a16z crypto — SI (super intelligence), hard math and cryptography: "Don't panic" panel — denser notes · Don't Panic Digest More
What this is: Nearer-verbatim notes from a public X panel video. Not a court transcript. Gaps labeled. Disfluencies lightly cleaned. Hosting ≠ endorsement.
Not Code Solutions LLC viewpoints or advice. Speakers' claims stay speakers' claims ([unverified] / host-said).
Not financial advice: These are notes of what the speakers said. Nothing here is investment, trading, tax or legal advice, or a recommendation to buy, sell, keep or move any asset, token, wallet or service.
Hedge legend: [unclear: …] · [seam … filled from audio check] · [unverified] for claims and figures · host-said for moderator framing · "Panelist (unconfirmed)" where the audio does not establish who is speaking.
Speaker claims: Claims are the speakers' own [unverified] — not checked, not restated as fact. Examples: quantum and SI-attack timelines (including the "coming months" warning the panel discusses); every "if there were a break" scenario, which is hypothetical; "around 700 papers" in the OpenAI release; "20 million dollars, 50 million dollars" of compute; "shave off 10 bits of security"; "95%, 99% cheaper" capability-per-dollar estimates; "closed source died last week"; Coinbase already following bunker-mode measures; and the iMessage migration to hybrid cryptography (raised as a question). Timestamps are approximate (player time); within a turn they mark the nearest preceding cue.
Source URL: https://x.com/a16zcrypto/status/2108639925021380964
Full video duration: 40:35 (native X) · Scope: 0:00–40:35
Moderator: Liz (a16z crypto; first name as spoken on audio) · Panel: Dan Boneh (Stanford), Eddy Lazzarin and Justin Thaler (a16z crypto), as introduced on audio. Names are used only where the audio establishes the speaker.
Posted: Fri 2026-10-09 · Notes desk: 2026-10-15
Contest OUT · Third-party names (OpenAI, NIST, Ethereum Foundation, Justin Drake, Vitalik Buterin, Coinbase, Bitcoin, Ethereum, TLS, Signal, iMessage, Haiku, etc.) kept verbatim when spoken.
Disclaimer: https://legal.codesolutionsllc.com/si-disclaimer — Notes of a public interview — not Code Solutions LLC views or advice.
Lane: Digest More feed only. Not a Daily X release from this pack alone.
[0:00] Dan Boneh: All of a sudden a new threat emerged in the world of cryptography, which is whether our AI friends can actually attack crypto systems that we thought were secure.
[0:09] Liz (moderator): The fear here is that the AI labs could break them if they are breakable.
[0:15] Panelist (unconfirmed): The fact that people try to break them and fail gives us more confidence. NIST is already standardizing many other types of public key systems that we can switch to. So if it turns out one of our assumptions is broken, we have backups, we just need to know.
[0:29] Liz (moderator): Are there startup opportunities here, where a new company might be able to come in and help?
[0:37] Liz (moderator): Hey, welcome to our show today. I'm Liz. I'm joined here with Dan Boneh, a professor at Stanford, and Eddy Lazzarin and Justin Thaler, two members of our team here at a16z. We're here to talk about a pretty big discussion that's been kicked off yesterday by a tweet that a security researcher, Justin Drake, put out warning the crypto industry to start preparing for what he's calling bunker mode. Specifically around this worry that the advances in AI are going to cause a breakthrough or breaking of cryptography faster even than a quantum computer might. And so he called on big institutions to start thinking about moving funds. (host-said)
[1:23] Liz (moderator): A lot of that has been kicked off by some papers that OpenAI put out and different breakthroughs they had in mathematical problems that were previously unsolved. And so, Dan, I don't know if you want to kind of summarize what those breakthroughs were and how that kicked this off.
[1:41] Dan Boneh: So let's see. I guess the first thing I should say is, you know, everybody calm down. Don't panic. The world today is the same as it was a year ago, two years ago. That's the first message. There are kind of two stories that are getting entangled and I think we should first disentangle them.
[2:03] Dan Boneh: There is this long going conversation on the threat of quantum computing to cryptography. This is not what this is about. Here, there's all of a sudden a new threat, which is whether our AI friends can actually attack crypto systems that we thought were secure, using their super intelligence and so on.
[2:27] Dan Boneh: The backdrop is that around 700 papers [unverified] were put up online, presenting enormous progress in mathematics and computer science. I can't say enough about how impressed I am with the results. It's really quite remarkable. I remember my inbox blew up when this came online.
