Executive analysis and nonlinear cascade risk

Publication check: October 8, 2026. The live catalogue now lists 719 manuscripts across 372 families. The official revision history records three withdrawals outside the eight families selected here, plus other repairs. For #002 it records removal of an obsolete introductory citation. This report retains its pinned 722-manuscript source snapshot; it is not a new audit of every revised manuscript. The history also records 13 reference-only updates without listing every affected title; whether any of the ten selected manuscripts are included was not separately checked. All attack implications remain conditional on the stated theorems.

8 selected result families · 10 manuscripts · Source snapshot: October 7, 2026

This analysis examines the path from a mathematical advance to someone stealing BTC/ETH keys, forging validator signatures, or defeating KZG and the ZK systems that depend on it.

The pinned October 7 source snapshot contains 722 manuscripts across 372 result families. The live repository may change after this snapshot. We selected 8 candidate families with plausible cryptographic connections and examined 10 manuscripts in more detail. This was a focused review, not an exhaustive audit of the entire collection.

Our conclusion: these reviewed results do not establish a practical, end-to-end attack-cost reduction against the blockchain targets we examined.

Some of the claimed theoretical advances are substantial. But the missing steps between those advances and a usable attack are substantial too. Here is what we found, assuming the stated theorems hold.

1) #142 — deterministic polynomial factoring over prime fields

This factors a polynomial over a known prime field. It does not factor an RSA modulus.

Randomized expected-polynomial-time algorithms for the polynomial task already existed. The new result removes randomness; it does not establish a speed advantage. A usable new reduction from RSA factoring or elliptic-curve key recovery to this task is still missing.

We cannot turn this theorem into “RSA-2048 is now cheaper to break.”

A follow-up question concerns the tools inside #142: Jacobian division and norm-equation methods might inspire other algorithms. Their stated settings involve restricted curve structure and divisibility promises. The paper’s discrete-log subroutine handles small-prime components; it is not a generic large-prime discrete-log solver. No effective reduction from these tools to extracting a deployed curve’s hidden scalar, with practical target-sized costs, is established here. This is a research direction, not a demonstrated attack.

2) #279 — exact quantum integer factoring

The ideal quantum circuit succeeds with probability exactly 1 over a fixed finite gate set, with polynomial worst-case resource bounds.

Shor already provided a quantum factoring route; candidates can be checked and success amplified through repetition. The new exactness guarantee is a theoretical improvement, but the paper establishes no lower practical qubit, gate-count or runtime requirement.

It also does not directly supply a new elliptic-curve discrete-log attack. The practical hardware gap remains.

3) #103 — L = RL = BPL

For the polynomial-time deterministic simulations compared here, the workspace bound improves from O(log² n) to O(log n). That is a major theoretical space improvement.

But the theorem needs an appropriate randomized log-space program as its input. It does not provide the program that solves secp256k1 key recovery. Finding such a target solver would itself already be a cryptanalytic breakthrough.

Less workspace for a simulation does not give us a new key-recovery work estimate.

4) #107 — faster dense matrix multiplication

This is the candidate with the most direct-looking connection to an existing attack component: linear algebra in NFS/TNFS attacks on finite-field discrete logarithms.

The field matters. The reported bounds are ω ≤ 2.25 over the complex numbers; ω < 2.258 outside an uncomputed finite exceptional-characteristic set; and ω < 2.371054886006746 over every fixed field.

Cryptanalytic relation matrices are sparse. Common solvers exploit that sparsity, with a rough cost around w·N² field operations, where w is row weight. A better dense-multiplication exponent does not by itself establish a faster sparse solve or a cheaper complete attack.

The striking complex-field bound cannot simply be inserted into a BLS/KZG security estimate.

5) #109 — integer multiplication below n log n

The reported asymptotic bound is O(n(lg n)^(1−κ)), with κ = 2^−182, in a fixed multitape Turing-machine model.

