Mark Boyer

Crypto's got a bunker. Most companies haven't got a list.

One of Ethereum's own researchers has told crypto holders to get ready for “bunker mode”. Which isn't what you want to hear from the people who built the vault.

For years the threat to the maths behind Bitcoin had a rough date on it. Quantum computers, some time in the 2030s, so everyone had a decade to worry about it properly.

Then last week OpenAI published a pile of new maths its own model had worked out. And Justin Drake, at the Ethereum Foundation, said it's now reasonable to brace for the wallet maths breaking before the quantum computers even turn up. Vitalik Buterin reckons there's a "good chance" AI breaks some of the newer, quantum-proof maths within about two years.

I wrote about this months ago as a quantum problem with a long fuse. So I'd love to say I called it, but it turns out it might have two fuses.

What's arrived isn't the break. It's the bunker.

But nothing's actually been broken. Coinbase's head of cryptography says there's no evidence whatsoever, calls it fear mongering, and he might well be right. So what's arrived isn't the break. It's the bunker.

And the bit that bothers me isn't Bitcoin. It's everything else that runs on the same kind of lock, which is most of what I've ever been responsible for. The VPN, the payroll file, the backups in a cupboard, and every contract that says "encrypted at rest" without saying how.

When Log4j landed, the fix took an afternoon. Finding everywhere it lived took weeks.

I've been through a smaller version of this. And I still wouldn't swear we found it all.

The hard deadline is the list

And the UK's cyber security centre has already set the homework. Swap the locks by 2035, and by 2028 just work out where they all are. That second deadline is the hard one, because almost nobody has a list.

Crypto's got a bunker. Most companies haven't got a list.

Take it further

An inventory nobody owns is an operating model problem, not a security one.