Can AI Break ECDSA or ML-DSA? Exponential Is Still Exponential

Table of Contents

Every crypto wallet is protected by a digital signature scheme. Bitcoin and Ethereum use one called ECDSA. Newer, quantum-resistant systems, including the upcoming QRL 2.0, use one called ML-DSA. Last week, two of Ethereum’s most senior researchers asked whether AI could break these schemes, and the question has been everywhere since.

On 7 October 2026, Justin Drake suggested the industry start planning for “bunker mode”. His worry is ECDSA. He argued that AI is getting so good at mathematics that it could find a way to break ECDSA on ordinary computers, before quantum computers arrive, and in the worst case within months. Vitalik Buterin replied the next day. He advised people not to rush to move their funds, but said the maths behind ML-DSA and most other quantum-resistant schemes could also be weakened by AI within two years. Both said the safest option is a different family of signatures, called hash-based signatures.

I think these concerns deserve a proper answer, and I think the answer is more reassuring than the headlines suggest. My view, in short:

1. So far, AI has made existing attacks faster. It has not found a fundamentally new way to attack any scheme we rely on.
2. Breaking ECDSA or ML-DSA would need a new kind of attack, not a faster version of an old one. That would be one of the biggest results in the history of cryptography. It could happen, but it is a different kind of event from anything we have seen.
3. The more realistic risk from AI is to the software that implements these schemes, not to the maths behind them.
4. On the quantum side, we are still running algorithms invented in the 1990s, just more efficiently. Inventing new quantum algorithms is the next step, and AI applied to that step is what I would watch most closely.

More on each below.

What AI has done so far

The biggest AI result in cryptography this year came in July, when Anthropic’s Claude Mythos Preview found two new attacks after about 60 hours of mostly independent work.

The first was against HAWK, a quantum-resistant signature scheme that NIST was considering for standardisation. Like ML-DSA, HAWK is built on lattices, which are grid-like mathematical structures in many dimensions. But HAWK relies on a newer and more specialised lattice problem than ML-DSA does, one with a lot of built-in symmetry. The AI found a symmetry nobody had noticed and used it to weaken the scheme. HAWK was designed to need about 2^128 steps to break. The attack brings that down to at most 2^108, and possibly 2^81. Its designers withdrew it from the NIST process.

The second attack was against a cut-down version of AES, the encryption used across the internet. Full AES repeats its scrambling step 10 times. Researchers study versions with fewer repetitions to measure how much safety margin the real thing has. The AI made the best known attack on the 7-round version between 200 and 800 times faster.

These are impressive results. But neither is a practical break. An attack that is 800 times faster sounds dramatic, but 800 is only about 2^10, so it knocks around 10 off a security level of 128. The HAWK attack was bigger, but it hit a scheme that was never deployed and that relied on a young, unusual assumption. Léo Ducas, one of HAWK’s designers, has said he does not think AI will break all cryptography.

I also read the HAWK result as the system working. The weakness was found during review, before anything depended on it.

Faster attacks versus new attacks

Cryptographers measure security in bits. A scheme with 128-bit security takes about 2^128 steps to break, which is 2 multiplied by itself 128 times. Every bit you add doubles the work. Every bit an attacker removes halves it.

There are two ways to make progress against a scheme like this.

The first is to make an existing attack faster. Imagine a lock with 2^128 possible keys, where the only method is to try them one by one. If you make each try 800 times faster, you still have about 2^118 keys to get through. That is roughly a billion times more than the number of nanoseconds since the Big Bang. And the defender can undo your gain by adding 10 more bits to the key.

The second is to find a new attack that works in a completely different way. Imagine discovering a flaw that lets each test rule out half of all the remaining keys. Now 128 tests are enough. No amount of speeding up the old method can compete with that.

Computer scientists describe the first kind of attack as exponential: the cost doubles with every extra bit, written O(2^n). Making an exponential attack faster by a fixed amount still leaves it exponential. Only a new idea changes that.

The last row has the smallest improvement but the biggest real-world effect, for reasons I come back to in the quantum section.

