Bitcoin's Exposed-Key Number Ranges From 1.9M to 7.1M BTC, and Drake's Bunker Mode Depends on Which One You Read
Ethereum Foundation researcher Justin Drake is asking the industry to prepare a mass move to fresh addresses in case AI breaks ECDSA. Most cryptographers call the threat unproven, and the "how much is exposed" number depends almost entirely on whether you count address reuse.
Seven million bitcoin at risk is the figure doing the rounds since October 7, 2026. That number is real, but it is the top of a range, and the bottom of that range is under two million. The difference matters more than the headline, because one part of the exposure can be fixed by the owner tomorrow and the other part can't.
What Drake actually said
The trigger was OpenAI's October 6 research catalog, 372 result families across 719 manuscripts [2], which Drake read as "mathematical superintelligence is upon us" [1]. The catalog itself warns that some unformalized results "could have issues" [2].
The line that got quoted least: "Don't rush… a rushed migration would do more harm than good. Don't panic either" [1].
The pushback
Yehuda Lindell (Coinbase) said there is "no evidence whatsoever pointing to a break of decades old hardness assumptions like elliptic curve cryptography" and called the warning "the very definition of FUD" in a thread on X [5]. Ledger CTO Charles Guillemet pointed out that if ECDSA fell, "Bitcoin will be the least of our problems" [6]. Rob Hamilton of AnchorWatch walked through five open research directions on secp256k1, from Semaev summation polynomials to lifting attacks, and concluded none gives a practical shortcut today; generic attacks remain around 2^128 operations [7].
On the other side, Scott Aaronson wrote on October 7 that, per unnamed sources, AI companies have "gingerly and discreetly" started testing whether internal models can break cryptographic primitives [3]. No lab, model or broken scheme is named.
In Spanish-language coverage, Alberto Mera of Un Podcast Sobre Bitcoin framed it neatly: quantum computing has the recipe (Shor's algorithm) but no kitchen to cook it in; AI has the kitchen but nobody has handed it a recipe [14].
Why the exposed-supply estimates disagree
| Source | Exposed BTC | What is counted |
|---|---|---|
| ChainQuery [8] | 7,105,243 (35.4%) | Any coin whose public key is visible, by any route |
| Project Eleven [9] | ~6.9M | Its public Risq List |
| Glassnode [10] | 6.04M (30.2%) | 1.92M structural + 4.12M operational (reuse) |
| bykaranteli [11] | 1,932,243 (9.61%) | Script type only (P2PK, bare multisig, Taproot), block 971,341 |
Two independent counts land on roughly 1.9M for structural exposure: outputs that reveal the key by design, such as early P2PK coins, bare multisig and Taproot outputs [10] [11]. Drake even says wallets under 50 BTC enjoy "partial cover" from "Satoshi's shield", the ~20K exposed 50-BTC addresses he attributes to Satoshi [1].
Everything above that is operational: ordinary addresses that have already spent and still hold a balance. Glassnode attributes 1.63M to 1.66M BTC of exposure to exchanges alone [10]. This is the part bunker mode actually targets, and it is mostly a custodian problem. A user who never reuses addresses and doesn't hold coins in Taproot outputs already keeps every public key hidden.
What Bitcoin has on the table, and how slow it is
Neither proposal is active, and we covered the background in Bitcoin's quantum problem and BIP-360.
BIP-360 (P2MR), by Hunter Beast, Ethan Heilman and Isabel Foxen Duke, is Taproot minus the key-path spend [12]. It defends against long-exposure attacks on keys left visible over time. It does not cover short-exposure attacks on keys revealed in the mempool; that needs post-quantum signatures, left to a future proposal [12]. Status: Draft.
