September 15, 2026 -- Current quantum computers do not pose a cybersecurity risk, but their successors will. Our new white paper analyses how this could play out for cryptocurrencies. The most important takeaway concerns the actions that should be taken today, while there is still time to sequence it.

A quantum algorithm known as Shor's algorithm puts widely deployed cryptographic schemes based on integer factorization and discrete logarithms in danger of being broken, including RSA, Diffie-Hellman, ECDSA, and EdDSA. Elliptic-curve cryptography schemes are the most exposed because their comparatively small key sizes make them a cheaper target. Unfortunately, their small key sizes are also why the major blockchain platforms such as Bitcoin, Ethereum and Solana use them to secure accounts, authorize transactions and maintain consensus.

Recent research from Google Quantum AI and collaborators has sharpened these concerns. They found a substantially more efficient way to implement Shor's algorithm. For the task of breaking the elliptic-curve discrete logarithm problem on secp256k1, their approach would need a quantum computer with around 20 times fewer physical qubits than prior estimates required, meaning that less hardware R&D will be needed to build such a quantum computer than previously thought. Similar conclusions are expected to hold for related schemes, such as P-256.

When quantum computers become sufficiently performant to pose a cybersecurity risk, they will be referred to as 'cryptographically relevant quantum computers' or CRQCs for short. A CRQC could derive a private key from a published public key. On a blockchain that means direct theft from exposed accounts, as well as the ability to use administrative and governance keys to perform malicious smart-contract upgrades. Stablecoin ecosystems are among the most vulnerable, since the compromise of issuer or administrator keys would allow unauthorized minting, burning, freezing or transferring of assets that the market generally treats as settled cash.

Grover's algorithm is the other relevant consideration, but the effect of this quantum algorithm is much more limited. Consider hash functions. They compress any input into a short fixed-length fingerprint, and they are useful in cryptography because recovering the input from the fingerprint is meant to be infeasible. Grover's algorithm gives a quadratic speedup on brute-force attempts at such a recovery, halving the effective preimage security level. For example, even when future CRQCs run Grover's algorithm against SHA-256, it will have roughly 128 bits of effective preimage security, which is still enough to leave it out of the reach of attackers.  

Some platforms already have partial defences. Bitcoin's most widely used address types record only a hash of the public key, so the key stays hidden while coins sit unspent and is revealed at the moment the owner spends. Solana's Winternitz vaults let a user park chosen assets behind hash-based signatures instead. Both help, and both are narrow. They cover selected assets rather than whole accounts, and neither protects validator identities or the cryptography securing consensus.

The white paper works through what is at stake economically across Bitcoin, Ethereum and Solana, detailing which components are exposed and which migration paths are practical today. Because blockchains are public and continuously priced, they give an unusually clear view of how their quantum risk is perceived. 

The analysis highlights four findings, discussed below, that extend beyond blockchain systems and carry across to conventional enterprise cryptographic infrastructure. Indeed, the implications already reach beyond crypto-native firms, as more than $200 billion in stablecoins and tokenized real-world assets is issued on Ethereum alone. 

1. Exposure time sets the threat

Envisioned quantum attacks on blockchains can be categorized into the following three classes.

At-rest attacks target public keys that stay exposed indefinitely: dormant accounts, reused addresses and validator keys. The key sits there and an attacker works for as long as is needed. There is no deadline, so the CRQC just needs to be functional. It doesn't need to be fast.

On-spend attacks must recover the private key from a public key revealed in a pending transaction, then get a competing transaction accepted before the original is included in a block. That window depends mainly on block or slot times (about 400 milliseconds on Solana, 12 seconds on Ethereum and an average of 10 minutes on Bitcoin), along with fees and mempool rules.

On-setup attacks work differently. Some cryptographic systems depend on fixed public parameters that are generated once in a setup ceremony. Producing those parameters creates secret values that the participants are then supposed to destroy. A CRQC could recover those secrets from the public parameters, and it only needs to do it once. From then on, the backdoor works on an ordinary computer, and using it produces nothing on the ledger that looks anomalous. Ethereum's data availability sampling and several privacy protocols rest on parameters of this kind.

The same exposure model applies to traditional enterprise cryptography. At-rest exposure is anything where a public key is durable and the asset it protects outlives it: root and intermediate certificate authorities, code and firmware signing keys, long-lived device identities, and information encrypted years ago that still matters today. 'Harvest now, decrypt later' attacks belong in this category. Short-lived session exposure is the equivalent of on-spend attacks, and it is the less urgent priority. At-rest exposure comes first, and it is important to get that ordering right.

2. Value concentrates in a small number of privileged keys

Working from public chain data and from resource estimates published by Google Quantum AI and collaborators, the picture is one of concentration.

• Approximately 6.9 million BTC are assessed as quantum-vulnerable, close to $500 billion at current valuations.
• About 9.7% of supply sits in script types whose public keys are exposed on-chain from the outset: mostly P2PK, with Taproot (P2TR) accounting for most of the rest (see Figure 1).
• On Ethereum, roughly 41 million ETH secures proof-of-stake consensus.