the new threat
AI is solving math.
Your cryptography is next.
Everyone is preparing for Y2Q, the day quantum computers break today’s encryption. It has a deadline. This threat doesn’t. In 2026 an AI disproved an 80-year-old conjecture, and every blockchain key, HTTPS certificate and signed payment rests on math nobody has proven is hard.
01 · y2q vs. the new threat
Y2Q has a deadline. AI math doesn’t.
Y2Q is the day a quantum computer breaks RSA and elliptic-curve cryptography. The industry has a plan for it. The plan assumes the threat arrives on quantum hardware, on a schedule you can watch.
| Question | Y2Q · quantum | The new threat · AI math |
|---|---|---|
| What breaks it | A large, fault-tolerant quantum computer running Shor’s algorithm | A faster classical algorithm, found by people or by AI |
| Hardware needed | A machine that doesn’t exist yet | Ordinary computers |
| Warning you get | Years: qubit counts and roadmaps are public | Almost none a result can be posted overnight |
| Official timeline | NIST draft: retire RSA and ECC after 2035 | None |
| What it could break | RSA and elliptic curves; hashes only weakened | Any scheme whose hardness is unproven, which is all of them |
| Does post-quantum crypto fix it? | Yes that’s the plan | Not by itself lattices are unproven too |
| How to prepare | Migrate to post-quantum algorithms | Crypto-agility: be able to swap any primitive fast |
A Y2Q plan is necessary, but it isn’t enough. If you can only move once, on NIST’s schedule, you’re exposed to the threat that doesn’t keep one.
02 · the scoreboard
Problems that stood for decades are falling
Each held up against the best human mathematicians for years. Each fell to AI in 2025 or 2026.
proofs that the math behind your keys is actually hard. It has held only because nobody has found a faster algorithm yet. Finding faster algorithms is exactly what AI is now doing.
Every figure is sourced on the threat page. None of this has broken real-world cryptography yet.
03 · what rests on unproven math
If the math falls, all of this falls with it
Every Bitcoin and Ethereum key
Safe only while the elliptic-curve discrete log stays unsolved. Every public key already on-chain is exposed at once if it falls.
Every HTTPS certificate
RSA and elliptic-curve signatures prove you’re talking to your bank and not an impostor.
Every signed transaction
Custody, settlement and stablecoins authorize money with the same signatures.
Post-quantum standards
The replacements rest on lattice problems, and researchers have already pointed AI at them.
04 · get ahead of it
The Math Break
Cryptographic risk audits for exchanges, custody firms and fintechs. We inventory every primitive you depend on, score how breakable and how replaceable each one is, and hand you a roadmap that works for Y2Q and for the threat that won’t wait for it.
Until NIST’s draft plan would disallow RSA and elliptic-curve signatures
That’s the Y2Q timeline. The AI clock has no display.
05 · this site is the demo
Don’t take my word for it. Inspect it.
Hand-built with no frameworks, trackers or third-party requests. The terminal reads this page’s own security headers live, the hero is the real Bitcoin curve equation drawn over a small field, and the footer audits the page you’re reading as it loads.
06 · who’s watching it
Joshua Bullock
Bug bounty hunter.
Offensive security and forensic litigation support, with platforms built under FCRA, GLBA and DPPA. I find the ways systems break before someone else does.
Find it first
Finding and responsibly disclosing vulnerabilities in live web apps and APIs.
Think like the adversary
Applications, infrastructure, and the people and processes around them.
Prove it holds
Controls, audit trails and data custody that stand up to review.
Findings that hold up
Written to the standard of a sworn declaration.