Bitcoin may eventually need quantum-resistant signatures, but Samson Mow says rushing that upgrade could create a mess of its own long before quantum computers become a real threat.
- Mow says Bitcoin should not rush PQ signatures
- Anthropic’s research found attacks on weakened cryptography, not Bitcoin
- Crypto-agility is becoming the real security requirement
- The hard part is upgrading Bitcoin without breaking Bitcoin
Samson Mow, CEO of JAN3 and a Bitcoin developer, is pushing back against calls to move Bitcoin too quickly toward post-quantum cryptography. His warning is straightforward: if Bitcoin swaps out its current signature schemes before quantum computers are actually capable of breaking them, it could open the network to more immediate vulnerabilities against classical computers.
That concern is not pulled from nowhere. Bitcoin currently uses ECDSA for legacy outputs and Schnorr signatures for Taproot-style outputs. Both are used to sign transactions, not to “store ownership” in some abstract sense, and both have been studied far more heavily than most newer cryptographic schemes. Post-quantum cryptography, or PQ cryptography, is designed to stay secure even if quantum computers become powerful enough to threaten today’s public-key systems. The catch is that changing Bitcoin’s signature machinery is not a clean software upgrade. It is a consensus-level migration on a global monetary network. That’s where the pain starts.
“A few months ago I cautioned against hastily moving Bitcoin to PQ signatures, lest we introduce a vulnerability to classical attacks. Now we have to worry about AI finding them too.”
“Hastily changing from ECDSA/Schnorr to PQ signatures may make Bitcoin vulnerable to classical computing attacks today.”
“Simply put: make Bitcoin safe against quantum computers just to get pwned by normal computers.”
Hard to argue with the punchline. The harder part is the engineering.
What sparked the latest debate
The immediate catalyst was research from Anthropic showing that its AI model, Mythos Preview, found new attacks against weakened cryptographic targets. One result was a substantially faster attack against a reduced-round version of AES, the Advanced Encryption Standard. Another improved a known private-key recovery attack targeting HAWK, a lattice-based post-quantum signature scheme.
That needs to be read carefully. Anthropic said neither finding poses an immediate threat. The AES result does not break full AES, only a reduced-round version that is deliberately weaker. And the HAWK result does not mean lattice cryptography is broken across the board. It means an AI-assisted search found weakness in a newer scheme with newer assumptions, which is exactly the sort of thing cryptographers exist to stress-test before it becomes a real-world problem.
In other words: no, Bitcoin did not get cracked by a chatbot. The research is more modest than the headlines might suggest, but still relevant. It shows that AI systems are increasingly useful as cryptanalytic tools, especially when they are pointed at schemes or variants that have not been beaten on for years by every bored mathematician with a grudge.
Why Mow wants Bitcoin to wait
Mow’s position is conservative in the most Bitcoin way possible: do not change the money layer too early just because the future might be scary. He argues that Bitcoin should move to post-quantum signatures only when there is a clear, practical quantum threat, in his words, when quantum computers are real enough to matter, not when they are still a research milestone and a lot of marketing PowerPoints.
That does not mean ignoring the threat. It means recognizing the difference between a future problem and a present one. If Bitcoin migrates too soon, it risks adopting a scheme that has not been scrutinized nearly as long as ECDSA or Schnorr. That could introduce fresh classical attack surfaces, implementation bugs, or compatibility headaches before quantum computers are even close to threatening the network.
Mow also praised work by Blockstream cryptographers and argued that hash-based schemes may offer a smaller mathematical attack surface than lattice-based alternatives like HAWK. That is a judgment call, not gospel. But the underlying point is familiar: simpler assumptions are often easier to trust because they give attackers fewer places to hide a knife.
Bitcoin’s conservatism cuts both ways. It protects the network from reckless changes, but it also makes serious upgrades slow, messy, and politically sensitive. That’s not a bug. It’s the price of having a decentralized system that does not let one committee or one billionaire press a green button and rewrite the rules.
What Anthropic’s findings actually mean
Anthropic’s work is useful because it shows AI can assist with cryptanalysis in a real way, not just in the “look, the model wrote some C code” sense. But the results should not be oversold.
The AES result hit a reduced-round version of the algorithm, not the full standard. That matters because reduced-round variants are weaker by design and often used in academic cryptanalysis precisely because they are easier to break. Likewise, the HAWK result targets a specific scheme with newer security assumptions. It is not a verdict on all lattice-based post-quantum cryptography.
That distinction matters for Bitcoin readers. The point is not that Bitcoin’s current signatures are suddenly in danger or that all post-quantum schemes are flimsy. The point is that the cryptographic frontier is not static. New algorithms can look strong until they get fed into a better search tool, a better proof strategy, or a better attacker. Sometimes all three arrive at once.
Anthropic’s findings are also a reminder that “post-quantum” does not mean “immune to every future attack.” It means designed to resist a known class of quantum attacks. It does not make a scheme immortal, and it certainly does not make it automatically safer than a more mature system that has been studied for longer.
What Ledger’s CTO took from the research
Ledger Chief Technology Officer Charles Guillemet read the research as a sign that AI is becoming more relevant to cryptography and cybersecurity, but not as proof that lattice cryptography is generally broken.