[2:50] Dan Boneh: I started going through the list of problems that progress was made on. And as I finished the list, the thing that stuck in my mind is: wow, this is incredible progress, but there are no questions here on cryptography. Not even on theoretical cryptography.
[3:11] Dan Boneh: There are lots of really interesting open problems in constructing new crypto systems. None of those questions were in the list. So you might wonder, does that mean the models are really bad at cryptography? We don't know.
[3:36] Dan Boneh: So one of the things I would like to start with is a call to the frontier labs to please tell us what you have done with trying to use these models to answer basic questions in cryptography. What is the status, for example, on actually attacking standardized and deployed crypto?
[3:59] Liz (moderator): So just to clarify: this tweet was not kicked off because there was something in the papers specific to cryptography, but rather the fact that they had massive breakthroughs in mathematics means there was likely a breakthrough in cryptography. (host-said)
[4:14] Panelist (unconfirmed): The OpenAI drop had a variety of papers across hundreds of different topics. Many of those, although not specifically about cryptography, were adjacent to it, in that they involved similar techniques and mathematical reasoning.
[4:38] Panelist (unconfirmed): So their absence is a little bit conspicuous, is what Dan is saying. If the reason for the omission is that AI models are notably bad and couldn't find anything, and cryptography is particularly robust, that in itself would be very interesting.
[4:59] Panelist (unconfirmed): If, on the other hand, they did make progress, but there were reasons that what they could have shared would be concerning, then that would be very interesting to know as well.
[5:29] Liz (moderator): It is not a given that the current cryptographic standards we use are human breakable. We just don't know if they are or not today. And so the fear here is that the AI labs could break them if they are breakable.
[5:52] Dan Boneh: Yeah, I think this is a really important point: all of cryptography is based on complexity assumptions. We have to assume that certain problems are hard. The reason we can't prove that is related to a famous open problem in computer science, P versus NP.
[6:13] Dan Boneh: We first have to resolve that problem before we can argue that certain cryptographic problems really are hard. And since we are very far away from that, none of the problems posted this week come even close to resolving the P versus NP problem. [seam 6:30 filled from audio check] We still have to keep making assumptions in cryptography. Let's say elliptic curve discrete log, let's say shortest vector in lattices. We have a whole list of problems that we know and love and we build crypto systems from. There's a huge body of literature on failed attempts, partially successful attempts. And so far all these problems remain secure.
[7:00] Dan Boneh: But now there's a new player in town. Maybe they'll see something that us humans have not seen. That's certainly a possibility. But this is not a new possibility. Two years ago, five years ago, 10 years ago, a clever human could have come up with a new attack. Cryptography is built on assumptions that could end up not being as strong as we expect.
[7:30] Dan Boneh: And so it's wonderful that people try. The fact that people try to break them and fail gives us more confidence. It would be an extremely positive development if the labs tried their best models at some of our basic cryptographic assumptions. If the models fail, and the labs say so, that would give us tremendous confidence.
[8:00] Dan Boneh: And even if they shave off a little bit of security, let's say 10 bits [hypothetical], that's wonderful for us to know. That would already be very strong evidence that the assumptions are worthwhile using.
[8:15] Panelist (unconfirmed): Another thing that would be nice for the labs to try: use these models to give much stronger evidence than we currently have that these problems are hard. For some lattice problems we know they're just as hard in the worst case as the average case. But there are complexity theoretic results you could hope to show that would give more confidence that they have no efficient algorithms.
[9:00] Panelist (unconfirmed): Dan is totally right, most of the reason we have confidence is people have just tried for decades and haven't come up with any good algorithms. But we can hope for other kinds of evidence, and those are pure math questions these frontier labs could be turning their models on.
[9:10] Liz (moderator): The specific tweet was about crypto wallets, but there is a much broader implication of breaking, like, ECDSA. Is one of you willing to elaborate on the larger implications?
[9:40] Panelist (unconfirmed): Let's pick on elliptic curve discrete log. If it turns out this assumption is not as strong as we thought and there's a realistic attack on it [hypothetical], that would not be good. Not only for the blockchain space; it affects the entire digital world. Home banking, healthcare, government communications.
[10:10] Panelist (unconfirmed): I should say NIST is already standardizing many other types of public key systems that we can switch to. In fact we have several backups. So we just need to know, is this a high priority? The lack of knowledge right now is creating a vacuum in the Twitter sphere, and that vacuum really needs to be filled.
[10:45] Panelist (unconfirmed): Maybe to simplify: in the absence of the ability to prove these problems are hard, we rely in some sense on time. We put these schemes out and we wait, because experts are testing and trying to break them. If they're around long enough and nobody breaks them, we emerge with confidence.
