Cryptocurrencies face new security risk as Ethereum researcher warns of potential ECDSA break

• Ethereum researcher Justin Drake has urged large crypto holders to move funds to fresh addresses with public keys that remain hidden.
• He warned that ECDSA could break before quantum computing milestones, allowing private keys to be decrypted quickly using available hardware.
• Ethereum co-founder Vitalik Buterin warned about the risk of losing funds from "botched" transfers.

Ethereum (ETH) researcher Justin Drake has urged the crypto industry to begin preparing for a potential breakthrough that could undermine the cryptographic systems securing digital assets.

Drake urges controlled migration to fresh addresses

In an X post on Wednesday, Drake called on the industry to calmly enter what he described as “bunker mode.” He recommended that large crypto holders consider moving assets to fresh addresses whose public keys have not yet been exposed.

“My personal recommendation is to set in motion a controlled mass migration of assets to fresh addresses,” Drake wrote.

He advised large holders to move most of their funds to addresses that have never signed a transaction. He also shared that once an address is used to sign a transaction, any remaining funds should be transferred to another fresh address.

The Ethereum developer stressed that the process should not be rushed or driven by panic. He described the proposed migration as a preventative measure that does not require new wallets or new cryptographic technology.

Drake noted that he now considers it reasonable to prepare for the possibility that the Elliptic Curve Digital Signature Algorithm (ECDSA) could be broken before future quantum computing milestones arrive.

“IMO it is now reasonable to brace for the possibility that ECDSA breaks before qday,” Drake wrote.

He linked his concerns to recent advances in artificial intelligence (AI) and mathematical research, pointing to several recent mathematical results that have challenged long-standing assumptions.

“Recent days have been humbling for human mathematical intuition. Long-held, unquestioned hypotheses have fallen,” he added.

The concerns come amid broader discussions about whether increasingly powerful computing systems can challenge existing cryptographic protections.

Quantum computing has long been identified as a potential threat to cryptographic systems used by Bitcoin (BTC) and other blockchain networks because sufficiently powerful quantum computers could use algorithms such as Shor’s algorithm to attack cryptographic schemes.

The threat has driven researchers and blockchain developers to explore post-quantum alternatives, including cryptographic systems designed to withstand quantum attacks.

Drake argued that hash-based cryptography could offer a stronger path for blockchain systems preparing for what he described as a post-AI environment. He stated that he would favor cryptographic approaches based on established hash functions, including algorithms from the SHA and BLAKE families.

He also called on major crypto companies and infrastructure providers to strengthen their defenses. Drake specifically mentioned Binance, Bitbank, Robinhood, Bitfinex and Tether, urging them to consider hardening their cold-storage systems.

For Ethereum infrastructure, Drake highlighted entities such as oracles and Layer-2 security councils could consider rotating ECDSA public keys more frequently or using multiple signatures involving hash-based schemes such as SPHINCS+.

Drake also pointed to the need to reassess and accelerate Ethereum’s cryptographic roadmap in response to advances in AI and the broader quantum threat.

“Exiting bunker mode safely will require post-AI cryptography. My inclination is to go all-in on hash-based cryptography and avoid structured mathematical assumptions entirely,” he wrote.

In response, Ethereum co-founder Vitalik Buterin noted in a Wednesday X post that the network has been shifting towards simpler hash-based signatures to reduce the risk from AI-accelerated progress in altering cryptographic systems. He highlighted that lattice-based cryptography, which many consider safe, also faces risks.

While Buterin supported moving funds to fresh addresses, he highlighted the risk of asset loss.

"But be careful about migrations; I personally have lost more money in botched migrations than I have lost in all hacks combined," Buterin wrote.