人工智能、量子技术与加密货币加密技术的真相

It’s nice to have everyone here. This could be a cool stream. I appreciate you joining. Here’s my plan and the context for where I’m going and why I want to do this stream.

First off, I know panels can be a bit awkward, so to start, I’ll just introduce everyone. I’m going to ask everyone a question to get some preparation in first, and then we’ll call it a free-for-all. Anyone can get involved and cut someone off.

I’m here to moderate. Tulip King is my quantitative moderator, and I have 3 people here who are much smarter than me, of course, who will help us figure out what’s going on. So let me be brief: we are live. We probably have, I would say, the largest flow of cryptocurrencies—probably 5–6,700 simultaneous active traders, who are probably trading Zcash at some point, but who trade cryptocurrencies all day long. Of course, we’re watching what’s happening in the market.

We read an article by Justin Drake. We understand it on a general level, but I think some of the nuances are getting lost, which is why there’s a lot of high-level discussion going on on the timeline. I’d like to simplify it a bit, explain it in simple terms, make it make sense to most people who don’t have a deep technical understanding of what’s going on, and hopefully it will reach a lot of people.

1. Threadguy explains the cryptography panic

Here’s what we’ll do. I want to give you my understanding of what’s happening as best I can, and then I’ll let you present it. All right. Are we live? We are live. There are about 700 people here. This is amazing. That’s great.

Here’s my understanding of what’s happening now, okay? We have cryptography that is essentially secure forever. It allows your Bitcoin public key, which holds your coins, not to be instantly cracked. It’s encrypted by some huge mathematical equation that would take the average person an infinite amount of time to crack, or would be far beyond their capabilities.

We don’t really know how hard it is, but it’s much harder than any human can do. That’s why our coins have been protected for so long. From what I understand, there are 2 threats.

The biggest one that everyone has always heard about is quantum. I can’t explain to you how a quantum computer works, but I understand there is some quantum algorithm that could theoretically crack Bitcoin’s public key. We don’t currently have the capability to run it, or even close to the hardware needed, and we’re not even sure if it’s theoretically possible. Some people think so; others don’t. Discussions are ongoing on both sides.

I understand that AI potentially accelerates quantum computing because there are 2 forces acting on it: the hardware and the algorithmic side. AI acceleration could theoretically reduce the algorithmic requirements, like the number of qubits needed to run these algorithms, so to speak. It could potentially speed up and compact the hardware required to run this upcoming doomsday Q-Day to crack these public keys. Obviously, I’m not going to explain it very well, but I’ll do my best.

That’s quantum fear number 1. The second one is brutal, manual decryption, so to speak. As Tulip King explained to me, it would take about a theoretical 1,000 years to break the encryption that protects most cryptocurrencies by decrypting them by hand.

But the fear is that in the last few months, thanks to what ChatGPT and these LLMs have been able to achieve in terms of accelerating mathematics, what we thought would take 100 years, maybe 10 years, maybe a few years—Justin Drake is talking about “Bunker Day” and saying, “You know what? Maybe it will be possible in a few months to crack what we thought was forever unassailable.”

So we have these 2 impending forces of doom—quantum and brute-force decryption—working against the cryptography that has protected our coins forever. The analogy I used earlier in the stream is that, if anyone has seen Naruto, Gaara has sand protection. It’s like he has this base sand that has protected our valuable multitrillion-dollar assets forever, and it stays the same. It’s flat, while as the show goes on, you have more powerful attacks and more powerful opponents. No one has ever topped him, but we’re flat and they’re accelerating. Of course, you have every reason to be concerned.

So here’s my explanation of what’s happening now, on a scale of 1 to 10. I think we have the best panel for this. ZK Dragon, I’m told you’re the smartest cryptographer in the world. Illia Polosukhin co-authored the canonical LLM Transformer paper from Google, and we have Mert.

I’ll start by asking each of you an introductory question. I hope we can build on this, and then people can just [expletive], “You’re telling me my explanation was terrible?” Then we can just break it down.

2. why cryptography hasn’t broken

ZK Dragon, I’ll start with you. Can you get us on the same page and explain why crypto has worked up to this point, why it matters, what our risk has been through 2026, and where we are now?

Yes, of course. Cryptography is kind of the art of taking a hard problem that we don’t know how to solve and doing something useful with it.

So what are hard problems? There’s such a thing as factorization. I’m giving you a damn big number. Can you figure out which 2 numbers are the factors of that number—the product of 2 prime numbers? Can you find those 2 prime numbers? How can I use this to do encryption, signatures, and so on? This is RSA.

There’s also something called elliptic curves, or the discrete logarithm on an elliptic curve. If you know what a logarithm is, we calculate the logarithm of another type of number. Well, if it’s difficult, how do you use it to create signatures and encryption?

Cryptography does this, and now, to break it, you basically just have to understand how hard this problem is. How hard is it to break RSA? How hard is it to break the discrete logarithm on an elliptic curve?

Interestingly, what caused the panic? OpenAI threw out about 770 results that were like mathematical reasoning results. But none of these results were even close to the level of analysis of any cryptographic problem.

The question becomes: Do you think all of these problems—RSA, the elliptic-curve discrete logarithm problem, and the factoring problem—are really hard, or could a smarter human or AI crack them?

The standard answer is, “Look, we’ve put so many hours into it that we have conferences every year about people trying to crack it and failing.” The NSA has the greatest mathematicians in the world. They haven’t made much progress on any of these issues. These are security issues. We keep trying, and we keep failing.

Then people see these AI results and notice that the AI literally did nothing to crack the core of the difficult part of the RSA algorithm or elliptic curves. So there is a gap. Will these AI models ever crack it?

I think the conclusion is that, no, actually, these things are probably pretty hard. We haven’t even achieved a 20% improvement with all these world-class models and so on.

To give you an example of how difficult these things are, let’s take Bitcoin. With Bitcoin, you have this economic incentive for lots of people to produce hashes, right? If you take all the hash rate from all the custom ASICs in the world for Bitcoin, you would need literally 1 trillion times more computation to start breaking the discrete logarithm on elliptic curves, based on what is known today.

A trillion times more.

Yes, that’s a generally accurate estimate. Let’s say you have the exact same hardware expansion as Bitcoin, dedicated to breaking elliptic curves. That’s a trillion times more.

3. how close is AI to cracking it?

That’s a huge number. I’ll throw this to Illia Polosukhin. I imagine that, at least on this panel, or at least out of everyone I’ve talked to, you might have the best understanding of the pace of LLM acceleration right now. What is your timeline, if you have one, for encryption-breaking AI, if the state stayed exactly as it is now and nothing really changed?

I agree with ZK Dragon. I think it’s about how much intelligence we put into solving the problem, right? Working hours. Compared with a lot of the problems that OpenAI has worked on effectively, which maybe had 1 person working on them for 20 years, there may not be many people in the world working on them. That’s how mathematics works. Typically, a few people in the world work on problems throughout their lives.

Cryptography is in a completely different situation, right? Many people do this. A lot of money was spent. Outside of blockchain, there is a very large economic incentive to be able to hack into other people’s data. This is of great interest to every agency in the world.

So I think the amount of comparative intelligence applied to solving this problem is already high. AI is also the fastest way we’ve seen to scale applied intelligence to any problem. Of course, we see some improvements and algorithmic improvements. But as ZK Dragon said, there’s actually a lot of slack, right? A lot of computation is required.

Even if we get a 10-fold improvement, that goes from 1 trillion times to 100 billion times compared with Bitcoin’s calculations. Huge improvements are needed to solve this problem that many people have tried to solve.

At the same time, ZK Dragon and I were talking about this in general and how the blockchain space has historically tended to become ossified, where you essentially say, “Hey, look, if this blockchain exists and nobody’s hacked it and nothing’s broken, then let’s not change anything.”

This is such a trend. Of course, Bitcoin and Ethereum have started to move in this direction.

I think it’s the complete opposite trend from what we’re seeing in a world where intelligence is accelerating. We need networks that can adapt effectively on their own, right? Ideally, they would use that intelligence. So even if there are some results, it won’t be like, “Okay, everything’s broken now.” It will be more like, “Great, we’ve abandoned this problem; maybe it’s become a lot easier.”

We still need, as they say, hardware ASICs specifically designed for this problem and built on a mass scale. So it will be something like a well-known problem that is now becoming a problem that is ahead of its time. We need the ability to adapt and adjust to it. I think it’s similar to evolution, right? The organisms that adapt best will survive.

I think, just like with blockchains, we need the ability to adapt and adjust, and the ability to add new cryptographic features, rotate keys, and update those things. For example, the Chrome browser, which many users use, is already adapted and supports post-quantum cryptography. They introduced it earlier this year. Did anyone need to know this? No, right? It’s just a standard update.

Normal software is usually updated as new information, performance improvements, and security warnings become available. So overall, I think blockchain needs to continue to adapt to threats and use artificial intelligence to be on the offensive on those issues.

How much more worried are you about impending doom, perhaps before and after we could use OpenAI to solve the Millennium Prize Problem, which seemed like the moment math showed up on my timeline every day? Was this a huge acceleration—a step function—or, for those really in the know, have you known about this for a while?

For me, I was talking about the cyber side of this over a year ago, or even before that. I think that was actually a bigger problem for blockchain last year with the hacks, right? People are now using AI to scale their ability to hack things. This is a much more practical problem that actually affects users every day.

I think math is just really exciting to talk about, and that’s why it’s become something of a hot topic. So, yeah, no, I don’t like it, but I’m not too worried about it, just based on these results.

I see. And then, Mert, I want to ask you—

Oh, go ahead, Dragon. I was just saying that on the math side, some of my friends with PhDs, or people doing their postdocs, are discouraged by their professors from working on the Millennium Prize Problems because it’s like, “Oh, it hasn’t been done for decades or centuries. Don’t waste your career. You will ruin your chance of getting permanent employment.”

So even though these are famous math problems, I don’t really believe that people are working on even the most famous ones that intensely. Like, one of the Millennium Prize Problems that was solved by a man decades ago—that was the whole point. He had to solve it in secret to stop being ridiculed.

Really? Isn’t it academic prestige to solve one of these problems? If you solve it, that’s amazing, but no one is supporting you on this journey. As you go along, you get ridiculed the whole way, and if one day you succeed, okay, you’re a hero. But the whole process is a no-no. People tell you not to do it because the best talent in the world isn’t actively working on the other Millennium Prize Problems.

Exactly.

4. upgrading chains for quantum

Okay, that makes sense. That’s good; I didn’t know that. Mert, I want to ask you about the enhancement side. You think a lot about Zcash, and then you think a lot about Solana. Something that Tulip King explained to me—maybe you could give some nuance—is that if you take any network and go post-quantum, you add something else to it.

You can solve problem A by being post-quantum, but you potentially introduce problems B, C, D, E, and F that haven’t been thought of before because you’ve implemented this new mechanism. So what are your thoughts on an upgrade plan for Zcash or Solana, and does it need to be implemented? I remember you replied to one of my tweets and said that if something happens, Zcash will be the first to update and fix it.

What does that actually mean, and is that what you’re all thinking about right now? People who usually think about things like this—are they all very focused on this right now?

Well, let me get to it. Much has been said, but I just want to touch on it a little. First of all, I think it might be worth summarizing everything Dev, Illia, and you have said. They’re right. Broadly speaking, look at the problems that OpenAI was working on.

And, by the way, you introduced me as a person, but I was also doing my master’s thesis in mathematics. And yes, I’m still pretty [__]. However, I like math. Well, not just these issues. As a trader, what do you pay attention to? You’re looking at incentives, right? That’s true of anyone who makes a trade or invests.

The incentives for all the intelligence agencies in the world and all the nation-states to break fundamental cryptography are infinitely higher than the incentives to solve some niche math problem that, as Dev said, people are actively discouraged from studying. Even if you throw all these incentives at it, generally speaking, I would say the most likely outcome is a speedup of, let’s say, factoring a number, as Dev mentioned.

This is how cryptography works. Let’s say the hard problem is something like this: If you’re eating a meal—let’s say a stew or a roast—you’re trying to figure out what ingredients are in it and in what portions, right?

You’re right.

Generally speaking, if it were to speed up by, say, 15%, which I think would be a realistic scenario, then, as Matthew Green—who was the only one to say that public-key cryptography might be over—later wrote, you would realistically just increase the sizes of the parameters. That didn’t get as much attention as the first post.

Instead of n bits, maybe you could do n + 24 bits. You would just adapt the cryptography, and then you would have to update those systems to accommodate that.