BIP-361, by Jameson Lopp and five co-authors, is Informational and requires a post-quantum signature BIP that doesn't exist yet [13]. Phase A, about 160,000 blocks (~3 years) after activation, bans sending to quantum-vulnerable addresses. Phase B, two years later, only allows ECDSA/Schnorr spends through a rescue protocol, such as proving knowledge of a BIP-32 seed. No rescue is known for P2PK. The authors write that if rescues cover most of the supply, the sunset would be "at most mildly confiscatory" [13]. Everything hangs on that "if".
So Drake's worst case is months. Bitcoin's most aggressive plan is roughly five years from an activation that has no date. That pace is deliberate, as anyone who followed BIP-110 will recognize.
The catch in the cure
Vitalik Buterin raised the point that undercuts any rush to swap schemes: if AI finds "skeletons in the closet" in elliptic curves, the same could happen with lattices, the basis of ML-DSA and most post-quantum signatures [4]. He also said he does not recommend anyone scramble to move funds today, and that he has "lost more money in botched migrations than I have lost in all hacks combined" [4].
What to do this week
Not much, and nothing hurried. Don't reuse addresses; your wallet already hands you a fresh one per receive. If an address you've spent from still holds coins, sweeping them to a new address in your own wallet is routine, so do it when you have time, with a test transaction if it's new to you. The concrete, present-day risk is a sloppy migration, not ECDSA. None of this is investment advice.
Block height, network status and any consensus changes as they arrive are live on the Network page. If either BIP moves, it will show up there before it shows up in headlines.
Sources
Labelled by type.
- Justin Drake (@drakefjustin), post on X, Oct 7, 2026. Bunker-mode, "months not years" and "don't rush" quotes. (Primary, author's statement)
- OpenAI, Research Catalog overview, Oct 6, 2026. 372 result families in 719 manuscripts; "could have issues" caveat. (Primary, official document)
- Scott Aaronson, The Mathocalypse, Oct 7, 2026, post update; anonymous sources. (Primary, expert opinion)
- ForkLog, Justin Drake says AI could break ECDSA before quantum computers, Oct 8, 2026; Vitalik Buterin quotes. (Secondary, press)
- Yehuda Lindell (@LindellYehuda), thread on X, Oct 8, 2026; closing post quoted by Gizmodo, Cryptographers Urgently Debating Whether AI Could Break Bitcoin's Security 'in Months', Oct 8, 2026. "No evidence whatsoever" and "very definition of FUD" quotes. (Primary, author's statement; Secondary, press)
- cvj.ai, Ledger CTO debunks AI threat to Bitcoin's ECDSA cryptography, Oct 9, 2026. (Secondary, press)
- The Crypto Times, Bitcoin's secp256k1: developer details open classical attack research directions, Oct 12, 2026; summary of Rob Hamilton's thread. (Secondary, press)
- ChainQuery, Quantum exposure report, methodology v1.2, 2026. 7,105,243 BTC exposed (35.4%). (Primary, data provider)
- CoinDesk, Researcher wins 1 bitcoin bounty…, Apr 24, 2026; Project Eleven figure. (Secondary, press)
- Glassnode, Measuring Bitcoin's quantum-exposed supply, 2026. 6.04M BTC exposed (30.2%), structural/operational split and exchange exposure. (Primary, data provider)
- bykaranteli, Quantum, 2026; own-node measurement at block 971,341. (Primary, independent analysis)
- BIP-360: Pay to Merkle Root (P2MR), BIP repository, Draft. P2MR design and long- vs short-exposure scope. (Primary, technical specification)
- BIP-361: Post Quantum Migration and Legacy Signature Sunset, BIP repository, Draft, Informational. Phases A and B, timelines, rescue protocols and the "mildly confiscatory" line. (Primary, technical specification)
- Alberto Mera, Un Podcast Sobre Bitcoin, ¿Existe la fórmula que ROMPE BITCOIN?, YouTube, October 2026 (in Spanish). (Secondary, explainer)
This article contains no NodeWitness measurement: every exposed-supply figure comes from the sources above.
More in Network and mining
Last updated: October 14, 2026