What if the machine that cracks the encryption isn't a quantum computer at all, but the large language model humming in an office in San Francisco?
That is the question Anthropic's undisclosed cryptographic discovery has quietly dropped into a market that has already grown bored of quantum doomsday headlines. The reflexive response โ a shrug from the futures curve, a brief flicker in quantum-resistant L1 tokens, a handful of tweet-threads explaining why Shor's algorithm needs millions of stable qubits โ tells you the market believes it has seen this movie. Google's Willow chip shaved roughly two to four percent off Bitcoin for a few days in December 2024. Microsoft's Majorana 1 repeated the trick in January 2025. The pattern ossified into script: quantum headline, dip, recovery within seventy-two hours, immunity compounds with each cycle.
But Anthropic's finding is not a chip. It is not a hardware milestone that can be dismissed with a skeptical footnote about error-correction thresholds. It is a claim about the mathematics underneath the next decade of cryptographic migration strategy. And, crucially, it has not been disclosed. Not the algorithm. Not the attack surface. Not the confidence interval. Nothing but a whisper that an AI safety lab โ one with a serious reputation for hiring people who break things for a living โ has found something in the encryption space that worried it enough to talk.
That combination is rare and dangerous. A high-trust AI lab, an undefined cryptographic finding, and a blockchain ecosystem mid-deliberation over its own post-quantum future. It isn't a fact. It's a narrative vacuum. And in eighteen years of watching this industry, I have learned that vacuums absorb the nearest available fear. Chasing the ghost of value in a decentralized void, I have learned to distinguish noise from signal โ and the single most important signal in the last year is not that AI might break encryption. It's that we might be asking the wrong question entirely.
Let me reconstruct the cryptographic status quo from first principles, because precision matters when the surrounding discourse is mud.
Bitcoin's security today rests on the elliptic curve digital signature algorithm (ECDSA) and Schnorr signatures, both instantiated over the secp256k1 curve. The mathematical foundation is the elliptic curve discrete logarithm problem (ECDLP): given a public key โ a point on the curve โ recover the private scalar. For a properly implemented system, classical computers require exponential time. This assumption is so fundamental that the entire settlement layer of the digital asset economy is built on it. Every multisig treasury, every Lightning channel, every wrapped Bitcoin token, every inscription that someone is treating as digital property โ all of it collapses to a single number-theoretic bet.
Quantum computing menaces this bet through Shor's algorithm, which solves the discrete logarithm problem in polynomial time. If a sufficiently powerful, fault-tolerant quantum computer existed, it could derive private keys from public keys. The nuance that gets lost in most coverage: Bitcoin public keys are only exposed at the moment of a transaction. Unspent outputs are typically stored in hashed form โ P2PKH addresses hash the public key, P2WPKH and P2TR do the same. This is a structural mitigation. An attacker must harvest exposed public keys โ from spent outputs, from reused addresses, from a P2PK coin that predates the hashed era โ and solve the discrete log before the funds move. The standard mitigation advice, "move your coins before they're re-spent with exposed keys," exists precisely because the window of vulnerability for dormant addresses is structurally different from active ones. The oldest, richest, most forgetful addresses are the most exposed. This detail, as I will show, becomes the corner piece of the migration puzzle.
The industry's answer is post-quantum cryptography (PQC). After years of international competition, NIST standardized a suite in 2024: ML-KEM (originally CRYSTALS-Kyber) for key encapsulation, ML-DSA (CRYSTALS-Dilithium) for general signatures, and SLH-DSA (SPHINCS+) as a hash-based conservative backstop. These schemes rest on fundamentally different hard problems โ learning with errors (LWE) in structured lattices for Dilithium, and only the security of cryptographic hash functions for SPHINCS+.
This distinction already contains the seed of the debate. Lattice-based signatures are compact and efficient: ML-DSA signatures run around 2.4 kilobytes. But lattices are a younger, more complex mathematical structure, and the history of cryptography is a graveyard of "hard problems" that turned out to be easier to attack than their creators hoped. Hash-based signatures are the opposite: conservative, almost embarrassingly simple, mathematically reducible to one of the most battle-tested primitives in the field. Their Achilles' heel is size. SPHINCS+ signatures are enormous, roughly 17 kilobytes versus ECDSA's 72 bytes. That is two orders of magnitude of block-space cost, not a line-item expense but a throughput tax that would rewrite Bitcoin's entire fee economy.
