There's a conversation happening in cryptography circles that hasn't fully reached the blockchain community yet. And when it does, it's going to be uncomfortable.
Most blockchain developers know that quantum computers are coming. Fewer have thought seriously about what that means for the specific cryptographic assumptions their chains are built on — and fewer still have considered that the threat isn't entirely in the future.
The Signature Problem
Bitcoin, Ethereum, and most major blockchains rely on ECDSA (Elliptic Curve Digital Signature Algorithm) or variants of it to sign transactions. ECDSA's security rests on a mathematical problem — the elliptic curve discrete logarithm — that classical computers can't solve efficiently.
A sufficiently powerful quantum computer running Shor's algorithm can.
This isn't news. What is worth thinking about more carefully is the specific exposure model of public blockchains.
When you send a transaction on Ethereum or Bitcoin, your public key is — by design — publicly visible on the chain. Always. That's how signature verification works. And unlike a database that gets patched, a blockchain is immutable. Those public keys will be there forever.
This creates a specific attack scenario that doesn't apply to most other systems: an adversary can harvest public keys today and attempt to derive private keys later, once quantum hardware is powerful enough. The attack surface is already deployed, already public, and cannot be recalled.
"Harvest Now, Decrypt Later" — But For Wallets
You may have heard the phrase "harvest now, decrypt later" in the context of encrypted communications — the idea that nation-state actors are storing encrypted traffic today to decrypt it once quantum computers mature. The same logic applies to blockchain, but with a different payload.
Instead of intercepting encrypted data, the target is the relationship between public and private keys. Any wallet that has ever sent a transaction — and therefore exposed its public key — is potentially vulnerable to a future quantum attack. Wallets that have only received funds and never sent (keeping the public key hidden) have a different risk profile, but the moment they transact, that changes.
The numbers matter here. As of 2024, estimates suggest that a significant portion of Bitcoin's supply sits in addresses where the public key is known. Ethereum's account model means public keys are exposed even more broadly.
NIST Finalized the Standards. Blockchains Haven't Moved.
In August 2024, NIST finalized the first post-quantum cryptographic standards — ML-DSA (FIPS 204) for digital signatures, ML-KEM (FIPS 203) for key encapsulation. These are the algorithms that governments, financial institutions, and critical infrastructure are being directed to migrate to.
The blockchain ecosystem's response has been measured, to put it charitably.
Ethereum has open EIPs discussing post-quantum signature schemes. Vitalik Buterin has written about the eventual necessity of migration. Bitcoin's community is more conservative — significant protocol changes require extraordinary consensus, and post-quantum migration is one of the most technically complex changes imaginable for a system processing billions in value daily.
Meanwhile, chains built more recently — like QRL (Quantum Resistant Ledger) — have incorporated post-quantum signatures from the start, using XMSS. They made a deliberate architectural bet that most of the ecosystem has not.
The Migration Problem Is Harder Than It Sounds
Migrating a live blockchain to post-quantum signatures isn't like updating a library. It requires:
- Defining a new transaction format that supports post-quantum signatures
- A transition period where both old and new signature schemes are valid
- Getting every wallet, every exchange, every smart contract that validates signatures to update
- Coordinating this across a decentralized ecosystem with no central authority
And post-quantum signatures are not drop-in replacements. ML-DSA signatures are significantly larger than ECDSA signatures — roughly 3KB versus 64 bytes. At scale, that has real implications for block size, storage, and fees.
The technical path exists. The coordination problem is the hard part.
The Timeline Question
How much time does the blockchain ecosystem actually have?
Honest answer: nobody knows precisely. Current estimates from NIST and leading cryptographers suggest cryptographically relevant quantum computers — powerful enough to break ECDSA — are likely 10 to 20 years away. Some estimates are more conservative, some more aggressive.
What's certain is that migration of systems as complex and decentralized as major blockchains takes years. The planning, the standards work, the implementation, the coordination, the deployment — all of that has to happen before the threat materializes, not after.
And the window to act is shorter than the timeline to threat, because the remediation takes time too.
What's Actually Happening Off-Chain
One dimension of this that gets less attention: a lot of blockchain infrastructure isn't on-chain at all.
Oracles delivering signed data to smart contracts. APIs that wallets and dApps call to get pricing, state, and authentication. Backend systems that authorize transactions before they hit the chain. Cross-chain bridges with their own signature schemes.
This off-chain layer has its own cryptographic assumptions, its own exposure to the quantum threat, and — unlike the on-chain layer — can be updated without consensus of thousands of nodes.
It's arguably where the first post-quantum migrations in the blockchain space will actually happen.
An Open Question
The blockchain community has navigated hard technical transitions before — the merge, layer 2 scaling, cross-chain interoperability. Post-quantum migration is different in one important way: the deadline is externally imposed by physics, not by product roadmaps.
What's your read on how the major chains handle this? Is the current pace of discussion proportionate to the risk, or is this one of those problems the ecosystem will address seriously only once it's urgent?
Top comments (2)
Great write-up.
I think one of the biggest challenges isn't the cryptography itself - it's coordinating migration across an ecosystem with millions of users, wallets, exchanges, custodians, and smart contracts. Even if post-quantum signature schemes are standardized today, upgrading a decentralized network without breaking compatibility is a massive engineering effort.
I also agree that the off-chain infrastructure deserves more attention. APIs, oracles, bridges, and backend signing services can adopt post-quantum cryptography much sooner than the base layer, making them a practical starting point for the transition.
The quantum threat may still be years away, but for blockchains, waiting until it's imminent is already too late. The time to design migration paths is now.
Thanks Kaito — you're putting your finger on exactly what makes this different from most cryptographic migrations.
With traditional software, you can push an update and users adopt it over weeks or months. With a decentralized network, there's no "push" — you need supermajority consensus across stakeholders with competing incentives, followed by a coordinated transition period where two signature schemes coexist without breaking wallets or contracts that haven't upgraded yet. That coordination layer is genuinely harder than the cryptography.
Your point on off-chain infrastructure is where I think the first real movement will happen. Oracles, bridges, and backend signing services can make independent decisions — they don't need network-wide consensus. A bridge operator can decide tomorrow to sign its attestations with ML-DSA. A price oracle can start delivering post-quantum signed data without waiting for Ethereum to change its transaction format. That's a practical entry point that doesn't require solving the coordination problem first.
The "design migration paths now" framing is the right one. The math of how long cryptographic migrations actually take — planning, standardization, implementation, deployment, adoption — consistently underestimates real-world timelines when decentralization is involved.