Quantum computing has moved from a distant theoretical concern to a defined security problem for blockchain networks, even though the machines capable of exploiting it do not yet exist. A March 2026 paper from Google Quantum AI estimated that breaking Bitcoin's secp256k1 signature scheme could require 1,200 to 1,450 logical qubits, translating to fewer than 500,000 physical qubits under assumptions including superconducting hardware with a 0.1% error rate.
Google's estimate puts a full attack at roughly 18 to 23 minutes. Because part of the calculation could be prepared before a target transaction appears, the paper estimated that an attacker might need about nine minutes after a public key is exposed in a broadcast Bitcoin transaction. It calculated a 41% chance of front-running a transaction before confirmation under its modeled conditions.
The figures do not describe current quantum capability. Google's Willow processor has 105 qubits, while public demonstrations referenced in the debate have reached only a 15-bit elliptic-curve key. Bitcoin relies on 256-bit keys. The gap remains enormous, but the discussion has shifted toward how blockchains would migrate before quantum hardware closes it.
Public-key exposure shapes the immediate risk
Quantum attacks on conventional blockchain signatures require a public key. An attacker would use it to derive the corresponding private key and create signatures that appear valid to the network.
That creates sharply different exposure profiles between chains and even between address formats on the same chain. Bitcoin addresses that commit only to a hash of a public key can keep the key concealed until the owner spends the coins. In that case, the practical attack window would be limited to the period between transaction broadcast and confirmation.
Addresses whose public keys are already visible on-chain present a harder migration problem. The author of Bitcoin Improvement Proposal 361 estimated that more than 34% of Bitcoin's supply was held in outputs with exposed public keys as of March 1, 2026. The estimate includes early Pay-to-Public-Key, or P2PK, outputs and coins associated with reused addresses.
BIP-361 specifically highlights the roughly 1.7 million BTC held in early P2PK outputs. Some of those coins are believed to be lost or dormant, which makes a voluntary migration strategy difficult: a protocol can offer safer destinations for funds, but it cannot force an absent owner to move them.
Ripple has reported a substantially lower exposure ratio for XRP, saying that 0.03% of XRP sits in dormant accounts with exposed public keys. Solana faces a different architecture issue. Its account addresses are raw Ed25519 public keys, so a user's public key is visible while funds remain idle rather than only when a transaction is made.
Larger signatures create a throughput trade-off
Post-quantum cryptography is available, but its deployment would change the economics of blockspace. Today's Schnorr signatures on Bitcoin and Ed25519 signatures on Solana are 64 bytes. Several alternatives standardized by the US National Institute of Standards and Technology are substantially larger.
ML-DSA signatures range from roughly 2.4 KB to 4.6 KB, depending on the security parameter. SLH-DSA signatures can range from about 7.8 KB to 50 KB. Falcon-512, now being developed by NIST as FN-DSA, is often cited as a smaller post-quantum alternative at roughly 0.7 KB per signature.
Ripple has estimated that Dilithium-based signatures would be about 40 times larger than its current signature format. Cardano co-founder Charles Hoskinson has warned that an early network-wide migration could reduce Cardano's speed by about tenfold. These size constraints explain why several networks are pursuing hybrid approaches, optional accounts, or per-application protections instead of replacing every signature system at once.
NIST has already given public- and private-sector technology operators a timetable. It published FIPS 203, 204 and 205 on August 13, 2024, establishing ML-KEM for key encapsulation, ML-DSA for lattice-based signatures and SLH-DSA for hash-based signatures. Its transition guidance calls for public-key algorithms vulnerable to quantum attack to be deprecated by 2030 and disallowed by 2035.
Some networks have deployed post-quantum accounts
The most advanced blockchain responses are appearing at the account layer, where users can choose a new key type without transferring balances to an entirely new system.
