What if an AI system found a way to pick the lock on your Bitcoin wallet, crack the encryption behind your bank transfers and expose the connection between your browser and a website? The same mathematical foundations protect much of the internet, so a breakthrough could put billions of digital interactions at risk. AI is getting better at solving difficult mathematical problems, and cryptographers are starting to ask whether the systems we trust to keep our data safe can keep up.
The mathematics behind digital security
Public-key cryptography works like a one-way street: a private key lets its owner sign transactions or decrypt information, while the corresponding public key can be shared openly. Working in the forward direction is easy; going backwards should be computationally impractical. This asymmetry is what keeps cryptocurrency wallets, encrypted messages, online banking and secure website connections running.
Under the hood, these systems rely on mathematical problems that have resisted efficient solutions for decades. Elliptic-curve cryptography depends on the difficulty of the elliptic-curve discrete logarithm problem. RSA relies on the difficulty of factoring large integers. If researchers found a way to solve either problem much faster, the foundations of digital security could start to crack.
AI adds a new variable to the equation. Models can now work through complex mathematical problems, develop proofs and explore approaches that might take human researchers years to find. The devil is in the details: a useful mathematical discovery could change the security assumptions behind systems used by millions of people.
What OpenAI's research showed
On October 6, 2026, OpenAI published a collection of 722 mathematical manuscripts, grouped into 372 families of related results. The repository included research papers, proof artifacts and Lean formalizations. Lean is a proof assistant that allows mathematicians to encode statements and check whether a proof follows from specified definitions and assumptions.
The release put AI-assisted mathematics firmly on the map. In its October 26 announcement, OpenAI presented new results in mathematics, computer science and physics, including a claimed refutation of the Exponential Time Hypothesis, or ETH.
ETH is a long-standing conjecture in computational complexity. In simplified terms, it says that solving certain Boolean satisfiability problems, such as 3-SAT, requires exponential time in the worst case as the number of variables grows. OpenAI's manuscript on ETH describes a deterministic algorithm that would solve a broader class of these problems in subexponential time. If the result holds, it would overturn an assumption widely used in theoretical computer science.
There is an important distinction between ETH and P versus NP. ETH concerns the expected difficulty of particular computational problems. P versus NP asks whether every problem whose solution can be checked efficiently can also be solved efficiently. A subexponential algorithm would challenge ETH without establishing a polynomial-time solution to NP-complete problems. The two questions are related, but they are not interchangeable.
OpenAI's result does not show how to recover private keys or break Bitcoin's signature scheme. The manuscript still needs independent scrutiny, and the researchers invited to review it have made clear that their involvement should not be taken as certification. The proof will have to stand on its own.
The bunker-mode warning
On October 7, Ethereum Foundation researcher Justin Drake called on the crypto industry to prepare for what he described as "bunker mode". He warned that advances in AI-assisted mathematics could help researchers find ways to break elliptic-curve cryptography, potentially before quantum computers reach the required level of capability.
Drake suggested that holders move funds to fresh wallet addresses whose public keys have never been exposed. In Bitcoin, certain address formats contain a hash of the public key. The public key becomes visible when the address signs a transaction. If an attacker could derive a private key from an exposed public key, the funds associated with that key could be at risk.
The proposal is a precaution against a hypothetical future attack. Drake did not say that ECDSA, the signature algorithm used by Bitcoin and Ethereum, had already been broken. He also warned that a rushed migration could leave users exposed to mistakes, phishing and lost funds. Moving house in a hurry is stressful enough; moving an entire wallet ecosystem is another level of logistical headache.
Vitalik Buterin responded on October 7, urging users to approach mass migration carefully. He discussed the risk of people losing funds through mistakes and raised questions about lattice-based cryptography, which is widely considered as a post-quantum alternative to current public-key systems.
The exchange turned an abstract security question into a practical one. If the assumptions behind a wallet's security change, users and developers need to know which keys are exposed, which algorithms are affected and how to move funds without shooting themselves in the foot.
How worried should the industry be?
Cryptographer Matthew Green shared his assessment in posts on October 8 and October 9. He estimated a 15% chance that confidence in existing public-key encryption algorithms could be seriously undermined and a 1% chance of a world in which public-key encryption is fundamentally impossible, a scenario he called "Minicrypt".
