Bitcoin’s quantum bet is wobbling: Anthropic’s Claude Mythos Preview AI model broke HAWK, a post-quantum signature scheme audited by human cryptographers for two years, in just 60 hours, reigniting urgency around the network’s cryptographic migration.
🔑 Key takeaways
- Anthropic’s Claude Mythos Preview halved the effective key strength of HAWK’s smallest parameter for $100,000 in compute.
- The attack cut the cracking cost from 2^64 to 2^38 operations and also improved AES by a factor of 200 to 800.
- BIP-360, the proposal for quantum-resistant Bitcoin addresses, was merged into the official repository in February 2026.
- Google Quantum AI estimates roughly 500,000 physical qubits could break Bitcoin’s cryptography, about 20 times less than previously thought.
- About 6.9 million BTC in wallets with exposed public keys are theoretically vulnerable, according to the Coinbase panel.
Claude Mythos breaks HAWK in 60 hours for $100,000
In early July 2026, Anthropic announced that its Claude Mythos Preview model had identified a flaw in HAWK, a digital signature scheme under consideration for post-quantum standardization. The attack was carried out in roughly 60 hours at a total compute cost of $100,000. It cut the effective key strength of HAWK’s smallest parameter in half, lowering the work needed to break it from 2^64 to 2^38 operations.
HAWK had previously survived two years and two rounds of expert review by human cryptographers. Larger key parameters remain impractical to attack for now, but doubling them to compensate would erase much of what made HAWK attractive in terms of signature compactness.
| Target | Initial key strength | After attack | Gain |
|---|---|---|---|
| HAWK (parameter 1) | 2^64 | 2^38 | ÷ 2 (~26× less work) |
| AES (weakened version) | n/a | n/a | × 200 to 800 |
| Poseidon (ZK hash) | n/a | n/a | < × 10 |
AES and Poseidon also in the crosshairs
The same research produced improvements on a deliberately weakened version of AES (Advanced Encryption Standard), the cipher used to protect Bitcoin wallet files, with improvement factors of 200 to 800. Against Poseidon, the hash function underpinning many zero-knowledge proof systems, gains were more modest, below a factor of ten.
Notably, the model initially refused the AES problem, telling researchers it was « truly difficult » and that there was « nothing easy to find. » After three short prompts, it produced a billion output tokens over three days and identified the improvement. Verification took nearly a month for two Anthropic researchers, and disclosure was coordinated with the NIST public mailing list.
BIP-360: Bitcoin’s quantum defense takes shape
None of this research affects Bitcoin or Ether today. Both networks secure transactions with elliptic curve signatures (ECDSA), which were not the target of the attacks. HAWK is not among the schemes contemplated for Bitcoin’s post-quantum migration.
BIP-360, the proposal to give Bitcoin quantum-resistant addresses, was merged into the official Bitcoin Improvement Proposals repository in February 2026. It introduces a new output type, Pay-to-Merkle-Root, which hides public keys and supports future post-quantum signatures. A working testnet launched in March 2026, gathering more than 50 miners, over 100,000 processed blocks, and contributions from more than 100 cryptographers.
BIP-360 specifies three algorithms already standardized by NIST and deliberately includes several fallback schemes in case one is broken later by classical or quantum advances. The Taproot upgrade, activated in 2021, already provides useful base architecture: each transaction can configure hidden spending conditions requiring quantum-safe verification.
BIP-361 proposes freezing more than a third of supply
BIP-361, the companion proposal, argues that the migration window is closing because classical cryptographic attacks are improving by 20× or more. It proposes freezing more than a third of Bitcoin’s supply: about 6.9 million BTC whose public keys are already visible on the blockchain. Roughly 1.7 million of those BTC sit in legacy formats with permanently exposed public keys, and another 1 million are concentrated in just 11 large addresses that could serve as an early warning system.