You sometimes hear people say “NP-hard is NP-hard”, meaning these problems are proven to be impossibly difficult. That is not quite right. The problems behind ECDSA and ML-DSA have not been proven to be in that hardest class. Our confidence comes from decades of the world’s best mathematicians failing to find anything better than exponential attacks, plus a few proofs about what whole families of attack cannot do. So the accurate statement is this: an exponential attack stays exponential until someone finds a genuinely new idea.

The real question, then, is what new idea an AI would need to find to break ECDSA or ML-DSA, and how likely that is.

Could AI break ECDSA?

ECDSA is based on elliptic curves. Your private key is a large secret number. Your public key is a point on a curve, produced by applying a mathematical operation to a fixed starting point that many times. Going forwards is easy. Working backwards from the public key to the private key is believed to be extremely hard. Bitcoin and Ethereum use a curve called secp256k1.

The best known way to work backwards takes about 2^128 steps. In 1997, the mathematician Victor Shoup proved that any attack that treats the curve as a black box cannot do better than this. So any faster attack has to exploit something specific about how this particular curve is built.

That has happened before, but only to badly chosen curves. Over the years, researchers found shortcuts for curves with certain special properties, and those curves were abandoned. secp256k1 avoids every known weakness of this kind. The main remaining idea, borrowed from a technique that works well against older systems, has been studied for over twenty years without producing a faster attack on curves like this one.

Now consider Drake’s scenario: recovering a key in about a week on a large cluster of graphics cards. By my rough estimate, such a cluster could do around 2^65 to 2^70 steps in a week. Getting from 2^128 down to that means removing around 60 bits, roughly cutting the difficulty to its square root. That is not an optimisation. It would need a new mathematical method that researchers have been looking for since the 1980s.

I do not think that is impossible, and I agree with Drake that taking precautions costs very little. But I think a break like that would be a historic mathematical result, not the next step on a trend.

Where AI is more likely to hurt ECDSA

In my view, the bigger near-term risk is the software, not the maths. Each ECDSA signature uses a fresh random number. If that number is ever reused, or is even slightly predictable, the private key can be worked out. This is how Sony’s PlayStation 3 signing key was recovered in 2010, and how Android Bitcoin wallets were drained in 2013. In 2019, researchers Joachim Breitner and Nadia Heninger scanned the Bitcoin and Ethereum blockchains for signatures with this kind of weakness and recovered hundreds of private keys.

This kind of search suits AI well: look through public data for patterns, test them, and check whether a key falls out. I would expect AI to find more weak keys this way long before it finds anything wrong with the curve itself.

Could AI break ML-DSA?

ML-DSA is the quantum-resistant signature standard NIST published in 2024. It is based on lattices. A simple way to picture the hard problem behind it: you are given a huge grid of points in more than a thousand dimensions, plus a point that has been nudged slightly off the grid by a small random error, and you have to find the nearest grid point. In two or three dimensions that is easy. At this size, it is believed to be extremely hard, for ordinary and quantum computers alike. ML-DSA-87, the strongest version, is set at roughly the same security level as AES-256.

The best known attacks are called lattice reduction. They work by gradually finding shorter, neater descriptions of the grid. Their cost grows exponentially with the size of the problem. Over the past decade, researchers have made them steadily more efficient, but in small steps worth a few bits at a time. That is exactly the kind of improvement AI is good at, and exactly the kind the parameters are designed to absorb.

Buterin’s concern is about structure. To make them fast and compact, the lattices in ML-DSA are built with a regular, repeating pattern rather than being completely random. The HAWK result showed that a scheme’s structure is where an attacker, human or AI, will look first.

This is a question the cryptography community has studied closely, and ML-DSA was designed with it in mind. Over a decade ago, researchers did find ways to exploit structure in some earlier lattice designs, such as a scheme called Soliloquy and certain versions of NTRU. Those results shaped what came next. The designers of ML-DSA deliberately chose a more conservative foundation that combines several smaller pieces, which makes that kind of structure much harder to break. None of the attacks on earlier designs carry over to it.

That is an important distinction from HAWK. HAWK relied on a newer and more specialised problem with a lot of built-in symmetry. ML-DSA relies on one of the most heavily studied problems in post-quantum cryptography. It went through eight years of public scrutiny in the NIST process before becoming a federal standard, and the lattice problems underneath it have been studied for decades longer. No one has found a shortcut. Breaking it would need a genuinely new algorithm, and there is no sign of one.

