping cryptographic mathematics from the public has been standard practice for half a century. It isn’t a conspiracy theory; it’s history.

It would also be the responsible choice. A lab that found a real weakness in a deployed standard should not post it on GitHub. It should disclose it quietly to the people who can fix it. OpenAI’s own system card for GPT-6 Astra already rates its cyber capability as “Critical” and keeps exploit work behind a gated programme.

Which leads to the conclusion that matters, and it holds whichever explanation is true. “Nothing published” cannot be read as “nothing found.” In the quantum era, the warning sign is visible hardware. In the AI era, the first sign of a break might be an empty folder in a public repository. Defenders can’t wait for an announcement that, if things are working as they should, may never come.

Defence and intelligence: the secrets that must last

For intelligence services and defence ministries, the threat has a specific shape: “harvest now, decrypt later.” An adversary records encrypted traffic today and stores it, intending to decrypt it once a break arrives. For a classified communication that must stay secret for 25 years or more, a break in 2035 is a break today.

That changes how the AI threat matters to defence in three ways.

Key exchange is the exposed layer, and it can’t be hash-only. Buterin is right that signatures can be built from hash functions alone. But public-key encryption and key exchange, the mechanisms that protect classified communications and satellite links, can’t. They need a mathematical “trapdoor”, and every known trapdoor has structure: lattices, codes, or the group theory behind elliptic curves. Buterin acknowledges this directly. So the defence sector can’t escape structured mathematics by switching to hashes. It can only choose which structure to trust, how much margin to add, and how many different structures to combine.

The US migration path already hedges towards Buterin’s advice, but still concentrates on lattices. The NSA’s CNSA 2.0 suite for national security systems requires only the highest parameter sets, ML-KEM-1024 and ML-DSA-87, and specifies hash-based signatures (LMS or XMSS), alongside ML-DSA-87, for software and firmware signing. Being “paranoid about parameter sizes” and preferring hashes where possible is, in effect, already much of US policy. The timeline has teeth: from 1 January 2027, new national security system acquisitions must support CNSA 2.0; networking equipment and firmware signing must use it exclusively by 2030; most other systems by 2033; everything by 2035. But the key-exchange layer rests on one lattice family. If Buterin’s scenario materialises, that’s where the exposure concentrates.

Europe has hedged differently, and the difference is worth noticing. BSI’s guideline requires post-quantum schemes to be deployed in hybrid mode, combined with a classical algorithm, rather than on their own. Its 2026 edition sets fixed end dates for classical key agreement used alone, starting in 2031. It also recommends FrodoKEM alongside ML-KEM. FrodoKEM is built on plain lattice problems without the extra algebraic structure ML-KEM uses for efficiency, and its security reduction is tighter. Neither FrodoKEM nor hybrid deployment as a requirement appears in CNSA 2.0. If the next few years bring AI-driven attacks on structured lattices, the more conservative European posture will look prescient. That’s a sovereignty argument Europe should be making loudly.

For long-lived defence systems — satellites, sensors, ISR platforms built to operate for fifteen years or more — the lesson is crypto-agility. A system whose algorithms can be replaced in the field survives a break. A system with its cryptography fixed in hardware does not. For deployed sensors and the data links behind them, hash-based firmware signing is the floor, and the ability to swap the key-exchange mechanism after deployment should be a procurement requirement, not a feature.

There’s also a strategic asymmetry. A state that discovers a break will not announce it. It will exploit the archives it has already collected. The countries with the largest stores of intercepted traffic and the most capable models gain the most, and they have the strongest reasons to stay silent. That’s why the absence of public evidence is not reassuring for intelligence services.

Finance: timelines built on the wrong countdown

The financial sector’s exposure is broad: interbank messaging, payment card systems, online banking, trading infrastructure, and the public-key infrastructure that authenticates all of it. Much financial data, including transaction records, personal data and contracts, also needs to stay confidential for years.

The sector has a plan. In January 2026, the G7 Cyber Expert Group, co-chaired by the US Treasury and the Bank of England, published a coordinated roadmap for the transition to post-quantum cryptography in finance. It sets out six phases, from awareness and inventory through migration, testing and monitoring. It describes 2030–2032 as a “challenging but prudent” target for critical systems and 2035 for the sector as a whole. It’s explicitly non-binding.

The problem is not the plan. It’s the assumption underneath it. Every one of these dates was set against a forecast of quantum hardware, a threat expected to give years of visible warning. The AI-mathematics threat offers no such warning and could arrive on ordinary computers. And the main target of the migration, lattice-based cryptography, is the area Buterin identifies as newly at risk.

Three consequences for banks, insurers and market infrastructures:

Treat the deadlines as ceilings, not schedules. A roadmap that ends in 2035 assumes the threat won’t arrive before then. Against a threat with no visible countdown, earlier is the only safe interpretation, especially for data that must stay confidential.

Design for replacement, not for a single destination. If the migration ends in “we now use ML-KEM everywhere”, a future attack on lattices means starting over. If it ends in “we can change algorithms without rebuilding systems”, it doesn’t. Crypto-agility is the real deliverable; any particular algorithm is temporary.

