BUNKER

AI may break elliptic curves before quantum does, so we built vaults to survive the post-AI era. Bunker mode for Solana: SHA-256 only. Live on mainnet.

[BUNKER @use_bunker]

AI may break elliptic curves before quantum computers do. The fix being floated is "bunker mode": move funds to fresh addresses whose public keys hide behind a hash.

On Solana that can't work. Your address is your Ed25519 public key, exposed from day one. There's no fresh address to run to.

So we built Bunker. It doesn't hide a key. It removes it.

• A vault lives at a program-derived address. No private key exists for it, so there's nothing for AI or a quantum computer to recover.
• Funds move only with an LMS signature (RFC 8554, NIST SP 800-208) that the program verifies on-chain. SHA-256 alone: no curves, no lattices.
• Each vault key has 1,024 one-time signatures and the address never changes. Rotate to a fresh key without moving anything.
• Hold, send, swap through Jupiter, earn with liquid staking and launch tokens from inside the vault. Every signature reads as one plain-English sentence.

What it doesn't cover yet: your wallet still pays fees with Ed25519, the program's upgrade key is Ed25519 until it's made immutable, and validators still run on elliptic curves.

Live on Solana mainnet: https://t.co/iy6py9L6eA

BjDqeXf3K6qLidvdhZeJUj3QQ93bndcYT1bs58SUpump

[Justin Drake @drakefjustin]

Today I call upon the blockchain industry to calmly begin planning for "bunker mode". My personal recommendation is to set in motion a controlled mass migration of assets to fresh addresses, i.e. addresses whose pubkeys remain hidden behind a hash.

Holders, starting with large and sophisticated ones, should consider moving the bulk of their funds to addresses that have never signed a transaction. And when they do sign one, they should also move remaining funds to a new address (possibly generated from the same seed phrase).

Don't rush. While I believe there is cause for action a rushed migration would do more harm than good. Don't panic either. Moving assets to protected addresses is a simple, preventative step which does not require new cryptography or new wallets.

IMO it is now reasonable to brace for the possibility that ECDSA breaks before qday, in the worst case in months not years. By "break" I mean fast private key recovery (e.g. in one week) on available hardware (e.g. a large GPU cluster).

Recent days have been humbling for human mathematical intuition. Long-held, unquestioned hypotheses have fallen. This includes the n log(n) bound for integer multiplication and the 3SUM conjecture. In hindsight, May's unexpected disproof of the Erdős unit distance conjecture was our warning shot.

Yesterday's OpenAI drop made it clear that mathematical superintelligence is upon us. They say there are weeks where decades happen. We are about to live through weeks where centuries of mathematical progress happen. Could our magic 64-byte ECDSA signatures be too good to be true? Was it just security through obscurity all this time?

Elliptic curves feel especially vulnerable to superintelligence. Curves carry rich structure, with room for fancy tricks like Schoof, Frobenius, pairings. (By contrast, hashes are designed to minimise algebraic structure.)

Separately, as Ewin Tang can attest, an efficient quantum algorithm sometimes foreshadows an efficient classical one. We should be open to the possibility of a classical counterpart to Shor that breaks elliptic curves and RSA at once.

Also noteworthy is the striking under-representation of cryptographic breakthroughs among the 722 mathematical results OpenAI published. I've witnessed first-hand the US government censoring academic quantum cryptanalysis results. Backroom interventionism is my base case.

I urge large, sophisticated actors to lead by example. Project11's "risq list" (bitcoin-risq-list.projecteleven[.]com) is a great tracker of exposed BTC pubkeys. Binance, Bitbank, Robinhood, Bitfinex, and Tether have an opportunity to harden their cold storage. Next month I'll address institutions in London in a live Q&A (forum.ethereuminstitutional[.]org/london-2026).

Again, please do not rush. Wallets holding under 50 BTC enjoy partial cover from "Satoshi's shield", i.e. his 20K exposed addresses that hold 50 BTC each. Load-bearing signers like oracles and L2 security councils should consider rotating ECDSA pubkeys with every signed message and/or multi-signing with a hash-based schemes like SPHINCS.