I think Buterin is right that lattice cryptography will keep attracting attention from AI. I would expect that attention to land first on newer, more experimental schemes like HAWK, which is exactly what has happened. That is the review process doing its job, and it is part of why ML-DSA is the scheme that made it through.

Open research and unpublished results

A lot of this research is now being done in the open. Eigen Labs runs a platform called Yukon that hosts public challenges. People and their AI agents submit improvements, an automatic checker verifies each one, and every accepted result is published for others to build on.

The best-known challenge, ECDSA.fail, asked participants to reduce the cost of one key step in the quantum attack on ECDSA. Over two months, more than 100 people working with AI agents cut that cost by 86%, to roughly half of Google’s own published estimate from March. Newer challenges target quantum-resistant signatures (sig.golf, with the Ethereum Foundation) and hash functions (HashSmash, launched on 5 October).

I think this is a good thing. The results are public, anyone can check them, and far more people are looking at the problem. It also shows where AI does best: problems with a quick, automatic way to check an answer and lots of room for small improvements.

The less comfortable point is that public results are not the whole picture. One company, WarpSpeed, says its AI has beaten the best public ECDSA.fail score by about 20% and has chosen not to publish. Google verified its March estimate without releasing the details. AI labs test their models privately for months. It is sensible to assume private research is somewhat ahead of public research. The question is whether it is ahead on speed-ups or on genuinely new ideas.

Quantum: faster existing algorithms, not new ones

This is the point I most want to make about quantum computing. Nearly all the recent progress has come from running old algorithms more efficiently, not from inventing new ones.

The quantum algorithm that breaks ECDSA, Shor’s algorithm, was published in 1994. Grover’s algorithm, which speeds up brute-force search, dates from 1996. Very few new quantum attacks on cryptography have been found since.

What has changed is how big a quantum computer you need to run them. In 2019, breaking RSA (another older signature and encryption scheme) was estimated to need around 20 million qubits. By 2025, it was under a million. This year, estimates for breaking ECDSA have fallen below 500,000 qubits, and one paper argued that 10,000 could be enough on a particular type of machine. ECDSA.fail shaved the cost again. All of this is engineering: making a known algorithm fit on a smaller machine. It is why ECDSA has a quantum deadline, and why that deadline keeps getting closer.

This is why the ECDSA.fail row in the earlier table matters most. Shor’s algorithm is already efficient enough to break ECDSA. The only thing standing in the way is hardware. Every improvement brings the date closer.

ML-DSA is in a completely different position, because there is no known quantum algorithm to make faster. The best quantum ideas against lattices go back to the early 2000s and still need far too much time and memory to be practical. In April 2024, a paper claimed an efficient quantum attack on the lattice problem behind ML-DSA. Researchers found a fatal error in it within about ten days.

Hash functions are better protected still, because here there is a proof. In 1997, researchers proved that no quantum algorithm can search faster than Grover’s. That puts a hard limit on how much any quantum computer, designed by a person or an AI, can do against a well-designed hash.

So the quantum threat to ECDSA is an engineering problem with a known solution. The quantum threat to ML-DSA would need a new algorithm that nobody has found. That step, inventing new quantum algorithms, has barely begun.

AI and quantum together

If I had to pick one thing to watch, it would be AI being used to invent new quantum algorithms, rather than to make old ones cheaper. For lattice-based schemes, that would mean finding a quantum attack that nobody has found in over twenty years of looking.

Some of the groundwork is already there. AI agents are optimising quantum circuits in challenges like ECDSA.fail, and AI is helping improve quantum error correction. In July, a project used AI agents to write a complete, machine-checked mathematical proof that Shor’s algorithm works, and its authors described it as a step towards AI helping to design and verify quantum algorithms.

This matters because AI makes the fastest progress when its answers can be checked automatically. The cost of a quantum circuit can be. A brand new quantum algorithm usually cannot, because there is no quantum computer big enough to test it on, and proving it works means a mathematician checking the argument line by line. Claimed breakthroughs in this area appear fairly often and usually turn out to have a gap in the reasoning. If AI gets tools to check its own quantum algorithm ideas reliably, progress could speed up a lot. That is the development I would watch.