« If these wallets are drained without explanation, it could signal that a powerful quantum computer is online. »
Coinbase Quantum Advisory Panel position paper
Google and Caltech: 500,000 physical qubits could suffice
On March 31, 2026, researchers at Google Quantum AI published a white paper showing that breaking the elliptic curve cryptography protecting Bitcoin and Ethereum could require fewer than 500,000 physical qubits, roughly a 20× reduction versus prior estimates that placed the figure in the millions. The paper was co-authored by Justin Drake (Ethereum Foundation), Dan Boneh (Stanford), and six Google researchers led by Ryan Babbush and Hartmut Neven.
« My confidence in q-day by 2032 has risen significantly. »
Justin Drake, Ethereum Foundation
The developed quantum circuits use either fewer than 1,200 logical qubits and 90 million Toffoli gates, or fewer than 1,450 logical qubits and 70 million Toffoli gates. On a superconducting architecture with standard assumptions, these circuits can run in minutes. The team used a zero-knowledge proof generated via the SP1 virtual machine to verify the claims without revealing attack details, a world first in quantum cryptanalysis. Google’s most advanced qubit chip, Willow, has 105 physical qubits.
A separate paper from Caltech, Oratomic, and UC Berkeley, published the same day, showed that a different hardware approach (trapped-ion architecture) could lower the bar to 10,000 to 26,000 specialized qubits. The two teams do not contradict each other: one optimized software, the other improved hardware efficiency. For an « on-spend » attack on Bitcoin, a superconducting quantum computer could complete the crack in about nine minutes, with roughly a 41% chance of outrunning the original transaction to confirmation.
Migration calendar: 2035 for NIST, 2029 for Ethereum
Coinbase’s independent Quantum and Blockchain advisory panel, including Professor Scott Aaronson (UT Austin), Dan Boneh (Stanford), Justin Drake (Ethereum Foundation) and Yehuda Lindell (Coinbase/Bar-Ilan), published a position paper warning that the industry must migrate now.
| Standard | Use case | Signature size | Status |
|---|---|---|---|
| ECDSA (current Bitcoin) | Transaction signatures | 64 bytes | Classical |
| ML-KEM | Public-key encryption | n/a | Post-quantum |
| ML-DSA | Digital signatures | 2,420 bytes (~38×) | Post-quantum |
| SLH-DSA | Hash-based signatures | ~17,000 bytes | Post-quantum |
ML-DSA signatures roughly 38 times larger could reduce Bitcoin transaction throughput by 90% or more. The panel recommends a « 1-of-2 signature » approach: a wallet registers both a classical elliptic curve key and a post-quantum key, but transactions need only one valid signature.
NIST finalized three post-quantum standards in August 2024 and set a 2035 deadline for completing migration. Executive Order 14144 (January 2025) folded those deadlines into U.S. federal cybersecurity requirements. Google targets 2029 internally. Ethereum launched pq.ethereum.org as a dedicated hub and also targets 2029. Over at Zcash, a new shielded pool designed to remain recoverable against quantum computers was activated just before Anthropic’s announcement, showing that the post-quantum migration race is now underway across the broader ecosystem.
A cryptographic countdown is underway
Anthropic’s attack on HAWK is not a disaster for Bitcoin, but it illustrates a deeper trend: classical cryptographic attacks are improving faster than standardized defenses. Generative AI is joining the cryptanalyst’s toolkit, and the pace of discovery now outstrips traditional human review cycles. For Bitcoin, the window for post-quantum migration remains open, but BIP-360, BIP-361 and the progressive activation of Taproot show the community is taking the threat seriously.
Near-term scenarios will hinge on three variables: the real arrival date of a cryptographically relevant quantum computer (the so-called « q-day »), the speed of new-address adoption by holders, and developers’ ability to ship the hard fork on schedule. If nothing breaks in the meantime, 2035 remains a realistic target. If a first post-quantum signature algorithm falls before then, migration will have to accelerate sharply, and the security of those 6.9 million exposed BTC will shift from theoretical concern to operational emergency.
Sources
This article is published for informational and educational purposes only. It does not constitute investment advice. Do your own research (DYOR) before making any decision.