And there is a third family worth naming, because it is the one actually proposed for Bitcoin in early discussions: Lamport signatures, a 1979 construction that signs a message by revealing preimages of a one-way function. The Bitcoin Improvement Proposal BIP-360, introduced years ago, explores exactly this route. Lamport signatures are simple and hash-based, but they are stateful and size-expensive, and the proposal languished โ not because it was cryptographically weak, but because the ecosystem's attention was elsewhere. The PQC migration conversation on Bitcoin core has always been a whispers-in-the-hallway affair, not a committee with a deadline. That culture of deliberation is both a strength and a structural vulnerability, and I will return to it.
The classical precedent for PQC failure exists. In 2022, during NIST's standardization process, researcher Ward Beullens broke Rainbow โ a multivariate-quadratic signature scheme โ using a classical laptop attack that had evaded the community for years. Rainbow had been a finalist. It had survived multiple rounds of cryptanalysis. And it cracked like a cheap vault under a single clever algebraic observation. If you want a proof that "standardization in progress" is not the same as "safe," Rainbow is the exhibit.
Now layer on the market's historical behavior. In December 2024, Google's Willow chip triggered a brief Bitcoin drawdown of two to four percent, which reversed within days. Microsoft's Majorana 1 in January 2025 produced the same shape โ FUD, a flinch, a shrug. The market's pricing reflects experience: quantum threat discourse is roughly five to ten percent "digested" into Bitcoin's risk premium, and each new headline adds less. The AI-threatens-PQC narrative, by contrast, is presumably priced at well under five percent โ not because it's implausible, but because it's both new and entirely evidenceless. An unpriced narrative is an opportunity, but it is also a risk, and the direction of that risk depends on details nobody has yet supplied.
That is the landscape. That is the baseline. Now let me take you into the analysis, because the question "can AI beat quantum to the punch?" decomposes into three very different questions, and only one of them is genuinely terrifying.
The first thing to understand is the category error embedded in the question itself.
Quantum attacks and AI-assisted cryptanalysis are not the same species of threat, and conflating them produces misleading conclusions. Shor's algorithm is a complexity-class revolution: it takes a problem believed to require exponential time โ discrete logarithm โ and cracks it in polynomial time. That is not a better search heuristic. It is a fundamental restructuring of the mathematical cost function. A toothbrush that could also drive a car would be closer to the relationship between a quantum algorithm and a classical one than anything AI has demonstrated.
Artificial intelligence, by contrast, is a search and optimization tool. Machine learning models, including the transformer architectures behind Anthropic's own products, are extraordinarily good at finding patterns in high-dimensional data, at heuristic search, at parameter selection, at interpolating between known solutions. They have not, to date, changed the complexity classification of a single important cryptographic problem. No one has demonstrated that a neural network can solve lattice problems โ learning with errors, shortest vector, closest vector โ faster than the best classical algorithms, let alone in polynomial time.
This doesn't make the AI threat vacuous. It just means the threat lives in a different layer of the stack. Let me be precise about the three ways AI could actually threaten PQC, with honest confidence estimates grounded in what the literature currently supports.
Path one: AI accelerates existing cryptanalysis. Confidence: medium. This is real, incremental, and already happening.
The dominant classical attacks on lattice-based cryptography โ the BKZ lattice reduction algorithm and its variants โ are computationally intractable in the worst case, but their practical performance depends on a cascade of heuristic choices: block size, enumeration strategies, pruning parameters, sieve selection. This is precisely the kind of high-dimensional, poorly-understood optimization landscape where machine learning excels. There is published research showing neural networks can improve the selection of lattice reduction parameters, can guide enumeration, can learn to choose better bases. The effect is not a complexity breakthrough; it's a constant-factor improvement. But in cryptography, constant factors define security margins. A scheme with a 128-bit security claim that is actually 110 bits because an AI learned to cut the search space by a factor of a hundred thousand is a scheme with a problem.
The near-term consequence is not that ML-DSA or SPHINCS+ "breaks." It's that the confidence interval around security margins narrows, and the cryptanalytic community โ chronically underfunded, perpetually slower than the deployment cycle โ has even less time to react. If AI becomes a standard cryptanalytic accelerant, the burden shifts from "prove this is hard" to "prove this is hard knowing that everyone in the room has a tireless pattern-recognition engine." That shifts the economics of research in ways that favor attackers, because attackers only need one successful discovery, while defenders must maintain the security claim indefinitely.
Path two: AI discovers new structural weaknesses. Confidence: low. This is the endgame scenario, and it is both overhyped and underprepared-for.
The deepest fear is that a large language model, trained on the entire corpus of mathematical literature, reaches a novel result โ a new algebraic relation in lattice problems, a new distinguisher, a new attack on a hash function โ that human cryptanalysts missed. There is a reason this is both the most discussed and least likely path: mathematics at the research frontier is not a pattern-completion task. Proving a new cryptanalytic result requires constructing a proof skeleton, verifying it, and understanding why the structural property exists. Current models are brilliant at imitating the shape of a proof and unreliable at producing a valid one.
