The quantum computer that could break Bitcoin’s signatures doesn’t exist yet. The cryptography meant to protect us from it, on the other hand, is already being broken, and in October 2026 the damage came from three directions at once: from ordinary programming mistakes, from AI models doing expert-level cryptanalysis, and from the camps that are supposed to agree on which replacement to use. None of these attacks needs a quantum computer.

What is being replaced

The signature schemes in use today, ECDSA and Schnorr on Bitcoin’s curve secp256k1 among them, fall the moment Shor’s algorithm runs on a large enough quantum machine. NIST’s main replacement is ML-DSA, published as FIPS 204 in 2024 and better known by its development name Dilithium, which went through six mutually incompatible versions before it was standardised. It is built on lattices, more precisely on the Module-SIS assumption. Next to it NIST has a second lattice scheme, Falcon (FN-DSA), and a hash-based one, SLH-DSA (SPHINCS+). That is the toolbox. Each of its tools came under pressure this autumn.

The software breaks before the mathematics

In “Exploiting ML-DSA bugs”, a 59-page paper from 1 June 2026, Daniel J. Bernstein describes two small programming errors of the kind that slip in by accident. In one, neighbouring coefficients of the secret mask come out equal; in the other, the nonce repeats, much as it did in Sony’s PlayStation 3 signing disaster. The faulty signatures still verify and pass the usual test suites. From two of them an attacker recovers the private key in about one second on a single laptop core.

Bernstein then puts numbers on the risk. He models around 50 libraries with 100,000 to 200,000 new lines of code between them and estimates that in 2027, 18% of pure ML-DSA keys will come from vulnerable libraries. For Ed25519 the figure is 1.6%, for Ed25519 and ML-DSA combined about 4.1%. He places the median for the first secret quantum attack in 2029 and for a public one in 2032, leaning on a Google paper from March 2026 that puts a secp256k1 key at 18 minutes of quantum computation. His conclusion is a double signature, classical plus post-quantum, instead of ML-DSA on its own. Critics, among them the author of a Wycheproof pull request, answer that the Ed25519 half is worthless the day a quantum computer exists. Both are right about different years, which is exactly the problem.

AI goes after the mathematics

On 28 July Anthropic reported that Claude Mythos Preview had found a previously overlooked symmetry in HAWK, a lattice-based signature candidate in NIST’s additional round 3. The symmetry roughly halves the effective security level, HAWK-512 dropping from 2^150 to at most 2^108, and a HAWK-256 challenge key fell within a few hours. The work took about 60 hours and around $100,000 in API costs. The same model sped up the best known attack on 7-round AES-128 by a factor of 200 to 800, and two researchers needed almost a month to check that result.

In practice neither finding changes anything today. HAWK is not deployed, full AES is untouched, and the paper states explicitly that Falcon is not affected. Anthropic’s own reading is that expert-level cryptanalysis is now within reach of AI, and that the bottleneck has moved to the humans who have to verify it. Put next to Bernstein’s paper, that gives the replacement schemes two separate risks, one in the implementation and one in the mathematics, and fixing one does nothing for the other.

Lattices or hashes

In early October Vitalik Buterin drew the line: AI attacks mathematical structure, lattices have a lot of it, hash functions have almost none, so Ethereum’s Lean roadmap stays hash-only. On 17 October a16z crypto answered with “The case for lattices” and a system called Aerie, which aggregates Falcon-512 signatures with lattice SNARKs. According to a16z it manages around 50,000 signatures per second on a laptop, against Ethereum’s target of 1,000, at about 42 bytes per signature in the aggregate plus a proof of roughly 66 KiB. Their argument: hash-only designs are home-grown constructions outside the NIST standards, hard to support in hardware wallets and custody, and error-prone because they depend on recursive STARKs. And private payments would need lattice encryption (ML-KEM) anyway.

On 18 October Eli Ben-Sasson, CEO and co-founder of StarkWare, replied that lattices are “ripe for AI to attack” and that one should wait three to five years. Chris Peikert, whom Ben-Sasson himself had addressed as a leading lattice expert, corrected him on the history: Module-SIS goes back to 2002, ten years earlier than Ben-Sasson had dated it. Ben-Sasson’s claim that HAWK is “utterly broken” also goes well beyond what Anthropic actually reported. Gabriel Shapiro, a lawyer and ETH investor, called Ethereum’s direction right but the question legitimately open, since lattices could be added later through a precompile.