“AI is rapidly reshaping the security landscape, and it may reshape cryptography as well, ”
“Importantly, this result does not weaken lattice cryptography as a whole. Instead, it targets Hawk’s newer security assumptions, which have not been scrutinized for as long as the more established assumptions underlying schemes such as Dilithium.”
That comparison to Dilithium is important. Dilithium is a more established lattice-based post-quantum scheme, and it has had more time to be reviewed, attacked, and argued over. In cryptography, that kind of scrutiny matters. “New” is not a virtue on its own. Often it just means “not broken yet by enough people.”
Guillemet’s bigger point was about crypto-agility, the ability to swap cryptographic algorithms without redesigning an entire system. That may become a basic requirement for secure software, especially as AI tools improve at finding weak assumptions faster than human review cycles can keep up.
“One lesson is becoming increasingly clear: crypto-agility, the ability to replace cryptographic algorithms without redesigning entire systems, may soon become a fundamental requirement for secure software, ”
“I’m looking forward to seeing crypto-agility on Bitcoin.”
For hardware wallet makers like Ledger, that question is not academic. If signature standards change, key handling, signing flows, and long-term device support all have to adapt without turning into a compatibility disaster. Bitcoin users do not want security theater, and they definitely do not want a fancy new migration that quietly breaks half the ecosystem.
The real Bitcoin problem: upgrading without a consensus train wreck
The debate is not really “quantum versus no quantum.” It is about timing, size, and governance.
If Bitcoin ever moves to post-quantum signatures, the network will need a migration path that protects old coins, new coins, wallet software, and nodes that may not upgrade on day one. That is already hard in a system where consensus changes are slow by design. It gets even uglier when the new signatures are larger and more complex than the old ones.
That size issue is not a footnote. Larger signatures mean more block space, which means higher fees, more transaction weight, and more pressure on the network. For a chain that treats block space like scarce real estate, because it is, that matters a lot. A “more secure” scheme that bloats transactions can still be a bad trade if it makes Bitcoin more expensive or harder to use.
So the tradeoff looks like this:
- resist a future quantum attack,
- avoid new classical vulnerabilities today,
- keep transaction sizes manageable,
- and do not turn a protocol upgrade into a governance circus.
That last point deserves a nod. Bitcoin has spent over a decade proving that even well-meaning upgrades can become ideological trench warfare. Adding post-quantum migration to the mix would not magically make the politics cleaner. If anything, it would probably do the opposite.
What Bitcoin users should take from this
Regular users do not need to panic. Bitcoin has not been broken, and Anthropic’s findings did not suddenly create a live threat to Bitcoin’s current signature system. But protocol developers, wallet makers, and security engineers should absolutely keep post-quantum planning on the roadmap.
The right posture is not blind alarmism and not lazy complacency either. Bitcoin should be prepared for a future where quantum computers matter, while still being ruthlessly skeptical of any rushed upgrade that could weaken the network before that future arrives.
That is the real tension here. Mow is not saying quantum risk is fake. He is saying premature migration could be just another way to hand attackers an easy win. Guillemet is not saying lattice cryptography is doomed. He is saying the industry should stop pretending that algorithm swaps are one-and-done events. Both are right to a point.
The last thing Bitcoin needs is a shiny post-quantum fix that turns into a classic example of “congratulations, you defended against the future and got wrecked by the present.” That would be a very expensive joke.
Key takeaways
-
Should Bitcoin rush into post-quantum signatures?
No. Samson Mow argues that moving too early could introduce more immediate classical attack risks before quantum computers are actually a practical threat. -
Did Anthropic break Bitcoin’s cryptography?
No. Anthropic’s research found attacks against weakened cryptographic targets, including reduced-round AES and HAWK, not Bitcoin’s current ECDSA or Schnorr signatures. -
Does the HAWK finding mean lattice cryptography is broken?
No. Charles Guillemet said the result targets HAWK’s newer assumptions, not lattice cryptography as a whole. It is a warning about scrutiny, not a collapse of the field. -
What is crypto-agility?
It is the ability to swap cryptographic algorithms without redesigning a whole system. In practice, that may become essential as new attacks and new standards keep emerging. -
What is the biggest challenge for Bitcoin’s quantum future?
The upgrade itself. Bitcoin has to balance quantum resistance, current security, transaction size, wallet compatibility, and consensus safety without creating a new disaster while trying to prevent an old one.
Related coverage has also tracked the broader pressure on Bitcoin’s cryptography side, including Anthropic AI Finds New Cryptographic Attacks, Raising and Anthropic finds new cracks in the tech meant to guard Bitcoin from Q-day. For a deeper look at the practical headaches, see Bitcoin's Post-Quantum Cryptography Transition: Challenges, and for a more skeptical take on the timing, revisit Bitcoin Quantum Debate: Samson Mow Warns Hasty Fixes Risk more than future threats.
For readers weighing the broader debate, Samson Mow Debunks Quantum Fears: Bitcoin’s Unbreakable and AI-Driven Cryptanalysis: Advances in Attacks on HAWK and provide useful context on how AI, quantum prep, and old-fashioned cryptographic humility are colliding in public view.
Further reading
For a closer look at the AI-cryptography angle behind this debate, this is worth a skim:
