Vitalik Buterin Urges Caution as Researcher Warns ECDSA Could Weaken

Ethereum co-founder Vitalik Buterin urged caution over rushed wallet migrations after Ethereum Foundation researcher Justin Drake called for preparations against a possible future failure of ECDSA, the signature system used for standard Ethereum account transactions.

Drake urged the industry to begin planning for what he called “bunker mode,” including controlled transfers to addresses whose public keys remain hidden behind hashes. He wrote Oct. 7 that ECDSA could, in a worst-case scenario, break “in months not years” before sufficiently powerful quantum computers arrive.

The warning does not establish that artificial intelligence has broken ECDSA, recovered private keys or stolen funds. Drake connected the concern to OpenAI’s Oct. 6 announcement that it was releasing mathematical results produced by an internal frontier model, including formalized proofs, attempted problems and information about computing resources.

Buterin said multisignature users should ideally replace each signer’s key after every operation if ECDSA becomes weak but does not fail instantly. He also recommended collecting signatures off-chain when possible to reduce the time between exposing a signature and retiring a key.

“But again: it's very easy to lose funds from a misconfigured rushed upgrade, so ... don't rush anything,” Buterin wrote Oct. 8.

ECDSA allows wallets to authorize transactions without exposing private keys. Once an account has sent a transaction, its public key can be exposed on-chain, creating a potential target for a future method that derives the private key.

Ethereum’s cryptography is not currently threatened by a quantum computer, and users do not need to take action now. The network is evaluating post-quantum alternatives, including systems based on hash functions and a gradual wallet migration.

The concern is that AI-assisted mathematical research could help uncover techniques that weaken elliptic-curve cryptography before sufficiently powerful quantum computers arrive. Drake’s “months not years” estimate remains a personal worst-case assessment rather than a timeline supported by a demonstrated exploit.

Buterin has also described artificial intelligence as a growing security consideration for blockchain systems, including its ability to identify software vulnerabilities and assist with complex cryptographic work.