Bunker mode, better safe than sorry

In May 2024 a major Belgian bank asked me for a short memo on the quantum safety of Ethereum. Two pages. I cannot say who asked or why. I can say what it said, because the memo is the only thing that survived: nothing happened after it, no decision, no follow-up.

Two years later people around me are telling each other to "bunker up". So I revisited it.

The memo

It said what everyone now says. ECDSA, the signature scheme behind every Ethereum account, breaks under Shor's algorithm once a large enough quantum computer exists. Keccak-256, the hash behind every address, only weakens under Grover's, so an address that has never signed anything keeps its public key hidden. The attack is a storage attack: scan the world state for every account with a transaction counter above zero, pull the public key from any signed transaction, derive the private key, sweep. Three mitigations: keep funds on addresses that have never sent, move to quantum-safe signatures when they exist, and move funds often.

Two months before I wrote it, Vitalik Buterin had posted How to hard-fork to save most users' funds in a quantum emergency on ethresear.ch, on 9 March 2024. I did not know the post at the time. My guess is that it is why the bank asked.

Two years on, the mechanics are the line on ethereum.org, page dated 8 September 2026: "For any account that has sent a transaction, the public key is exposed onchain." What the two years added is scope. The EF now counts four areas that need post-quantum work where the memo looked at one; a signature anywhere exposes the key, a permit or a signed message as much as a transaction; and there is the transit attack Deloitte had described, the key derived in the "about 10 to 20 seconds" between broadcast and inclusion.

What moved

August 2024: NIST finalized its three post-quantum standards. November 2024: NIST's draft transition report proposed disallowing ECDSA at Ethereum's security level after 2035, with weaker variants deprecated from 2030. Still a draft as of October 2026.

May 2025: Craig Gidney at Google cut his own 2019 estimate for factoring RSA-2048 from 20 million noisy qubits to under a million. August 2025: Vitalik, asked about timing, pointed at Metaculus: median, then, 2040 for a quantum computer factoring an RSA number, "Seemingly about a 20% chance it will be before end of 2030."

January 2026: the Ethereum Foundation formed a Post-Quantum team. Its own page targets core infrastructure for "approximately 2029" and calls those "planning milestones, not guaranteed commitments". Bitcoin merged BIP-360 into its proposal repository in February; a merge, as Bitcoin Magazine noted, is neither an endorsement nor an activation.

March 2026: Google set itself a 2029 deadline to migrate to post-quantum cryptography, citing "progress on quantum computing hardware development". Six days later its Quantum AI team published the estimate that explains the hurry: Shor's algorithm against the curve Ethereum and Bitcoin use, in "less than 1,200 logical qubits", on "fewer than 500,000 physical qubits in a few minutes". Google's number, Google's hardware assumptions, and one of its co-authors is the Ethereum Foundation's Justin Drake.

April 2026: a 15-bit curve key was broken on public quantum hardware for a one-bitcoin prize from Project Eleven, a post-quantum vendor. The same month Scott Aaronson, the sceptic the sceptics quote, wrote that "some of the most reputable people in quantum hardware and quantum error-correction" now think a machine that breaks deployed cryptography "ought to be possible by around 2029". He adds "I'm not a timing guy." In 2020, as The Register quoted him, his line was "we have no idea how long it will take". That is the sceptic view: not that the threat is fake, but that the people who used to say "no idea" now name a year.

Then AI showed up

The 2024 memo had one attacker, a hypothetical with a quantum computer. 2026 added three things it could not have imagined.

The first was to the attacker's budget. ECDSA.Fail, an open competition Eigen Labs launched in late May 2026, asked people to shrink one arithmetic step of Shor's algorithm on Ethereum's curve. More than 100 participants pointed AI coding agents at it, and by 26 July the benchmark score had fallen 86%, from 10.75 billion to 1.496 billion. It was one step, and the tests "did not crack a Bitcoin private key". But the defence runs on a schedule measured in years, and one piece of the attack got 86% cheaper in two months.

The second was to the defence. HAWK was a lattice signature scheme in the third round of NIST's search for additional post-quantum signatures. In late July an AI model found a weakness that "approximately halves the block size required in lattice reduction" to recover a key; on 29 July the HAWK team withdrew it, and NIST's candidate page now says so. HAWK was only a candidate; the finalized standards are untouched. But the "post" in post-quantum turned out to have a second attacker. Justin Drake's phrase for it, months later: "Exiting bunker mode safely will require post-AI cryptography."

The third has no quantum computer in it at all. On 26 June 2026 an internal OpenAI research model, mid-task on the Sepolia test network, had no test ETH to pay for a contract deployment and could not get any from the faucets. It derived wallets from developer recovery phrases that are public, checked 362 addresses, found one with a balance, and paused: "But using public known key/funds ethically?" Then: "Funds on a known public dev mnemonic are effectively abandoned/test ETH; Sepolia valueless." It deployed, reported the job done, and, in OpenAI's own words, "did not disclose that it had selected a funded account through a public recovery phrase or spent that account's balance." Test tokens, no value, disclosed in October. CoinDesk's last line does the rest: on mainnet "that would have been real ether taken from someone else's account."

Bots have taken unguarded money on their own since at least 2020, when Paradigm's Ethereum is a Dark Forest described funds sniped "in the seconds after" a transaction hit the mempool. What is new is a thing that reads the memo, understands it, and runs the two steps it can, scan and sweep, because a task told it to find money. The derive step still needs a quantum computer, or Drake's hypothetical shortcut. Nothing in my 2024 threat model needed a qubit for the rest.

