Panoramic Research Report: Is the Crypto World Ready for Quantum Attacks? Is Everyone Prepared?

Original | Odaily (@OdailyChina)

Author | jk

Before You Read: Five Things to Clarify First

This report does not assume the reader has any knowledge of cryptography or quantum physics; if you only care about the conclusions, you can jump straight to "Key Findings"; before diving into the main text, we will first explain five key concepts clearly using everyday analogies.

1. How Do "Keys" in Cryptocurrency Work?

Your Bitcoin or Ether is not stored in some file; it is registered under an address on the blockchain. To spend this money, you must present a "digital signature" to prove to the entire network that you are the owner of this address. Generating a signature requires a private key, which only you know; verifying a signature uses a public key, which is public and can be checked by anyone.

You can think of it as a signature sample kept by a bank: the bank holds your signature sample (public key), and when someone comes to withdraw money, the bank compares the handwriting against the sample (verifying the signature), but no one looking at the sample can imitate an identical handwritten signature (derive the private key). This mechanism is reliable today because deriving the private key from the public key is mathematically considered too difficult to accomplish. The threat of quantum computers lies precisely in the possibility that they could make this "impossible thing" feasible.

2. What Quantum Computers Change

An ordinary computer cracking a password is like a person holding a large ring of keys and trying them one by one; no matter how fast they try, it would take an astronomical amount of time. A quantum computer does not try faster; it uses a different way of solving the problem: for certain types of mathematical problems, the Shor algorithm proposed in 1994 can compress the time required from "on the scale of the age of the universe" to "minutes to hours."

It must be emphasized that quantum computers are not omnipotent. For the vast majority of everyday computing tasks, they offer no advantage. Unfortunately, the type of problem they excel at happens to be exactly the foundation on which the public-key cryptography (including RSA and elliptic curves) relied upon by today's internet and blockchain is built. By contrast, hash functions (which can be understood as a one-way meat grinder that churns any input into a fixed-length fingerprint) are only slightly accelerated by quantum algorithms, so security mechanisms built on hashing are relatively robust. This also explains why most post-quantum solutions are moving toward "hash-based" approaches.

3. Why "No Need to Panic, but Cannot Ignore It"

Today's quantum computers are still far from being able to threaten Bitcoin.Cracking a single Bitcoin key requires about 500,000 physical qubits, while the most advanced publicly available chips today have only about a hundred—a gap of several thousand times. So no one will steal your coins with a quantum computer today.

But there are two unsettling factors on the timeline.First, migration itself is extremely time-consuming: replacing the entire blockchain's signature system requires writing code, auditing, testing, coordinating a network-wide upgrade, and then getting hundreds of millions of users to move their assets over; the industry generally believes this takes five to ten years. Second, the estimates are falling rapidly: a year ago it still required millions of qubits (which can be simply understood as the computing power a quantum computer needs to crack the blockchain), and this year it has dropped to fewer than 500,000. This is like building a bridge that takes ten years while the arrival of a flood cannot be predicted; the sensible approach is to start construction now rather than wait for the water to rise.

4. Why Some Coins Are More Dangerous

Whether the coins in an address are at risk depends on whether the public key has already been exposed. You can think of it as a sealed envelope: many addresses store not the public key itself but the hash fingerprint of the public key, which is equivalent to sealing the public key inside an envelope; the envelope is only opened when you spend the money. As long as the envelope is not opened, a quantum computer has no way in.

The problem is that some addresses' envelopes were opened long ago.Certain early Bitcoin addresses (including the Satoshi era) wrote the public key directly on-chain, with no envelope; and a large number of users reuse the same address, so when they first spend, the envelope is opened, and any remaining coins stay in the same address, leaving the public key permanently exposed. These are the "exposed" assets repeatedly mentioned in the report, accounting for about one-third of the total Bitcoin supply. In addition, even for sealed envelopes, during the brief window when you initiate a transfer and the transaction has not yet been confirmed, the public key is broadcast—a fleeting but not impossible attack opportunity.

5. What "Post-Quantum" Is Actually Solving

The solution is not complicated: switch to a new lock that even a quantum computer cannot pick. Academia has already proposed several candidates, such as hash-based signatures and lattice-based signatures, and standardization was completed by the U.S. NIST in 2024. What is truly difficult is the next three things: the new locks are bigger and heavier, with signatures 10 to 40 times the current size, directly slowing transaction speeds and driving up costs; changing the lock requires network-wide agreement, and decentralized networks are precisely the hardest to reach consensus; and for those coins whose owners have gone missing and will never come to change the lock, whether to freeze, destroy, or leave them as they are—no solution can satisfy everyone.

A Few Common Misconceptions

One misconception is that "once quantum computers appear, all cryptocurrencies will go to zero." In fact, what is threatened is the signature step; the network can respond by upgrading its signature scheme, progress varies across chains, and the risks are not equal.

