Picking a signature scheme feels like a decision you make once. Your chain, wallet or custody setup signs with it for years, and every key and signature it produces ends up on a ledger that never forgets.
Then a headline lands saying AI might break it. On October 7, 2026, Justin Drake of the Ethereum Foundation said it was worth bracing for ECDSA to fail before quantum computers arrive. The same day, Vitalik Buterin warned that the lattice maths behind schemes like ML-DSA (the Module-Lattice-Based Digital Signature Algorithm) could be shaken too. Somebody on your team forwards the link with a question mark.
So can AI break ECDSA or ML-DSA? Nobody has proved that it can. You still need an answer for your own team, though, and “probably fine” doesn’t hold up well in a security review. What follows is the honest state of play, plus a plan that works whichever way the maths goes.
Nobody Has Broken Either One
No AI system has published a working attack on either scheme. ECDSA is the Elliptic Curve Digital Signature Algorithm, the signature behind Ethereum and Bitcoin accounts. ML-DSA is the lattice-based standard that NIST, the US National Institute of Standards and Technology, finalised as FIPS 204 in August 2024. Drake called his “months, not years” scenario a worst case, and Buterin said he wouldn’t tell anyone to move funds today. Yehuda Lindell, who heads cryptography at Coinbase, says there’s no evidence of a break in assumptions that have held up for decades.
What is new is the direction. Researchers are now pointing AI tools at cryptography on purpose, and AI-assisted cryptanalysis is a real field with real results on smaller targets. Nobody can say yet how far it goes. That uncertainty is what’s rattling people, and it’s a fair thing to plan around.
What the Evidence Shows So Far
The results so far are narrower than the headlines. A Meta AI research project called SALSA trained a transformer model to recover secrets from lattice problems, and it worked on small, simplified instances. The authors say it doesn’t yet succeed at the sizes real schemes use. Their own words for the earlier experiments were “toy versions.”
The result getting more attention is HAWK, a lattice-based signature scheme that NIST was still evaluating. According to a report in CYBR.SEC.Media, an AI model found an attack that cut its expected security sharply, and HAWK’s designers withdrew it. The same report says NIST doesn’t consider this a problem for its finalised standards, which rest on different foundations. A weakness caught in a candidate before standardisation is the system working as it should. It also shows that these tools can find something real.
So far, AI has made some attacks cheaper and has turned up flaws in newer designs. It hasn’t produced a new way to break ECDSA or ML-DSA. Standards are built with some room for this kind of progress, which leaves one open question: whether a big jump is coming.
A Chain Can’t Swap Its Signatures Overnight
On a blockchain, a public key becomes visible the first time an account signs, and the ledger keeps it for good. Signatures from 2026 will still be sitting there in 2036. If a scheme weakens, you can’t patch a server and move on. Wallets, contracts, exchanges and validators all have to move together.
That’s why the advice for ECDSA holders sounds so awkward. Drake’s “bunker mode” means shifting funds to fresh wallets whose keys have never been exposed. But moving money has its own risks. Phishing sites pose as migration tools, funds go to the wrong address, and a fresh Ethereum wallet still signs with ECDSA anyway. A rushed migration can do more damage than the threat it’s meant to avoid.
So the useful question is how painful the swap would be if you ever had to make it. A chain that offers a second signature option from day one has a very different answer from one that has to build the option under pressure.
How ARMchain Handles a Scheme Change
ARMchain is a Layer 1 blockchain that signs user transactions and validator messages with ML-DSA, and it’s EVM-compatible, so your Solidity contracts carry over. We don’t claim ML-DSA is immune to whatever AI finds next. Nobody honest can claim that. What we can point to is how the chain is set up around it.
Smart contract accounts on ARMchain can use other validation schemes through account abstraction. SLH-DSA, the hash-based signature standard in FIPS 205, is one of them. It rests on hash functions rather than lattice maths, so a lattice breakthrough wouldn’t touch it, and it’s the same family Drake himself points to as a fallback. Passkeys and MPC for ECDSA are supported as well, but neither of those is post-quantum, so they’re a convenience and not a hedge.
There are trade-offs. SLH-DSA signatures are considerably larger than ML-DSA ones, which adds to data and fees. Custom validation logic for these accounts has to be written in Yul, so budget for an audit. And this covers contract accounts. It’s a second option for the accounts that need it, and it doesn’t change what the base chain signs with.
The Bigger Risk Is Probably Somewhere Else
Several cryptographers argue that the more realistic danger from AI sits in the software around the maths. Bugs in signing libraries, key generation, wallet code and contract validation are a finite search with a clear success signal, and AI is already good at that kind of search. Defenders get the same tools, but only if they use them before release.
For a team building on a new chain this is worth sitting with. A rock-solid signature scheme won’t help if the account contract that checks it has a hole. Independent audits, small codebases and tested upgrade paths do more for you in practice than watching the lattice debate.
Four Steps for Your Team
You don’t need to settle the AI question to get ready for it.
- Take inventory. List every place you rely on public-key signatures: wallet keys, validator or node credentials, admin and multisig keys, CI code-signing, API authentication. Most teams find a few they’d forgotten.
- Rank by lifespan. Anything that has to stay trustworthy into the 2030s goes first. Long-lived attestations and records are the obvious case, because they’ll still be checked years from now.
- Choose infrastructure that can swap. Ask any chain or vendor how you’d change signature schemes if you had to. If the answer is “we’d need a hard fork,” that’s worth knowing now. Put the ability to switch into contracts as a requirement.
- Try it before you need it. Run a local Fakenet, sign one of your existing contracts through ARMchain’s SDK, and see what larger signatures do to your data and fees. Better to find that out in a test than in a crisis.
Plan for the Swap, Not the Prediction
Whether AI breaks ECDSA, ML-DSA or neither, you won’t know in advance. What you can control is whether changing schemes is a planned project or a scramble. Can AI break ECDSA or ML-DSA is the question making headlines. The one worth answering in your own roadmap is how fast your team could move if the answer ever turned out to be yes.
If you’re working through that for a chain or product, get in touch with the ARMchain team.
FAQs
Can AI break ECDSA today?
No verified attack exists. The warnings are about a possible shortcut in the future, and the people raising them have said so themselves. Quantum computers are the better-understood threat. Shor’s algorithm can break elliptic curves in theory once the hardware is big enough, which is why most post-quantum planning starts there.
Is ML-DSA still safe to use?
As far as anyone knows, yes. It’s a finalised NIST standard, and there’s no practical attack against it. Buterin did single out lattice maths as the part AI could shake, so the sensible move is to avoid building anything that can only ever use one signature scheme. Use ML-DSA, and keep an exit open.
Should I move my funds to a new wallet now?
Buterin said he doesn’t recommend it today, and Drake warned that a rushed move can do more harm than good. A fresh Ethereum wallet still signs with ECDSA, so you’d be taking on transfer risk without changing the underlying scheme. Wait for audited migration paths from your ecosystem, and ignore any “quantum-proof wallet” link that lands in your inbox.
Is SLH-DSA a better choice than ML-DSA?
It depends on the job. SLH-DSA relies only on hash functions, which is a more conservative bet than lattice maths. The price is bigger signatures, so more data per transaction. It suits a high-value account that signs rarely, such as a treasury or an admin key, while a busy account will feel the extra weight.
What does cryptographic agility mean for a blockchain?
It means being able to change the signature scheme without rebuilding everything around it. On a chain, that’s hard, because keys, signatures, contracts and wallets are all tied to one scheme. In practice you look for a platform that lets an account pick its own validation, so a switch can happen account by account and doesn’t need the whole network to move at once.
Share this article