The Week in One Sentence
An Ethereum researcher told crypto to prepare for "bunker mode," cryptographers called it FUD, and Bitcoin slid toward $80,000 as bond yields hit a multi-decade high.
1. Bunker Mode, and the Case Against Panic
On Wednesday, Ethereum Foundation researcher Justin Drake posted a warning on X that spread fast. Artificial intelligence, he argued, could help someone break ECDSA, the signature scheme that protects most Bitcoin and Ethereum wallets, before quantum computers ever get the chance. "IMO it is now reasonable to brace for the possibility that ECDSA breaks before qday, in the worst case in months not years," he wrote. He defined a break as recovering a private key from its public key in about a week on hardware like a large GPU cluster. His prescription was "bunker mode": large holders should gradually move funds to addresses whose public keys have never appeared on-chain, and move leftover balances to a fresh address after every transaction.
The timing came from OpenAI, which on Tuesday published hundreds of mathematics manuscripts produced by an unreleased internal model. Drake read the pace of that progress as a warning sign. The release itself contained no attack on ECDSA or on any wallet, and Drake said plainly that he was not claiming anyone had broken it.
The case for taking it seriously. Drake's argument is not baseless. Bitcoin's signatures are secure because nobody knows a fast way to work backward from a public key to a private key. That is a well-tested assumption, not a mathematical proof. Drake argues elliptic curves carry more mathematical structure than hash functions do, which gives a clever enough algorithm more to work with. Some serious people agreed the direction deserves attention. Dragonfly's Haseeb Qureshi called it "a very sober call." Vitalik Buterin said developers should take AI-driven math seriously and lean toward hash-based cryptography where they can. Johns Hopkins cryptographer Matthew Green noted that machines are now outperforming humans on problems researchers have worked on for years. On the same day, in an unrelated report, Europol urged the industry to start preparing wallet upgrades for quantum computers now, because a coordinated migration could take years.
The case against. None of that is evidence of a break, and the cryptographers closest to the question said so. Yehuda Lindell, head of cryptography at Coinbase, called it "a really bad take." AI proving theorems, he argued, does not show that problems assumed to be hard are actually easy. He added that hash functions have historically been broken more often than elliptic curves, which cuts against Drake's claim that curves are the softer target. Adam Back, the cryptographer who invented Hashcash, the proof-of-work design Bitcoin's mining builds on, replied with two words: "fud-burger." Alpen Labs engineer Jose Storopoli put the skeptics' position simply: extraordinary claims require extraordinary evidence. Even Buterin, who took the risk seriously, said: "I don't recommend anyone scramble to move their funds to new wallets today." Europol's report also said the quantum computers needed for an attack do not yet exist and that their arrival is uncertain.
What it means for Bitcoin specifically. Bitcoin had a head start here, and Bitcoin Magazine's Juan Galt pointed it out with some amusement. Most Bitcoin addresses already hide the public key behind a hash until the coins are spent, and standard wallet practice is to use a fresh address every time. "Bunker mode" is close to a description of how a well-run Bitcoin wallet already works. Even under Drake's own one-week definition of a break, a public key revealed at the moment of spending sits in the mempool for minutes before the transaction confirms, not days.
The coins that are exposed fall into three groups: the earliest coins, including Satoshi's, sitting in old pay-to-public-key outputs; coins in addresses that have been reused after spending; and Taproot outputs, which place a public key on-chain when they receive funds. Project Eleven, which tracks this exposure, counted more than 8.1 million BTC in addresses it classifies as vulnerable as of its September 14 update. That is a measure of visible public keys, not of anyone's ability to use them.
The longer-term work is real and already moving, slowly, as it should. BIP-360, which proposes a new output type that does away with Taproot's key exposure as a foundation for future quantum-resistant signatures, was merged into the official proposals repository in February. A merge is not an endorsement or an activation. The genuinely hard problem is not your wallet. It is coordinating the migration of millions of exposed coins across a network with no one in charge, years before anyone can say when it will be needed.
Did the warning move the market? CoinDesk listed it among Thursday's pressures when Bitcoin fell as low as about $80,300, alongside rising bond yields and an oil spike. It is impossible to say how much of the drop it caused.
The honest bottom line: there is no public evidence that ECDSA is weaker this week than it was last week. The practical advice that comes out of all this was already good advice. Don't reuse addresses. Use a fresh receive address. Don't move coins in a hurry, because rushed migrations cause real losses. Buterin said he has "lost more money in botched migrations" than in all hacks combined. And treat any unsolicited "quantum-safe wallet" pitch that arrives in the next few weeks the way you would treat anyone asking for your seed phrase.
2. AI Is Breaking Things. Just Not the Math.
If you want to know where AI is actually hurting Bitcoin software, the evidence is not in cryptography. It is in code.
In August, a volunteer group called the Bitcoin Red Team, led by developer Calle and AnchorWatch CEO Rob Hamilton, pointed AI models at 390 open-source Bitcoin repositories. In about 27 hours they filed 4,962 findings, 85 rated critical. Only about a fifth had been reproduced at the time of their last public update, so many may turn out to be false alarms. But the volume is the point. AI is now very good at finding ordinary software bugs, the kind that drained wallets in issue #025. Coinkite has said it suspects AI helped attackers find the Coldcard flaw, according to CoinDesk. Hamilton, notably, was among the people who pushed back on Drake this week, asking which mathematics he believed was actually degrading.
This week's releases show the defense side of the same trend. On October 7, Core Lightning shipped version 26.06.9. It fixes a regression from the previous release that could throttle busy nodes. It also changes how a node handles a payment that reaches its deadline while a channel is closing: the node now force-closes the channel instead of risking the loss of forwarded funds. Several configuration settings that could expose sensitive values or accept injected options were tightened. Maintainers held back the security tests to give operators time to upgrade, and urged users to upgrade as soon as practical.
