Cryptocurrency and the Quantum Problem

Cryptocurrency is not mostly protected by encryption. Ownership is protected by digital signatures. A private key authorizes a transaction, and a public key lets the network verify it.

That distinction matters when people talk about quantum computers destroying blockchains.

A sufficiently capable quantum computer could run Shor’s algorithm against the elliptic-curve systems used by Bitcoin, Ethereum, and many other networks. Given a public key, it could recover the private key and forge signatures. It would not need to guess a seed phrase, reverse the entire blockchain, or break every part of the protocol at once. It would attack the piece that says who is allowed to spend.

No machine can do that today, and there is no honest date for when one will. The arrival estimates move because the hardware, error correction, algorithms, and definition of a useful machine are all moving. A date such as 2030 or 2035 is useful as a migration deadline. It is not a prophecy.

The reason to work on this now is simpler: replacing cryptography in a live system takes years.

Signatures are the first problem

Shor’s algorithm applies to the mathematical structure behind ECDSA, Schnorr, EdDSA, BLS, and other public-key systems. These are not obscure pieces. Depending on the chain, they protect ordinary accounts, validator messages, multisignature wallets, bridges, and some proof systems.

Hash functions are in a different position. Grover’s algorithm gives a quadratic improvement over generic brute-force search, but that is not the same as making a hash function useless. The parameter sizes and exact use still matter. “Quantum computers break Bitcoin” and “SHA-256 is quantum-safe” are both too blunt to be helpful.

There is also an important difference between a public key and a hash of one.

Some Bitcoin output types hide the public key behind a hash until the output is spent. Others, including pay-to-public-key and Taproot outputs, expose an elliptic-curve public key from the beginning. Once a key has been revealed, an attacker with a capable quantum computer could work on it for as long as the funds remain spendable under that key. Even a key that stays hidden until spending has a shorter exposure window while its transaction is waiting to confirm.

Ethereum has a similar distinction. A standard account that has only received funds exposes an address derived from its public key. After that account signs and sends a transaction, the public key can be recovered from the signature.

Hiding a public key therefore buys time. It is not a post-quantum signature scheme, and it is not a complete migration plan.

The migration is harder than the replacement

Post-quantum signatures already exist. NIST finalized ML-DSA and SLH-DSA in 2024, alongside ML-KEM for key establishment. That gives new systems vetted standards to build on. It does not make them drop-in replacements for a blockchain signature.

Their keys and signatures have different sizes. Their verification costs are different. Some useful aggregation properties do not carry over. On a blockchain, those differences are paid by every node that stores, transmits, or verifies the data. A scheme can be cryptographically sound and still be a poor fit for a particular protocol.

Then the network has to adopt it. Consensus rules must recognize the new signatures. Wallets and hardware devices must support them. Exchanges and custodians must update. Users have to move funds from old authorization rules to new ones. The network has to remain usable while both systems exist.

The dormant funds are the sharp edge.

If the network accepts the old signatures forever, a future quantum attacker can eventually forge them. If it stops accepting them, a legitimate owner who missed the migration loses the ability to spend. A chain could add deadlines, recovery paths, or emergency rules, but none of those choices can distinguish an absent owner from an attacker by magic. Once the old signature no longer proves ownership, the protocol has lost its original test.

That is not just a cryptography problem. It is a governance problem with money attached.

There is no useful survival table

A survival table would be satisfying: major chains live, small ones die, and more than 90 percent of the market disappears. The evidence does not support that kind of precision.

A large network has money and engineers to work on a migration. It also has more software, hardware, institutions, users, and old funds to coordinate. A small network may be able to change quickly, or it may have nobody left who can do the work. Market capitalization does not answer the technical question, and “too big to fail” is not a security property.

The same goes for quantum-resistant branding. A chain is not quantum-resistant because it uses one post-quantum signature somewhere. Wallet recovery, validator authentication, bridges, commitments, zero-knowledge proofs, and upgrade keys may rely on different assumptions. The system is only as ready as the authorization paths that still matter.

Bitcoin’s proposed BIP 360 is a good example of the work being incremental. It proposes an output type that avoids Taproot’s exposed key path and could support post-quantum spending conditions. It addresses long-exposure attacks; it does not by itself replace signatures or solve the short window when a key is revealed during a spend.

Ethereum’s post-quantum roadmap has to consider account signatures, validator signatures, commitments, and proof systems separately. That is a more honest picture of the problem than replacing one algorithm and declaring the chain safe.

What to do with this now

For someone using cryptocurrency, there is no reason to make panicked transfers or buy a coin because its marketing says “quantum-resistant.” Use maintained wallet software, keep recoverable backups, and pay attention when the network and wallet developers publish an actual migration path. Avoiding address reuse is good practice, but it should not be mistaken for permanent quantum protection.

For someone building a protocol, the work starts with an inventory. Find every place the system depends on a quantum-vulnerable primitive, every place public keys become visible, and every component that assumes today’s signature sizes and verification costs. Make replacement possible before it is urgent. Test standardized candidates. Decide how old keys will move and what happens to the ones that do not.

“Harvest now, decrypt later” is often brought into this discussion from encrypted communications. A public blockchain is already public. There is no encrypted transaction history to harvest. The relevant problem is that the chain permanently preserves exposed public keys and signatures, leaving them available if key recovery becomes practical later.

NIST’s post-quantum cryptography project is already telling conventional systems to begin migration. Cryptocurrency has an extra constraint: there is no central operator who can quietly rotate everybody’s keys.

That is the quantum problem in its plainest form. Finding replacement mathematics is only the beginning. A network becomes post-quantum when its users can move, its infrastructure can verify the new rules, and it has made a defensible decision about the old keys left behind.