Between 15 and 16 October, Google demonstrated a cheaper way to produce the scarcest resource in a fault-tolerant quantum computer; Anthropic published AI-designed circuits that make the core step of a quantum attack on elliptic curves up to seventeen times cheaper in gates; and Anthropic also solved the 25-year-old mystery of where the NIST curve seeds came from. Days later Vitalik Buterin argued that a second threat runs alongside the quantum one: AI-accelerated mathematics finding shortcuts in any cryptography that has structure to exploit. His prescription — keep public keys hidden behind hashes, trust hashes over everything else — is not new to Bitcoin. Satoshi built it into the address format. Then the network relaxed it for efficiency, and the newest proposals spend most of their effort restoring it.
Current Conditions
Primary Route — An Upgrade in Reverse
Weeks like this one invite a single headline — the machines are coming for your keys — and the honest reading starts by refusing it. Four documents arrived within days of each other, and they do not tell one story. Three of them narrow the distance to a quantum attack on elliptic-curve signatures. The fourth widens the threat to a channel that needs no quantum computer at all. And a fifth, filed alongside them in most coverage, points in the opposite direction entirely. Sort them first; the Bitcoin lesson only becomes visible once they are sorted.
Two Channels, and One Piece That Doesn’t Belong
Channel one is quantum engineering, and it moved. A quantum computer running Shor’s algorithm needs enormous numbers of a particular resource state to perform the operations that take it beyond classical computing. Producing those states cleanly has been one of the field’s heaviest costs for two decades. Google’s demonstration shows a filtering method that grows high-purity states cheaply on real hardware — at small scale, with scaling still to prove, but on the chip rather than on paper. On the algorithmic side, Anthropic’s circuit work went straight at the most expensive step of the attack that matters for Bitcoin: point addition on an elliptic curve, performed over and over inside Shor’s algorithm. Claude found a way to make a classical inversion method reversible without storing its branch history, and the resulting family of designs moves the frontier of what qubit-and-gate combinations are available. Neither result names a date. Both shrink the machine that would be needed.
Channel two is mathematical, and it is an argument, not a result. Vitalik’s warning concerns classical cryptanalysis accelerated by AI: if a decade of AI-assisted mathematics delivers what used to take half a century, structured cryptographic problems may turn out to have shortcuts nobody has been clever enough to find — the way factoring fell over decades from naive search to the number field sieve. His argument is a judgement about where hidden structure is likeliest to hide. Lattices, the basis of the new post-quantum standard ML-DSA, are rich in structure and young in cryptanalysis. Elliptic curves have a little structure, and a long record. Hash functions are designed to have none. Hence his ranking: hashes over lattices wherever hashes are possible.
It is worth being precise about the evidence for channel two, because the week’s coverage blurred it. Nothing published this month shows AI finding a classical shortcut against elliptic curves or lattices. And elliptic curves over prime fields have a notable record here: four decades of attack research have produced nothing comparable to what happened to factoring, and the best known general attack remains the generic one that works on any group. That does not prove no fourth form of structure exists. It means the analogy to factoring is a possibility to hedge against, not a trend already visible.
The piece that doesn’t belong is the curve seeds. It has been widely cited as evidence of AI turning cryptanalyst, and it is a genuinely elegant piece of detective work — but what it recovered was the state of a weak 1990s random-number generator, which Anthropic itself describes as a textbook lattice-reduction problem once you know to look. And its conclusion runs the other way: the NIST curves look more trustworthy now, not less. More pointedly for this piece, it never concerned Bitcoin. Satoshi chose secp256k1, a curve with parameters so small and so obviously unarbitrary that there was never a seed to explain. The suspicion that took a quarter century to dissolve for the NIST curves was one Bitcoin sidestepped from the start.
What Both Channels Attack: a Visible Public Key
Both channels, if they arrive, break the same thing. Neither touches a bitcoin wallet as such; they attack the step from a public key to its private key. And here the architecture of the network matters more than any headline, because a bitcoin address is not a public key.