[11:30] Panelist (unconfirmed): Because of the pace of progress on AI's mathematical abilities, there is a conspicuous absence of time. A whole new well of cognitive ability to scrutinize has appeared, and we're not hearing from them about what they are discovering in the normal way we would from academic research.
[12:00] Panelist (unconfirmed): You're totally right. In the past we'd have to wait like 10 years before a system could be deployed, to give people enough time to analyze. Now we can accelerate this process tremendously. Somebody makes a new assumption, builds a crypto system, and we let a model run for a week, for a month, try to break it, and if it can't, boy do we have a lot of confidence that the assumption is valid. [seam 13:00 filled from audio check] [unclear]
[12:40] Panelist (unconfirmed): It's a change in how we normally do it. We have a background rate of attention paid by cryptographers to these systems, and we sit back and wait long enough. Then we say, "This has got to be good."
[13:10] Panelist (unconfirmed): But now the labs can say, "We took our tip-top, totally unrestricted, most cyber-capable model, we told it to go absolutely insane, and we spent 20 million dollars, 50 million dollars [hypothetical, unverified] trying to break this scheme." We'd have more conviction than you could probably get from the conventional process in a decade. So we have the prospect of more confidence in our security than ever before. There's just a gap in how that information is created and shared.
[13:45] Panelist (unconfirmed): And we can accelerate the deployment of better cryptography. The gap is also that some of the models are accessible to the labs but not to the rest of the public.
[14:05] Liz (moderator): In the absence of that information, how do you think about this as an everyday user of technology?
[14:15] Panelist (unconfirmed): So nothing has changed. The world today is the same as the world a week ago, a year ago. Until we learn something new about our standard cryptographic systems, keep using the systems as they are. When we learn something new, either we'll have more confidence or we'll have to react. So please, don't panic. Keep calm.
[14:45] Panelist (unconfirmed): To put it another way, the reaction is not a reaction to new information. It's maybe an indirect reaction to the dump of mathematical results from OpenAI — amazing, but I don't think a surprise. We didn't learn that elliptic curves are vulnerable in a way they weren't before.
[15:30] Panelist (unconfirmed): To give people more confidence: we have a lot of different types of assumptions for public key cryptography. Not just elliptic curves or lattices — isogenies, code-based systems, multivariate polynomial based systems, hash-based signatures. So if we need to react, we can react. Everything takes time, but we sort of know where to go. Even if the worst of the worst happens [hypothetical], there are still plenty of ways to recover.
[16:00] Justin Thaler: One thing worth mentioning is we generally believe there is no efficient algorithm for these problems. It's not that we think there might be and humans just aren't smart enough to find it. If there is not one, it doesn't matter how smart the AI is, it cannot find the nonexistent algorithm. The worry is that our belief is totally wrong.
[16:48] Justin Thaler: The first tweet was by Justin Drake of the Ethereum Foundation, warning of a possible complete break of elliptic curve cryptography in the coming months [speaker-reported claim, unverified], suggesting at least large cold wallets on Ethereum enter bunker mode, or not have exposed public keys on chain.
[17:10] Justin Thaler: Vitalik Buterin followed up with a slightly more toned down tweet, still speculating about better attacks. And even Vitalik's tweet mentioned he himself has lost more personal funds in botched migrations than in all hacks. [unverified]
[17:35] Justin Thaler: We as humans tend to struggle with tail risks that are very scary, when there are clear and present risks that are more dire, even though less cataclysmic. So I want to emphasize that bugs remain everywhere. The AIs are good at finding the bugs. I hope that's good for defensive practices more in the medium to long term than offensive ones. And fundamentally the worst thing you can probably do right now is something. You should do nothing.
[18:24] Justin Thaler: And the recommendations in Justin Drake's post were really just good hygiene that institutions should already be following, independent of AI or quantum.
[18:40] Eddy Lazzarin: To Justin's point regarding institutions, Coinbase already came out and said they already do a lot of the specific measures outlined in bunker mode [unverified]. The further down this rabbit hole you go, we are already preparing. We have different types of assumptions we can switch to.
[19:08] Eddy Lazzarin: We already require institutions to take best practices like making sure public keys aren't revealed on the blockchains where that's relevant. As we learn more, we will probably add more and more [seam 19:30 filled from audio check] methods of preparation to our kit. So the frustrating thing about the take "we need to go into bunker mode" is that the specific things it advises are probably not good and risky for normal people to do, and are already things the hardcore institutions are doing.
[20:00] Eddy Lazzarin: If we're calling for anything here, what we're calling for is more information so we can know how to adapt.