The paper describes extremely large constants and thresholds, and uses schoolbook multiplication below its cutoff. It establishes no speed gain at cryptographic sizes.

Substituting 256 or 2048 into the asymptotic expression would not establish an implementation speedup.

6) #029 — the proof input behind #142

The relevant connection is its uniform Hecke zero-free theorem, not the primitive-root count itself. It supports #142’s proof chain. It does not supply an independent RSA or curve-key recovery algorithm.

7) #002 — an exact BSD formula under stated conditions

This concerns global arithmetic of elliptic curves. No effective algorithm is supplied for extracting the hidden scalar d from a finite-field public key Q = dG.

8) #030 — modularity over imaginary quadratic fields

The structural theorem becomes more general. But the natural j=0 CM lifts of the blockchain curves discussed already had classical modularity results. A usable bridge from the new theorem to target discrete logs remains missing.

How big is the demonstrated security drop?

For secp256k1, roughly 2^128 group operations remains a representative generic classical attack scale, with existing constant-factor improvements. This is not a security lower bound.

These results supply no established new end-to-end figure such as 2^100 or 2^80. For BLS/KZG, the cost also depends on the curve, target instance and precomputation model; there is no single honest number covering every system.

We also separated illustrative function values from attack costs. For example, changing c from 2.371177 to 2.25 makes the normalized function m^c about 5.33× smaller at m = 10^6. That is not a measured speedup, 81% fewer attack operations, or a loss of 2.415 security bits.

The actual consequences, if the missing bridges were built, would differ:

• secp256k1 key recovery → ECDSA/Schnorr forgery → control of assets whose public keys and spending conditions permit it.
• Relevant BLS key recovery → forged validator messages; consensus impact depends on stake and protocol conditions.
• Relevant KZG trapdoor recovery → false openings; matching ZK systems and applications need separate analysis.
• RSA factoring → RSA-dependent systems; it is not the native BTC/ETH signature route.

That is what the diagrams show: reported results, existing algorithms, missing attack bridges, practical resource gaps, and conditional on-chain consequences.

Cryptanalytic progress can be nonlinear.

A reusable mathematical method could resolve several missing bridges at once. A practical attack on an affected discrete-log group could spread across the schemes using that group. In finite-field DLP attacks, substantial precomputation can be reused across targets in the same field; each target still requires further work. And recovering one KZG setup trapdoor can undermine many commitments using that setup, without recovering a fresh trapdoor for each commitment.

Ethereum’s KZG commitments and validator BLS signatures both use BLS12-381. A practical discrete-log algorithm applicable to the relevant groups could undermine both systems. By contrast, leaking one KZG setup’s τ defeats binding for commitments under that SRS without itself recovering validator keys. A solver for a relevant pairing target field would not automatically attack secp256k1. Consensus impact depends on the effective validator stake and messages an attacker can forge, not simply on recovering one BLS key.

Those are real amplification mechanisms. Our dependency diagrams are not a timeline: the number of missing arrows is not a measure of remaining research effort. The review does not establish that these eight results have triggered such a cascade, or that future progress will be slow or incremental.

Conclusion: the public evidence in these eight candidate families does not establish that practical blockchain key theft or proof forgery has become substantially cheaper.

This is an assessment of demonstrated attacks. It does not establish future safety, a probability of a break, or a percentage of “progress toward breaking crypto.”

The underlying source-statement and arithmetic analysis went through three review rounds with Claude Opus 5.5, with the displayed arithmetic separately recomputed. The nonlinear scenarios above are conditional extrapolations, not demonstrated attacks. We did not verify the original mathematical proofs; model agreement is not a correctness certificate.

Source collection: https://github.com/openai/math
Snapshot examined: October 7, 2026.

Primary references for the shared-curve facts: Ethereum KZG specification and validator BLS public-key specification. The cascading attack implications above are conditional inferences, not demonstrated attacks.