A private key is the one secret that moves your crypto

What is a private key, and what is a public key?

A private key is the secret you use to sign a transaction. ethereum.org puts it directly: the private key "grants you custody over the funds associated with your account," because only a signature made with it is accepted.

The public key is generated from the private key using a signature scheme called the Elliptic Curve Digital Signature Algorithm, ECDSA. It works in one direction: the public key checks a signature and is not supposed to reveal the private key behind it.

The address you share to receive funds is a third item. On Ethereum, ethereum.org states that an address is the last 20 bytes of the Keccak-256 hash of the public key. A hash is a one-way scramble: the same input always gives the same output, and the output cannot be unscrambled.

So there are three layers, and each one hides the one before it. The private key is behind the public key, and the public key is behind the address.

What does a signature prove?

A signature proves that the person sending the transaction holds the private key, without the key itself ever being shown. The network checks the signature against the public key and accepts or rejects the transaction.

Think of a signature on a cheque that the bank can verify without ever seeing your pen. The bank learns that you signed, and nothing it sees lets it sign for you.

This is why a lost private key cannot be recovered and a stolen one cannot be reversed. Nobody sits above the system with a reset button, because the key is the whole permission.

Why do some public keys sit in plain view?

A public key becomes visible when its owner spends. The Bitcoin developer guide notes that in many cases the hash of the public key is distributed. The actual public key follows "only ... when the outputs they control are spent."

So an address that has received funds and never spent keeps its public key behind the hash. Once it signs a transaction, the public key is on the record for good.

The exposure grows when an address is reused. A wallet receives several payments to one address, spends some, and the public key is revealed while a balance still sits there.

Glassnode counted this in a report covered by Analytics Insight on 22 May 2026. It found 6.04 million BTC, 30.2 percent of the issued supply, with public keys already exposed on-chain. Of that, 1.92 million BTC (9.6 percent) is structural, from early output formats and similar designs that reveal the key by design. The other 4.12 million BTC (20.6 percent) is operational, mostly from address reuse. Glassnode said the figures are not a ranking of any company's safety.

Source: Analytics Insight, report dated 22 May 2026, read this run.

What did the AI warning actually say?

On 7 October 2026, Ethereum Foundation researcher Justin Drake wrote on X that the industry should "calmly begin planning for bunker mode," according to Decrypt. His recommendation is a controlled, gradual migration of funds to fresh addresses whose public keys stay hidden behind a hash.

His reasoning is that AI-driven mathematics is advancing quickly. Decrypt reports that he pointed to 722 results OpenAI had published. He wrote that elliptic curves feel especially vulnerable to superintelligence. His worst case is ECDSA breaking "in months not years." By break he meant recovering a private key in about a week on hardware such as a large GPU cluster.

Crypto Briefing reports that the statement "did not demonstrate such an attack." It also did not establish that ECDSA has been compromised. The classical algorithm Drake raised remains a hypothetical in his own words. He also asked holders not to rush, since a rushed move could do more harm than good.

My view is that this is a useful prompt and a poor reason to act in a hurry. It is a researcher's worst case, stated openly as one, with no attack shown. The sensible response is to understand the structure of your own exposure, which takes an afternoon, and to leave the panic out of it.

How would an exposed key actually be attacked?

If ECDSA were broken, an attacker would take a public key already on the record and work backward to the private key. Decrypt describes the result as being able to "drain the wallet." An address whose public key is still hidden behind a hash would give the attacker nothing to start from.

That is the logic of Drake's recommendation. Addresses that have never signed are harder to target, and an address that has signed should hold only what has not yet been moved.

Take a ₹1 crore portfolio with 3 percent in bitcoin: ₹1,00,00,000 × 0.03 = ₹3,00,000. If that sits at one reused address, the entire ₹3,00,000 is behind a revealed key. Spread the same amount over three addresses that each received once and never spent. Then ₹1,00,000 sits behind each hash, and no key is on the record. The number of addresses changes what an attacker could see, and the value of the bitcoin stays the same.

What can a holder check on their own wallet?

A holder who keeps their own keys can run a short audit. Four questions cover it:

1. Has the address holding my balance ever sent a transaction, which reveals its public key?
2. Have I received payments to the same address more than once?
3. Who holds the backup of my private key, and could I find it if I needed it?
4. Am I using a wallet that creates a fresh address for each receipt, as the Bitcoin developer guide describes for hash-based addresses?

A yes to the first two shows where your exposure sits. The backup and wallet questions matter whatever happens to ECDSA.

How does a holder of a Qatobit index relate to private keys?

A holder of a Qatobit index holds the basket, not the coins. Investing in a Crypto Index requires no knowledge of blockchain or wallets. The investor manages no private key, address or backup phrase.

Custody is institutional. Qatobit publishes live Proof of Reserves, available at any time, and its design keeps user funds separate from operational funds. User assets are insured. Two guides cover that evidence: how to read a Proof of Reserves attestation and what Proof of Reserves proves.

Insurance and reserves protect assets in custody. They do not protect an investment from a fall in price. Anyone who prefers to hold a position on a schedule and leave the key management to someone else can invest in QSI Growth or start a Bitcoin SIP.

For the wider picture, read how your rupees become crypto on an Indian exchange and whether a crypto exchange is legal in India.

What to take from the warning

A private key is a single secret that controls the funds behind it, and the public key and address exist to keep that secret from being derived. The warning asks whether that protection will hold against advances in mathematics. It is a worst case from one researcher, with no attack shown. The next question for any holder is how much of their balance sits behind a public key that is already on the record.

Frequently asked questions

What is a private key in crypto?

A private key is the secret used to sign a crypto transaction. Whoever holds it can move the funds, and the network accepts the signature without ever seeing the key.

What is the difference between a public key and an address?

A public key is generated from the private key and checks signatures. On Ethereum, the address is the last 20 bytes of the Keccak-256 hash of the public key, so the address hides the public key until the account spends.

Has AI broken the signatures that protect bitcoin and ether?

No attack has been shown. Justin Drake's 7 October 2026 warning describes a possible worst case of "months not years." Crypto Briefing reports it did not demonstrate an attack or establish that ECDSA is compromised.

How many bitcoin have exposed public keys?

Glassnode counted 6.04 million BTC, or 30.2 percent of the issued supply, with exposed public keys in a report covered on 22 May 2026. Of that, 4.12 million BTC (20.6 percent) came mostly from address reuse.

Do I manage a private key if I hold a Qatobit index?

No. You hold the basket, not the coins, and investing in a Crypto Index requires no knowledge of blockchain or wallets. Qatobit custody is institutional, and live Proof of Reserves is available at any time.

Crypto investments are subject to market risk. Not financial advice.