Can AI Reverse SHA-256 and Steal Bitcoin? A 2026 Fact-Check of the Neural Network Paper

Fact-checked and updated 21 October 2026 with the latest SHA-256 cryptanalysis, AI cryptanalysis results and quantum-computing milestones.

Short answer: no. A 2022 paper claimed that a neural network could "translate" SHA-256 hashes back into English and, combined with quantum computing, open the door to stealing bitcoin. We read the paper line by line, re-computed the hashes in its own figures, and checked its claims against 2026 cryptography research. Can a neural network reverse SHA-256? Not this one. What the model actually learned is a lookup table: it recognises hashes it has already seen. That is a dictionary attack, not a break of SHA-256. The real long-term risk to Bitcoin is a quantum computer running Shor's algorithm against exposed public keys, and that risk has nothing to do with neural networks.

Key takeaways

• The paper trained a 2019-era Seq2Seq model (GRU cells with Bahdanau attention) on SHA-256 hashes of about 150,000 English phrases and movie titles.

• It only "translated" hashes of phrases that were already in its training data. Unseen hashes produced unrelated training phrases.

• Our own test shows why: among 150,000 random SHA-256 hashes, the first 6 hex characters alone identify 99% of them uniquely. The model can memorise a prefix-to-phrase table and never touch the hash function's internals. That also explains why its attention focused on the first few chunks of each hash.

• The paper contains several factual errors about Bitcoin, BIP-39 wallets and complexity theory (listed in full below).

• Full 64-step SHA-256 has no known practical preimage or collision attack. In 2026, classical cryptanalysts pushed practical collisions from 31 to 35 steps and theoretical ones to 37–38 steps, still far short of 64, and none of it used neural translation.

• AI did break new cryptographic ground in 2026, but as a research assistant: AI-assisted work broke the NIST signature candidate HAWK and improved an attack on 7-round AES. Neither result touches SHA-256 or Bitcoin.

• The real quantum risk targets Bitcoin's ECDSA/Schnorr signatures, not SHA-256. Estimates published in 2026 dropped to between roughly 10,000 and 500,000 physical qubits, and roughly 6–6.7 million BTC sit behind already-exposed public keys.

• Bitcoin's first formal quantum-resistance proposal, BIP-360 (Pay-to-Merkle-Root), was merged into the BIP repository in February 2026 and is still a draft. In October 2026, Coinbase called for migration work to start now, and nine crypto firms formed a "Quantum Alliance".

The paper at a glance

TitleA Neural Network Contribute to Reverse Cryptographic Processes in Bitcoin Systems: Attention on SHA256 AuthorsFrancesco Colasanto (University of Florence), Luca Grilli (University of Foggia, corresponding author), Domenico Santoro and Giovanni Villani (University of Bari Aldo Moro) Published inApplied Mathematical Sciences, Vol. 16, 2022, no. 4, pp. 215–232 (HIKARI Ltd) DOI10.12988/ams.2022.916778 DatesReceived 27 May 2022, published 14 June 2022 LicenceCreative Commons BY-NC-ND Core claimTreat SHA-256 output as a "language" and use neural machine translation to translate it back to English, then combine this with Shor's algorithm to reverse the chain that produces a Bitcoin address.

The paper went from submission to publication in under three weeks. That alone proves nothing, but it is worth noting for a claim that, if true, would be one of the most important results in modern cryptography.

First, what a cryptographic hash function promises

A hash function takes input of any length and returns a fixed-length fingerprint. SHA-256 returns 256 bits, normally written as 64 hexadecimal characters. For a hash to be cryptographic it must offer three properties, which the paper also lists:

1. Preimage resistance: given a hash h, it should be infeasible to find any input m with SHA-256(m) = h. Generic cost: about 2256 guesses.

2. Second-preimage resistance: given one input, it should be infeasible to find a different input with the same hash.

3. Collision resistance: it should be infeasible to find any two inputs with the same hash. Because of the birthday paradox, the generic cost is about 2128.