Exiting bunker mode safely will require post-AI cryptography. My inclination is to go all-in on hash-based cryptography and avoid structured mathematical assumptions entirely, whether from curves, lattices, or isogenies. A single battle-tested hash (e.g. from the SHA or BLAKE families) yields plausible post-AI security.

The Ethereum roadmap on strawmap[.]org fully embraces hash-based cryptography with end-to-end formal verification as a response to the quantum threat. Those timelines must now be revisited and accelerated in light of mathematical superintelligence. I'll be pushing for maximum defensive acceleration.

[BUNKER @use_bunker]

https://t.co/8WegP191KA check out our code here

[BUNKER @use_bunker]

For those who are new, here is how to use the vaults!

[BUNKER @use_bunker]

How a Bunker vault signs, in 40 seconds.

One key, 1,024 one-time leaves. Every action spends one. A 2,508-byte SHA-256 signature crosses 3 transactions and is verified before anything moves. A spent leaf never signs again.

https://t.co/RjKx2hI9wa

[BUNKER @use_bunker]

understand it more here https://t.co/LLjbnDzsl1

[BUNKER @use_bunker]

Just used all the creator rewards to buy back and lock 🔒

We encourage everyone to check out and use the post quantum vaults

https://t.co/fB9oLpTeG2

[BUNKER @use_bunker]

Why only once?

A hash-based one-time key reveals part of its secret every time it signs. Sign two different messages and it starts to leak.

So each Bunker key holds 1,024 of them, and the program never lets one sign twice.

BjDqeXf3K6qLidvdhZeJUj3QQ93bndcYT1bs58SUpump

[BUNKER @use_bunker]

Agreed.. no fear, just ship. So we shipped.

Bunker is a vault protocol on Solana mainnet, built for the post-AI era:

• Vaults live at program-derived addresses. No private key exists for them, so there's nothing to recover.
• Funds move only with LMS signatures (RFC 8554, NIST SP 800-208) on SHA-256 alone. No curves, no lattices. As Lindy as it gets.
• Each key has 1,024 one-time signatures. Rotate to a fresh key anytime without moving funds.
• Every signature reads as one plain-English sentence, so you see exactly what you approve.
• Hybrid mode adds an Ed25519 co-signer if you want two signature systems.
• Send, swap through Jupiter, earn with liquid staking and launch tokens, all from inside the vault.

Opt-in: your wallet keeps working, and you move only what you choose.

https://t.co/iy6py9L6eA

BjDqeXf3K6qLidvdhZeJUj3QQ93bndcYT1bs58SUpump

[toly 🇺🇸 @toly]

Cryptography doom == ai doom.

It’s fear based on uncertainty from smart people unable to predict the future. It’s not fear based on certainty from smart people with real world repeatable measurements.

Fear is a great sales tool though. Wallet devs should be shipping pqc solutions now and establishing the processes of managing those secrets safely and rotating those protocols safely and getting implementation Lindy and robustness under their belt. Thats the great business opportunity underneath all this.

[BUNKER @use_bunker]

👇👇

[BUNKER @use_bunker]

Fun fact: a single Bunker signature (2,508 bytes) is more than twice the size of an entire Solana transaction (1,232 bytes).

Here's how it still gets on-chain 👇 https://t.co/zKsHF714YS

[BUNKER @use_bunker]

Try to get in our vaults we dare you🤣🤣 @IBM @AnthropicAI @IonQ_Inc

[BUNKER @use_bunker]

read more about the docs here https://t.co/wj42QuyhVy

[BUNKER @use_bunker]

Appreciate it. One correction, because it's the whole point:

On Solana, a fresh address hides nothing. The address is the Ed25519 public key, so it's exposed from day one. Bunker mode as Drake describes it can't work here. (Solana signs with Ed25519, not ECDSA. Both are elliptic curves.)

So Bunker takes a different route:

• A vault lives at a program-derived address. No private key exists, so there's nothing to recover, by AI or by quantum.
• Funds move only with a one-time LMS signature (RFC 8554) over SHA-256, verified on-chain.
• Each vault key holds 1,024 one-time signatures. When they run low you rotate the key, not the funds: same address, nothing moves.
• Before you sign, the exact bytes are decoded into one plain sentence.

