比特币和以太坊地址是通过对公钥进行哈希生成的，因此只要一个钱包从未从某个地址支出过，其公钥就会隐藏在哈希之后。一旦签署交易，公钥就会被发布到链上，成为任何能够解决ECDSA背后椭圆曲线离散对数问题者的固定目标。贾斯汀·德雷克的‘掩体模式’提议完全围绕这一暴露差距构建：他具体建议‘启动资产向新地址的受控大规模迁移’[1]，即从未签署过交易的地址，从而使其公钥保持在链下且无法触及，直到所有者选择支出为止。已经暴露的规模才是真正的驱动力——研究公司Project Eleven的‘Bitcoin Risq List’显示，截至2026年9月中旬，处于公钥可见地址中的BTC数量超过817万枚，此前估计为604万枚BTC，约占流通供应量的30%[2]。这正是‘掩体模式’试图在理论性破解发生前缩小的资金池，而不是事后应对。
引发整个恐慌事件的并非一篇密码学论文。2026年10月6日，OpenAI发布了722份数学手稿，代表了由内部前沿模型生成的372个独立结果家族，且未使用任何数学专用工具[3]。德雷克本人对此事高度强调，描述了‘数学超级智能’，并称‘最近几天对人类数学直觉来说是一种谦卑的经历。长期坚持、不容置疑的假设已经倒塌。’但正如CryptoSlate对该公告的报道所明确指出的那样，‘OpenAI的公告并未报告对ECDSA或RSA的实际攻击’[4]。发布的材料中没有任何内容声称找到了更快的椭圆曲线离散对数算法、打破了困难性假设或恢复了单个私钥。整个‘在几个月内破解ECDSA’的情景完全是德雷克从通用数学进展外推至尚未证实的特定密码分析能力的结果——这一区别成为随后行业争论的核心。
行业反应几乎立刻分裂。Coinbase密码学主管耶胡达·林德尔（Yehuda Lindell）直接拒绝了这一警告：‘在没有任何证据的情况下发表此类言论，恰恰是不负责任的行为。这就是FUD的典型定义，’他认为AI解决开放猜想并不能说明椭圆曲线密码学背后的特定困难性假设实际上已经减弱[5]。Dragonfly Capital的哈西卜·库雷希（Haseeb Qureshi）则持相反立场，认为德雷克的呼吁是一种合理的预防措施，而非制造恐惧[1]。维塔利克·布特林则居中调和：他明确承认底层风险——‘我们应认真对待AI加速数学对密码学构成的风险’——但在程序层面反对德雷克的紧迫性，而非实质内容，并指出‘我个人因错误迁移而损失的资金，超过了我在所有黑客攻击中损失的总和’[9]。这种张力——可信研究人员一致认为风险真实存在，但在是否应立即行动上激烈分歧——也在社区对该事件的反应中显现出来。原生加密受众对‘几个月’的时间线公开表示怀疑，反复引用林德尔的反驳作为更可信的解读，并将更深层的启示视为值得长期关注的风险，而非紧急状况，而主要是次级媒体放大和面向散户的评论推动了接近恐慌的叙事。
布特林的回应不仅缓和了德雷克的紧迫感，还扩大了威胁模型。他警告称，AI加速的数学进展也可能威胁到以太坊研究社区原本视为ECDSA后量子安全替代方案的格基方案（ML-DSA、Falcon）：‘到目前为止，大多数人一直认为“椭圆曲线被破，哈希安全，格基安全”，’[1]他写道，结论是在可行的情况下应优先采用基于哈希的签名方案，因为它们的安全性建立在比格问题更为保守的假设之上。这一重新定位恰逢以太坊第二届年度后量子研究研讨会前夕，会议定于2026年10月9日至12日举行[4]——这一时间安排使一条X帖子变成了议程项目。这也与比特币生态系统的密码学家乔纳斯·尼克（Jonas Nick）此前表达的不安相吻合，他曾直言：‘我们知道椭圆曲线已被破解。这让我感到不安’[2]——提醒人们ECDSA最终将被淘汰从来不是争议点，真正的问题只是时间表以及什么应该取代它。
抛开修辞，定量论据依赖两条独立曲线的趋近，而非单一突破。在量子方面，加州理工学院（Caltech）和Google Quantum AI于2026年3月的一项分析发现，破解256位椭圆曲线密码学所需的量子资源可能比2019年的估计少约20倍——不到50万个物理量子比特，而非之前的基准[6]。到2026年5月，安全研究人员已警告AI本身正在加速这一量子研究进程，Project Eleven的CEO亚历克斯·普鲁登（Alex Pruden）指出：‘AI确实正被用于加速量子计算的发展，’NEAR联合创始人伊利亚·波洛苏金（Illia Polosukhin）则认为，今天放在网上的任何敏感数据都应在几年内被视为可解密的[7]。德雷克自己的独立估算则认为，到2032年，量子计算机从暴露的公钥中恢复secp256k1私钥的概率至少为10%[8]。这些数据均不涉及通过AI实现的ECDSA经典破解——它们是早于本周数学突破恐慌数月的量子时间线估算。德雷克10月7日的警告实际上是将一种新的、发展更快的AI风险嫁接到本已缩短的量子时钟上，这就是为什么尽管对即将发生的经典破解的证据实际上仍然为零，反应却显得如此紧迫。
“认为OpenAI的数学成果显示，由AI驱动的进展可能压缩破解ECDSA的时间线，使其早于量子计算出现，行业应主动将资金迁移到未暴露的地址：‘数学超级智能已经到来。’”
“认为AI加速的密码分析风险可信，并将其扩展到基于格的后量子方案，但反对仓促迁移：‘我个人因错误迁移损失的资金比我在所有黑客攻击中损失的总和还要多。’”
“拒绝AI已削弱ECDSA困难性假设的前提，称该警告毫无证据：‘没有任何证据指向像椭圆曲线密码学这样几十年来困难性假设的崩溃。’”
“对椭圆曲线密码学已知的理论可破解性表示不安，相较于林德尔的否定态度，更谨慎地认同德雷克的观点：‘我们知道椭圆曲线已被破解。这让我感到不安。’”
“表示AI已被用于加速量子计算的发展，并探测实现漏洞或密码弱点，强化了对时间线缩短的担忧：‘AI确实正被用于加速量子计算的发展。’”