SHA-256 achieves this by padding the message, splitting it into 512-bit blocks and running each block through a compression function of 64 rounds built from additions, rotations, shifts and bitwise logic (a Merkle–Damgård construction). The result is the avalanche effect: changing one input bit flips about half the output bits, unpredictably.

That last point matters for any machine-learning approach. Neural networks work by finding smooth, learnable structure, where similar inputs lead to similar outputs. SHA-256 is engineered so that there is no such structure to find.

What the researchers actually did

The idea: hashes as a foreign language

The authors propose looking at a SHA-256 digest not as a number but as text in an unknown language, comparable to a string of Chinese or Japanese ideograms where groups of symbols carry meaning. If chunks of the hash "mean" something, a translation model with attention should be able to learn which chunk corresponds to which English word.

The model

• Architecture: sequence-to-sequence encoder-decoder with GRU (gated recurrent unit) cells.

• Attention: Bahdanau (additive) attention, the 2015 mechanism that predates the Transformer.

• Implementation: the standard TensorFlow "NMT with attention" tutorial, run in Google Colab.

The dataset

• English sentences from the English–Italian sentence-pair files on manythings.org (the Anki/Tatoeba sets), with the Italian side removed, plus a list of movie titles.

• Each English phrase was hashed with SHA-256. Phrases ranged from one word to more than 20 words.

• About 150,000 lines in total, with training limited to 70,000 sentences for speed.

The experiment: how to split the hash

Because a translation model needs "words", the 64-character hash was cut into equal chunks. Four splits were tested:

SplitChunk sizeExample reportedWhat happened 4 tokens16 characters"hi how are you" correct; "keep your hands off me" → "keep your hands off"Correct or partial, but only on phrases from the dataset 8 tokens8 characters"home alone blades of" correct; "blog vhs" → "turbo mary"Mixed; wrong outputs were other phrases from the dataset 16 tokens4 characters"they went surfing" correct; "headhunter" → "tom is his hair is his"Attention concentrated on the first 3 chunks 32 tokens2 characters"eat it" → "tom is a good father"; "eat up" → "tom is getting angrier"Both wrong; attention on roughly the first 7 chunks

The authors also highlight a case they call a "particular translation": the hash of "walle the", which was not in the training set, came out as "the final fantasy xv", and the hash of "the final fantasy xv" came out as "the". They read this as a sign the network can learn. Their conclusion recommends Transformers, an exponentially larger dataset and new splits, and, notably, describes the method itself as comparable to a dictionary attack built by a neural network.

What is really happening: a lookup table with extra steps

We checked the paper's figures against real SHA-256 output. The hash chunks printed on the heat-map axes match exactly. For example, the 32-token figure for "eat it" starts 85 57 85 68 ec d7…, and SHA-256("eat it") is 85578568ecd7685e…. The 16-token figure for "they went surfing" starts 85e3 cc47 7d18, and SHA-256("they went surfing") is 85e3cc477d18e7ff…. So the experiment is real. The interpretation is the problem.

Test 1: how many characters does it take to identify a hash?

We generated 150,000 random SHA-256 hashes, the same size as the paper's dataset, and measured how many are uniquely identified by their first k hex characters:

Prefix lengthShare of hashes uniquely identified 4 charactersabout 10% 5 charactersabout 87% 6 charactersabout 99.1% 7 charactersabout 99.95% 8 characters100%

With 150,000 entries, a hash's first 6–8 characters work as an almost perfect ID. A neural network does not need to understand SHA-256 at all. It just needs to memorise "this prefix belongs to this phrase". That is precisely what the heat maps show: in the 16-chunk split, attention sits on the first 3 chunks (12 characters), and in the 32-chunk split, on roughly the first 7 chunks (14 characters). The paper presents this as a weakness of the split. It is actually the clearest evidence that the model is doing table lookup.

Test 2: do similar phrases have similar hashes?