Is this trivial for every network? Could this simply be updated?

I don’t like making general statements because everyone approaches it differently, but if the incentive is so strong that you’ll die if you don’t upgrade, then I’d say everyone would probably be able to upgrade.

And not to interrupt you again, but what are the implications of the update? Is it clunky or slower? Are there any side effects of this update? If you could just do it, wouldn’t everyone just do it?

I think this might go back to your first question, which is how this mechanically works in practice. The best-case scenario, of course, is that the network is a group of hyper-paranoid programmers who have been considering potential edge cases like this from day one. That’s why I say Zcash is in the best position to deal with this.

The first reason is that Zcash has a very limited scope, right? Its use case is kind of like—oh, it’s literally just a store of value. It is not programmable in the same way as Ethereum. It only does one thing, and it does it really well. So the risk is reduced.

That’s why I’m also against collateralized assets like stablecoins on Zcash or something like that, because you want to minimize risk. That’s the reason why, even 1.5 to 2 years ago, we were talking about Zcash being best positioned for quantum-resistant cryptocurrencies.

Having top cryptographers in the cryptocurrency space has its advantages because these people are constantly thinking about theoretical risks, right? In the case of Zcash, Dev can talk about the actual plan because he’s the one working on it. It will be much easier when you have a limited scope and build the entire network taking these edge cases into account.

Of course, with something like Solana, it’s a little more difficult. But I think we know for sure that Solana is probably the crypto network that has been improved the most after being field-tested. What I mean is that there were a lot of outages in 2022 and 2023, and then a major code rewrite that just happened. Now it can handle scale.

So Tulip King’s point is correct: if you update something, it may lead to other problems in the future. Or you have to compromise. That goes for all engineering, right? You just have to evaluate these trade-offs. Should you go to zero, or maybe reduce performance by 10% for about 6 months before you release the next update?

In my opinion, the only thing that matters is being prepared for extreme risk, right? When it comes to extreme risk, you either go to zero or you survive. If you survive, you can make additional improvements that will drive the network, which was more or less what we saw with Solana in 2022.

I think when it comes to crypto bugs, improvements, quantum risk, and all these different things, Zcash is the most prepared for it. I’m obviously biased.

One of the things we did when designing NEAR was to separate the cryptography from the account model. Compared to Ethereum, Solana, and Bitcoin, where the cryptography is encoded directly into the address, in NEAR the address is human-readable, like ilia.near or threadguy.near. Then your keys are assigned to that account.

These keys can now use any cryptography. We’ve supported both ECDSA and Ed25519 from the very beginning, right? Two types of standard cryptography. Earlier this year, we added lithium, which is network-based post-quantum cryptography, and we plan to add more. We can add hash-based cryptography.

Importantly, in response to your question or comment—“Hey, listen, if you add new cryptography to fix the previous one, what if you introduce new bugs?”—if people are worried about it, and I understand why, then at least in the current situation, they shouldn’t be. You could just require them all to be on your account and sign at the same time, right?

If you have something like a billion-dollar cold-storage facility, you’re probably not making transactions every second.

You're not trading meme coins on this, are you? It's your centralized exchange or custodian or whatever—your cold wallet. You can't just plug all of your cryptography into NEAR. You can have 4 or 5 different cryptographic keys and say, “Hey, listen, I'm only moving money if everyone signs off.” Correct? Now you're effectively protected against implementation problems of individual cryptographies, fundamental cryptographic problems, or quantum-computing problems, right? This is a fairly unique feature in NEAR.

On the implementation side, especially for post-quantum systems, the reason we only added it this year, even though we designed it in 2018, is because we didn't really have standardized cryptography until last year. Last year, NIST, the U.S. cryptography standards institute, developed the entire process. Developers probably know better: a multiyear process of effectively testing new cryptographic primitives. They unified 3 different schemes that are safe in post-quantum systems, and now there are implementations.

As I mentioned, the rest of the internet also uses ML-DSA, lithium curve. So it is more or less a standard used not only in cryptocurrencies. In fact, very few cryptocurrencies use it at the moment—only us. But it's used across the rest of the internet, and if you think about securing communications with different servers, that's where the world is heading.

Tulip King, before I let you go, I just want to ask 1 quick question. I want to ask these questions to the developers. Could you try to simplify this? I know you're generally optimistic, but how worried are we about quantum? And how worried are we about AI speeding up brute-force decryption? What is more disturbing, and how disturbing is it relative to the other?

5. what if OpenAI cracks cryptography tomorrow?

I'm not really concerned about the AI side of things, but maybe this gives some hope or insight. Let's assume we have a worst-case scenario. Worst-case scenario: OpenAI will publish a blog post tomorrow: “Listen, we know how to break elliptic curves 1 million or 1 trillion times—let's go crazy. A quadrillion times better than what's known. We'll release it publicly in a month.”

Okay, that means that even if someone had all the Bitcoin ASICs, it would still take them a long time. So then every network on every blockchain will immediately say, “Hey, tomorrow we're going to disable every elliptic-curve feature you want.” It depends on how the networks coordinate this, but all the curves should be down by the end of the month.

It turns out that every blockchain, except for early Bitcoin adopters, has the ability to recover its funds even if the elliptic curves are frozen. This trick is called a zero-phrase. Basically, everyone except MPC users will be perfectly happy with the right engineering. If you freeze the elliptic curves, you can still prove, using zero-knowledge proofs, “Hey, I know the seed phrase and the HD path, so I know the private key for this public key.” You can use that to recover your funds after a few months of being frozen.

It's like I'm jumping off the stack. So basically, if OpenAI came out right now and said, “We found a way to break this type of encryption that protects a trillion dollars of coins on the blockchain. We will publish in 30 days. Good luck,” you could basically pull the emergency lever and freeze the vast majority of coins and secure them.

Exactly. Exactly. What's the minimum warning required? Could it be done in a day? Could it be done in an hour? How long would it take? Do people have to give consent? What would happen to Satoshi's coins?

There are 2 questions. Satoshi's coins are a different situation. They can be frozen, but they probably can't be spent, because the trick that makes them available to everyone comes from seed phrases. All funds with seed phrases will be fine, but seed phrases were an invention that came later in blockchain history. Satoshi predates seed phrases. That's the problem.

I get it. Basically, nobody else predates seed phrases.