Green described these figures as subjective estimates based on intuition, rather than probabilities produced by a formal model. They are a way to put a number on uncertainty, not a countdown to a cryptographic disaster.
The scale of the impact would depend on the discovery itself. A breakthrough against one family of algorithms would not automatically compromise every encryption system. Different cryptographic schemes rely on different mathematical assumptions, so an attack that works against one may leave another untouched.
For now, researchers are keeping a close eye on those assumptions and on the options available if they become unreliable. The debate has also brought post-quantum cryptography back into the spotlight.
What post-quantum cryptography can offer
Quantum computing has been on the industry's risk register for years. A sufficiently powerful quantum computer could use Shor's algorithm to break widely deployed RSA and elliptic-curve systems. That prospect has pushed researchers to develop post-quantum cryptography designed to withstand attacks from both classical and quantum computers.
On August 13, 2024, the US National Institute of Standards and Technology (NIST) finalised its first three post-quantum standards. ML-KEM is designed to establish shared encryption keys, while ML-DSA and SLH-DSA are digital signature algorithms. They rely on different mathematical foundations, with SLH-DSA using hash-based cryptography.
These standards give the industry a head start on the quantum threat. Their long-term reliability still depends on the mathematical assumptions behind them, which need to withstand continued scrutiny. AI-assisted research could help uncover weaknesses that have gone unnoticed.
A useful example appeared on July 28, 2026, when Anthropic announced that its Claude Mythos Preview model had identified a vulnerability in HAWK, a lattice-based digital signature algorithm under consideration for standardisation. The HAWK team subsequently withdrew the algorithm from consideration. NIST clarified that the finding did not affect its finalised standards, including ML-KEM and ML-DSA. It was a reminder that cryptographic review can turn up surprises, even in work that has already attracted serious attention.
Hash-based cryptography offers another route. Its security relies on the properties of cryptographic hash functions, giving it a different mathematical foundation from elliptic-curve and lattice-based schemes. Hash-based signatures can handle authentication and transaction signing. Other parts of digital infrastructure still need ways to establish shared encryption keys.
Secure connections between browsers and websites, for example, depend on authentication and key establishment. Public blockchains need digital signatures to authorise transactions. Replacing the cryptographic components would involve protocols, software, hardware, wallets, exchanges and the services built around them. That is a lot of moving parts, and every one of them would need to be brought into line.
A separate security problem at Binance
The Binance incident of October 29, 2026, offers another perspective on crypto security. Public information about the attack does not establish a connection to AI-assisted mathematics or a break in cryptographic algorithms.
Binance reported that approximately $6.3 billion in assets had been stolen from its hot wallets. In its initial update, the exchange said its investigation suggested the incident may have involved a compromised laptop. Binance also said it had found no evidence that wallet private keys had been leaked.
On October 31, the FBI attributed the theft to TraderTraitor, a North Korean state-sponsored hacking group. Binance began restoring withdrawals in phases on November 1, after saying it had covered approximately 95% of the stolen assets.
The incident shows how much can hinge on access permissions, compromised devices and internal systems. A secure algorithm cannot stop someone from abusing legitimate access or gaining control of an employee's machine. The hot-wallet heist is a reminder that security has several layers, and the weakest one can open the door.
The transition ahead
A practical cryptographic breakthrough would create a difficult migration problem. Blockchain networks would need to agree on new signature schemes, wallets would need to support them, and exchanges would have to move large amounts of assets without exposing users to phishing, mistakes or incompatible software. Networks with millions of existing addresses could face years of coordination work. There would be no magic switch to flip.
The internet would face a similar challenge. Public-key cryptography is built into TLS, the protocol that secures connections between websites and browsers, as well as messaging systems, VPNs, software updates and digital certificates. A serious weakness in widely used algorithms would require a coordinated response across services and devices that cannot all be upgraded overnight.
Post-quantum standards give the industry a starting point. AI-assisted mathematical research adds another reason to keep testing their foundations and to prepare for discoveries that could change the security landscape. The real test will be how quickly developers, platforms and infrastructure providers can act when a mathematical breakthrough moves from the research paper into the real world.