Bitcoin Core fixed a privacy issue in its experimental private-broadcast feature, which is off by default. In some cases it could let an observer link private connections to a node's ordinary activity. The fix was backported to the 32.x branch on October 1, and a fix for 31.x is still in review. Version 32.0's third release candidate shipped October 6, and the final release is targeted for today, October 10. We covered what is in it in issue #031.
None of this is glamorous. It is reported bugs, reviewed fixes, held-back exploit details, and staged releases. That is what defending against a real AI threat looks like, and it is happening in public.
If you run a Core Lightning node, upgrade. If you hold Bitcoin in a hardware or mobile wallet, keep the firmware and app current, and download updates only from the maker's own site.
3. Yields, Oil, and a Weak Jobs Report
Bitcoin spent the two weeks since our last issue first pushing toward September's high, then giving it back.
The first push came on Friday, October 2, when the September jobs report showed just 29,000 jobs added against roughly 90,000 expected. Unemployment rose to 4.2%, and July and August were revised down by a combined 60,000. Markets read that as a reason for the Fed to pause. CME FedWatch odds of an October hike fell from about 71% to about 17%. Bitcoin touched $87,219 that day and was near $87,000 again by Sunday evening.
Then the bond market took over. Yields kept climbing despite the weak jobs data. On Thursday the 10-year Treasury yield touched 5.36% and the 30-year reached 5.73%, both multi-decade highs. Fed Governor Christopher Waller signaled more hikes may be needed. An attack on a tanker off Qatar sent Brent crude to about $105 a barrel. Bitcoin fell four days in a row, hit about $80,300 on Thursday, its lowest level of the month, and opened Friday near $81,700, down about 3.7% on the week. It recovered to around $82,600 by Friday afternoon. Former Bitcoin miners that now host AI data centers fell hardest, with several down between 6% and 11% on Thursday.
Spot ETFs closed September with about $2.65 billion in net inflows, one of their strongest months in a year. The week ending October 2 added only about $83 million on provisional data, and flows have been choppy since. Across all of this, Bitcoin is still up about 4% from a month ago and has held above $80,000 in a week when yields, oil, and a viral cryptography scare all pushed the same way.
The Numbers
| Metric | Value |
|---|---|
| BTC Price | ~$82,600 (Fri Oct 9, afternoon) |
| Two-Week Range | high ~$87,200 (Oct 2); low ~$80,300 (Oct 8) |
| On the Week | down ~3.7% |
| From All-Time High | ~35% (peak $126,198) |
| September Payrolls | +29,000 (vs. ~90,000 expected); unemployment 4.2% |
| October Hike Odds (CME) | ~71% to ~17% after jobs report |
| 10-Year / 30-Year Treasury | 5.36% / 5.73% intraday highs (Oct 8) |
| Brent Crude | ~$105 (Oct 8) |
| Spot ETF Flows | September ~+$2.65B; Sept 28-Oct 2 ~+$83M (provisional) |
| BTC Tracked as Quantum-Exposed | 8.1M+ (Project Eleven, Sept 14) |
| Bitcoin Core 32.0 | rc3 out Oct 6; final targeted Oct 10 |
| Core Lightning | v26.06.9 released Oct 7 |
What to Watch Next Week
Whether "bunker mode" gets evidence. The claim stands or falls on published cryptanalysis. Watch for any paper, result, or disclosure that actually shows a weakness in elliptic-curve cryptography. Absent one, expect the story to fade.
September CPI, Wednesday October 14. With yields at multi-decade highs, a hot print would test whether Bitcoin can keep holding $80,000. A soft one could take pressure off the bond market.
Bitcoin Core 32.0 final. The release is targeted for October 10. Node operators should wait for the signed release and verify it before upgrading.
Oil and the Strait of Hormuz. Brent near $105 keeps inflation expectations, and yields, elevated. Any de-escalation would loosen the main outside pressure on risk assets.
The Fed on October 28. Hike odds collapsed after the jobs report, but Waller's remarks kept the door open. The CPI print decides which way that goes.
Free Tools
Track price, sentiment, ETF flows, and network health in one place with Bitcoin Pulse, our free live dashboard. No account required.
A week of headlines about yields, oil, and the end of cryptography is the argument for a fixed schedule over reacting to any of them. See what steady buying through the noise would have done with the DCA Calculator.
New here? Start with Intro to Bitcoin or browse the Bitcoin Glossary.
New to Bitcoin? → Intro to Bitcoin
Explore every term → Bitcoin Glossary
Bitcoin Legacy
This week's debate was about moving coins to new addresses. Whatever you decide about quantum risk, every move like that changes where your Bitcoin is. The plan your family would rely on has to change with it.
If something happened to you tomorrow, could the people you love recover your Bitcoin? For most holders the honest answer is no. The keys sit in a drawer or a safe, the instructions live in your head, and the people who would need them have never seen a seed phrase.
Legacy is the tool we are building to close that gap. Answer a short set of questions about how you hold your Bitcoin, and it generates three printable documents: a letter explaining what you own and where it is, a First 48 Hours guide written for someone who has never touched Bitcoin, and a security checklist. It works with hardware wallets, exchanges, multisig, and mobile wallets.
The sensitive fields stay blank by design. Seed phrases and PINs get written by hand after you print, never typed into anything. Nothing you enter is stored or sent anywhere. It runs entirely in your browser, and there is no account to create.
Legacy is in development. Join the waitlist.
Bitcoin Weekly is published every week by 21VOX. Written by Karl. No financial advice. Just signal.