If AES is broken, does your VPN still protect you? The answer is nuanced — and depends heavily on which VPN you use.
How VPNs Use AES
Most VPN protocols encrypt your traffic with AES-256-GCM:
- OpenVPN: AES-256-CBC or AES-256-GCM by default
- WireGuard: Uses ChaCha20-Poly1305 (NOT AES)
- IKEv2/IPsec: AES-256-GCM typically
- NordLynx: Based on WireGuard, uses ChaCha20
This is the critical distinction: WireGuard-based VPNs don't use AES at all. They use ChaCha20, which is structurally different and not affected by the Möbius Bridge.
VPNs That Are (Probably) Still Safe
If your VPN uses WireGuard or ChaCha20:
- Mullvad — WireGuard by default, ChaCha20
- NordVPN (NordLynx) — WireGuard-based, ChaCha20
- IVPN — WireGuard support
- Proton VPN — WireGuard support (called Stealth)
VPNs That Need Migration
If your VPN defaults to OpenVPN or IKEv2 with AES:
- Check if your provider offers WireGuard as an option and switch to it
- If WireGuard isn't available, consider switching providers
- OpenVPN supports ChaCha20 as a cipher option — check if your provider allows manual configuration
Does a VPN Even Matter Now?
Yes, for several reasons:
Your ISP still sees your traffic without a VPN. Even if the VPN's encryption is theoretically weakened, your ISP logging your unencrypted DNS queries and browsing patterns is a more immediate concern for most people.
The attack isn't trivial. Breaking AES with the Möbius Bridge presumably still requires effort and resources. A VPN raises the bar, even with AES.
WireGuard/ChaCha20 VPNs aren't affected. Switch to one and this question goes away entirely.
Geographic restrictions still apply. VPNs for accessing region-locked content work regardless of the underlying cipher.
Recommendation
Switch to a WireGuard-based VPN. NordVPN's NordLynx and Mullvad are strong choices. If you're already on WireGuard, you're already past this particular problem.
Get personalized security recommendations: Take the free risk assessment.