"eat it" and "eat up" differ by two letters. Their SHA-256 hashes differ in 153 of 256 bits, close to the 128 you would expect by chance. Nothing in the hash of "eat up" hints that it is related to "eat it". This is why the model cannot generalise: there is no gradient pointing from one hash toward a similar sentence.

Test 3: what happens on hashes the model has never seen?

By the paper's own account, the model fails. "blog vhs" became "turbo mary"; "walle the" became "the final fantasy xv"; the hash of "the final fantasy xv" became "the". In each case the output is a phrase or fragment that already existed in the training data. A model with no real signal still has to emit something, and the most likely output is a common training phrase. This is the behaviour of a classifier picking from a memorised list, not of a translator.

Reproduce it yourself

Readers can verify the numbers above with a few lines of Python:

import hashlib, os, collections

# Hashes from the paper's figures
for s in ["eat it", "eat up", "they went surfing"]:
    print(s, hashlib.sha256(s.encode()).hexdigest())

# How unique are short prefixes among 150,000 hashes?
hs = [hashlib.sha256(os.urandom(16)).hexdigest() for _ in range(150_000)]
for k in range(4, 9):
    c = collections.Counter(h[:k] for h in hs)
    unique = sum(1 for h in hs if c[h[:k]] == 1)
    print(k, "chars:", round(100 * unique / len(hs), 2), "% unique")

# Avalanche effect between two near-identical phrases
a = int(hashlib.sha256(b"eat it").hexdigest(), 16)
b = int(hashlib.sha256(b"eat up").hexdigest(), 16)
print("bits that differ:", bin(a ^ b).count("1"), "of 256")

Why "just use a bigger model" will not fix it

The paper's future-work section suggests Transformers and an exponentially larger dataset. Both miss the underlying issue:

• A bigger dataset is a bigger dictionary. Any input that is in the table can already be found instantly with a plain hash-to-text database, which costs nothing to train and is 100% accurate. Rainbow tables and cracking tools such as Hashcat have done this for decades.

• A bigger model does not create signal. Attention can only exploit structure that exists. If the output bits behave like random noise with respect to the input, a Transformer finds the same nothing that a GRU finds.

• The search space does not shrink. A real Bitcoin private key or wallet seed comes from 128–256 bits of randomness. No dictionary, learned or otherwise, can cover 2128 entries.

Independent work points the same way. A project that tried to invert reduced-round SHA-1 by chaining neural networks, one per round, could not get networks to reverse even a single round, and concluded that classical or differential-neural methods are a better use of effort.

Errors in the paper's cryptography and Bitcoin sections

Beyond the main claim, several statements in the paper are inaccurate. Anyone citing it should know about them.

Paper saysWhat is correct SHA-256 output uses the alphabet A–Z, a–z, 0–9The standard text form is hexadecimal: 0–9 and a–f, 16 symbols, 4 bits per character. A Bitcoin address is 34 hexadecimal charactersLegacy addresses are Base58Check (typically 26–35 characters, no 0, O, I or l). Modern SegWit and Taproot addresses use Bech32/Bech32m and start with bc1 (42 or 62 characters). p = 2256 − 232 − 977 is a Fermat primeFermat primes have the form 22k + 1. The secp256k1 prime is a special-form ("pseudo-Mersenne") prime chosen for fast arithmetic. The private key is a random number transformed via SHA-256A private key is any integer from 1 to n − 1 (n ≈ 1.158 × 1077). Hashing the random number is one possible implementation, not a protocol rule. The BIP-39 mnemonic is turned into the seed with HMAC-SHA512BIP-39 uses PBKDF2 with HMAC-SHA512 and 2,048 iterations, salted with "mnemonic" plus the optional passphrase, to produce a 512-bit seed. The left 256 bits of that seed are the master private keyUnder BIP-32 the seed goes through another HMAC-SHA512 keyed with "Bitcoin seed". The left half of that output is the master key and the right half is the chain code. Spending keys are then derived from it along paths such as BIP-44/84/86. Once you have the private key you can go back to the mnemonic wordsNot possible. PBKDF2, HMAC-SHA512 and BIP-32 derivation are all one-way. Knowing a child private key does not reveal the seed or the words. Shor's algorithm puts the discrete logarithm in BPPShor's algorithm puts it in BQP (bounded-error quantum polynomial time). BPP is the classical probabilistic class, and the discrete log is not known to be in BPP. SHA was born in 1993, based on MD5SHA-0 (1993) followed the design of MD4, the predecessor of MD5. SHA-2 came later: published in 2001 and standardised in FIPS 180-2 (2002). Dobbertin found collisions after 226 work for MD4 and MD5Dobbertin broke MD4 fully and found collisions for MD5's compression function. Full MD5 collisions came from Wang and colleagues in 2004–2005. Transformers avoid the use of feedforward networksTransformers avoid recurrence. Every Transformer block contains a feedforward sublayer. Hash functions "encrypt" informationHashing is not encryption. Encryption is reversible with a key. A hash has no key and is designed to be irreversible.

