An unreleased anthropogenic AI model broke a post-quantum signature scheme in roughly 60 hours, raising anew a question Bitcoin developers have yet to answer: when should the network begin transitioning to quantum-resistant cryptography?
The findings pose no immediate threat to Bitcoin. HAWK-256 has never been used on the network, and no existing wallets are affected. But it changes an important assumption underlying Bitcoin's post-quantum roadmap: artificial intelligence is making testing and potentially breaking complex cryptographic systems faster and cheaper.
What Mythos Did to Hawk and What It Cost
On July 28, Anthropic announced that its Claude Mythos Preview model, available to a select group of approved users, discovered an attack on HAWK-256, the final candidate for a lattice-based signature still under evaluation in NIST's third round of post-quantum cryptography, which had not been previously documented.
The AI uncovered a hidden symmetry in HAWK's design that experts had overlooked, leading to a security reduction that cut the algorithm's effective strength in half and reduced the estimated work factor from approximately 2^64 to 2^38 operations. According to Anthropic's research blog, the attack took about 60 hours and cost an estimated $100,000 in compute, and was executed by a researcher without formal cryptography training.
The cryptographic community's response was swift. Sophie Schmieg of Google stated, "Effectively, with this paper, the HAWK algorithm is dead." Matthew Green of Johns Hopkins University noted that while the research contained no groundbreaking math, it represented a new combination of existing techniques. Ars Technica reported that HAWK's creators pulled the algorithm from public access the next day.
Why All Bitcoin Wallets Remain Unaffected
The result does not affect Bitcoin.
Bitcoin uses the ECDSA algorithm on the secp256k1 elliptic curve, which is unrelated to HAWK. This algorithm was never implemented in Bitcoin, any blockchain, or commercial software. Its failure occurred during a verification process designed to find flaws before deployment.
Bitcoin's anticipated migration has already moved past HAWK. In February 2026, BIP-360 was submitted to the Bitcoin Improvement Proposal repository, introducing a new output type known as P2QRH, which uses ML-DSA and SLH-DSA—two algorithms finalized by NIST in 2024 after years of public vetting. Furthermore, in April 2026, Jameson Lopp and others presented BIP-361—a proposal for phasing out ECDSA in Bitcoin. HAWK was not included in either BIP-360 or BIP-361.
The Test That Will Define the Start of the Migration
As discussed on TFTC, the key question is whether AI-powered cryptanalysis could ultimately crack the algorithms Bitcoin hopes to use, namely ML-DSA or SLH-DSA. If either of these algorithms is found vulnerable before the network completes its migration, the strategy of waiting for mature standards may become moot.
The economics are also changing. Anthropic reported that significant cryptanalysis can now be conducted in roughly 60 hours for about $100,000, making this type of testing far more reproducible. Intelligence agencies like the NSA or GCHQ are almost certainly conducting similar work behind the scenes, meaning public results likely lag private ones.
Researchers drew parallels between this case and AGU, another post-quantum contender that withstood years of research but was ultimately attacked within an hour on a laptop in 2022. AI seems to be accelerating this trend.
Why the Timeline Keeps Shrinking
Cryptopolitan previously reported that AI cryptanalysis is lowering expectations for when quantum attacks may become viable. A 2026 Forrester quantum security report makes a similar claim, warning that novel algorithms are "overnight" shrinking security timelines by minimizing the computing resources needed to solve complex encryption problems. It predicts alarming Q-Day related security threats by 2030.
Google has also accelerated its efforts, setting a goal to phase out RSA and elliptic-curve cryptography in its systems by 2029 and expressing a desire for other companies to follow suit.
For Bitcoin, the situation is critical, as analysts cited by TheStreet estimated that approximately 6.7 million Bitcoin worth nearly $600 billion sitting in wallets could potentially be vulnerable to a sufficiently advanced quantum computer. Additionally, a study titled "Quantum Horizon" claims that about 2.3 million Bitcoin would be lost forever to quantum attacks, and that there is a one-in-six chance a quantum computer capable of breaking cryptography will be operational by 2035. Therefore, the authors argue Bitcoin's main challenge is no longer hardware, but whether the network can successfully transition before the technology becomes available.
What Cryptography Does Bitcoin Use?
Bitcoin uses several different cryptographic primitives, each serving its purpose. Importantly, Bitcoin does not encrypt transactions. Instead, it relies on cryptography for authentication, integrity, and achieving consensus. Here is a detailed breakdown:
| Function | Cryptography Used | Purpose | Vulnerable to Quantum Computing? |
|---|---|---|---|
| Digital Signatures | Signatures ECDSA (legacy) and Schnorr (Taproot) on the secp256k1 elliptic curve | Prove ownership of bitcoin | Yes (Shor's Algorithm) |
| Hashing (Proof-of-Work) | SHA-256 | Mining and block hashing | Significantly less affected (Grover's algorithm offers only quadratic speedup) |
| Address Generation | RIPEMD-160 + SHA-256 | Create Bitcoin addresses from public keys | Not directly vulnerable like signatures |
| Merkle Trees | SHA-256 | Verify transaction inclusion in blocks | Much less impacted |
Concerns focus on Bitcoin's digital signatures (ECDSA and Schnorr) being vulnerable to future quantum computers using Shor's algorithm. Therefore, developers and researchers are exploring how Bitcoin could transition to post-quantum signature schemes, such as hash-based or lattice-based alternatives, through future protocol upgrades. Any such transition would require broad consensus in Bitcoin due to its impact on wallets, transactions, and consensus rules.
The HAWK attack did not directly affect Bitcoin because Bitcoin does not use HAWK. However, the result demonstrates how AI can accelerate cryptanalysis and shorten the time required to evaluate or break new cryptographic schemes. Combined with recent advances in quantum algorithms, these developments underscore the urgency of Bitcoin developers' efforts to prepare for a transition to a post-quantum architecture.