That prompted Vitalik’s second post on 19 October. Precompiles and the EVM are the wrong place, he wrote, because all the data would have to go into the block as calldata, which caps out at roughly 8 MB/s. Instead he argued for “EIP-8288 maximalism”: everyone signs locally with whatever cryptography they like, wraps the result client-side in a STARK, and lets the mempool aggregate those proofs recursively. Ethereum would then “never add a new precompile again”. Ben-Sasson agreed.

Every participant in this exchange has a stake in the outcome. StarkWare stands for STARKs, Aerie was built partly with LayerZero Labs, and Vitalik is the author of EIP-8288. Which camp is right I can’t judge; I’m not a cryptographer, and the people who are disagree with each other in public.

Ethereum’s protocol is already voting

Hegotá, the fork after Glamsterdam, shows where Ethereum is heading in practice. Mainnet is expected for “Q2 2027” but not confirmed, and Glamsterdam itself goes to the Hoodi testnet on 26 October. Two components are firmly planned. FOCIL (EIP-7805) has a committee of 16 validators produce inclusion lists every slot, which the block builder must respect; a single honest member is enough to defeat censorship. Frame Transactions (EIP-8141) bring native account abstraction with a free choice of signature scheme, explicitly intended as a post-quantum path.

On 8 October the ML-DSA precompiles (EIP-8355) were rejected, with the Ethereum Foundation calling them “premature standardization”. Verifying ML-DSA in EVM bytecode costs around one million gas, which would have been an argument for a precompile. What moved forward instead were two ECDSA retirement proposals, EIP-8151 (blocking ecRecover) and EIP-8298 (SETCODEFROM), together labelled the “k1 exit”. The BLS credential retirement (EIP-8365) was scaled back. Quick Slots (EIP-8198), ten-second instead of twelve-second slots, remain disputed: Ethlabs and Lido rank them at the top, the EF delivery teams give them a “D”, partly because of how they interact with the post-quantum direction. They have been CFI since 1 October.

Josh Rudolf’s Ethlabs update for week 17 (18 October) adds the inside view. His thesis is that ETH is Ethereum’s most important application, a programmable store of value, precisely because Ethereum has no single story. Gnosis already runs the Fast Confirmation Rule live, so deposits from L1 take 12 to 24 seconds instead of about 14 minutes, with no hard fork, just a client setting. At the Cambridge research week, with more than 100 researchers, a path to finality in seconds with post-quantum-secure validators was presented for the I* fork; that is a target, and nobody has measured it yet. And the formal verification of the Fast Confirmation Rule in Lean, posted by fradamt, was done by AI agents in four to five days.

Where Bitcoin stands

An overview by Quantum Zeitgeist from 26 July compares twelve chains. Only QRL protects user funds by default, with the hash-based signature scheme XMSS since its 2018 mainnet. XMSS is stateful, though, and reusing a signature position is catastrophic. Algorand and Hedera use Falcon, Solana offers only an opt-in vault, and IOTA actually moved back to Ed25519 in 2021. Bitcoin and Ethereum are listed as “Proposed”.

The article is outdated and imprecise in one point that matters here. It calls BIP-360 (Pay-to-Merkle-Root) a “quantum-safe address type”, which it isn’t: it removes the elliptic-curve key path, as described in Behind the Hash, but it still needs a post-quantum signature opcode on top. An earlier post on this blog, If Quantum Kills Bitcoin, It Has Already Killed Everything Else, made the same simplification and still treated the three NIST schemes as one block.

Bitcoin ends up in the same family as Ethereum. Neha Narula’s favourite is the hash-based OP_CHECKSHRINCS, about five times the size of a Schnorr signature, which would probably mean a two- to eightfold increase in block size. The price is paid in a different currency, though. Ethereum pays in complexity, with recursive proofs everywhere, and Bitcoin pays in bytes and in governance, up to the question of freezing coins that BIP-361 raises.

What I can’t answer is the question this whole month circles around: if the camps that know the most can’t agree on lattices or hashes, how long can a network that changes as slowly as Bitcoin afford to wait for them?