There is also a logical gap in the attack chain. A legacy Bitcoin address is RIPEMD160(SHA-256(public key)). To get from address to public key you would first have to invert RIPEMD-160, which the paper does not address at all. And for any address that has ever spent coins, the attacker does not need to invert any hash: the public key is already on the blockchain.

How a Bitcoin address is really built

Here is the correct pipeline for a standard modern wallet, with the reversal difficulty of each step:

1. Entropy (128–256 random bits) → mnemonic words (BIP-39, 12–24 words from a 2,048-word list, with a SHA-256 checksum). Easy both ways; the words simply encode the entropy.

2. Mnemonic + passphrase → 512-bit seed (PBKDF2-HMAC-SHA512, 2,048 rounds). One-way.

3. Seed → master key and chain code (BIP-32, HMAC-SHA512 keyed "Bitcoin seed"). One-way.

4. Master key → child private keys along a derivation path. One-way for hardened paths.

5. Private key k → public key K = k·G on the secp256k1 curve. One-way for classical computers (elliptic-curve discrete log). Breakable by a large quantum computer running Shor's algorithm.

6. Public key → address: HASH160 (RIPEMD-160 of SHA-256) plus Base58Check for legacy and SegWit-v0 addresses; Taproot (P2TR) addresses instead encode a 32-byte tweaked public key directly. One-way for hashed types, with Grover only halving the security exponent.

Step 5 is the weak link in a quantum future. The hash steps are not. Note also that Taproot outputs place the key itself on-chain, so they are exposed from the moment they receive funds.

Where SHA-256 cryptanalysis actually stands in 2026

SHA-256 has been studied intensely for over two decades. Real progress comes from differential cryptanalysis and SAT solvers attacking reduced-step versions, not from machine translation:

• 2013: Mendel, Nad and Schläffer's 31-step collision attack (EUROCRYPT 2013) set a record that stood for over a decade.

• 2024: the first practical 31-step collision, with an actual colliding pair, was presented at ASIACRYPT 2024. A SAT-plus-computer-algebra approach reproduced a 38-step semi-free-start collision (a weaker notion where the attacker may also choose the starting state), while pure SAT stalled at 28 steps.

• 2026, practical: Li, Liu, Wang and Shi reported the first practical collision attack on 35-step SHA-256 (IACR ePrint 2026/1080), four steps beyond the previous practical record. A separate preprint (ePrint 2026/1120) claims the first actual colliding message pair for 36 steps, at about 257 work.

• 2026, theoretical: Zhang, Li, Gao and Wang (Shandong University) claimed the first 37-step collision attack (ePrint 2026/232), the first advance on the 2013 step count in 12 years. ePrint 2026/1120 claims a 38-step attack at about 2104.3 work, which is far beyond anything feasible to run, and reports that its method fails at 39 steps.

• The full function has 64 steps. No practical collision, second-preimage or preimage attack on full SHA-256 has been published. Several of the 2026 results are preprints that have not yet been peer-reviewed.