Perhaps from a coordination perspective, what will happen is that basically all exchanges, cross-chain networks, communication protocols, and trading platforms will shut down. Then it doesn't really matter when it's actually implemented on-chain, because it's going to be rolled back to the point where that decision is implemented.

Think about it from a blockchain perspective, right? What most computing power or stake would consider to be the blockchain. Problems arise from boundaries, right? Problems arise from reconciling the state of the blockchain with the rest of the world, other blockchains, or exchanges. The response really has to happen on those platforms.

That's why Near and Tend, as a cross-chain platform, needs a lot of information to reconcile all these different chains. Referring to some of the comments you made a few weeks ago, that's something we can address. But that's where the threats lie, and you have to counter them by being very proactive. You need systems that are as intelligent as possible.

Can I just interject here? I wanted to summarize what these guys said. Unlike Justin Drake's suggestion in his post, it's not only extremely unlikely, but extremely, extremely unlikely. Even if something were to happen, it's not nearly as bad as what Justin suggests in his post.

But even if you imagine that this is by far the worst thing we've ever seen, and that OpenAI comes along tomorrow, even in that scenario, not only will you still have the possibility of recovery, but you'll still have access to many other types of cryptography. That's why I wrote that it's much, much, much more likely that you'll lose money by going into bunker mode than that it will actually happen, right? If you think about it logically.

Theoretically, Mert, if OpenAI came along and said they'd cracked 1 type of cryptography, wouldn't that mean that every other type is useless from the perspective of, “Okay, we used to think that none of these areas were vulnerable. One type was just cracked; therefore, you can assume that each type is much more vulnerable to attack than we initially thought”?

No. The dev is cutting in here. Yeah, he didn't like it.

Cryptography is in the same situation as mathematics, which is, “Oh, you've solved a bunch of problems that no one is paying attention to. Okay, cool, but no one is looking at that.” Cryptography is also quite well segmented. It revolves around using the same 1 to 5 problems that cryptographers are interested in, and it does not use anything else.

So if you break something that's not in the realm of those 5 big problems, nobody cares, because nobody's trying to break it. Nobody's trying to break it because nobody's using it, and no one uses it because no one tries to break it.

We just think that before people start worrying, they should remember that we've seen literally no progress on the big problems. Wait for something to happen, like a 10% or 2× acceleration on elliptic curves. It's not as if we were 4 quadrillion off. To get a trillion-fold improvement would still leave us over a billion off.

What is most likely to break, and what does it protect? What are you most afraid of?

I actually expect to see a thousandfold speedup in RSA.

Which resources does this correlate with?

Nothing in blockchain. It protects your TLS handshakes for old browsers. It turned out that elliptic curves were just much faster in every respect. It took them a little longer to understand it.

For the same reason I explained, it took longer to implement elliptic curves and get comfortable with them. Elliptic curves are faster in all domains. But yes, I expect the old browser TLS protocol to go first, or to speed up a thousand times. Again, it doesn't matter, because in the case of RSA, we are over a trillion away from a comparable breakthrough against Bitcoin. I don't have that number handy, but it's much, much further.

6. AI hacks are the real threat

I'm curious. I feel good after this conversation. People much smarter than me convinced me not to worry about the boogeymen in the entire industry. So I don't have to worry so much about network-level cryptography.

I'm curious, and you mentioned it, Illia: where have we seen hacking attacks that are really driven by AI at the protocol level? A project deployed on Solana, a project deployed on NEAR, or a project deployed with Zcash—the exploit was detected and patched.

But now there's a big push for formal verification. Solana is probably useless without the projects built on it. The same goes for NEAR. And when it comes to Zcash, if the privacy feature isn't working, it probably has some issues too.

7. debrief with Tulip King

So I'm curious, Illia. We can start with you, because you kind of brought this topic up, but I'm curious how each of you thinks about designing your networks so that what's built on them is secure, and what practices and changes you're implementing in that regard.

Yeah, that's a great question. These are real risks that we face every day, versus hypothetical risks that get people hyped on Twitter.

There are a lot of things that we've been doing. In effect, you could say that RSM [?] is a form of formal verification. On the one hand, we've worked hard to make formal verification itself extremely cheap.

One of the problems was that if you open up AI, you have access to Astra and you can run it, you can leverage it. We had a swarm of agents running for about 10 days, but that's $10 million worth of computing power that nobody would actually spend. We've reduced the prices of many formal verifications by 100 to 200 times. We've already published some of it, but we'll keep updating it.

You can prove any lemma using a combination of our own harness with DeepSeek. It currently ranks number 1 in 2 different benchmarks and is 200 times cheaper than running it with GPT or Claude.

The second thing we will implement is a fully formalized NEAR virtual machine. One of the challenges of formal verification is that you can prove anything you want, right? However, this does not mean that this is exactly what is triggered. Therefore, we need to formalize the stack on which the system runs, along with all its properties.

This allows developers to prove their properties. Developers could prove, for example, “Hey, look, if a user deposits money, they can withdraw it,” right? For example, in the case of a pool. However, it must be effectively proven that this relies on a set of critical components of the main virtual machine itself. This also posed a significant threat.

In the medium term, we want to enable formal verification at the implementation level. This allows us to formally verify the contract when we implement it. So now you can verify that the source code of this contract is the one you’re using, right, using an explorer. But if you don’t read the smart contract, you probably won’t get much value out of that source code.

Now, with agents, you can ask questions. What you’re really saying is, “Hey, here’s a set of properties that this contract has.” You deposit money and you can withdraw it. You want to redeem a token, you’ll get an output token—a minimum output token. These properties, ideally, should be enforced at the level of an effective smart contract harness. That’s something we also strive for.

So then you actually have the ability to compose between smart contracts, right? Because then they say, “Oh, I can actually rely on the properties of another contract. Even after it’s updated, those properties will still apply.” To replicate that, you build frameworks and tools that other developers can use to verify the code that they write and publish.

Most importantly, at the virtual machine level, you’re pushing for formal verification, so developers know, “Okay, the virtual machine is making these assertions to me. Now I can make them too.” And because it’s a blockchain and everything is connected, if I use this project, I can rely on their assurances.

By building this ecosystem, you’re essentially creating a chain of trusted assurances. Is this the right way to think about it?

Exactly. You can imagine that every smart contract becomes Ethereum, right? Then you can build your own on it and rely on its correctness.