A second misconception is that "quantum computers will make mining meaningless." Mining relies on hash computation, and quantum algorithms offer only limited acceleration; they will not overturn proof of work.

A third misconception is that "this is science fiction and has nothing to do with me." It is true that quantum computers currently cannot crack Bitcoin, but regulators, custodians, and ETF issuers have already added it to their formal risk lists, and the migration window has also been written into the policies of various countries.

Key Findings

The crypto industry's level of preparation for quantum attacks is markedly higher than a year ago, but post-quantum protection that can actually be used on mainnet remains very scarce; overall, it is not yet prepared.

Blockchains rely on private-key signatures to prove asset ownership; the security of signatures rests on the mathematical hard problem of the elliptic curve discrete logarithm. Classical computers cannot solve this problem in feasible time, but a sufficiently large quantum computer with error correction, using the Shor algorithm, could in theory derive the private key from the public key and thereby transfer someone else's assets. Post-quantum cryptography refers to signature and encryption schemes that are considered secure even in the face of quantum computers.

"Elliptic curve discrete logarithm" sounds abstract, but it can be understood with an everyday analogy. Imagine a public starting point on a specially shaped grid; following fixed rules, you "jump" from the starting point a number of times and finally land at some position. Your private key is the number of jumps, an extremely large random number; your public key is the position of the final landing point, which is made public. Given the number of jumps, calculating the landing point is easy—a few hundred steps of computation suffice; conversely, seeing only the landing point and wanting to know how many times the jump was made, there is currently no better way than trying every possible number one by one. The curve used by Bitcoin and Ethereum has about 2 to the 256th power possible values—an astronomical number; even using all the computers in the world, it could not be exhausted within the lifespan of humanity, or even the universe. This is precisely why the private key cannot be derived from the public key by others.

The reason a quantum computer poses a threat is that it does not have to try one by one. The Shor algorithm exploits the properties of quantum superposition to examine a large number of possible values simultaneously and extract the hidden pattern in the jumping process, compressing a search that would originally require an astronomical number of steps into a manageable amount of computation. In other words, a classical computer is fishing for a needle in the ocean drop by drop, while a quantum computer finds the pattern that locates the needle.

For a real attack, the process roughly consists of three steps: first, the attacker reads the already-public public key of an address from the blockchain; second, the attacker uses a sufficiently large quantum computer to compute the corresponding private key; third, the attacker uses this private key to forge a valid signature and transfer the coins in that address to themselves. The network cannot distinguish whether this signature is genuine or fake, because mathematically it is exactly the same as one signed by the owner. This is also why the report repeatedly emphasizes "whether the public key has been exposed": if the public key has not been exposed, the first step of the attack cannot even begin.

When Will the Threat Arrive?

Over the past year, academic estimates of the quantum resources needed to break cryptocurrency have dropped significantly. A white paper released by Google Quantum AI in March 2026 (with co-authors including Dan Boneh of Stanford University and Justin Drake of the Ethereum Foundation) presented two attack circuits against the secp256k1 curve, requiring no more than 1,200 and 1,450 logical qubits respectively. Logical qubits refer to qubits that have undergone error correction and can perform reliable computation; converted to actual hardware, on a superconducting route with an error rate of about one in a thousand, the required physical qubits are fewer than 500,000, and a full run takes about 18 to 23 minutes. Because about half of the computation can be completed in advance, once a public key is disclosed when a transaction is broadcast, the attacker needs only about 9 minutes to derive the private key. CoinDesk noted in its report that this means the attacker has about a 41% chance of redirecting the funds before the original transaction is confirmed. Forbes believes this result represents about a 20-fold reduction from previous estimates of millions of physical qubits.

Qubits can be simply understood as the computing power a quantum computer needs to crack the blockchain; correspondingly, Q-day refers to the day when a sufficiently powerful quantum computer appears.

In a May 2025 preprint, Craig Gidney pointed out that the noisy qubits required to break RSA-2048 had dropped to fewer than 1 million, whereas his and Ekerå's 2019 estimate was 20 million. Another preprint submitted on the same day as the white paper by Caltech, Oratomic, and UC Berkeley claimed that using a neutral-atom route, 10,000 to 26,000 qubits might suffice, but this conclusion comes from simulation and has not been verified on hardware. In addition, Google did not disclose the attack circuit itself, using only zero-knowledge proofs to demonstrate that the circuit is valid—the first "responsible disclosure" approach adopted in this field.

Screenshot of the Google paper, source: arxiv

However, the reason there is no need to panic is that there is still a large gap between the current state of hardware and the above estimates. Google's Willow chip has only 105 qubits; the largest elliptic curve key successfully cracked in a public demonstration was only 15 bits, while Bitcoin uses 256-bit keys. The Q-Day Prize awarded by Project Eleven for this is also controversial; Bitcoin developers believe the output is not significantly different from random guessing.