In the address format that became standard, what sits on the chain before you spend is a hash of your public key. The key itself is revealed only when you sign a spending transaction. Until then, an attacker holding a quantum computer — or an AI-discovered shortcut against elliptic curves — has nothing to work on. To get at your coins, they would have to break the hash, and hashes are precisely the primitive both Vitalik’s argument and the quantum literature rate as the most robust. Grover’s algorithm offers quantum computers only a square-root speedup against hash functions, which larger outputs absorb. That is Vitalik’s “fresh address” recommendation, already built into Bitcoin’s default format for most of its history: keys stay behind a hash until the moment they are used.
What Satoshi Shipped — Both of It
Here the story needs its first honesty, because the convenient version — Satoshi foresaw the quantum threat — is not established and is not quite right. Bitcoin’s original software used two formats. Payments to addresses used the hash-protected form. But mining rewards in the early years were paid directly to raw public keys, visible on the chain from the first block. Those pay-to-public-key outputs are where roughly 1.7 million BTC still sit today, including the roughly 1.1 million attributed to Satoshi’s own mining. The designer’s own coins are held in the least protected format the protocol has ever used. Whatever the motive for the hashed address — compactness, an extra layer against unknown weaknesses, or both — it was not applied consistently, and the sources do not tell us that quantum computing was the reason.
What is clear is the effect. The hashed address gave Bitcoin a structural property that turns out to be exactly what a pessimist about elliptic curves would want: for coins that have never been spent from, and whose address has never been reused, the curve is not exposed at all. Most of the exposure that exists today was created afterwards, by users — through address reuse, which re-exposes a key already revealed by an earlier spend — and by protocol design.
The Upgrade That Went the Other Way
Taproot, activated in November 2021, is the protocol-design part. It was a substantial improvement by the standards it was built for: Schnorr signatures, cheaper and more private spending, complex scripts that look like simple payments. Its central efficiency trick is the key-path spend, in which an output can be spent with a single signature against a key committed in the output itself. To make that work, a Taproot output carries a public key directly — tweaked, but a public key all the same — from the moment it is created. A Taproot address shows its key before a single satoshi has been spent from it.
In the threat model of 2021, that was a sensible trade: elliptic curves were treated as safe, and the gain in efficiency and privacy was real. In the threat model of October 2026 it reads differently. Vitalik’s “fresh address” advice works for a classic or SegWit address; for a Taproot address it does not, because a fresh Taproot address is already exposed. The newest format in the protocol is, on this one dimension, a step back to the early mining outputs: key on display, waiting.
Negotiating the Way Back
The proposals now moving through Bitcoin’s process read, structurally, as a return trip. BIP-360, merged into the official repository in February 2026, introduces an output type called Pay-to-Merkle-Root: it commits only to a hash tree of spending conditions and removes the key-path spend that puts a key on display. It does not itself fix which post-quantum signature schemes will fill those conditions; the choice between hash-based and lattice-based options is exactly where Vitalik’s argument now bites. Its central move, though, is the old one: keep the key behind a hash.
BIP-361, put forward by Jameson Lopp and co-authors, is the harder question. It proposes a sunset for legacy signatures — a migration deadline, after which coins still in vulnerable formats would be frozen. That is where the old exposure becomes political. Coins whose owners are alive can move. Coins whose keys are lost cannot, and the largest single block of them is Satoshi’s. Freezing them protects the network from a future attacker harvesting a million coins; it also means the network, by agreement, disabling coins it did not issue and does not own. Bitcoin’s whole identity, as The Myth and the Migration argued, is that no operator sits in the system who can do that. The quantum question has reached the one place where Bitcoin’s design gives it no comfortable answer.
The best defence against both quantum machines and AI mathematics is to keep the public key off the chain until the moment it is used. Satoshi shipped that in 2009 — for addresses, not for his own coins. The protocol traded it away for efficiency in 2021. Its newest proposals mostly try to buy it back.
Three Honesties
First: the hash is a shield with a window in it. The moment you spend from a hashed address, your public key is broadcast and sits in the mempool until the transaction confirms. An attacker fast enough to derive the private key inside that window could race your transaction. Hiding keys protects stored coins against slow attackers; it does not protect a spend against a fast one. And every reuse of an address undoes the protection for whatever remains there.
