ECDSA Break Warning: Which Bitcoin Wallets Are Exposed in 2026

Short answer: On October 7, 2026, Ethereum Foundation researcher Justin Drake urged the industry to start planning for a "bunker mode": in his worst case, ECDSA, the signature scheme that protects most Bitcoin and Ethereum wallets, could be broken "in months not years", most likely by AI-driven mathematics rather than by a quantum computer. Vitalik Buterin agreed the risk is real but said nobody should scramble to move funds. The same day Europol published a report concluding that cryptocurrencies will not collapse because of quantum computing, but that wallets with already visible public keys are the weak spot. Analysts put that exposed supply at roughly 6 to 6.9 million BTC, about 30% of all bitcoin. No practical attack on ECDSA has been demonstrated.

What exactly did Justin Drake say?

In a post on X, Drake wrote that it is now reasonable to prepare for an ECDSA break before "q-day", the moment quantum computers can crack today's public-key cryptography. By "break" he meant something concrete: recovering a private key from a public key quickly, for example within about a week on a large GPU cluster. His trigger was not a quantum milestone but OpenAI publishing hundreds of mathematical results produced by an internal model that week, which Drake called evidence that "mathematical superintelligence is upon us". His argument: elliptic curves have more mathematical structure than hash functions, so a new shortcut on ordinary computers is more plausible for them.

His proposed response is "bunker mode": holders, starting with large and sophisticated ones, gradually move most of their funds to fresh addresses that have never signed a transaction, so the public key stays hidden behind a hash. He also asked exchanges and custodians to review cold-storage practices. Drake was explicit that this is a personal recommendation, that ECDSA has not been broken, and that people should neither panic nor rush.

How did Vitalik Buterin and others react?

Buterin replied the same day. He agreed that AI-accelerated math is a serious reason the old assumption ("elliptic curves broken, hashes safe, lattices safe") may not hold, and warned that even lattice-based post-quantum schemes such as ML-DSA could take hits from the next two years of AI research. But on wallets he was clearly cautious: he does not recommend anyone scramble to move funds today, moving to never-used addresses is a good precaution only if it is easy, and he said he has personally lost more money in botched migrations than in all hacks combined.

Others split. Coinbase's head of cryptography Yehuda Lindell said there is no evidence that the hardness assumptions behind elliptic curves have weakened and called the warning FUD. Dragonfly's Haseeb Qureshi called it a sober call worth acting on. Solana Foundation's Jacob Creech said Solana users do not need bunker mode and described a possible future hash-based migration path for its Ed25519 keys.

What did Europol publish?

Europol's European Cybercrime Centre (EC3) released two reports on October 7, 2026: Quantum Computing and Cryptocurrencies and Harvest Now, Decrypt Later. The crypto report separates the blockchain from the wallets on top of it. Hash functions such as Bitcoin's SHA-256 are considered largely resistant to quantum attacks; public-key signatures are the "primary point of exposure". Its recommendations: a phased move to post-quantum cryptography, crypto-agility, priority for the most exposed assets, and pre-emptive migration of funds whose keys are already public, because those cannot be secured after the fact.

A note on the numbers. Coverage of the report cites roughly 6 to 6.9 million BTC in addresses with exposed public keys. These figures come from on-chain analysts: Glassnode estimated in 2026 about 6.04 million BTC (30.2% of supply), while CryptoQuant founder Ki Young Ju put it at about 6.89 million BTC earlier in the year. The gap comes from methodology, mainly how coins exposed through past spending are counted.

Key facts

Which addresses are actually exposed?

The rule is simple: an attacker who can turn a public key into a private key needs to see the public key first. Whether it is visible depends on the address type and on your history.

• P2PK (pay-to-public-key). The earliest Bitcoin outputs, including many coins mined in 2009–2010 and attributed to Satoshi Nakamoto, lock funds directly to a public key. It is visible on-chain forever. Drake calls the roughly 20,000 such 50 BTC outputs "Satoshi's shield": a large, tempting first target that may give smaller wallets some breathing room.
• Taproot (P2TR, addresses starting bc1p). A Taproot output stores a tweaked public key directly, so the key is exposed as soon as coins arrive, not only when they are spent. Taproot is not broken; it is simply in the "structurally exposed" bucket for this specific threat.
• Reused addresses. Hashed formats (P2PKH addresses starting with 1, P2SH starting with 3, P2WPKH starting with bc1q) hide the key until the first spend. Once you spend from such an address, the key is public, and anything left there or sent there later is exposed. This "operational" exposure, about 4.12M BTC by Glassnode's count, is the part individuals can fix themselves.
• Ethereum accounts. An Ethereum address is a hash of the public key, but the key can be recovered from any signed transaction. In practice, every account that has ever sent a transaction has an exposed key; an address that has only received funds has not.

Even a fresh address reveals its key at the moment you spend, while the transaction waits in the mempool. That window is minutes, which matters only against a very fast attacker. The long-term fix is protocol-level post-quantum signatures, which both Bitcoin and Ethereum developers are discussing; we covered Ethereum's direction in Buterin's Hegota roadmap piece.

What should a holder do now, without panic?

1. Check, don't scramble. Even Drake and Buterin agree on this. A rushed move done wrong loses funds today; the threat they describe is a scenario, not an event.
2. Find your exposed coins. In your wallet, look at addresses you have already spent from and still hold a balance on, old P2PK outputs and Taproot (bc1p) addresses.
3. Stop reusing addresses. Use a wallet that generates a new receiving and change address every time; most HD wallets do this by default.
4. Consolidate calmly into hashed, never-used addresses if your exposed balance is significant: test with a small amount, double-check the destination and keep the seed backup current. Moving funds is when people fall for address poisoning and fake signatures.
5. Mind fees. Batch movements into a few transactions in low-fee periods rather than many small ones.
6. Keep the basics. Hardware wallet, offline seed, no seed in screenshots or cloud. Our self-custody security guide covers the threats that are real today.
7. Exchange balances are the exchange's job. Coins held on a platform sit in its addresses; whether those are rotated depends on the custodian, which is another reason to keep long-term holdings in your own wallet.
8. If you swap, compare first. Moving funds sometimes coincides with rebalancing. Rates and limits differ a lot between services: the changerella.com exchangers list compares them, and app.changerella.com swaps directly into an address you control, without an account.

This article explains a technical risk and is not investment advice.

FAQ