Not new cryptography, and not just key hygiene either: hash-based signatures, the oldest and most conservative kind there is.

https://t.co/iy6py9L6eA

[0xNomad @0xNomad33]

Crazy $BUNKER hasnt bonded yet Bunker mode is probably the hottest crypto topic on X right now and $BUNKER is basically built around the exact problem people are talking about.

The idea is simple: keep funds in fresh addresses where the public key hasn’t been exposed yet, then rotate again after signing.

No fancy new cryptography, just better key hygiene and less pubkey exposure.

If ECDSA ever becomes a real issue, this could matter a lot.

BjDqeXf3K6qLidvdhZeJUj3QQ93bndcYT1bs58SUpump

[BUNKER @use_bunker]

Two locks, two kinds of math.

In hybrid mode, every withdrawal, rotation and close needs your SHA-256 hash key AND an Ed25519 cosigner.

Ed25519 breaks? The hash key still holds. Your 24 words leak? The cosigner still holds.

Turn it on when you open a vault

https://t.co/X0GYVJPHoj

BjDqeXf3K6qLidvdhZeJUj3QQ93bndcYT1bs58SUpump

[BUNKER @use_bunker]

Check us here here: https://t.co/CWWDIXeUno

[BUNKER @use_bunker]

Agreed. And on Solana no address hides its public key, so "move to a fresh address" doesn't help.

So we built the wallet side: vaults that sign with SHA-256 only.

Check us out on @Pumpfun here👇

BjDqeXf3K6qLidvdhZeJUj3QQ93bndcYT1bs58SUpump

[CoinMarketCap @CoinMarketCap]

LATEST: 🔒 Europol warns crypto wallets, not blockchains themselves, are the main weak point against future quantum attacks.

[BUNKER @use_bunker]

How the bunker vault compares to regular solana wallets 👇

BjDqeXf3K6qLidvdhZeJUj3QQ93bndcYT1bs58SUpump

[BUNKER @use_bunker]

We bought back and locked more supply using rewards
https://t.co/NR11tO7yPf

[BUNKER @use_bunker]

One correction for Solana: a program-derived address has no private key at all.

A Bunker vault sits in your "alive" column: funds move only with a SHA-256 (LMS) signature. Fee payers are still Ed25519, so keep them small.

$BUNKER

[奶奶 capital @testinprodcap]

If classical discrete log breaks. You really want to short ai?

Dead now
• Solana, Algorand: address = public key
• Monero: forgery, hidden inflation, deanonymization
• ETH proof-of-stake: BLS/KZG forgeable
• Any ETH account that has sent a tx
• ZEC Sapling + leftover Orchard

Dead on BTC too
• Reused addresses
• P2PK (early ~1M BTC)
• Taproot
• Shared xpubs
• Lightning

Frozen but alive
• Unspent hashed addresses (BTC, ETH receive-only, ADA, XRP, LTC): safe at rest, but spending = bots/miners steal it
• ZEC Ironwood: funds recoverable via a future fork, but privacy is lost

[BUNKER @use_bunker]

Blockchains mostly need the half that survives: signatures. Those can rest on hashes alone today.

We built that for Solana: a vault whose signatures are LMS over SHA-256. No curves, no lattices.

BjDqeXf3K6qLidvdhZeJUj3QQ93bndcYT1bs58SUpump

[Matthew Green @matthew_d_green]

@kmad @matthew_pines Well, encryption specifically.

[BUNKER @use_bunker]

Recovery mode is the right protocol answer, and Solana's seed-proof plan is one. But it needs a fork and coordination. A vault needs neither. Bunker covers the gap on Solana today: signatures that rest on SHA-256 alone.

$BUNKER

BjDqeXf3K6qLidvdhZeJUj3QQ93bndcYT1bs58SUpump

[Haseeb Qureshi ＞|＜ @hosseeb]

Hiding your coins in a bunker won't save your blockchain. Given the risks AI poses to fundamental cryptography, I propose every chain implement a "cryptographic recovery mode": https://t.co/3qXwrQLvFu