[20:05] Liz (moderator): Correct me if I'm wrong, but the types of cryptography this tweet refers to are the same types under threat from a quantum computer. This is a threat we've already been preparing for, and if it comes from AI before quantum, it doesn't make it new. (host-said)
[20:35] Panelist (unconfirmed): Dan opened with remarks about the conflation of the quantum issue with the AI math skills issue. Because of fears of the quantum threat, people have already begun to treat elliptic curve cryptography as something that may be vulnerable soon, so we've already deployed many of the mitigations. The post didn't come with concrete recommendations institutions aren't already following.
[21:15] Panelist (unconfirmed): If what Justin was warning about happens in the timelines he mentioned [hypothetical], it's a cataclysmic event for all digital infrastructure throughout the world. There's no way we're fully moving off elliptic curve cryptography in the next couple years. So the focus on blockchain hygiene is very discordant with that.
[21:45] Dan Boneh: I will add that the quantum threat is really only about elliptic curve type systems and RSA. The AI threat is broader: it could also look at our post-quantum systems and potentially weaken them [hypothetical]. So it is quite important to know that the latest models could not break our post-quantum candidates, because those are the ones we're moving to.
[22:30] Dan Boneh: I totally agree with Eddy, the answer is we should be doing what we are already preaching. One of the main things is crypto agility: deploy systems that can quickly switch from one design to another if the one in use turns out to be insecure. Crypto agility is our friend for defending against the unexpected. It's a term over a decade old. If our AI friends come up with things we didn't expect, crypto agility will kick in.
[23:15] Eddy Lazzarin: This debate also surfaced another opportunity to relitigate elliptic curves versus hashes versus lattice cryptography. Dan is totally correct that the AI threat is broader. What Drake was saying is there may be structure in lattice and elliptic curve cryptography that perhaps makes it more vulnerable to a well-resourced AI model [speaker-reported view]. We didn't learn anything specific about that from the OpenAI drop. I'd love to hear from Dan and from Justin about what might make some more secure than others against an AI threat.
[24:40] Liz (moderator): The point being, we think of hash functions as post-quantum, but they might not be post-AI.
[24:45] Panelist (unconfirmed): Yeah. And we think of lattices as post-quantum, but not necessarily post-AI.
[25:00] Panelist (unconfirmed): On the internet at large there is no debate: everybody's using lattice-based crypto systems for key exchange and signatures. In the blockchain space there is still a debate between hash-based and lattice-based signatures.
[25:30] Panelist (unconfirmed): Generally the attitude is that hash-based signatures are more secure. If one hash function is not as secure as we thought, we switch it out and everything works as before; the framework is guaranteed to be correct. If the core lattice [seam 26:00 filled from audio check] problems are not as hard as we thought, the whole mechanism collapses and we have no recovery. So hash-based signatures are far more agile.
[26:10] Panelist (unconfirmed): Because the entire construct of a hash-based scheme — the framework is sound. The choice of hash function is less important in the grand construction. Whereas lattice-based schemes, maybe like elliptic curve, rely on a specific shared set of assumptions.
[26:40] Panelist (unconfirmed): The other argument in the blockchain space, in Bitcoin and Ethereum, is that we already make hash assumptions for Merkle trees and such. If signatures were also purely hash-based, we're not adding new assumptions. The Bitcoin core devs I talk to are quite excited about getting rid of elliptic curve assumptions and having Bitcoin depend only on a hash function [speaker-reported]. The same is playing out in the Ethereum Foundation space.
[27:35] Justin Thaler: This is a much more complicated question than it appears. The whole world's digital infrastructure is going to be very challenged if we only used hash-based cryptography, because you can't do good encryption or key exchange from that. In the Ethereum community, the plan to use only hashes, which comes with bigger cryptography, is to use SNARK recursion — proofs that you know proofs that you know proofs.
[28:30] Justin Thaler: The prosaic issue is it's very complicated, so the surface area for bugs gets very large. I'm very optimistic that the same AI tools scaring people about cryptography will help us get the bugs out, but that's a really hard problem. And we don't understand the security of SNARK recursion very well. You tell me lattices might be attackable, I say I don't know about SNARK recursion. There are a lot of non-quantifiable risks. We have to do our best to weigh these things.
[29:30] Panelist (unconfirmed): I do want to make one more point. Lattice-based systems have much better properties than hash-based — threshold signatures, non-hardened key derivation. Hash-based systems are harder to use, like Justin was saying, they're much larger, and stateful versus stateless.