As for when a machine with actual cracking capability will appear, expert judgments are broadly concentrated in the early to mid-2030s, and there is also risk before 2030. Coinbase's advisory board stated that it cannot be certain that such machines will not appear by NIST's 2035 migration deadline. Charles Hoskinson believes the probability of a commercial-grade quantum computer appearing before 2033 is more than half, while Nic Carter estimates the probability that Bitcoin will be vulnerable by 2035 at 70% to 80%. Google has set its own post-quantum migration timeline for 2029.

The Nature of the Risk and the Scale of Exposure

For public ledgers, the main risk is signature forgery—that is, an attacker derives the private key from an exposed public key and steals assets—rather than the industry's commonly cited "harvest now, decrypt later." For addresses whose public keys already appear on-chain, their assets are in a state of "static exposure" from the day a large quantum computer appears; assets that use only a hash value as the address and have never been spent are exposed only during the brief window between transaction broadcast and confirmation. The "harvest now, decrypt later" threat mainly falls on privacy coins, because transactions recorded today may be retrospectively de-anonymized in the future. Hash functions themselves are not the weak link: SHA-256 and Keccak lose only square-root-level security strength against quantum algorithms, and proof-of-work mining and hash-based commitments remain generally secure—which is also why most post-quantum solutions tend toward hashing.

The scale of exposed assets is considerable. Coinbase's advisory board estimates that about 6.9 million BTC (about 32% of total supply) has public keys already exposed on-chain, of which about 1.7 million are in about 20,000 early P2PK addresses and about 5 million stem from address reuse, including the cold wallets of some large exchanges. The authors of BIP-361 give a slightly higher figure, stating that as of March 1, 2026, it exceeds 34%. By comparison, Ripple says only 0.03% of XRP is held in dormant accounts with exposed public keys. The differences in figures mainly stem from different statistical criteria for P2PK, address reuse, and Taproot outputs.

Progress and Divergence Across Chains

In terms of actual progress, the chains have clearly diverged. QRL has run on native post-quantum signatures since 2018; Algorand launched native Falcon accounts in August 2026; NEAR launched ML-DSA accounts in July 2026; Starknet's Falcon accounts are already running on mainnet but have not been audited; Tezos's related code has entered mainnet with an upgrade but is disabled by default. Ethereum (around 2029), XRPL (2028), Sui (Q1 2027), and Stellar and Hedera (around 2027) have roadmaps with dates; Solana has chosen Falcon but set no timetable; Cosmos SDK has released support but each chain must enable it itself. Bitcoin's two related proposals are still in draft stage and lack an activation path; Cardano is still in the research stage; Monero, Avalanche, and BNB Chain have no formal plans.

Account abstraction is the most important structural difference. Networks where accounts can change their own signature schemes without requiring a network-wide fork (Starknet, Algorand, NEAR, Sui, Aptos, and Ethereum after EIP-8141 lands) allow users to migrate one by one; Bitcoin's account model does not have this flexibility, and migration can only rely on new address types and years of voluntary transfers.

The Difficulty Lies in Governance: How to Ensure Everyone Acts in Unison?

The cryptographic solutions themselves already have standards to follow; what is truly unresolved are governance and engineering issues.

First is how to coordinate a soft fork or hard fork so that the entire network upgrades in sync. Second is how to handle assets that never migrate, including about 1.7 million BTC from the Satoshi era—whether to freeze, revoke, or leave them as they are; currently only a few chains have taken a clear stance. Third, the new signatures are 10 to 40 times larger than the existing 64-byte signatures, which will directly drag down transaction throughput and drive up costs. Ripple points out that Dilithium signatures are about 40 times the size of existing signatures; Coinbase's advisory board warns that block sizes could inflate by up to 38 times after the switch; Hoskinson cautions that switching Cardano too early could slow the network by about 10 times.

Standards and Regulation

Traditional finance and government agencies have already set clear migration timetables, and it is against this backdrop that the various blockchain chains are being pushed to act. The most critical is the U.S. NIST post-quantum standard, which both defines the signature schemes blockchains can choose and sets the deadline for the retirement of old algorithms.

The Industry Gold Standard: NIST Standards

NIST is the U.S. National Institute of Standards and Technology, part of the U.S. Department of Commerce, responsible for developing technical standards. Its standards in the field of cryptography (such as AES and SHA hashes) are widely adopted globally. In August 2024, it released the first batch of post-quantum cryptography standards, so most blockchain post-quantum solutions follow it.

NIST officially released three post-quantum standards on August 13, 2024, with a fourth still being developed. FIPS 203 (ML-KEM) is a key encapsulation mechanism used for encrypted communication, not a signature scheme. FIPS 204 (ML-DSA, formerly Dilithium) is a lattice-based signature with a signature size of about 2.4 to 4.6 KB, and is currently the most common default choice. FIPS 205 (SLH-DSA, formerly SPHINCS+) is a hash-based signature with the most conservative security assumptions, but its signature size reaches about 7.8 to 50 KB. The not-yet-finalized FIPS