QRL has used native post-quantum signatures since 2018. Algorand added native Falcon-1024 accounts in its v5.0.0 mainnet upgrade in August 2026, after recording its first Falcon-1024 transaction on November 3, 2025. Algorand said that more than 140,000 post-quantum transactions had been processed by June 2026. Its roadmap calls for Falcon-512 support, post-quantum multisignature accounts and staking support by the end of 2026, with broader quantum resilience targeted for 2027.
NEAR added ML-DSA signatures through Protocol 2.13, released on July 20, 2026. Its design allows users to switch keys through one on-chain transaction while retaining multiple active key types. NEAR has set validator-level post-quantum consensus as a goal for the second half of 2027.
Sui has proposed optional ML-DSA-65 accounts for routine use and SLH-DSA-SHA2-128s for high-value vaults built through Move contracts, targeting mainnet availability in the first quarter of 2027. Aptos proposed SLH-DSA-SHA2-128s as an optional account type in AIP-137, published in December 2025 and awaiting governance approval.
Starknet already offers a Falcon-based post-quantum account written in Cairo on mainnet, though the implementation has not been audited. A Starknet community Snapshot vote in October 2026 delivered 93.52% support for research into a move toward an independent post-quantum layer-1.
Bitcoin and Ethereum face longer governance paths
Bitcoin's proposed response remains at the draft stage. BIP-360, merged as a draft in February 2026, would create Pay-to-Merkle-Root outputs that remove key-path spending and keep public keys concealed while coins remain unspent. The proposal would use addresses beginning with "bc1z."
BIP-361, published in April 2026, takes a more forceful route. It proposes a staged retirement of older signature spending, beginning with restrictions on sending coins to vulnerable address formats roughly three years after activation. About five years after activation, ECDSA and Schnorr spends from affected outputs could become invalid, freezing coins that had not migrated. The proposal also sketches a potential later recovery method using zero-knowledge proofs.
Quantum-Safe Bitcoin, or QSB, demonstrated another approach in August 2026 through MARA Slipstream without a Bitcoin soft fork. The method adds a hash-based lock through signature grinding, but it carries transaction costs reported in the hundreds of dollars and does not secure outputs whose public keys are already exposed.
Ethereum's roadmap places post-quantum foundations around 2029. Its work spans BLS validator signatures, KZG commitments used for data availability, ECDSA account signatures and zero-knowledge systems used by layer-2 networks. Draft EIP-8141, published in January 2026, proposes "frame transactions" that would let accounts select their own signature verification rules, offering a path toward account-level migration without requiring every user to change keys at the same moment.
Institutional disclosures reflect a longer planning cycle
BlackRock added quantum-computing risk language to the iShares Bitcoin Trust prospectus in May 2025. Similar language has appeared in documentation for an Ethereum-related product, while VanEck's 2026 BNB ETF filing included warnings related to the cryptographic security of BNB Smart Chain.
Hedera has laid out a four-stage plan beginning with post-quantum or hybrid TLS between nodes, followed by client connections, mixed Ed25519 and Falcon-style consensus signatures, and eventual support for new user key types. Its target time frame is 2027.
Stellar's plan begins with ML-DSA verification through Soroban host functions in 2026 and targets a protocol-level post-quantum signer type by the end of 2027. XRPL has proposed a four-stage route toward a native amendment by 2028, while its XLS-295 proposal for ML-DSA-44 remains in draft.
The practical dividing line is increasingly whether a network can rotate keys at the account level. Systems such as Algorand, NEAR, Sui, Aptos and Starknet can design migration paths that preserve an account's balance and application relationships. Bitcoin's unspent-output model offers strong protection for fresh addresses but requires users to adopt new address types and move funds before older signatures become unsafe.
Quantum-capable hardware remains far from the scale described in Google's estimates. Yet the migration work required to change cryptographic systems, update wallets, coordinate validators and handle dormant funds could take years. That places the immediate burden on protocol design and key-management choices rather than on a sudden quantum attack.
For a deeper grasp of blockchain’s cryptographic foundations before the quantum shift, explore our guide on digital signatures.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
