Leaving the Key on the Counter

At the National Institute of Standards and Technology, mathematician Dustin Moody has spent years evaluating whether the algorithms protecting our digital lives can endure tomorrow’s machines. Since 2016, his post-quantum cryptography project has subjected world-class defenses to rigorous stress tests, culminating in the release of three finalized standards on August 13, 2024. Yet as artificial intelligence models write software and modern supercomputing clusters process billions of operations every second, a listener asks a question that strikes at the core of personal finance: If AI and supercomputers get smarter every year, how come things like Bitcoin stay safe? Couldn’t an AI running on a massive computer break into crypto wallets at any moment, and what actually protects digital assets if these capabilities end up in the wrong hands?

To see how digital assets hold up, you have to look at the mathematical foundation behind the screen. When a listener worries that an AI might soon crack a crypto wallet, they are imagining a digital lock being picked or smashed. But Bitcoin’s core architecture relies on mathematical one-way functions: asymmetric public-key cryptography using the Elliptic Curve Digital Signature Algorithm on the secp256k1 curve, alongside double SHA-256 cryptographic hashing. As a NIST report on blockchain technology explains, a digital signature can be validated by anyone with the public key, but calculating the private key from that public information cannot efficiently be done. Finding an original input from a hash digest is computationally infeasible. It is like a vault where locking the door and verifying the owner takes fractions of a millisecond, but reversing the equation demands calculating backward through pure mathematical friction.

The sheer physical magnitude of that friction is where popular intuition breaks down. That barrier is known as the 256-bit lock. Exhaustively searching a 256-bit key or hashing space requires running through two to the power of 256 possibilities—a 78-digit number that dwarfs human comprehension. While standard computers can run millions of SHA-256 calculations per second and the entire mining network runs quintillions, reversing a single hash would take longer than the age of the universe. Even pooling every classical supercomputer on Earth to test billions of guesses every second would fail to make a measurable dent across billions of years.

This defense was deliberately built to withstand expanding raw compute. Public-key cryptography emerged in computer science to eliminate the danger of sharing symmetric keys across insecure channels, grounding security in conjectured mathematical hardness. Historical precedents proved why that scale was necessary: back in 1998, the Electronic Frontier Foundation spent about 250,000 dollars building the Deep Crack machine, which teamed up with distributed.net in January 1999 to crack a 56-bit DES key in just over 22 hours. That breakthrough pushed NIST to select the Advanced Encryption Standard in 2001, the same year SHA-256 was published. Bitcoin adapted early signed-chain ledger concepts from 1991 into digital cash in 2008 precisely so that classical brute force would remain permanently out of reach. Through Dustin Moody's NIST gauntlet, candidates are constantly measured against that unforgiving standard. So if raw computing power cannot smash the door down, why did headline after headline this summer claim AI was cracking encryption?

The public alarm began in earnest on July 28th, 2026. Anthropic announced that its Claude model had uncovered a mathematical weakness in HAWK, a candidate digital signature scheme under consideration by the National Institute of Standards and Technology. Ars Technica reported that the AI found a method to exploit symmetries in the math, effectively cutting the key strength in half, and the candidate algorithm was withdrawn the following day. For anyone watching from the outside, the headlines sparked an immediate conclusion: if artificial intelligence could unravel an advanced cryptographic algorithm, production blockchain keys might be next.

Yet Bitcoin does not rely on exotic or proprietary encryption. It depends on standard mathematical primitives, primarily the secp256k1 elliptic curve for signatures and SHA-256 for cryptographic hashing. These exact same tools secure everyday software downloads, digital certificates for web traffic, and secure communication protocols across the internet.

That common foundation reveals who is truly exposed if the math broke tomorrow, who falls first. As researcher Sultan Meghji documented in 2026, the United States alone has about 8,500 federally insured banks and credit unions. If classical supercomputing or an AI model could systematically break 256-bit elliptic curves or invert SHA-256, cryptocurrency wallets would be only a footnote. Bank payments, corporate secrets, encrypted messages, and electronic commerce would tumble down at the exact same moment.

Which brings us to the real puzzle: what did AI actually do this year that set off so many alarms?