Two things stand out. First, progress is real but slow: about six steps in twelve years, with a large safety margin still left. Second, these are collision attacks, finding two unknown inputs that hash alike. Reversing a given hash (a preimage attack), which is what the Bitcoin paper claims, is a much harder problem, and preimage results on SHA-256 remain stuck at far fewer steps.

Machine learning does have a legitimate place in cryptanalysis. In 2019, Aron Gohr showed at CRYPTO that deep residual networks could act as "distinguishers" for round-reduced Speck32/64, beating the best classical differential distinguisher. That launched the field of neural differential cryptanalysis. A 2025 survey counted 238 follow-up papers. The key differences from the Bitcoin paper: those networks attack reduced-round ciphers, they answer a yes/no question (cipher output or random?) rather than reconstructing inputs, and they are measured on fresh, unseen data against classical baselines.

AI and cryptography in 2026: what actually changed

Since the paper was published, AI has started to produce genuine cryptanalysis, though not in the way the paper imagined. The difference is that today's results come from AI systems acting as research agents that reason about an algorithm's mathematical design. None of them try to "read" hash or ciphertext output the way a translation model reads text.

• HAWK broken (July 2026). Anthropic disclosed on 28 July 2026 that its Claude Mythos Preview model, with researchers Zygimantas Straznickas and Stephen A. Weis, recovered signing-equivalent keys from two HAWK-256 challenge public keys. HAWK is a candidate in NIST's additional post-quantum signature round, not a deployed standard. The attack exploits a symmetry in HAWK's algebraic structure that roughly halves the dimension of the hard problem. HAWK-512 and HAWK-1024 were weakened but remain exponentially hard, and the likely fix is larger parameters or a redesign. An independent, weaker attack on HAWK was reported separately using a different AI model.

• 7-round AES (2026). The same work improved the best-known attack on AES-128 reduced to 7 of its 10 rounds, a target that had not moved since 2013. It still needs about 2105 chosen plaintexts, the gain is about 2.7 bits, and full AES is unaffected.

• Finalised standards held. ML-KEM, ML-DSA and SLH-DSA were not broken, and no production key was recovered.

• The cost of verification. Analysts noted that each publishable AI-found result cost roughly USD 100,000 and a week of compute, and that checking claims now takes longer than generating them.

Overclaimed AI-versus-SHA-256 stories also continue. London-listed Quantum Blockchain Technologies has said since 2024 that its "Method C" AI oracle can predict when an input is likely to produce a winning Bitcoin mining hash and skip some of the work. Sceptics point out that the results were tested on historical blockchain data, that the inference may cost more than the cheap hashes it skips, and that even if the claim were true it would be a modest mining-efficiency gain, not a break of SHA-256. No peer-reviewed cryptanalysis supports it.

The lesson for the 2022 paper: AI's real gains came from finding flaws in an algorithm's design, especially new and lightly reviewed ones. Nothing has shown that a neural network can learn to invert well-studied primitives such as SHA-256 from input and output pairs.

The real threat to Bitcoin: quantum computers and exposed public keys

Shor versus Grover

• Shor's algorithm solves the elliptic-curve discrete logarithm in polynomial time. That turns a public key into a private key. This is an exponential speed-up and the serious threat.

• Grover's algorithm speeds up brute-force search quadratically. Against SHA-256 it cuts preimage security from 256 to about 128 bits, still out of reach. A 2026 analysis found that quantum mining also collapses once the overheads of real error-corrected hardware are counted; the fleets required would need energy on a scale far beyond present-day civilisation.

In other words, the paper's half about decrypting SHA-256 is neither needed nor possible, and its half about Shor's algorithm is the part that matters.

How big a quantum computer is needed?

For comparison, Litinski's 2023 estimate was about 9 million physical qubits, and a 2021 study put a one-hour break at around 317 million. A widely reported September 2026 study cut the required computing power by roughly another 50%. The minutes-scale Google estimate matters most, because an attack that finishes within one block interval (about 10 minutes) could intercept a transaction while it waits in the mempool. Slower machines would still threaten coins whose public keys are permanently on-chain. Google also moved its own internal post-quantum migration deadline to 2029.