Can you help with a comparison to Move? I know they said the same thing in their marketing years ago, but I don’t know how to compare what you do to Move.

Move had this for a few specific properties, right? Move is an object-oriented language, so if you’re a smart contract developer in Solidity, you have to change your mindset a little bit to work with Move. With Move, you could say, “Hey, I have this token as an asset, and it’s going to have this total supply, and there will be no double spending.” This would guarantee at the compiler level that it is correct.

The problem is that as soon as you want to go beyond that and deal with shared state, you lose that guarantee. With Uniswap, for example, you have shared state that applies to all LP positions and the total number of tokens in the pool. What you really need is some first- or second-order logic that says, “Hey, look, for any possible deposit, I need to make sure you can withdraw and make any trades.”

This requires mathematically proving all the code of the entire smart contract.

Oh, great. Before this existed, there were simple things where you didn’t even need formal proofs because they were simple. This whole rounding thing interested me, and it’s new. It’s great.

Exactly.

8. why Justin Drake posted bunker mode

I want to get it back up and running quickly. I want to ask you, Mert. We have 45 minutes, so if anyone needs to leave, let me know. I appreciate you being here.

Mert, I’d like to ask you about this. Going back to your argument about Justin Drake, you said that the theory he proposed—even in the infinite worst-case scenario—was infinitely worse than the infinite worst-case scenario could ever possibly be. What was that? Why did he post it? What was the purpose? What was the point?

Well, it’s hard for an ETH holder to understand, but I would say this: Let’s steelman this for a second. Let’s say he’s really concerned that there are going to be fundamental breakthroughs at an accelerating pace that are going to get worse and worse—or better and better, depending on your perspective—and he just wants us to be ready.

Of course, I think that’s right, but I would say that as a leader in this field, you have a responsibility—no, you definitely have a responsibility—to explain both sides of the equation to people. Every new technology that has ever been created since the dawn of time can be interpreted both positively and negatively.

However, I want to point out that when it comes to AI, for some reason it is used solely as a strange tool of destruction that will never actually improve anything. Illia proved that’s not true just 5 minutes ago, because they use AI to formally verify things and even amplify them.

These things can always be used in both situations. I don’t want to belittle people who might say it’s going to happen faster than we can rationally account for, so we should be ready. We should be ready, and the Zcash guys and a few other teams have basically outlined and specified plans for what we’re going to do if this or that happens.

Zecora Development Team supposedly came out the next day. We should definitely be ready. It’s a bit like quantum Bitcoin. Will quantum happen next year? Absolutely not. I think the basic chances are practically zero.

However, as an investor, you want low entropy. You want to minimize future surprises so you can sleep soundly. Your risk calculations are not always adjusted day by day. For example, if you’re a fan of Threads and, for some reason, you have 5× leverage instead of just holding a spot position and resting, you want something with long-term guarantees.

This is why gold exists. In this case, it’s similar: You want to know there will be a plan. There will be some defense in such a scenario. That’s completely fine.

But I think saying something like “We need to go into bunker mode” is completely inappropriate and will almost certainly make everything worse. I’ll also point out one thing here: The markets were already very volatile that day before this post.

What happens on cryptocurrency Twitter is that you let the charts think for you, and then you become convinced that something is wrong from the start. Then it goes into a panic flywheel. This happens all the time, and that’s a good thing, because otherwise there would be no advantage.

What I’m saying is that these risks are very, very, very exaggerated. But even in the case where they’re super real and there’s this killer—a North Korean who’s going to somehow hack it tomorrow, which again is computationally impossible—even in that case, we are ready.

After all, this industry isn’t just a bunch of morons. There are very intelligent engineers, cryptographers, and designers who have a very personal interest in ensuring that we build this technology properly and that it lasts a long time.

I want to ask you, Mert—I don’t think that’s a good argument for coins, because that’s not a good argument for price. But maybe it’s a good argument for life, which is that the main problem was that everyone was coming out and saying, “If we break Bitcoin, then you’re going to have bigger problems than the price of Bitcoin.”

My answer was, “I don’t really have a bigger problem than the price of Bitcoin. This is actually my single biggest problem.” But there’s this sense of reassurance that cracking something like this has implications beyond just cryptocurrencies.

So my question is: Who else, or what else, in terms of protocols, is involved in trying to protect these cryptographic primitives? How much should I focus on this? I don’t like the United States in general. Is it just us, or is this such a niche problem?

This is what Dev is all about. I’ll let you take over in a moment.

But when I say you have much bigger issues to worry about, I’m really talking about 2 things. First of all, going back to our earlier conversation about everyone on Earth analyzing these sets of cryptographic primitives to try to break them: If you have an AI with such a high level of intelligence looking at them all the time, that’s a completely different kind of risk than some problem that a PhD student was working on 5 years ago.

It’s not really comparable, because if you crack one, you get state secrets. You can spy on everyone’s conversations. You can fake certificates on the internet and make billions. That’s one aspect.

The other aspect is that, depending on the type of cryptography, literally everything on the internet would be exposed. Everything from your messages to your interactions with websites, making online payments, your credit card information, your stored files—literally everything on the internet would be exposed, depending on the type of cryptography that was broken.

The most important type of cryptography—the most general, the most widely used? The number one most-used type is hashing, but even paranoid people don't talk about breaking hashing. Everyone's talking about signatures and public-key encryption. But I think the scary part—and in the case of quantum, it's unfortunately quite realistic—is basically all encryption. At this point, it hits everything.

No, no. This isn't going to be a one-time thing, so it's important to understand that. But actually, the real problem with quantum computers is not blockchains, because no one is going to waste their time like we do. We need to understand that quantum computers can be very expensive. This will be a huge operation. It's going to be developed either by states or by huge institutions like Google, correct? And they're going to be very focused on how they use them.

If you're a state, the best solution is to decrypt other parties' encrypted communications, correct? What happens now is that, if you're in one of these organizations, you're essentially intercepting encrypted traffic. So it's not a blockchain problem at all because, apart from Zcash, everything else is basically unencrypted. I mean, even Zcash isn't encrypted, right? This is proof of ZK. Blockchain doesn't have this problem at all. That's the real problem with quantum computers: communication.

Again, if you're a normal person, that's probably not a problem either. But, as you can imagine, the Department of Defense and other organizations use encryption on a daily basis for communication, and that's what quantum computers will be focused on.

