Post-Quantum & Cryptographic Trust

Ethereum co-founder Vitalik Buterin posted on X on the 8th, Japan time, that AI-accelerated advances in mathematics make it quite possible that the practical security of lattice cryptography will suffer a serious blow within the next two years. Lattice cryptography is a method based on the difficulty of solving mathematical problems on high-dimensional lattices, and has been regarded as the leading candidate for post-quantum cryptography. The previous day, Ethereum Foundation researcher Justin Drake warned that, citing OpenAI's publication of 722 mathematics papers, the ECDSA signature scheme used by Bitcoin and Ethereum could be broken before Q-Day, the point at which quantum computers crack cryptography, and in the worst case within a matter of months. Drake called on the industry to prepare for bunker mode, proposed systematically moving assets to unused addresses whose public keys have not been exposed, and urged five companies including Binance and bitbank to strengthen their cold wallets. Buterin said he does not recommend rushing to move funds to new wallets today, but added that reliance on cryptography vulnerable to AI should also be reduced, and that if lattice cryptography is used, key sizes should be increased tenfold. Just about three weeks ago, Buterin said that AI also helps defense, so crypto asset security will not collapse; this time he has raised his assessment of the threat by one notch. Blockchains that have considered lattice-based approaches for post-quantum security may be forced to reconsider their strategy.

Crypto exchange Bitget announced on its official X account on September 28 that it had resumed Bitcoin withdrawals starting at 5:00 p.m. Japan time. The move is part of a phased restoration of withdrawal services that had been suspended following a security incident confirmed on September 24. The exchange said the vulnerability behind the incident has been fixed, no new unauthorized transfers have been detected since the incident was contained, and user account balances were unaffected. Under the withdrawal resumption schedule, Ethereum withdrawals will resume at 5:00 p.m. on September 29, Tether at 5:00 p.m. on September 30, and other cryptocurrencies, fiat currencies, and P2P-related withdrawals at 5:00 p.m. on October 2. The backdrop is a large-scale asset outflow that occurred on September 24, when the company detected unauthorized asset movements from some of its hot wallets and warm wallets on September 25 and disclosed that about $387.5 million in assets had been moved to addresses controlled by the attacker. An initial investigation found that the attacker breached a key backend system underpinning the wallets, falsified transfer data, and moved the assets, but no evidence was found that the private keys themselves were stolen. The company plans to cover the losses through its user protection fund, which stood at roughly $464 million at the time of the incident, exceeding the amount lost, and users do not need to take any additional steps before withdrawals resume.

Bitget, a major cryptocurrency trading platform, disclosed that digital assets worth about $351.6 million were transferred out of its system without authorization, with preliminary evidence linking the incident to a North Korean hacker group. Bitget CEO Gracy Chen said the investigation team found IP addresses linked to a VPN service previously used by North Korean hackers, as well as attack patterns similar to earlier operations tied to North Korea, though the exact technical method of access is still under review. Bitget detected the unauthorized transfers of digital assets from crypto wallets on the afternoon of Thursday, September 24, U.S. time, totaling 19 transactions from hot wallets and warm wallets, while cold wallets were unaffected. The assets transferred out included ether, XRP, USDT, USDC, AVAX and BNB across multiple networks. An earlier estimate put the losses at about $183 million, but Bitget said that figure did not cover transactions on all affected networks. Bitget's security team found that hackers breached the wallet backend system before falsifying transfer data and prompting the system to sign off on the transactions. The company said it has brought the incident under control and prevented further asset transfers. Chen said the attack was not caused by a private key leak or compromise. Bitget is still temporarily suspending withdrawals to repair and strengthen system security, while deposits and trading remain available as normal. The Bitget CEO has not given a definite timeline for resuming withdrawals, but said it could take only a few hours to a few days and is unlikely to stretch to weeks. The company added that customer asset balances remain accurate and that losses are covered by its user protection fund, which holds more than $464 million.