But I want to be careful here, because my own history teaches me the dangers of dismissing the implausible. In 2017, while working as a quantitative analyst in Zurich, I published a fifteen-page technical takedown of a ZK-Snarks privacy project called Parallax Coin. The whitepaper's anonymity guarantees were, I argued, compromised by transaction graph analysis โ the primitive was sound, but the composition leaked. The team's response was to invite me to their advisory board. The lesson that stuck was methodological: the catastrophic failure mode in cryptography usually isn't a direct break of a primitive. It's an indirect leak through composition, through edge cases, through the space between assumptions. If AI ever "breaks" PQC, I suspect it will be through a similar mechanism: not a direct algebraic annihilation, but a discovery that some practical instantiation โ a parameter set, a padding scheme, a hybrid protocol โ violates the clean mathematical model. That is a discovery a pattern-recognition model could plausibly reach: not by proving things, but by noticing that the distribution of outputs from a real implementation differs from theory in a statistically significant way. The statistical anomaly becomes the thread that human cryptanalysts pull.
Path three: AI attacks the implementation layer. Confidence: medium-to-high. This is the most probable, most immediate, and most ignored threat.
Here the landscape inverts. Breaking lattice math end-to-end is hard. Finding vulnerabilities in code is something AI is demonstrably becoming excellent at. Anthropic's own research has shown large language models capable of discovering and exploiting real-world software vulnerabilities when given the right scaffolding. The cryptographic supply chain โ hardware wallets, signing servers, node software, wallet libraries, smart contract bridges, oracle networks โ is an enormous corpus of complex, imperfectly-reviewed code. An AI that can read millions of lines of Rust and C, identify a subtle fault in a random-number generator, a nonce reuse bug, a side-channel leak, or a key-handling edge case, and then autonomously exploit it โ that is not a speculative 2035 scenario. The primitive components exist today. The history of Bitcoin's own implementation failures โ including the 2013 Android entropy disaster that drained wallets through weak random number generation โ proves that the implementation layer, not the mathematics, is where the blood actually pools.
This reframes the entire threat model. When the article asks whether AI might threaten PQC "before quantum computers can attack current Bitcoin signatures," it implicitly assumes the AI attacks the mathematical layer. But an AI that compromises a hardware wallet's firmware or a popular library's derivation logic attacks the same end result โ loss of funds, compromise of keys โ with far less exotic machinery. The crypto industry's obsession with the quantum apocalypse has always had a quality of looking at the horizon while ignoring the pickpocket in the room.
The Rainbow lesson and the evidence asymmetry.
The 2022 Rainbow break deserves more attention in this discourse than it receives. Rainbow was a finalist in NIST's PQC process. It had been publicly analyzed for years. And it was broken by a single classical paper โ no AI, no quantum โ that found a mathematical weakness in the underlying oil-and-vinegar structure. The scheme collapsed entirely; its security claim evaporated overnight.
Rainbow is a double-edged precedent. For the AI-breaks-PQC thesis, it demonstrates that PQC schemes are not immune to sudden, catastrophic, previously-undiscovered weakness โ and that the margin between "survived several rounds of scrutiny" and "utterly broken" can be razor-thin. For the anti-AI thesis, it demonstrates that dramatic cryptanalytic failures can happen with purely classical reasoning โ which means we don't need AI to fear the migration; we already have evidence that young cryptographic constructions are fragile. The relevant question is not only "will AI discover weaknesses faster?" but "are we comfortable betting the settlement layer on schemes with a fraction of the battle-testing that ECDSA has enjoyed?"
ECDSA/secp256k1 has survived roughly three decades of cryptanalytic assault, with a few famous implementation failures but zero breaks of the mathematical foundation. The PQC candidates have existed in their current standardized forms for, at most, a few years. The empirical base rates say: the older cryptosystem is the safer one. That is the uncomfortable, under-discussed truth of the entire migration debate. We are proposing to move from a well-understood risk to a less-understood one, because the well-understood risk has a known future attack โ quantum โ while the less-understood one has an unknown present.
The migration math nobody wants to do.
