Quantum Risk in Crypto: Panic Is Premature

When Google’s quantum research team published a paper in March revising the resource estimate for breaking elliptic-curve cryptography, the crypto industry reacted rather overdramatically. Going as far as calling it the end of Bitcoin.

Previous estimates concluded that cracking 256-bit elliptic-curve cryptography with Shor’s algorithm would require tens of thousands of logical qubits. But Google’s team brought that number down to fewer than 1,200 logical qubits; a 20x reduction in the estimated cost of the attack.

Now that the attack is cheaper in theory, how does that affect the Bitcoin in your wallet in a decade? After all, no quantum computer on Earth is remotely close to sustaining 1,200 fault-tolerant logical qubits.

Not to be like the gentleman who stated man won’t fly in a million years just 9 days before the Wright Brothers took to the skies, but getting to that level would require the type of breakthroughs you see in the third act of sci-fi movies.

So let’s assume the breakthrough is near. For anyone holding assets on a blockchain secured by elliptic-curve cryptography, the only question becomes: how much time do we have?

In my view, that is the more useful way to think about the problem: not whether quantum computing will eventually break today’s cryptography, but whether the industry can migrate before that becomes possible.

Not All Crypto

Shor’s algorithm recovers a private key from a public key. If the public key is not exposed onchain, the algorithm has nothing to work with.

Most modern Bitcoin address types keep the public key hidden until funds are spent. P2PKH and P2WPKH hash it, while P2PK and Taproot expose it immediately. The risk is concentrated on addresses where a past transaction has already revealed the key.

Onchain analysis shows that over 34% of all Bitcoin in circulation has had its public keys exposed. That’s approximately 1.7 million BTC across roughly 20,000 exposed keys sitting in legacy addresses.

Ethereum faces a broader version of the same problem. Every externally owned account that has ever signed a transaction has exposed enough information for its public key to be recovered. Beyond individual accounts, validator BLS signatures, KZG commitments, and some zero-knowledge proof systems also depend on cryptography that a sufficiently powerful quantum computer could break.

The Migration Is Already Ongoing

Quantum computers threaten RSA and elliptic-curve cryptography across banking, government PKI, and secure communications so Blockchains are just a part of a much larger transition.

NIST finalized its first three post-quantum cryptography standards in August 2024: ML-KEM for key establishment, ML-DSA and SLH-DSA for digital signatures. On the blockchain side, Bitcoin has BIP-360, merged into the official repository in February 2026. This proposal removed the need to expose a classical public key onchain.

Ethereum’s Protocol cluster is targeting a quantum-resistant base layer by December 2029 across execution, consensus, and data.

Delivery of this will require five hard forks at roughly seven months each.

These timelines are not unique to crypto. Google has set a 2029 internal target for completing its own post-quantum migration, while the UK’s National Cyber Security Centre has targeted completion by 2035. Blockchain networks are therefore migrating as part of a much broader cryptographic transition, rather than responding to a threat unique to crypto.

The Timeline Math

A Citigroup report earlier this year gave us a 19-34% probability of a cryptographically relevant quantum computer appearing by 2034.

The migration plans of most blockchains all target completion before 2034, so the race currently favors defenders.

I believe this is where the crypto industry’s current panic gets the timeline wrong. The quantum threat is real, but the relevant deadline is not the day a quantum computer comes online. It is the deadline for moving vulnerable assets and infrastructure before one does.

The only concern now is the harvest-now, decrypt-later loophole. An attacker can catalog exposed public keys today and attempt key recovery once a capable machine exists.

This is why migration planning cannot wait for quantum computers to arrive. By the time they’re here, every exposed key is already at risk.

What We Can Do Now

For most users today, phishing, malicious dApp signing, compromised firmware, and poor entropy for generation remain far more likely to cost them money than a quantum computer.

The sensible position is to hold both facts at the same time. Strengthen defenses against current attacks. Stop reusing addresses. Use wallet software that defaults to output types hiding public keys. And watch the migration timelines.