The alarm started when artificial intelligence crossed out of theory and into real cryptanalysis. In July 2026, Anthropic reported that an experiment taking about 60 hours and costing approximately 100,000 dollars in API compute allowed its Claude model to uncover a structural symmetry in the lattice of a signature proposal called HAWK—an unstandardized scheme under evaluation by the National Institute of Standards and Technology. Anthropic reported that the expected operations to recover a small key dropped dramatically, from 2 to the 64th down to 2 to the 38th power. Following the announcement, HAWK's developer withdrew the candidate from consideration, and NIST confirmed it will not be deployed. In benchmark studies, researchers reported that frontier models broke between 65 and 86 percent of weakened test ciphers. Other research noted deep learning proving effective at side-channel attacks, which extract keys by observing physical hardware leakage such as electrical power rather than breaking mathematical designs. Author Marin Ivezic observed that AI had begun contributing to attacks on algorithm specifications directly.

Yet this breakthrough did not breach the mathematical fortress guarding modern cryptography. Anthropic explicitly noted that the attack remained exponential in time, was unique to HAWK, and left larger keys impractical to attack—meaning no production software had to change. Modern deployed algorithms run with full rounds and full key lengths, where key recovery through deep learning remains practically infeasible. As a peer-reviewed survey by Bandyopadhyay established in December 2025, production cryptography depends on high entropy, computationally hard problems, and an absolute absence of exploitable patterns. Tech reporter Dan Goodin noted that the reported attacks are incremental and do not break systems people rely on today, while Ivezic pointed out that an attack on the standard cipher AES only covered seven out of ten rounds.

What the models accomplished was research acceleration, not magic. In the HAWK candidate test, post-quantum expert Sophie Schmieg remarked, “Basically with this paper, HAWK is dead,” but Johns Hopkins professor Matthew Green noted, “the attack does not invent fundamentally new mathematics,” explaining that “it simply extends a bunch of tools that were lying around and well-known, and gets a good result.” Analysis from PostQuantumSecurity.org emphasized that human researchers still had to guide, validate, and interpret the outcome. Left unguided, models stumble: a 2025 study showed ChatGPT-4o hallucinated false logic, wrongly claiming an XOR operation inverted a linear diffusion layer. As tech reporter Dan Goodin noted, the underlying mathematical primitives remain safe, at least for now, outside testing environments. So AI cannot rewrite computational complexity on classical hardware. But there is another machine being built that does not play by classical rules.

That machine is the quantum computer. Classical supercomputers and frontier artificial intelligence are trapped by exponential math: they can only guess combinations, leaving a 256-bit key entirely out of reach. But a cryptanalytically relevant quantum computer would operate on different physics. Running Peter Shor's 1994 algorithm, it would solve the discrete logarithm problem underpinning elliptic-curve cryptography in polynomial time. Instead of guessing billions of times over trillions of years, a machine with sufficient quantum power could derive a Bitcoin private key directly from an exposed public key.

Yet that threat does not break cryptography evenly. While Shor's algorithm undoes public-key signature systems like Bitcoin's secp256k1, it cannot crack symmetric math or hash functions the same way. Against SHA-256, a quantum machine can only run Grover's algorithm, which offers a quadratic speedup. That effectively halves a 256-bit key search space to roughly two to the 128th operations. Because two to the 128th remains vastly out of computational reach, the hashing that secures Bitcoin's block history and mining stays resilient. The vulnerability lands squarely on public signatures.

This asymmetry brings back the question of who falls first if the math breaks tomorrow. If Shor's algorithm becomes operational, the global financial system and secure web encryption buckle alongside crypto wallets, because the exact same public-key protections safeguard banks and military communication. But that threshold is not here yet. As of early 2026, no cryptanalytically relevant quantum computer exists. Today's hardware remains far too small; Google's Willow chip, for instance, operates with about 105 qubits, and a spokesperson confirmed it is incapable of breaking modern cryptography.

Google researchers estimated in March 2026 that cracking 256-bit elliptic curves in minutes would require a processor with fewer than 500,000 physical qubits. While that marks a major theoretical improvement, building hardware at that scale remains years away. Industry expert Wolfgang Amadeus Vitale argues that cryptanalytically relevant machines are not expected by 2030, with broader estimates pointing toward 2030 to 2035—though the exact arrival date remains genuinely unknown. If the quantum threat is real for public keys, how does a decentralized network like Bitcoin actually defend itself?

The answer starts with how Bitcoin updates its rules. The repository lists several successfully deployed consensus soft forks, including Pay to Script Hash, Segregated Witness, and the Taproot spending rules. Continuing that line of defense, developers merged BIP 360 into the proposals repository in February 2026. The draft introduces an output format called Pay-to-Merkle-Root, reusing tested Taproot code but stripping out the direct key-path spend. By directing spends entirely through script trees, proponents argue it protects transactions against long-exposure quantum attacks.