Where the hardware is today (October 2026)

• Quantinuum Helios (19 October 2026): reported a logical fidelity of 99.9995% (about 5 errors per million operations) using a colour code that encodes up to 37 physical qubits per logical qubit, with errors falling exponentially as the code grows. The company says this is about 10 times better than its own September record, and it targets a universal fault-tolerant machine, Apollo, for 2029. The comparisons come from the company's press release.

• Google (October 2026): published research on "magic states", the resource that typically consumes about 95% of a fault-tolerant machine's capacity, reporting a 40-fold error reduction and 99.9% accuracy. It still has to be shown at scale. Google's Willow chip, announced in December 2024, has 105 physical qubits.

• IBM: has reported 70 logical qubits and targets 200 by 2029 and 2,000 by 2033. QuEra has run algorithms on up to 96 logical qubits.

That leaves the best machines more than ten times short of the roughly 1,200–1,450 logical qubits needed, and running them for millions of gates is a separate hurdle. Opinions on timing still vary widely: one alliance CTO calls 2028 realistic, while Casa's Jameson Lopp has said such a machine is at least a decade away. In mid-October 2026, Polymarket traders priced about a 1% chance of a quantum threat to Bitcoin by the end of 2026 and about 11% by the end of 2027.

How much bitcoin is exposed?

• Glassnode found about 6.04 million BTC (30.2% of supply) behind exposed public keys in its first analysis; a later update put it at 6.26 million BTC (31.2%), of which about 4.33 million came from address reuse and 1.94 million from script types that reveal the key by design.

• Google's paper estimated about 6.7 million BTC in wallets that could become targets.

• Exposure comes from early pay-to-public-key (P2PK) outputs, including coins associated with Satoshi Nakamoto, legacy multisig, Taproot outputs, and any address that was reused after spending.

• Glassnode reported that about 57% of exchange balances sit in exposed addresses, while the sovereign holdings of the US, UK and El Salvador showed zero exposure.

• The industry "Quantum Alliance" formed in October 2026 puts the figure at about 6.4 million BTC, including Satoshi's estimated 1.1 million.

Estimates differ slightly by method and date, but all land at roughly 30–34% of supply.

Bitcoin's response so far

• BIP-360 (Pay-to-Merkle-Root, P2MR), by Hunter Beast, Ethan Heilman and Isabel Foxen Duke, was merged into the official BIP repository on 11 February 2026. It is a Taproot-like output with the quantum-vulnerable key path removed, and it lays the groundwork for post-quantum signature opcodes in later soft forks. It is still a draft with no activation timeline, though BTQ Technologies has run it on a separate test network since March 2026.

• BIP-361 ("Post Quantum Migration and Legacy Signature Sunset"), led by Jameson Lopp with five co-authors, proposes three phases: stop sending to vulnerable address types about three years after activation, freeze unmigrated legacy coins two years after that, and possibly allow recovery later through zero-knowledge proofs tied to a BIP-39 seed. It is highly controversial. Critics call a protocol freeze confiscation, and Lopp himself has described it as a rough sketch.

• Coinbase (October 2026): the exchange, which says it holds about 12% of all bitcoin, published a call to start post-quantum migration work now because it will take years. It named P2MR (BIP-360) and a possible "P2TRv2" as promising structures. It asked for evaluation of ML-DSA, SLH-DSA, FN-DSA and hash-based options such as SHRINCS, and warned against stateful signature schemes, where reusing a signing state can enable forgery. It suggested the debate over abandoned coins run alongside the technical work rather than block it. Coinbase framed this as input to discussion, not a final position.

• Quantum Alliance (October 2026): nine crypto companies, including Hacken, the Midnight Foundation, Quantus and Postquant Labs, launched a group to publish common security tests and migration guidance for Bitcoin, Ethereum and other chains. Custodians such as WBTC have also announced quantum-readiness work.