Bunker mode, and the page that says "nothing"

On 7 October 2026 Drake, a researcher at the Ethereum Foundation, posted on X: "Today I call upon the blockchain industry to calmly begin planning for 'bunker mode'." Move the bulk of your funds to "addresses that have never signed a transaction", and when you do sign, move the rest to a fresh address again. His trigger is not a quantum computer. It is OpenAI's release of 722 mathematical manuscripts that week and his reading of it, "mathematical superintelligence is upon us": it is "now reasonable to brace for the possibility that ECDSA breaks before qday, in the worst case in months not years", meaning key recovery "in one week" on "a large GPU cluster". A personal recommendation, he says, and twice: do not rush. No such shortcut has been shown, as the sceptical write-ups that week pointed out, and three of the 722 manuscripts were retracted within days, with not all of the rest machine-verified.

Drake reaches for superintelligence; Ben-Sasson below reaches for AI more broadly. This is where I come out on it. The risk is real. It is not for today, with one exception: the easy money. A system that wants resources takes the cheapest ones first. Today the cheapest are the private keys sitting in public recovery phrases, the ones the agent found. The day derivation gets cheap, the 41.9 million ETH behind exposed public keys joins that pile. "Harvest now, decrypt later" is the industry's phrase for it; on Ethereum the harvest was done the day the key signed.

Mitigation one from a memo a bank filed in May 2024, now with a name.

The same week, the EF's own site, under "What do users need to do?", still said: "Right now: nothing. Your funds are safe." Page dated 8 September 2026, still there on 23 October. Both positions are the EF's, and The Block noticed the gap the day Drake posted. Their internal timing is their business. A bank in 2024 would have read "nothing" as permission.

Then the loudest reaction. On 8 October Eli Ben-Sasson, StarkWare's CEO, borrowed the phrase: "This calls for 'bunker mode'." His second reason was AI: "Is anyone willing to bet how much time we have until AI breaks something that we considered as safe?" Two weeks later Starknet holders voted, with "More than 93.5% of the voting power", to research leaving Ethereum for a post-quantum L1 of its own. "Ethereum's target of 2029 to become quantum-safe is too late, and deadlines slip. Ask anyone who waited for the Merge." A rollup is only as quantum-safe as its base chain, by its own team's account. The poll was a first step, StarkWare did not vote, and a second vote would be needed to actually move. One of them has started looking for a deeper bunker.

The number nobody had

Every percentage in this debate traces back to one measurement. Deloitte's analysis, undated on its page and dated 2021 by those who cite it, found "currently over 65% of all Ether are vulnerable to a quantum attack". Quantum Horizon, a paper submitted in June 2026, puts it at "50-65% of all ETH" and says what nobody else had: "No clean 2026 re-measurement exists." Every 2025 and 2026 figure, it found, leads back to Deloitte.

So I ran it. On 23 October 2026, against Google's public Ethereum dataset on BigQuery, current to 11:40 UTC that day, with the memo's own test: has this account ever sent a transaction? 41,870,669 ETH sits in accounts that have, spread over 195.7 million addresses. That is 34.3% of the day's supply of 122,155,370 ETH, and 54.7% of the ETH held in accounts outside the staking deposit contract. 25,361,798 ETH sits in accounts that never sent, and 9,362,407 ETH in contracts, which hold no key of their own and are not counted as exposed, even where one admin key controls them. The top 1,000 exposed accounts hold 24,686,141 ETH, about 59% of everything exposed and a fifth of all ETH there is. Google's March paper put the top 1,000 wallets at roughly 20.5 million; different cut, same shape.

Set 34.3% against Deloitte's 65% of all Ether, and against Quantum Horizon's 50 to 65%, and it is lower than both, for two reasons that have nothing to do with the risk shrinking. Against Deloitte, because more than a third of the supply has moved behind validator keys since 2021, a separate exposure the scan excludes by design. Against Quantum Horizon, which already subtracts staking, because its reconstructions assume nearly all ETH in ordinary accounts has signed; this count finds 25.4 million ETH in accounts that never did. Same test, different Ethereum. And it is a floor: a permit or a signed message exposes a key without ever sending a transaction, and no balance scan can see that.

What bunker mode does not fix

The day the bunker spends, it is exposed. Google's estimate puts a key recovery at minutes once the public key is out, which is longer than the seconds Deloitte counted between broadcast and inclusion, so at that speed the transit attack still fails on Ethereum unless the transaction waits in the mempool. What spending costs you is the key that stays public afterwards. Drake's version keeps the memo's third mitigation alive in a stricter form: every time you sign, move the remainder to a fresh address. Delegating an account to code under EIP-7702, live since Pectra in May 2025, does not help; a December 2025 survey paper is blunt that delegating "does not confer PQ protection on the underlying signing key". Contracts with admin keys, at least 70 of them holding 2.5 million ETH by Google's count, and rollup bridges have no fresh address to run to. Dormant accounts are, on the EF's page, "an open governance topic" with no consensus. My own agent registration from July (see the ERC-8004 piece) sits on franknft.eth, a hot wallet that is public by design: an agent that transacts is an agent that signs.

And by Drake's own logic, leaving the bunker needs cryptography that does not exist yet. The scheduled exit on Ethereum is EIP-8141, signature agility at the account level, listed as "Scheduled for inclusion" in Hegotá, expected on mainnet in "Q2 2027", date not confirmed.

Where I land

Better safe than sorry. The memo was right, and nothing came of it: the mechanics held, its first mitigation is now the advice of the people who build the chain, and nobody moved. A memo nobody acts on is a prediction, not a defence. The risk is real. It is not for today... except the easy money, which is today, because the thing that finds published keys and spends them already exists, and it does not need a qubit.