“Today I call upon the blockchain industry to calmly begin planning for "bunker mode". My personal recommendation is to set in motion a controlled mass migration of assets to fresh addresses, i.e. addresses whose pubkeys remain hidden behind a hash. Holders, starting with large and sophisticated ones, should consider moving the bulk of their funds to addresses that have never signed a transaction. And when they do sign one, they should also move remaining funds to a new address (possibly generated from the same seed phrase). Don't rush. While I believe there is cause for action a rushed migration would do more harm than good. Don't panic either. Moving assets to protected addresses is a simple, preventative step which does not require new cryptography or new wallets. IMO it is now reasonable to brace for the possibility that ECDSA breaks before qday, in the worst case in months not years. By "break" I mean fast private key recovery (e.g. in one week) on available hardware (e.g. a large GPU cluster). Recent days have been humbling for human mathematical intuition. Long-held, unquestioned hypotheses have fallen. This includes the n log(n) bound for integer multiplication and the 3SUM conjecture. In hindsight, May's unexpected disproof of the Erdős unit distance conjecture was our warning shot. Yesterday's OpenAI drop made it clear that mathematical superintelligence is upon us... Elliptic curves feel especially vulnerable to superintelligence... Exiting bunker mode safely will require post-AI cryptography. My inclination is to go all-in on hash-based cryptography and avoid structured mathematical assumptions entirely, whether from curves, lattices, or isogenies.”
“I don't recommend anyone scramble to move their funds to new wallets today. But we should take the risks to cryptography from AI-accelerated math seriously, and minimize our exposure to not just quantum-vulnerable cryptography, but also potentially AI-vulnerable cryptography. The core new area of risk from this viewpoint is, unfortunately, ML-DSA / FHE / lattices. (and it's also another reason, along with quantum, why ECDSA might fall even faster than expected, hence the "fresh address" recommendation) So far most people have been in the mode of thinking "elliptic curves broken, hashes safe, lattices safe". But there is a good chance that the concrete security of lattices will take serious hits from the next two years of AI math... Hash-based > lattice-based, in those situations where hash-based is possible at all. For anything lattice-based, be much more paranoid on param sizes.”
“JUST IN: Ethereum researcher Justin Drake calls on the crypto industry to enter "bunker mode" as AI superintelligence could threaten standard ECDSA encryption faster than expected. "My personal recommendation is to set in motion a controlled mass migration of assets to fresh addresses, i.e. addresses whose pubkeys remain hidden behind a hash."”
“What if AI breaks crypto before quantum computers even get the chance?”
$200B Loss. Crypto Enters BUNKER MODE
Ethereum's Quantum Plan Before Q-Day with Justin Drake
BITCOIN: EMERGENCY!!!!!!!
System online.