Watch the crypto-asset sector as an early warning. Blockchains are where a classical break would show up first, because exposed public keys and their balances are public. Banks with crypto-custody businesses face the issue directly; everyone else should treat unexplained movements from long-dormant exposed addresses as a signal worth monitoring.

What to do now

The practical steps are the same whether the threat turns out to be quantum, AI or both. That’s the good news: hedging against the AI threat costs little beyond what the quantum migration already requires.

Know your cryptography. Inventory every algorithm, key, certificate and protocol in use. Every roadmap — CNSA 2.0, the G7’s, BSI’s — starts here, and most organisations still haven’t finished.

Deploy hybrid. Combine post-quantum and classical schemes, as BSI requires, so a break in one doesn’t expose the other.

Use hash-based signatures wherever the use case allows. Firmware, software updates and long-term signing keys are the obvious candidates. SLH-DSA, LMS and XMSS rest on hash functions, which carry the least exploitable structure.

Choose conservative parameters. Use the highest parameter sets, as CNSA 2.0 already does, and evaluate less-structured options such as FrodoKEM for long-term confidentiality.

Diversify the key-exchange layer. Where possible, avoid depending on a single mathematical family. HQC, a code-based scheme NIST selected as a backup, is heading for standardisation; BSI has said it will recommend it once available.

Build for agility. The ability to replace cryptography quickly matters more than any single choice of algorithm.

Shrink exposure in the meantime. Use forward secrecy, rotate keys, avoid exposing public keys unnecessarily, and keep the most sensitive data off networks where it can be harvested.

Don’t panic-migrate. Buterin’s most practical sentence applies well beyond crypto wallets: “I personally have lost more money in botched migrations than I have lost in all hacks combined.” A rushed migration is itself a security risk.

The broader story

This is the part of the AI mathematics story that will matter most outside academia.

Mathematicians are arguing, with good reason, about who should be allowed to use these tools, how results should be released, and who will check them. An association of mathematicians has demanded a boycott; an advisory group at the Institute for Advanced Study has asked labs to stop testing open problems on internal models; Aaronson has called it the “Mathocalypse”. This publication has argued that nobody owns the open problems, and that the real bottleneck is checking, not producing.

But cryptography is where the question stops being academic. A proof of the Unique Games Conjecture changes theoretical computer science. A better algorithm for lattice problems would change who can read the world’s secrets. And unlike a maths paper, it might never be published.

The take

Nothing has been broken. The evidence this week shows AI overturning long-held beliefs about computational hardness by small margins, not collapsing the security of any deployed system. The sceptics, Lindell foremost among them, are right that there’s no evidence elliptic curves or lattices are about to fall.

But the map has still changed, and the new one looks like this:

Elliptic curves: on borrowed time, possibly shorter than the quantum countdown suggests. Lattices: unproven against AI, and the destination most of the world is migrating towards. Codes: the old conservative choice, just reminded that estimates move. Hashes: the safest ground available, not a guarantee.

For finance, intelligence and defence, the conclusion is the same whichever threat arrives first. Migrate now, migrate to hybrid, migrate to agility, and stop treating the deadlines as schedules. The quantum threat comes with a countdown you can watch. The AI threat may arrive as a silence — an empty folder where a paper should have been.

The organisations that come through this well won’t be the ones that guessed the right algorithm. They’ll be the ones that can change their algorithms fastest.

Sources: OpenAI’s mathematics release (6 October 2026) and GitHub repository; Scott Aaronson, “The Mathocalypse” (Shtetl-Optimized, 7 October 2026), including the catalogue of complexity results, the Williams–Alman 3SUM result attributed to an Anthropic model, the absence of cryptography and his sources on labs’ cryptographic testing; the withdrawal of the K3-surfaces Hodge manuscript as reported in that thread and consistent with OpenAI’s repository; Justin Drake’s “bunker mode” post on X (7 October 2026) and coverage by Cointelegraph, Decrypt and CryptoSlate, including the ~6 million BTC exposed-key estimate (Cryptopolitan); Vitalik Buterin’s post on X (8 October 2026); Yehuda Lindell’s response via cryptonews.net and Yellow; Isabel Foxen Duke via Decrypt; NIST FIPS 203, 204 and 205 (August 2024); NSA CNSA 2.0 requirements and timeline via its FAQ and published guides; BSI TR-02102-1 (2025-01 and 2026-01 editions) on hybrid requirements, FrodoKEM and end dates, and BSI’s 1 October 2026 advice on Classic McEliece, via postquantum.com; G7 Cyber Expert Group, “Advancing a Coordinated Roadmap for the Transition to Post-Quantum Cryptography in the Financial Sector” (13 January 2026); historical accounts of differential cryptanalysis (Biham and Shamir; Coppersmith, 1994) and of GCHQ’s early public-key work, declassified in 1997. The section “What I think is happening” is the author’s opinion and is presented as such; no evidence of a cryptographic break by any AI system has been published. Not security, legal or investment advice. Analysis and framing are the author’s.