Apple has asked the Investigatory Powers Tribunal to lift restrictions that bar the Home Office from confirming it secretly ordered the company to build a "backdoor" into iPhones. The US technology giant, joined by human-rights organisations Liberty and Privacy International, argued at a case-management hearing on Thursday that confirming the order's existence would let the legal challenge be heard in public. The Home Office ordered Apple last year to break the encryption protecting iPhone users' iCloud accounts, which hold photos, files, contacts and messages, even when users have enabled the most advanced protection features. Apple has refused, saying it would never build a way to break its own encryption, and has instead removed its "Advanced Data Protection" feature for everyone in Britain. Daniel Beard KC, for Apple, said lifting the restrictions would allow "facts to be deployed in the open"; Ben Jaffey KC, for the campaign groups, called the secrecy "farcical" and the "emperor's new clothes", while Neil Sheldon KC, for Home Secretary Shabana Mahmood, said departures from "neither confirm nor deny" inevitably weaken its effectiveness. The three-person tribunal, led by its president Lady Carmichael, did not rule. The order was first issued early last year by then home secretary Yvette Cooper, dropped under pressure from the Trump administration, and replaced by a second order applying only to people in Britain.

SEALSQ Corp reported a $32.2 million operating loss for the six months ended June 30, 2026, compared with $21.2 million a year earlier, according to full results released September 11. Revenue for the half reached $11.2 million, up 131%, though that figure includes $2.5 million contributed by IC'Alps SAS, so the headline increase reflects acquisition growth as well as organic sales. Gross margin came in at 48.5%, producing $5.4 million of gross profit, while research, selling and administrative expenses totaled $39.0 million before $1.4 million of other operating income, with general and administrative costs alone at $23.1 million. SEALSQ held approximately $479.8 million of unrestricted cash and cash equivalents at June 30, and full-year revenue guidance remains $27 million to $36 million, implying roughly $15.8 million to $24.8 million in second-half sales. Management expects initial QS7001 and QVault TPM commercial revenue toward the end of 2026, with a more significant contribution in 2027 and beyond, subject to certification, customer qualification and procurement timing.

Liquid, a sidechain of Bitcoin, has suspended operations after an actor claiming to be a white-hat hacker withdrew approximately 4,000 bitcoins, worth $320 million, from the network's federation wallet. The withdrawal accounted for about 95% of the roughly 4,200 BTC balance that backed the L-BTC issued on the sidechain. Bridge nodes were disabled, preventing new transactions, while various exchanges suspended deposits and withdrawals of L-BTC. However, other assets such as USDT and DePix were unaffected. Blockstream, Liquid's technology provider, contacted the actor via an on-chain message, with the actor promising to return most of the bitcoins after the vulnerability is fixed and all nodes are patched. As of the time of reporting, no funds had been returned.

Alex Thorn, head of research at Galaxy Digital, said on September 3 that in the security breach involving the hardware wallet COLDCARD, the attacker behind the third wave has moved the stolen bitcoin for the first time. The attacker exchanged part of the stolen funds for Ethereum through THORChain, a cross-chain decentralized exchange (DEX). Moving funds from Bitcoin to Ethereum suggests a possible attempt to launder the money. According to Thorn, this is the first time stolen funds have moved from their original addresses across the series of attacks, which are classified into waves one through three. About 90% of the funds stolen in the third wave remain unmoved at this time. Additionally, although the attacker has faced issues such as some transactions being refunded during the exchange on THORChain, they have repeatedly attempted to exchange the remaining funds. Thorn said he has traced the funds routed through THORChain to new Ethereum addresses and shared that information with relevant authorities and cryptocurrency-related companies. Coinkite, the developer of COLDCARD, disclosed a firmware flaw in seed generation on July 30, and the attacker is believed to have regenerated private keys from weak seeds to steal funds. According to a tally published by Thorn on August 24, a total of 1,789.28 BTC, worth approximately $114.7 million (about 18.4 billion yen) at the time of the theft, was stolen from 8,865 addresses in the series of attacks.