Second: Satoshi’s motive is not on record here. It is tempting to credit 2009 with foresight about quantum computing. The design is consistent with caution about unknown weaknesses in elliptic curves, and also with the simpler benefit of shorter addresses. The fact that the earliest mining rewards were paid to raw keys argues against any systematic quantum hedge. What can be said is narrower and sufficient: the hashed format happens to be the right defence, whatever the reason it was chosen.
Third: the numbers disagree, and so do the threat models. Exposure estimates range from about a quarter to over a third of supply depending on what is counted. Analysts at CoinShares argue that only about ten thousand coins sit in exposed holdings large enough to be worth attacking early. And channel two remains a well-reasoned conjecture rather than an observed trend. The prudent conclusion is about direction, not timing: every development this week pushes in favour of keys behind hashes, and none of them says when it will matter.
What Actually Transfers
This blog adds this to its Bitcoin file — The Hoarder’s Paradox priced the properties, The Same Trade, Judged Twice the asymmetry, What the Price Is Made Of the factory, The Cycle Machine the machine, The Myth and the Migration the myth — as the first piece about the cryptography underneath them all.
Ask what is exposed, not what is threatened. Quantum and AI-math threats both act on visible public keys. A coin behind an unused hashed address presents nothing to work on; a coin behind a reused address or a Taproot output presents its key today. The useful question about any holding is not “is Bitcoin quantum-safe?” but “has this key ever been shown?”
Hash first is the structural bet. Across channels, the primitive with the least exploitable structure is the one rated most robust by the quantum literature and by Vitalik’s argument alike. Systems that commit to hashes and reveal structured material only at the moment of use degrade gracefully under both threats. That principle generalises far beyond Bitcoin.
Upgrades have threat-model vintages. Taproot was well designed for 2021’s assumptions; those assumptions moved. Every design choice is a bet on a threat model, and the bet should be dated. When the model shifts, the question is not whether the old choice was a mistake but which of its trades no longer pay.
Instrument Check — Worth Your Attention
Study — Anthropic, “Designing more efficient quantum circuits with Claude,” October 2026, with arXiv paper. Read the point-addition section and its table rather than the summary: the result is a new frontier of qubit-versus-gate trade-offs, not a single headline number. Then note what the authors did not claim — no revised estimate of the machine needed to break a 256-bit curve.
Read — BIP-360, “Pay-to-Merkle-Root,” Bitcoin BIPs repository. The specification is the clearest statement of what the Taproot key-path spend gave up and how it would be restored. Read it alongside BIP-361’s migration-and-sunset proposal to see where the engineering question ends and the property question begins.
Follow — Vitalik Buterin on AI-vulnerable cryptography, X, October 2026. A rare long-form argument about cryptographic risk that ranks primitives by how much structure they offer an attacker. Read it as a reasoned prior, not a forecast — and note the closing advice on migrations, which is the most empirically grounded sentence in it.
Flight Log — Dispatch From Altitude
Aviation has a name for the problem BIP-361 is wrestling with, and a century of practice in handling it. When a safety issue is discovered in a type already in service, the regulator issues an airworthiness directive: a mandatory inspection or modification, with a compliance deadline. Aircraft that comply keep flying. Aircraft that do not are not confiscated and not destroyed — they simply stop being airworthy, and stay on the ground until someone does the work. The fleet is protected without anyone seizing anyone else’s property, because the owner always holds the means to comply.
Bitcoin’s legacy outputs break that model in exactly one place. A sunset with a migration deadline is an airworthiness directive in all but name, and for owners who hold their keys it works the same way: comply, and fly on. But the largest exposed holding belongs to an owner who may never return, flying an airframe nobody else is permitted to touch. An aviation authority facing an abandoned aircraft with a known defect parked beside an active runway would not leave it there indefinitely; neither would it be comfortable towing away something it does not own. Bitcoin is having that argument without an authority, which is the point of Bitcoin and the difficulty of this particular decision.
And the other aviation habit worth borrowing is the one Vitalik ended on. The industry learned long ago that a significant share of maintenance-induced problems arrive during the maintenance itself — the panel refitted wrongly, the system reconnected in the wrong order. The fix for a latent risk can become the incident. That is why changes are planned, staged, checked by a second pair of eyes, and never rushed because a headline arrived on a Friday. Keys behind hashes are the right direction. Getting there calmly, one verified step at a time, is the part that actually keeps the coins.