No, nobody's going to try to use them for the first many years to break real signatures, because the value of actually having access to—and gaining intelligence on—your adversaries and allies is so much higher for these organizations. It's not that we'll have as much of a preview of everything if that happens, because the computing power can and will be allocated to other problems.

To tie back to your earlier question, this is another argument, right? You don't have many chances. Imagine you're America and you've deciphered some crazy, primitive cryptographic code. Are you going to attack Zcash or China? What are you going to do here? You won't have many chances before the news gets out, right? And, back to Dev, there is some time to prepare. This is not something that happens quietly overnight.

9. who could actually crack cryptography?

I actually like this. Who is able to do this? How much money do you need? Let's say you have the relevant intelligence or similar knowledge. Is it Google, or will the United States do it first and then, when you reveal that you have it, it becomes obsolete? Like everyone else, you have one chance because everyone knows this is happening and forces an update.

My question is, who can break it? Some people, like Tulip King, won't achieve a post-quantum state or something like that—as if he were the one who would break it. So who can break it?

Let's look at it this way: both questions are essentially the same. There are actually 2 answers, and they're the same.

Let's say a private company like ChatGPT, OpenAI, or Claude does this. If you break cryptography, you must report it to the government, yes? Otherwise, you'll get into serious trouble. We've already seen Claude say no to the Department of Defense, and they got into trouble.

If you break cryptography and don't report it to the government, that's it. It's like they just came in, nationalized you, and took over everything, right? It's basically as if a private company simply invented nuclear weapons. This won't happen without government consent. So in both cases, it has to go to the government. It has to go up.

The point is that a lot of people in the chat are saying, “You have to report this.” But the thing is, if you're Sam Altman and you get to that point, you're actually motivated to cooperate because you're already a gigabillionaire. You really have no financial incentive to hack or break this thing.

Well, the thing is, if you try to hack something, you'll basically go to jail, right? And you're already one of the richest people in the world, so you lose everything if you actually use it, right? OpenAI itself uses cryptography, of course, for most things.

One thing I want people to always remember is that, even without breaking it, let's say you have an algorithmic improvement, you still need an ASIC at the scale of Bitcoin or larger. The biggest cryptographic reduction of all time that was shocking to people was RSA factorization going from exponential to subexponential in, I don't know, the 1990s or something. This barely moved the needle in terms of actually breaking things.

Maybe we'll get something like the worst realistic panic case: taking over TSMC for a year or so, taking over all their ASICs, and having 10-gigawatt-plus data centers. There is no such thing as a secret gigawatt data center in the world. So even if you figure out the algorithmic part, the hardware needed to run it is huge.

It's a bit like a quantum problem. It's definitely difficult, but it exists. Theoretically, there is enough computing power in the world to do this if you had an algorithm that could run it. The speed difference between a GPU and an ASIC is crazy. I was giving estimated numbers using Bitcoin ASICs. There are plenty of surplus GPUs in the world. Thank you, AI industry.

But they're not even one-thousandth as fast as dedicated ASICs. So we have to multiply this number by thousands before it becomes a quadrillion to a quintillion.

If you had it now, how much power would it require, and how long would it take?

It could just be the power consumption in terms of GPUs—the amount of power needed to break that, assuming even a millionfold improvement. I don't know the GPU terms. I know ASIC terms better. Bitcoin is in the tens of gigawatts.

When it comes to Bitcoin, 10 gigawatts runs for, let's say, 1 million years. That's the amount of power needed, right? So in terms of GPUs, instead of 1 million years, you need 100 million years.

Answering your question, Thread, basically, it's the United States or China. There is basically no other possible answer.

I understand. That's actually a pretty good argument. Do you know when this happened? How quickly would the United States find out if China were to achieve decryption status and use it to break encrypted U.S. communications? How long would it take us to find out? How long would it take for this to get to Trump's desk?

Okay, it just happened. We actually have a comparable case, a somewhat unfortunate one—which is not a good thing—called Logjam from 2013.

Snowden posted, “Hey, the U.S. government is cracking all your SSH communications.” It took maybe about 2 years for cryptographers to realize, “Hey, there's a vulnerability in the SSH protocol because they chose weak parameters, which meant the government could spend billions of dollars and break something.”

Zooming out, the normal cryptography thing is that, if you took all the world's computing resources, it would take quadrillions of years. SSH had a path where it cost several billion dollars, and people just didn't notice. The U.S. government did this, and there's no way to know when the decryption is broken. You can only find out if the signatures are forged or something like that.

It took about 2 years for the warning. Now the world has changed. We're much more digital, and people are more up to date. Furthermore, formal verification means there will never be a situation where there's an accidental gap—for example, billions of dollars compared with all the quadrillions of years of computation in the world. This means the world has developed a lot between 2012 and now.

Okay, I basically feel like I could do this for a long time. I have 1 more question for everyone, and then I'll let you go. I can have 2 quick questions, though.

First, I want to go back to a point you made earlier. I'm going to mix up the units of measurement, but you said we were talking about trillions. What was the calculation? Where did the trillion come in?

A trillion times all Bitcoins.

Okay, okay, I get it. How fast is the acceleration of artificial intelligence currently? How much will it be reduced? How fast are we cutting a trillion times now? Is this when it will be a thousand times?

On the software side, literally zero. There has been literally no acceleration in that regard. What's happening is that we're increasing the world's power—our ability to generate power. You all tweet at us every day.

We're increasing our capacity to produce ASICs. The United States is producing 5 integrated-circuit fabs, TSMC is producing more, and so on. We're increasing our capacity for ASIC production and power.

I don't know. I tried to bring up this topic recently. It feels like we're 4 or 5 times bigger than we were 4 years ago. So the hardware side is getting better, but the hardware is trying to eat up that 100-trillion factor and is limited by physical resources.

Understood. And then my second question for you is this: I recently had the world-famous mathematician Doug Colquitt[?] on stream.

A really great guy. He proposed the idea that maybe artificial intelligence will come along; first, it will break everything, and then DeFi 3.0 will emerge: perfect DeFi, perfect smart contracts, AI-backed cryptography.

Is there some tangible goal that we can look forward to, so that we can say, “Okay, Zcash is perfect now,” or, “Ethereum smart contracts are almost perfect now”? Is there a tangible end state that can be reached at some point where you might think, “Okay, we’ve got the clock, the last wall of worries is over. Maybe the hardware side is over, but on the software side, it’s unbreakable and guaranteed”? Because this is perfection and the final state, or you can simply get another billion years.

