Bitcoin's post-quantum plan faces AI-assisted cryptanalysis reality check for builders

Anthropic's Claude Mythos Preview model discovered an attack on HAWK, a candidate post-quantum digital signature, in just 60 hours at roughly $100,000 in compute. While Bitcoin's current elliptic curve signatures are unaffected, the finding accelerates the timeline for post-quantum migration planning and underscores that AI can now stress-test cryptographic proposals faster than human experts.

What happened

Anthropic reported that Claude Mythos Preview halved the effective key strength of HAWK, a proposed replacement for digital signatures that protect online banking and web payments. For the smallest parameter set, the expected cost of recovering a key fell from about 2^64 operations to 2^38. The attack took 60 hours and about $100,000 in computing costs against an algorithm that had survived two years and two rounds of expert human review. Larger keys remain impractical to attack, but doubling key sizes to compensate would remove most of HAWK's appeal.

The same research produced 200x to 800x improvements on a deliberately weakened version of AES, the cipher used across the industry to encrypt wallet files. Against Poseidon, the hash function underpinning many zero-knowledge proof systems, the model found smaller improvements under tenfold. Anthropic disclosed the attack to HAWK's authors in June and coordinated publication with NIST's public mailing list.

Why AI builders should care

This changes the risk calculus for any system relying on post-quantum cryptography. AI models can now find classical weaknesses that human reviewers missed, and they do it in days rather than years. For builders of crypto protocols, wallets, or any infrastructure that will need to migrate to quantum-resistant algorithms, the implication is clear: cryptographic evaluation cycles are accelerating. A candidate algorithm that passes human review today could be weakened by an AI-assisted attack tomorrow.

BIP-361, the companion proposal to Bitcoin's quantum-resistant address plan, argues that the migration window is closing because cryptographic attacks are improving by up to 20-fold. Anthropic's results align with that trend, with a model behind it. Builders should assume that any candidate algorithm could be stress-tested by AI, and plan for faster iteration cycles.

Practical implications

For crypto developers, protocol agility is now a first-class requirement. BIP-360, the proposal to give Bitcoin quantum-resistant addresses, already specifies three NIST-standardized algorithms and includes several deliberately so users have fallbacks if one is later broken. The Zcash upgrade activated this week introduces a new shielded pool designed to remain recoverable if quantum computers become available. These examples show that proactive migration planning is feasible.

However, verification remains expensive. Claude initially refused the AES problem, telling researchers it was "genuinely hard." After three short prompts, it produced a billion output tokens over three days and found the improvement. Verifying the result took two Anthropic researchers nearly a month. Builders should invest in automated verification tools and consider that AI-discovered weaknesses may require significant human effort to confirm.

Caveats

HAWK is not publicly deployed anywhere, and Bitcoin does not use it. The attack targets only the smallest parameter set; larger keys remain secure. The AES results were on deliberately weakened versions, not the full cipher. Poseidon improvements were under tenfold. Nothing in this research affects Bitcoin or ether currently, as both secure transactions with elliptic curve signatures, which neither attack targeted. The findings are part of ongoing evaluation and do not represent an immediate threat.