Assume, hypothetically, that Bitcoin decides to migrate to PQC signatures tomorrow. Not in five years. Tomorrow. The first blocker is pure arithmetic. A SPHINCS+ signature is on the order of 17 kilobytes. Current Bitcoin blocks are capped at four million weight units โ roughly four megabytes effectively. At 17 kilobytes per signature, a fully-loaded block carries about 235 transactions. That is a throughput collapse of roughly two orders of magnitude compared to today's typical block usage. Suddenly, a network that struggles at seven transactions per second drops to fractions of a transaction per second. Fees explode. The fee market enters a domain where the competing claims are no longer about DeFi composability; they are about basic UTXO movement. The Lightning Network, which depends on cheap on-chain settlement, would see its economic model twisted by an order-of-magnitude increase in the cost of opening and closing channels.
The lattice-based alternative โ ML-DSA at roughly 2.4 kilobytes per signature โ is feasible from a size perspective, but it carries the younger-mathematics risk profile discussed above. And this is the trap: the compact scheme is the one whose math AI is most plausibly able to accelerate cryptanalysis against, while the conservative scheme is the one that breaks Bitcoin's economic model. There is no free lunch. There is no parameter set that is simultaneously conservative and compact. Any migration path is a bet on either mathematical youth or economic absurdity.
Then there is the dead-coin problem, and this is where my tokenomics background kicks in. Estimates of permanently lost Bitcoin vary, but a frequently-cited figure hovers around fifteen to twenty percent of the twenty-one million supply โ call it three million coins in wallets whose keys are lost, or in inaccessible early-era formats. A PQC migration that requires key rotation from old addresses to new signature schemes would, by definition, strand every coin whose owner cannot participate. Even at a conservative ten percent, that's roughly 2.1 million Bitcoin permanently locked โ a deflationary supply shock of a magnitude the market has never priced. The "hard cap of 21 million" becomes, in practice, a cap of maybe 19 million or less, depending on migration participation. That is a profound, unquantified, and completely un-discussed structural change. Bitcoin's monetary narrative โ the precise, unforgeable scarcity that anchors its entire value proposition โ would be silently amended by logistics rather than by consensus.
And the migration doesn't eliminate the legacy attack surface. It creates a transition window โ likely lasting years โ during which old-format addresses remain spendable alongside new ones. An attacker doesn't need to break the PQC scheme. They need to compromise the weakest link in the transition period: an old ECDSA address with an exposed public key, holding a large balance, left behind by an owner who "didn't get around to migrating." The most valuable honeypots in the system will be the last, the richest, the most forgotten addresses. This is not a theory; it is the precise mechanism by which every migration in cryptographic history has failed. The 2017 Parallax Coin case I analyzed was exactly this shape: a sound primitive with a leaky composition path.
The coordination bottleneck: miners, pools, and the ghost of decentralization.
Let me add a dimension most commentary ignores โ the political economy of the migration decision. Bitcoin's upgrade path requires coordination across a remarkably distributed network. But the fourth halving in 2024 compressed miner revenue, and hash power has been consolidating. Realistically, the overwhelming majority of Bitcoin's hash rate is controlled by a handful of industrial pools; if you look at the distribution, three to five entities effectively determine whether an upgrade activates. The decentralization narrative โ the philosophical core of the entire project โ increasingly oscillates between a meaningful social reality and a convenient myth. When the PQC migration arrives, the decision will be made by a very small number of very large mining pools, a handful of exchanges, and a core development process with its own politics and its own glacial pace.
This is an unpriced risk. Markets price the exotic threat โ AI breaks lattice math โ as a speculative tail. They do not price the coordination failure: a migration that fragments the chain, strands a percentage of supply, creates legacy-address honeypots, and rearranges the power structure of the Bitcoin ecosystem all at once. A botched migration, in other words, is more dangerous than a successful cryptanalytic break of a PQC scheme, because a successful break might be patched, while a botched social migration is irreparable. The chain would carry the scar in its supply history forever.
From my position in the market, I can give you a rough pricing map. Quantum threat to current ECDSA: five to ten percent digested. Every Willow or Majorana headline adds a couple of points of temporary volatility, and the market reverts. AI threat to PQC: under five percent priced โ and that's generous; I suspect it's closer to two. Migration coordination risk: essentially zero percent priced. The dead-coin supply shock: zero percent priced. The throughput tax: zero percent priced. Asymmetric pricing is where narratives are born. The market is paying attention to the wrong tail.
Here is the contrarian position, and I want to state it with the precision it deserves: the real danger of the Anthropic narrative is not that AI breaks post-quantum cryptography. It is that the fear of that scenario distracts us from the attacks that are already live, and simultaneously accelerates a migration that is itself the catastrophic event.