What would this special shape look like? What would perfection look like?

Ideal cryptography would look like needing a probability that’s so small that it’s crazy to think about. Cryptography talks about things like 2^128 and 2^256. That means you need a probability that’s so small that it’s as if you need a billion times more atoms than there are in the universe or something.

The shape of perfect cryptography would be that you need so much computation that it would suggest using the entire universe for a trillion years, or you’d get lucky at that level of magnitude. But to get exactly that, you would need something that looks like proving that P is not equal to NP, and that our cryptographic problem can’t be solved any faster.

So I don’t know if it’s really practical. No one really has such expectations. I think it’s more practical to say, “Okay, look, we’ve done all the math, we’ve done all the AI, we’ve just kept going, and nothing’s happened.”

Today, we have the brute-force cost for 128-bit security, a trillion times greater than Bitcoin’s hash rate. Let’s say, “Okay, well, maybe as we expand out to the stars, we’ll actually reach billions of times our computational capacity.” Let’s make our cryptography 2^128 or 2^256 instead of 2, and let’s make it so that breaking it requires breaking 3 different assumptions at each layer instead of 1.

You’ve probably heard people say something like, “What if you created”—well, Ali said this earlier—“what if you made your address 2-of-3 secure, where each of the signatories was using a different type of cryptography?” It would probably be an end state of, “Look, everything is 256-bit secure, and you have to break 2 out of 3. You have to break 3 out of 3 to do anything.” This is probably the shape of what you call “made for keeps.”

Then you can ask for something like, “If 1 of the 3 breaks, no stress. Just update it before the next one.” I think, going back to algorithms, we can go quite far because now, through formal verification, we can prove that the code does exactly what is expected.

At the same time, everything from processors to network types and everything else is evolving. Trying to ossify any specific element also seems a bit odd, as if all the hardware evolved.

I see. Thank you for that. Illia, I’ll let you go, and then I’ll give it to Mert. Maybe to reverse the question: Is there a pre-OpenAI record that says we’ve reached the end state in terms of cracking? Is there some sort of LLM acceleration gauge that might suggest, “Oh, shit, this is going faster than I thought”? And, almost conversely, why do you think you’re secure and well prepared for what’s coming?

I always think LLMs go slower than I thought. I expected the current state of coding agents. That’s how it all started in 2017, when we were basically doing live coding. In a sense, we were limited by the amount of hardware we could scale the models on.

The next really big improvement on the LLM side that I’m looking forward to is real-time learning.

Yes?

We continuously train the models, moving away from pre-trained runs that take months, or from having a context of 1 million tokens. There’s a clear gap between that and what will continue to grow, so I think that will also bring huge improvements in the intelligence and capabilities of these models.

There will also be some kind of personalization and the ability to use them to conduct research. I just can’t wait for it. I’m excited. I think these tools are just amazing.

As we sit here, we’re proving ZK evidence with 128-bit post-quantum security. None of this is something I would have been able to do manually before, during this conversation.

But, yeah, I mean, on the near side, as I mentioned, we’ve kind of built agility. We built it with upgradeability in mind. For example, Solana is one of the most frequently updated protocols, with updates made almost every 6 weeks.

We have a very transparent protocol that we developed from the very beginning to be able to constantly innovate the blockchain. Everything is built with the ability to be updated in mind. As I mentioned, cryptography was like, “Hey, this is the choice for now. We will update it. We will implement it. We have to turn off the old ones.” Great, we can turn it off.

It’s literally a 3-line code update to disable something. Adding a new one is about 200 lines of code to add new cryptography to the entire protocol. Overall, it’s about making sure that we can update and be flexible, formally verify the correctness of the entire system, and give users the tools they need to secure their funds at any time.

10. smart contract hacks are better than quantum

That’s great. Thank you for that. And then I’ll let you go last.

Man, you’re a little bit mine, a little bit that guy I whisper sweet nothings to, telling me that everything’s going to be all right. So far, you’ve been right. I feel like the day will come when you come on the channel and tell me it won’t be the same.

Is this quantum-resistant encryption okay for the inevitable future? Should I just stop thinking about it for now? What will happen from now on? What do you think about every day? I don’t know. I don’t even have a good question for you, but you’re just that kind of guy to a lot of people. I would say you are something of a father figure to retail traders in CT.

I would say the risk of losing money just because a smart contract is hacked is probably a billion times higher—maybe a trillion times higher—than breaking some fundamental cryptography.

There is a sufficient reason for the core developers to think about this, right? People like Ilya and Dev should start thinking about these kinds of things so that no one is caught off guard by a black swan. But as you can see from this panel, they’re already thinking about it. Nobody sits idly by.

Even in the worst-case scenario, it will still be fine. Some inconvenience may occur. Maybe a temporary performance hit and something like the Solana crashes of yore. Inconvenience, but not a disaster.

Other threats are much more likely to take you down than basic cryptography, and certainly quantum computing for the foreseeable future. If that changes, believe me, I would like to help protect the industry as much as possible. I would be the one to ring the bell. I regret the day this happens.

Honestly, guys, it was so calm, rational, and realistic—at least, I hope so. That’s completely the opposite of what I absorb as an emotional trader on the timeline every day.

Mert, it’s always a pleasure. ZK Dragon, it was nice meeting you, and thank you for coming. Illia, it was nice meeting you, and I equally appreciate all your time. Does anyone have anything they’d like to quickly discuss before we do this?

Keep building. Keep using blockchain. No bunker mode also means you’re not using blockchain, so let’s keep using blockchain. It’s an amazing technology that makes tremendous things possible.

Developers, thanks for your time.

If you have anything to worry about, worry about supply chains or just your router. If you’re going to panic about supply-chain risk, how is that a real problem that people should be solving on a daily basis, like a SIM card in your supply-chain registry?

Yes, exactly. Exactly. Honestly, good point. [Expletive], man. We have bigger problems.

Okay, thanks again so much for your time. It was great. I hope this was good for the industry and everyone watching, and until next time.

What’s up, man?

Yo. What do you think about this?

All right. Dude, was that it? By the way, that was pretty awesome, right?

Oh, yeah. It was like a debate. I think it was a good panel.

