AI risk to crypto wallets: Ethereum researcher warns keys could be cracked in months

What it is

Justin Drake, an Ethereum Foundation researcher, warned on October 7, 2026 that AI-assisted advances could break ECDSA — the elliptic-curve signature scheme securing blockchain transactions — faster than quantum computing threats, possibly within months in a worst case.

How it works

Drake's concern is a practical key-recovery attack: an attacker with access to a large GPU cluster could recover a private key from an exposed public key in roughly a week. The risk is specific to addresses whose public keys have already been revealed on-chain (i.e., any address that has signed a transaction), since the attack targets the public key, not the address hash itself. This is a projected future capability, not a demonstrated break of ECDSA.

Preconditions / Affected

• Applies to ECDSA-secured wallets on Ethereum and similar chains.
• Risk is concentrated on addresses with exposed public keys — any address that has already signed at least one transaction.
• Fresh addresses that have never signed a transaction keep their public key hidden behind a hash and are not yet exposed to this attack vector.
• Highest priority: large/sophisticated holders, institutional cold storage, and critical signers such as oracles and L2 security councils.

What to do

Drake's stated recommendations, framed as gradual "bunker mode" prep rather than rushed migration:

• Migrate holdings into fresh addresses whose public keys have never appeared on-chain.
• After any transaction signs and exposes a public key, rotate remaining funds into a new unexposed address again.
• Institutions: audit which public keys are already exposed and harden cold storage.
• Critical signers (oracles, L2 security councils): rotate keys and/or add hash-based signature schemes such as SPHINCS.
• Ethereum developers: accelerate the timeline for transitioning to hash-based cryptography, treating AI progress as a reason to revisit existing quantum-threat upgrade schedules.

flowchart TD
    A[Address signs a transaction] -->|public key now exposed on-chain| B[Vulnerable to AI-assisted ECDSA break]
    A -->|never signed| C[Public key stays hidden behind hash]
    C --> D[Not currently exposed to this attack]
    B --> E[Rotate remaining funds to fresh unexposed address]
    E --> C

Caveats

Drake's warning describes a potential future threat, not a demonstrated attack on ECDSA — no working exploit is claimed. He explicitly cautions against rushed migrations, noting that hasty key rotation could introduce more risk than it removes.