[30:00] Panelist (unconfirmed): So many of us cryptographers are a little sad that some of the blockchain community will move to hash-based signatures with no algebraic properties to leverage. We may be removing assumptions but also removing capability. As a cryptographer, I'd be quite happy if we ended up using lattice-based schemes; they give much more room to build interesting structures. But perhaps that constraint is also where this extra sense of security comes from.
[31:00] Liz (moderator): A quick summary. Justin laid this out very nicely: it is not a given that there is an efficient algorithm to break this type of cryptography. If there is one, the timeframe to find it is likely sped up given advances in AI. That's where the panic and confusion is coming from. The easiest way to minimize that is more information from the labs. If the labs said, we threw compute, time and money at this and couldn't crack it, that would give you confidence, at least until the next big upgrade in the model. (host-said)
[32:00] Panelist (unconfirmed): In the extreme case it should give you more confidence than the history until today. If you believe, like many of the people posting yesterday, [seam 32:30 filled from audio check] that these models are now basically at or better than most people studying these systems, then you should get great confidence from knowing the equivalent of 100,000 expert mathematicians or cryptographers took a look at a scheme. We need to reconsider how we decide what we feel confident about.
[33:07] Liz (moderator): Institutions: security best practices you should already be doing. Everyday user: nothing to do at the moment, don't panic, continue on. Startups: are there opportunities where a new company could help?
[33:34] Panelist (unconfirmed): Startups will need to seriously consider what security assumptions they make in their software. That's already happening: how people think about open source is changing. Everyone recognized closed source died last week [speaker claim, unverified], because of our ability to decompile things.
[34:02] Panelist (unconfirmed): Because of the agentic properties of AI systems, they can go on unbounded side quests in pursuit of a goal. We have to think carefully about security boundaries, sandboxes and capabilities-based permissioning around AI agents. Yet another way to design software that protects users as much as it empowers them.
[34:35] Panelist (unconfirmed): I'd go a step further. These new capabilities are a gift to startups and established software shops. In the past a crypto system gets attention from cryptographers after it's deployed; that's the wrong time. Now any startup can have these models analyze its cryptography and software for bugs before shipping. Over time software quality and crypto quality will go up, because nothing will ship unless the model said it's valid.
[35:40] Panelist (unconfirmed): I saw someone, with the release of [unclear] Haiku, comparing models from a year ago versus today. Hard to compare apples to apples, but some estimates were 95%, 99% cheaper for intellectual capability per dollar [speaker-cited estimate, unverified]. Pair that with a frame we've used: the number of bugs in software is finite. Then we're asymptotically approaching zero bugs.
[36:39] Panelist (unconfirmed): Then we're net improving the security of the world, not eroding it. This isn't a battle of wits where your smarter system can overpower mine no matter what. It relies on vulnerabilities, and vulnerabilities can be removed, designed away, mitigated. The primary resource for mitigating them, machine intelligence, is getting radically cheaper every couple months.
[37:34] Panelist (unconfirmed): Companies are already spending a lot scanning their code base with the latest models. Every software update, rescan; every new model, rescan. An interesting research question: how to do software scanning more efficiently, so we don't have to rescan everything every time.
[38:05] Liz (moderator): Say the labs take up your plea, throw compute at it, and say you're right, we did break elliptic curve cryptography [hypothetical]. What happens next?
[38:30] Panelist (unconfirmed): Then we move to post-quantum cryptography, which we're already doing; lattice-based systems are already deployed. Many internet connections today use agile cryptography: encrypted under elliptic curves and lattices at the same time. Break elliptic curves, it doesn't matter, it's also under a lattice-based system.
[38:50] Panelist (unconfirmed): Didn't, like, iMessage make that migration last year [speaker question, unverified], and many other such systems [seam 39:00 filled from audio check] have done that?
[39:00] Panelist (unconfirmed, answering): Exactly, Signal and so on. Yes. I was actually referring to one of the TLS key exchange methods, X25519MLKEM768. It's a jumble of letters, but it means you're protected by both elliptic curves and lattices. Maybe the labs come forward and say, "We broke both" [hypothetical]. Then we introduce a third one. We'd have to standardize, a longer process, but we kind of know where to go. More work and perhaps more of a rush.
[39:34] Panelist (unconfirmed): At the risk of stating the obvious, the labs shouldn't just throw out a scheme to break elliptic curves. They should responsibly disclose it to the government and the industry, develop a plan, and everybody updates their software as quickly as possible. That's a known process all security experts know very well.
[40:10] Liz (moderator): Great. Well, thank you for that. I feel calmer. So hopefully everyone else does as well. Thanks so much.
[40:15] Panelist (unconfirmed): This was fun. Thank you, Liz.