At first I thought, “Oh, shit. I don’t know anything.” I think they really enjoyed it.

Oh, man. First of all, I knew these kids were smart, but, oh my God, they are so damn smart. This is just crazy. They are much smarter than everyone else on Crypto Twitter. Thank goodness.

I mean, that was really great. I feel like they—

And by the way, I’m surprised no one has done this panel before.

I feel like they liked it.

Yes. Yes, it was good. Everyone got along. Can you get me something to go?

Yes. My conclusion is not to worry about it. Really, I’m not worried about it. You know what really made me feel good? I think maybe a misconception, or something I hadn’t thought of, was that the first person to reach that state would be the United States of America.

Yes, as if you were simply not powerful enough to care.

Yes, well, Dev was right. He said something like, “Even so, because it’s a numbers game, right? You need a trillion years to break SHA, and you reduce it to 10,000 years.”

Well, you still need a government to manage all this hardware to break it and so on, right?

Nobody—literally nobody, not even you—would need an absurd breakthrough.

Really? Oh, it's just a fundamentally flawed kind of breakthrough. In my opinion, the price didn't drop at all because of it. There's no way we abandoned it. We only abandoned it because it was time to abandon it. I don't know what else to say.

Yeah. I think the market is just weird. I think nobody believes it yet; that's what this price action is saying.

So, by the way, we also have to ask: if it's so absurd and unlikely, why are you even improving your chains?

Good point. Well, I think it's exciting.

Well, in the case of Zcash, because Zcash is money, right? And I really liked what Kyle Soska said on Taiki's podcast. It's like, I could put a dollar under my mattress and come back in 30 years. Maybe the dollar has gone down in value, but I'll still go to the store and buy something. I feel the same way about Bitcoin.

As opposed to Bitcoin, where it's like, “Okay, for a long time, Bitcoin was the only cryptocurrency you could buy and hold without worrying about anything.” So now that you have to upgrade it and you have to worry about it, it creates a mental burden that makes you think it becomes less attractive as money. The basic principle of money is that I can hold it there and store value there, right? But if this is questionable, then Bitcoin must be discounted.

So Zcash, which is like a championship fight, right?

The huge advantage it could have over Bitcoin is... Well, quantum might not matter for a decade, but it will matter eventually. And when it does become relevant, imagine, a decade from now: will Bitcoin be even more upgradable, or will it be even more rigid and harder to use than it is now? Since we have all these developers and all this momentum, let's do this update now, and then we as a currency pair will be more valuable. So I think, in the case of Zcash, it's pretty obvious why—

Yeah, right. They want to do it, right? Because they are trying to be money.

For other things like NEAR and Solana—and I think NEAR, judging by how Illia Polosukhin described it, which, by the way, completely changed my opinion of NEAR. I think he's a bit naive about NEAR now. It was so sick.

Yes, but they have abstracted it so much from reality.

So, okay, you can have an account using different signature types. So if you want to use a quantum signature, sure. If you're already worried about it, sure. And if you're not worried about that, then just do your thing or whatever. So, as far as NEAR goes, I guess it didn't seem like a big deal to me.

As for Solana, I don't think we've really delved into their schedule or anything like that.

Well, yes. I think my takeaway verification is really great.

Takeaway: we definitely gave up on this Justin Drake thing.

But I think you gave up on that, and then everyone realized it was just a small burger, and you can't give it up anymore. Maybe you have that excess, but it was kind of like giving up on Justin Drake if that was the case.

You know, I don't think this is the kind of thing where we're going to give up on every mathematical breakthrough. From that point on, it's going to be kind of a panic. At least from this conversation we just had.

Yeah, I really left that feeling good.

Yes, I think we'll stop talking about it. I think we're done. I'm pretty good about future broadcasts.

Yeah, I think the reason the market sucks right now is because people just disagree. I believe we are still in a bull market. I think everyone's like the Chumba Bear pill, where all these coins are shit and everything eventually goes to zero. I just don't know. I don't understand this.

For the first time in history, there are real coins on the market. Just buy them. Yes, everything looks like shit because you're holding dogshit, you know? But I think the market—the prices right now are telling me the market hasn't gotten used to it yet.

Cryptocurrencies are actually already moving up the adoption curve in some sense, and they really are getting more serious. So I don't know. I'm still buying all these drops. I guess I just think the market is wrong, and I agree with you. Crypto Twitter is useless. It is the most pessimistic. Everything is unconscious. It's terrible now. Luckily, our stream is great.

Great facts. Big facts.

Also, sorry, I've started dominating the questions on this stream.

Dude, do you want me to promote you on stream?

Promote to chat?

Yes, yes, of course. I told you that you could do this interview without me, man.

I guess, for chat awareness, Thread Guy has spent the last 2 or 3 days going crazy. I don't know anything about that. What's going on? I'll look like an idiot.

So we literally went through boot camp. I watched movies. I spent hours chatting with GPT trying to make sense of it all. We had many conversations. So I knew I would keep the dollar. I knew the whole time I was like, “Okay, I'm just having this conversation. So if Thread Guy really needs someone to lean on, he knows I'm there for him.” But, like, I knew you had this all along.

What did you think of my initial explanation?

Man, it was great. That was money.

Do you think they looked at me like, “God, you're so stupid?”

Or they'd say, “Dude, we're hosting. We're starting every clip from today's stream with Thread Guy, the cryptography expert.”

That. Yeah, I was working on it quietly this morning, I'm not going to lie. I woke up feeling like I was... Yeah, I was a little scared.

Man, I think last night, even though you had it figured out, I gave a pretty good explanation last night, I think.

Yeah. Yeah. Yeah. Yeah.

And then they... Everyone's like, “Well, Joe Rogan doesn't know stuff, but he still attracts people.” But you really have to know enough to ask questions. You know what I mean? You really have to know. You can't be an idiot. You have to know enough.

Mm.

But it's like with a world-renowned cryptography expert. It's like with that world-renowned mathematician, Doug Colquitt. He's like my buddy, my dude.

Man, that's so good. He's my buddy.

Ugh, thanks for that introduction.

Dude, we have some great brains here who want to join the chat. Thanks for being such a support today.

Man, that's why I'm here. That's what you pay me for.

But you'd do it for free, right?

Oh, of course. Of course. I'd love to.

All right. I'll give you a massage and go get breakfast. You're the guy, man.

All right. Cool. See you, buddy.