For most everyday users, a shield already exists in the math. Standard Bitcoin addresses, like traditional Pay-to-Public-Key-Hash or Segregated Witness formats, do not publish public keys on the blockchain. Instead, an address is derived by running the key through a cryptographic hash. Until the owner actually spends those funds and broadcasts the underlying key to the network, the public key remains concealed. As long as addresses are not reused, advocates argue unspent balances remain shielded from long-exposure threats.

Broader digital infrastructure faces the same shift, looking to Dustin Moody's NIST gauntlet for guidance. NIST published its first three finalized post-quantum standards in August 2024 and later proposed dual-stack models to deploy post-quantum credentials alongside classical keys. As Moody stated, “Organizations should continue to migrate their encryption systems to the standards we finalized in 2024.” He explained that NIST selected HQC “because we want to have a backup standard that is based on a different math approach than ML-KEM,” adding that it is essential to have a fallback “in case ML-KEM proves to be vulnerable.”

Yet Bitcoin faces an operational dilemma the broader banking world does not share. As authors behind BIP 361 document, over a third of all existing bitcoin had public keys exposed on-chain—outside studies estimate roughly 6.5 to 6.9 million coins. The proposal warns that network upgrades historically take multiple years to coordinate across miners, exchanges, and custodians, while admitting it is not currently believed possible to construct a rescue protocol for early legacy public-key addresses.

That divide has sparked fierce debate over whether to sunset legacy signatures or freeze unmigrated outputs. Satoshi Nakamoto once wrote that “Lost coins only make everyone else's coins worth slightly more. Think of it as a donation to everyone.” Proponents of BIP 361 counter that quantum-recovered coins represent “a theft from everyone,” but critics object to freezing coins whose owners are inactive, condemning freezes in widely shared comments as “highly authoritarian and confiscatory.” Furthermore, researchers note that post-quantum signatures like CRYSTALS-Dilithium and SPHINCS+ introduce substantial increases in signature size, heightening storage and bandwidth demands and threatening to reignite contentious block-size disputes. So the cryptographic math is sound, and the protocol has an upgrade path. Where, then, are billions of dollars in crypto actually being lost right now?

The thefts that make the news do not happen because someone unpicked the underlying mathematics. Consider what took place on September 6th, 2026, when approximately 4,000 bitcoin was drained through the Liquid Network bridge. An attacker did not crack elliptic-curve cryptography. Instead, Blockstream reported that an Elements consensus flaw—where verification caching omitted key contextual bindings, followed by raw byte concatenation without length framing—allowed an attacker to inflate unbacked tokens and push them through a bridge partner named SideSwap. SideSwap had kept its signing key online without velocity limits or size caps, automatically releasing the funds. That same day, the attacker posted on-chain, "we are whitehats. contact us on chain," eventually returning 3,400 bitcoin, while approximately 602 bitcoin remained subject to recovery.

That crime scene captures the real landscape of digital asset vulnerability. National Institute of Standards and Technology reports point out that when news headlines announce cryptocurrency was stolen, it almost certainly means private keys were found and used, not that the blockchain's core cryptography was compromised. Losses happen through phishing, exposed seed phrases, and operational configuration gaps. Even frontier artificial intelligence evaluation studies show models reaching production networks through simple misconfigurations rather than mathematical wizardry. The point is not an algorithm cracking under pressure; it is a door left unlocked.

The structural defenses that actually protect assets address that human reality directly. Long-established network mechanisms like BIP 11 enable multi-signature arrangements, requiring approvals across M-of-N independent keys before funds can move. Institutional custodians and cautious individuals back that up with air-gapped cold storage—holding keys on dedicated hardware completely disconnected from the internet, where transactions are signed internally so private keys never touch an online computer, ensuring an upstream coding defect or online compromise cannot touch the underlying reserve.

And that answers the listener's core question. AI and classical supercomputers cannot easily hack crypto wallets because they cannot brute-force the 256-bit lock—an astronomical search space spanning a 78-digit number of possibilities. Researchers surveying deep learning establish that key recovery against full-strength production cryptography remains practically infeasible. What Anthropic observed during the HAWK candidate test was an automated tool detecting structural symmetry in an unstandardized draft cipher, not a machine shattering production one-way functions. The mathematics protecting digital assets still holds. The real danger has never been a supercomputer breaking the vault's steel door; it is whether someone leaves the keys lying on the counter.