The same tools also help defenders. A checker that can confirm a real breakthrough can also reject a flawed claim in hours rather than days.

Whenever a new result is announced, the question I ask is simple: is this a faster way to run something we already knew, or a genuinely new attack? So far, every AI result has been the first kind.

How I rank the risks

This is my own view, ordered from most to least likely to cause real losses in the next few years:

1. Badly written ECDSA software. Reused or predictable random numbers and weak key generation. These have already cost people real money, and AI makes them easier to find.
2. Quantum computers running Shor’s algorithm against ECDSA. The algorithm is known and the hardware needed keeps shrinking. This is the risk that should set migration timelines.
3. Implementation flaws in any signature software. Every scheme, old or new, depends on being implemented carefully. Leaks through timing, power use or faults are a general risk, and well-audited implementations are the answer.
4. Newer, more experimental quantum-resistant schemes. HAWK has already shown this. I expect more results here, which is what review is for.
5. A new mathematical attack on ECDSA without a quantum computer. This would need a method researchers have sought since the 1980s. I would not rule out AI finding one, but I see no evidence that it is close.
6. A new attack on the standardised post-quantum schemes, ML-DSA and the hash-based schemes. Both rest on problems that have resisted decades of attack, classical and quantum, and neither has any known quantum algorithm to make faster.

A few things support the bottom half of that list. There are mathematical proofs limiting what whole families of attack can do. Speed-ups worth a few bits are easy to absorb, and ML-DSA-87 is set at the highest security level NIST defines. Defenders can use the same AI tools to test schemes before they are deployed. And the simplest protection for today’s chains is already known: Drake and Buterin disagree on urgency, but agree that you should avoid reusing addresses, so your public key stays hidden until you spend.

I also agree with both of them that hash-based signatures deserve a central place in the post-quantum toolkit. They depend on very few assumptions, which makes them a strong complement to lattice-based schemes like ML-DSA.

QRL

QRL has used XMSS, a hash-based signature scheme, since its mainnet launched in June 2018. Its security depends only on the hash function it uses, with no special mathematical structure for an attacker to exploit. That is over eight years of running the type of cryptography Drake and Buterin both pointed to as the most resistant to quantum and AI attacks.

QRL 2.0, which is still in development and not yet live, will introduce ML-DSA-87, the strongest version of the NIST standard, alongside EVM compatibility. It is built on one of the most thoroughly studied problems in post-quantum cryptography, and the 87 parameter set gives it the largest safety margin the standard offers. Once QRL 2.0 launches, QRL will have run both families that the cryptography community regards as the strongest foundations for a post-quantum future: hash-based and lattice-based. We will keep following the research in the open, as everyone should.

Choosing cryptography is not a one-off decision. It means regularly checking your assumptions, choosing the most conservative ones available, and being ready to act if the evidence changes.

Conclusion

AI is now doing real cryptography research, much of it in public, and the quantum computers needed to break ECDSA are getting smaller on paper faster than most people expected. Both deserve attention.

But so far, AI has made existing attacks faster. It has not found a fundamentally new way to attack ECDSA, ML-DSA or a well-designed hash function. For ECDSA, the real deadline is quantum, and AI is bringing it closer. For ML-DSA, there is no deadline unless someone invents a new algorithm. That is the step to watch.

Until someone proves otherwise, exponential is still exponential.

Sources

• Anthropic Mythos results on HAWK and AES (summary)
• HAWK-512 bit-security figures
• Léo Ducas comments, The Stack
• Drake and Buterin on bunker mode, investingLive
• Drake bunker mode post, Forklog
• ECDSA.Fail: Open Autoresearch (arXiv 2609.09582)
• ECDSA.fail results, Decrypt
• WarpSpeed unpublished circuit claim
• HashSmash launch, 5 October 2026
• Breitner and Heninger, Biased Nonce Sense (ePrint 2019/023)
• FIPS 204, Module-Lattice-Based Digital Signature Standard
• Cain et al., Shor with 10,000 atomic qubits (arXiv 2603.28627)
• Pinnacle architecture and RSA-2048 estimates
• Agentic Lean formalisation of Shor (arXiv 2607.14082)