The headline said RSA was broken. The abstract said otherwise. Between those two sentences, an entire category of institutional risk was mispriced — again.
A preprint surfaced this week claiming a new classical attack against the RSA public-key cryptosystem. Within hours, the phrase "RSA is dead" was circulating through market feeds. Within a day, the correction arrived: the attack is classical, not quantum; it is an academic result, not an exploit; and the authors were careful to note that there is no cause for broad panic. Properly implemented RSA-2048 and RSA-3072 remain intact.
I have audited cryptographic systems for long enough to recognize the pattern. The announcement is the noise. The reaction is the signal. And this reaction told me something specific: the market still does not know where RSA actually lives inside its own infrastructure. It is not in Bitcoin's consensus rules. It is not in Ethereum's account model. It is in the certificate chains, the firmware attestations, and the hardware security modules that certify the custody of every institutional dollar now sitting inside a spot ETF.
That is the real exposure. And it has almost nothing to do with the attack everyone spent forty-eight hours arguing about.
The baseline nobody remembers
RSA turns forty-nine next year. Rivest, Shamir, and Adleman published it in 1977. Its security rests on one mathematical assumption: that factoring a large semiprime is computationally infeasible.
For four decades, that assumption has survived every classical algorithm deployed against it, including the General Number Field Sieve — the best known method for factoring large integers. GNFS runs in sub-exponential time. Not polynomial. That single distinction is the ballgame. A classical attack that improves the constant factor inside a sub-exponential algorithm does not break RSA. It narrows the margin and pushes key sizes upward at the next refresh cycle. That is a maintenance event, not a catastrophe.
What the new preprint almost certainly describes — and I am inferring here from the framing, not from details the authors disclosed — falls into one of three buckets.
First, a constant-factor improvement to GNFS or one of its variants. This is the most common form of progress in factoring research: incremental, mathematically interesting, and operationally irrelevant for standard key sizes.
Second, a lattice-reduction improvement touching the Coppersmith family of attacks. These exploit structured weaknesses — short keys, partial key exposure, low-entropy generation. They are devastating against bad implementations and inert against good ones.
Third, and most plausibly given the "classical" framing, a result that only bites on weak parameters: multi-prime RSA, small public exponent e, or keys generated with insufficient entropy. That would place the significance squarely in embedded and legacy systems, not in the data center.
I should be explicit about confidence. The original reporting withheld the paper's provenance, the authors, the attack class, and the complexity improvement. Without those four data points, any claim of a practical break is unsupported. Absent peer-reviewed confirmation, the rational prior is that this is an academic improvement, not an exploit. Certainty is a liability in this domain — in both directions.
Classical versus quantum is not a detail
Here is the distinction the market collapsed.
A classical attack runs on classical hardware. It is bounded by transistor budgets and clock cycles. It may be faster or slower, but it is ultimately playing the same game every factoring researcher has played since 1977.
A quantum attack is different in kind. Shor's algorithm, given a sufficiently large fault-tolerant quantum computer, factors RSA moduli in polynomial time. That would not narrow the margin — it would eliminate it. Every RSA key in existence would become public. So would every ECDSA key, every BLS key, and every elliptic-curve signature protecting Bitcoin and Ethereum.
No such machine exists. The largest fault-tolerant demonstrations remain orders of magnitude away from the millions of physical qubits required, and the error-correction overhead is the binding constraint, not the qubit count in a press release.
The new attack is classical. It does not shorten the quantum timeline by a single day. What it does — and this is the part worth extracting — is remind every institution that the cryptographic assumptions underpinning their custody stack are dated, and that the migration clock has been running for years.
The standards are already written
In August 2024, NIST finalized the first post-quantum standards: FIPS 203, derived from CRYSTALS-Kyber, for key encapsulation; FIPS 204, derived from CRYSTALS-Dilithium, for digital signatures; and FIPS 205, derived from SPHINCS+, as a hash-based backup. A fourth, FN-DSA, better known as Falcon, remains in process.
NIST IR 8547, the transition guidance, sketches the deprecation schedule: RSA-2048 and ECDSA P-256 deprecated by 2030, disallowed by 2035. CNSA 2.0, the NSA's suite for national security systems, aligns roughly with that horizon.
These dates are not hypothetical. They are procurement requirements. Every vendor selling into regulated markets — exchanges, custodians, payment processors, cloud providers — is now on a clock. The question is not whether they will migrate. The question is whether they will migrate before the tail systems become the binding constraint.
The ledger remembers what the market forgets. Every signature executed under a primitive scheduled for deprecation is a liability with a maturity date.
Where RSA actually lives in Web3
This is the part that deserves the most attention, because it is the part almost nobody models correctly.
Bitcoin does not use RSA. Bitcoin uses ECDSA over secp256k1 for transaction signing, and SHA-256 for proof-of-work and address derivation. Ethereum's execution layer uses ECDSA over secp256k1; its consensus layer uses BLS12-381 for validator signatures. Neither chain depends on the integer factorization assumption at any point in its consensus or account model.
So a classical improvement to RSA factoring has zero direct impact on on-chain security. Full stop.
But the on-chain layer is not where institutional money touches cryptography. It touches it in four places.
One: TLS. Every exchange endpoint, every RPC provider, every custodian API is wrapped in TLS, and a meaningful share of those certificate chains still terminate in RSA. The migration toward ECDSA certificates reduced this surface but did not eliminate it.
Two: firmware and code signing. Hardware wallets, HSM appliances, and secure elements ship with vendor signing keys. Several major HSM vendors historically used RSA for firmware attestation. A migration here touches physical devices with multi-year refresh cycles.