Consider the incentive structure of the announcement itself. Anthropic is not a neutral observer. It is an AI safety company, with an institutional interest in demonstrating the power โ and danger โ of frontier models to regulators, investors, and the public. A cryptographic discovery that "raises questions" is, in policy terms, a gift: it justifies compute oversight, model evaluation requirements, and the broader regulatory agenda that AI labs have been lobbying for. I am not accusing anyone of fabrication. I am noting that the timing, the opacity, and the framing of the disclosure are all consistent with a political project as much as a technical one. The most powerful unanswered question in this story is not "what did Anthropic find?" but "why did Anthropic announce it, now, in this form?"
I learned this reflex the hard way. In 2022, after Terra/LUNA's collapse, I led a three-person audit team through the algorithmic stablecoin's peg mechanism. The death spiral was visible in the design โ seigniorage shares, unbacked by any external reserve, guaranteed a run under the right conditions. But the interesting part wasn't the math. It was watching the ecosystem's reaction: a market that had priced terraUSD as a "risk-free yield monster" suddenly discovering that the base rate was a fiction. The lesson I carried forward: narratives are priced before mechanisms are understood. The absence of a disclosed mechanism in the Anthropic case makes the narrative all the more powerful, and all the more dangerous, because it can be filled with any projected fear. Just last year, while developing my "Verifiable Compute" framework with two leading AI labs, I saw the same dynamic repeat inside the AI industry itself โ a whisper of capability, a conference keynote, a regulatory meeting, all before any peer review.
Here's the uncomfortable inversion: the more credible the AI-threat-to-PQC narrative becomes, the more pressure builds on Bitcoin to migrate fast. And a fast migration is the worst possible outcome. It guarantees the transition window honeypots, guarantees the dead-coin supply shock, guarantees the throughput collapse, and guarantees a coordination catastrophe executed in haste. The rational response to a potential AI threat is the opposite of the emotional one: slow down, demand disclosure, demand peer review, demand evidence โ because the migration itself is a one-way door. Even the NIST process, which is comparatively quick, took years and still produced Rainbow.
There is also a deeper epistemological error embedded in the original framing. The question "can AI beat quantum?" treats AI and quantum as competing clocks. But they are not competing clocks; they are different kinds of interventions. Quantum computation threatens a specific, known algorithm on a specific, known assumption. AI threatens an emergent, uncharacterized, open-ended process of discovery across every layer of the stack โ including the code that implements the migration, the wallets that hold the keys, and the exchange infrastructure that facilitates the transition. The AI threat doesn't replace the quantum threat. It brackets it. Quantum threatens the math. AI threatens the entire human-and-code system that surrounds the math. And the system is where this industry's actual catastrophes have always happened.
The industry's instinct when confronted with "AI might break PQC" will be to build more PQC โ bigger forests, stronger walls. I think the data suggests something different. The attack surface that AI already demonstrably improves is the implementation surface: vulnerability discovery at scale. A ten million dollar investment in AI-assisted auditing of the Bitcoin codebase, of hardware wallet firmware, of Lightning implementations, is worth more to the network today than a decade of speculative lattice conferences. The enemy is not quantum. The enemy is not, yet, AI breaking mathematics. The enemy is the distribution of intelligence across the threat surface โ and the defenders are losing the asymmetry game.
So where does this leave us? Let me be direct about what I believe the market is mispricing. The market has priced quantum FUD โ it's a known script with a known recovery. The market has not priced the migration itself. It has not priced the dead coins, the throughput tax, the transition honeypots, or the coordination fragility of a fork decided by three mining pools. And it has not priced the possibility that the AI-PQC narrative is a policy instrument before it is a technical finding. In the taxonomy of risks facing Bitcoin, the order of expected damage is not what the headlines suggest. It is, from most to least likely: implementation-layer AI attacks on existing code; coordination failure during a rushed migration; latent math fragility in young PQC schemes (regardless of AI); and only then, the exotic endgame of an AI discovering genuinely new cryptanalysis.
This doesn't make the Anthropic discovery boring. It makes it urgent in a different register. The question we should be asking โ the one that the entire industry should be demanding โ is not "can AI beat quantum?" It is "what exactly did Anthropic find?" Peer review and disclosure are the vaccines against narrative vacuums. Until we have the technical content, the rational posture is skepticism, not fear; and the rational action is not to accelerate migration, but to harden the implementation layer we can already improve.
The next narrative cycle, I suspect, will move from "quantum FUD" to "AI-PQC dread" to "migration readiness." That last one โ the actual state of wallet infrastructure, exchange support for PQC, BIP momentum, the feasibility of hybrid signatures โ is where the real information will be. Chasing the ghost of value in a decentralized void, I have learned that the value was never the algorithm. It was the adaptive capacity of the human systems around it.
The ghost doesn't die. It migrates. The only question is whether Bitcoin's social layer migrates faster than the threat model does. I'd bet on neither, and that's the trade.
