Ethereum Founder Vitalik Buterin: Lattice Cryptography May Face Severe Challenges Within Two Years
Ethereum co-founder Vitalik Buterin responded to researcher Justin Drake's "bunker mode" proposal, stating that advancements in artificial intelligence mathematics over the next two years have a high probability of severely weakening the specific security strength of lattice cryptography. He explicitly does not recommend holders rush to move their funds to new wallets today.
The new risk centers around quantum-resistant signature scheme ML-DSA, fully homomorphic encryption (FHE), and more broadly, lattice constructions. The industry's previous default judgment was that elliptic curves would fail, hash security would hold, and lattice would also be secure; he amended the latter, believing that lattice can no longer be automatically considered a secure area. This same logic provides an additional reason for ECDSA to fail faster than expected, as Bitcoin and Ethereum wallets generally rely on ECDSA to authorize transactions, and once public keys are exposed on-chain, the risk increases.
He used factorization as an analogy: the naive algorithm's complexity is about 2^(n/2), while the number field sieve reduces the actual complexity to 2^(O(n^(1/3))), causing RSA keys and signatures to expand to about 400 bytes instead of 64 bytes. If AI brings about the equivalent of 50 years of mathematical progress within two years, it is conceivable that similar algorithmic leaps could occur in lattice-based cryptography. His operational inference is that to keep the public key system credible in the long term, key parameters should be increased by about tenfold, and more conservative parameters should be adopted for all lattice-based schemes.
He explicitly expanded the applicability beyond on-chain. Website integration, encrypted communication, Tor, and VPN are not just blockchain issues. Privacy protocols should avoid putting encrypted notes directly on-chain, instead using third-party channels for off-chain transmission; multi-signatures should prioritize off-chain signature confirmations. When funds can be easily managed, they should be placed in addresses that have never initiated transactions to hide the public key, but the migration itself incurs operational losses; he stated that his losses from migration errors have already exceeded those from previous hacking incidents.
The Ethereum Lean route has shifted to pure hash constructions over the past year, avoiding lattice signatures and related zero-knowledge structures, prioritizing hashing wherever possible, including Winternitz one-time signatures and SPHINCS-type schemes. Drake connected this discussion to recent AI mathematical outputs, stating that elliptic curves contain algebraic structures like Schoof, Frobenius, and pairings that can be exploited, while hashing is deliberately designed to minimize structure.
This is a re-pricing of security assumptions driven by events, not an immediate sell-off directive. Addresses that have exposed public keys, protocols that have staked on lattice after quantum migration, and projects relying on FHE for on-chain privacy computations are under pressure; hash signatures, conservative parameter lattice implementations, and infrastructure for off-chain encrypted data transmission are relatively beneficial. Funds will not immediately shift due to a single statement, but new deployments will shift the security budget from "lattice is quantum-resistant" to "hash priority, parameter amplification, and less public key exposure." If exchanges and custodians continue to reuse addresses, they are effectively shortening the remaining security window of ECDSA.
Source: Public Information
ABAB AI Insight
Vitalik Buterin has treated cryptographic assumptions as replaceable layers in protocols since the Ethereum white paper in 2014, rather than as a permanent foundation. After the transition to proof of stake was completed in 2022, he shifted the engineering focus to account abstraction, proof systems, and the Lean route; over the past year, this route has already replaced lattice signatures with hash signatures. He has publicly stated that personal losses from migration errors have exceeded those from hacking incidents, which explains his support for hiding public keys in new addresses while opposing large-scale migrations on the same day.
Capital will not first flow to transactions that "break the lattice," but rather to projects that can change assumptions. NIST will list ML-DSA and ML-KEM as post-quantum standards in 2024, and governments and cloud vendors will base their migration budgets on this; if the specific security of lattice is eroded by AI mathematics, this budget will need to be divided into two parts: one for purchasing larger lattice parameters and another for shifting to hash signatures, off-chain encrypted transmission, and unspent address management. The bunker mode promoted by Ethereum researchers essentially changes the default behavior of exposing public keys to a cost-incurring action.
This is similar to how the number field sieve in the 1990s shifted RSA from "just make the key longer" to "must continuously lengthen it." After SHA-1 was practically collided in 2017, the certificate system did not collapse immediately but enforced a switch to SHA-2 within the window period. Lattice-based cryptography is currently at the same stage: the expansion period of post-quantum standards is being pulled back into a control period for parameter and structure selection. Designs like Zcash that put encrypted states on-chain directly conflict with his requirement that "encrypted notes should not be on-chain," and if on-chain privacy computations are tied to FHE, they will first encounter parameter inflation.
Structurally, this represents a transfer of pricing power. Security is no longer priced by the label "quantum-resistant," but by the amount of remaining algebraic structure. Elliptic curves have rich structures, lattice-based cryptography still has optimizable mathematical surfaces, and hashing is designed to have as little surface as possible. As AI lowers the cost of mathematical searches, primitives with more structures will be re-evaluated first, while those with fewer structures gain relative pricing power. If protocol parties continue to equate post-quantum with lattice-based cryptography, they are exposing the migration paths of standard organizations over the past few years to a faster attack research cycle.
ABAB News · Laws of Cognition
Quantum resistance is not security; less structure is security.
The bill for migration errors often comes before the bill from hackers.
Once standards can be rewritten by accelerated mathematics, labels are no longer a moat.