Three: key wrapping and key management. Enterprise KMS platforms and HSM clusters frequently wrap symmetric keys under RSA for transport and storage. This is legacy architecture, widely deployed, and slow to replace.
Four: attestation and audit chains. Remote attestation frameworks — the mechanisms that let a custodian prove a key was generated inside certified hardware — often rely on RSA-signed certificates at the root of trust.
None of these sit on a blockchain. All of them sit under the custody of assets that now trade through regulated vehicles. When a spot ETF reports its holdings, the chain of cryptographic trust protecting those holdings terminates, at the root, in a primitive that carries a deprecation date.
Architecture reveals the true intent. A custodian with a published cryptographic inventory and a post-quantum roadmap is telling you something. A custodian that cannot name its root-of-trust algorithm is telling you something else.
Harvest now, decrypt later
There is a second-order mechanism the market consistently underprices, and it has nothing to do with the speed of any attack.
Adversaries do not need to break RSA today to profit from it tomorrow. They need to record ciphertext today and wait. This is the harvest-now-decrypt-later model: capture encrypted traffic, archive it, and decrypt it when the cryptographic environment changes — whether through quantum capability or through a classical breakthrough nobody currently anticipates.
For most data, this is a theoretical concern. For financial data with a long confidentiality requirement — settlement instructions, custody agreements, identity documents, corporate communications — the confidentiality window is measured in decades. A twenty-year confidential document captured today is exposed if the primitive protecting it falls in twenty years.
This reframes the migration question entirely. The relevant deadline is not the date an attack becomes practical. It is the date the recorded data must remain confidential. Those two dates are converging faster than most institutional roadmaps admit.
Based on my audit experience
I have been here before, in a different register.
In late 2017, while the ICO market was at its peak, I declined three high-profile raises because their tokenomics models had structural flaws that no amount of community enthusiasm could paper over. Instead I spent roughly four hundred hours auditing an early DeFi prototype's contract logic and found a reentrancy path that could have drained a nine-figure pool. The lesson was not that I was clever. The lesson was that the crowd's attention is almost never pointed at the layer where the risk actually sits.
The same pattern governed my 2024 ETF analysis. My framework modeled the microstructure effect of institutional rebalancing on exchange reserves and predicted roughly a fifteen percent reduction in available circulating supply from passive accumulation. That model did not require me to forecast price. It required me to understand where the flows terminate. The same forensic method applies here. Trace the cryptographic dependency graph, and you find the exposure is not at the primitive layer everyone is shouting about — it is at the attestation layer nobody is looking at.
And in 2026, working on verifiable compute for autonomous agent economies, the constraint reappeared in a new form. Agents transacting without a cryptographic proof of computation inherit a trust deficit no reputational system can close. The answer there — zero-knowledge proofs bound to settlement — is the same architecture the post-quantum migration demands: a proof that survives inspection by an adversary who has already broken the assumption you were relying on.
The contrarian angle
Here is what makes this week interesting, and it is not the attack.
The consensus reaction was binary: panic or dismissal. Both are traps, and they are the same trap expressed differently. Panic treats an academic result as an operational one, which leads to bad trades. Dismissal treats the migration calendar as somebody else's problem, which leads to bad architecture.
The contrarian position is neither. It is that the cryptographic threat is real but slow, and the operational threat is fast but invisible. Institutions will not migrate because the mathematics demands it. They will migrate because a regulator, an auditor, or an insurer demands it — or because a counterparty fails first.
Migration is a cost center. It generates no revenue, no yield, no narrative. It competes against everything that does. In a bull market, capital flows to stories with measurable upside, and cryptographic hygiene has no measurable upside until the day it has nothing but downside. Patterns repeat, but the participants change — and the new participants are institutions whose procurement cycles move at the speed of compliance, not at the speed of mathematics.
There is a second, subtler point. Crypto markets have increasingly decoupled from their own cryptographic foundations. Price discovery is driven by liquidity, macro positioning, and ETF flows. The primitive layer — the actual security assumptions — barely enters the pricing function. That decoupling is efficient in calm markets and catastrophic in tail events. Mapping the invisible currents of liquidity tells you where price goes. It does not tell you where trust breaks.
Position sizing as survival
For a fund manager, the translation is mechanical.
This week's preprint does not justify a change in exposure to Bitcoin, Ethereum, or any proof-of-stake asset. The cryptography securing those networks is elliptic-curve and hash-based, not RSA, and remains unaffected by any classical factoring result.
What it does justify is three things.
First, a cryptographic inventory audit of every counterparty. Exchanges, custodians, OTC desks, and RPC providers should be able to name their root-of-trust primitives and their migration timelines. Most cannot. That inability is itself a data point.
Second, a re-underwriting of operational risk in custody. The threat model is not that someone factors the modulus. It is that a device which cannot be updated sits in the chain of trust for a decade.
Third, an assessment of the firm's own data-confidentiality horizon. Anything with a confidentiality requirement extending past 2035 should be assumed exposed to harvest-now-decrypt-later and treated accordingly.
Survival is a function of position sizing — and position sizing should be a function of knowing exactly which assumption you are standing on.
The takeaway
The attack did not break RSA. The reaction broke something more fragile: the assumption that the market understands its own cryptographic foundations.
The migration clock is not ticking toward the attack. It is ticking toward the date when the old assumptions expire — and it has been ticking since before anyone printed a headline.
The question worth asking is not whether RSA survives this preprint. It is whether the institutions custodying the next trillion dollars can answer one simple question: what is your root of trust, and when does it expire?