• Other ideas on the table: Changpeng Zhao suggested freezing Satoshi's coins if they stay untouched. Postquant Labs' Richard Carback prefers migration and has floated placing vulnerable coins in a trust that owners can reclaim with proof of ownership.

• The standards side: NIST finalised ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) in August 2024, selected HQC as a backup key-establishment algorithm in March 2025, and is finalising FN-DSA (FALCON) as FIPS 206. NIST's transition plan deprecates quantum-vulnerable algorithms in 2030 and disallows them in 2035. ML-DSA is the leading candidate for Bitcoin, but its signatures are around 2.4 KB versus 64 bytes for Schnorr, which raises fee and block-space questions.

The inheritance question the paper raises

The authors note one sympathetic use for reversing wallet cryptography: heirs who cannot access a deceased person's coins. The problem is real, but breaking cryptography is the wrong fix, because anything that unlocks an heir's wallet unlocks everyone's. Practical alternatives already exist: written inheritance instructions stored with a lawyer, multisignature setups (for example 2-of-3 keys spread between the owner, a family member and a trusted service), Shamir secret-sharing backups (SLIP-39), and timelocked recovery paths in modern wallet software.

What bitcoin holders should actually do

1. Do not reuse addresses. Spending from an address publishes its public key. Modern wallets generate a fresh address for every receive; use that feature.

2. Generate keys with real randomness. The paper's method, and every dictionary attack, works only on guessable inputs. "Brainwallets" made from phrases or song lines were drained by exactly this kind of lookup. A 12- or 24-word BIP-39 phrase from a hardware wallet's random generator cannot be enumerated.

3. Check for exposure. If coins sit in a P2PK output or a reused address, consider moving them to a fresh address. Free tools can scan an address for revealed public keys.

4. Treat Taproot with awareness. Taproot outputs expose a key from the start. They are fine today, but they are part of the exposed pool in a quantum scenario.

5. Follow BIP-360. When a quantum-resistant output type activates, migrating early will be the main defence.

6. Ignore "AI cracked Bitcoin" headlines unless they come with code, a held-out test set and a peer-reviewed cryptography venue.

How to read papers like this one

This paper is a useful case study in spotting overclaimed AI security research. Ask these questions:

• Was it tested on unseen data? Here, the reported successes used phrases from the training set, and unseen inputs failed.

• Is there a trivial baseline? A hash-to-text lookup table would score 100% on the same test with no training.

• Does the result scale? A dictionary of 150,000 phrases versus a key space of 2256.

• Where was it published? Cryptographic breaks normally appear at IACR venues (CRYPTO, EUROCRYPT, ASIACRYPT, FSE) or the IACR ePrint archive, where cryptanalysts review them.

• Do the background facts hold up? Errors about address formats, wallet standards and complexity classes suggest the cryptographic framing was not reviewed by specialists.

Conclusion

The Colasanto, Grilli, Santoro and Villani paper is a creative idea, and its authors are candid that the result resembles a dictionary attack. But calling it a way to "reverse" SHA-256 is wrong. The network memorised which hash prefix belonged to which phrase in a 150,000-line list, which a database does faster and more accurately. On new hashes it produced unrelated phrases, exactly as the avalanche effect predicts. SHA-256 remains unbroken at full strength, and Grover's algorithm does not change that.

The latest research supports that conclusion from both sides. Classical cryptanalysis of SHA-256 advanced in 2026 to 35 practical and 37–38 theoretical steps of 64, without machine translation. AI's real cryptographic wins came from reasoning about the designs of newer algorithms such as HAWK, not from learning to invert mature primitives.

The part of the paper that points at a real problem is its final section on Shor's algorithm. In 2026 that risk moved from theory to engineering estimates and record error-correction results, roughly a third of all bitcoin sits behind exposed public keys, and the protocol has a draft defence in BIP-360. The story worth watching is not AI against hashes. It is quantum hardware against signatures, and whether Bitcoin migrates in time.