Q-Day Countdown: Will Quantum Computing End Cryptocurrency?

Mainstream Technical Approaches: Lattice Cryptography and Hash Signatures Stand Side by Side

Current research and implementation of PQC mainly focus on the following major mathematical camps:

• Lattice-based cryptography:Security is built on high-dimensional lattice problems (such as Module-LWE), combining efficiency and security. It is the core direction for current standardization and engineering implementation, with representative algorithms being ML-KEM and ML-DSA.

  Hash-based signatures: Relying solely on the collision resistance of hash functions, the mathematical assumptions are extremely simple and conservative, with SLH-DSA as the representative standard. Other approaches: HQC (Hybrid Quality Control) was selected by NIST in March 2025 as the fifth PQC algorithm, serving as a non-lattice basis backup for ML-KEM. The draft standard is expected to be released in 2026, with the official standard in 2027. Multivariate and isogeny-based cryptography, due to security or efficiency issues, have not yet entered NIST's initial standardization pipeline. The isogeny-based approach, in particular, suffered a major setback when the SIKE algorithm was compromised. Standardization Milestone: NIST Establishes the "One Encapsulation, Two Signatures" Framework The FIPS standardization process, led by the National Institute of Standards and Technology (NIST), is a key turning point in propelling PQC from theory to application. In August 2024, NIST officially released three core standards, establishing the basic division of labor for PQC migration: FIPS 203 (ML-KEM): A key encapsulation mechanism based on lattice problems (KEM), responsible for key exchange; FIPS 204 (ML-DSA): A digital signature algorithm based on lattice cryptography, responsible for general digital signatures; FIPS 205 (SLH-DSA): A digital signature algorithm based on stateless hashing, serving as an alternative for high-security signatures.

Industry Implementation Ecosystem: A Three-Layer Architecture of Main Line, Transition, and Support

In addition to the core algorithm, the construction of the quantum-resistant security system also relies on multi-layered engineering strategies:

• Hybrid Deployment: Adopting a parallel signature/encryption mode of "traditional algorithms (such as ECC/RSA) + PQC" as a risk hedging means in the early stage of migration, ensuring that even if the new algorithm has unknown vulnerabilities, the traditional algorithm can still provide bottom-line security.

Crypto-agility: Through architectural design, the system possesses the ability to quickly replace, upgrade, or roll back algorithms to address potential future risks of algorithm cracking. Auxiliary enhancement technologies: These include Quantum Key Distribution (QKD) (suitable for government/military private networks, but cannot replace internet signature verification), Quantum Random Number Generation (QRNG), and Hardware Security Modules (HSM/Secure Enclave) to enhance random number quality and key storage security. Figure 4: Panoramic View of Quantum-Resistant Routes Compared to traditional Web2 blockchains that rely on centralized mechanisms (such as certificate rotation and account freezing) to mitigate data breach risks, blockchain directly and immediately transforms underlying cryptographic crises into asset loss and governance impasses. Its underlying architecture's "triple irreversibility"—permanent public ledger, irreversible asset transfers, and self-managed private keys—means that assets with exposed public keys are vulnerable to private key recovery and signature forgery, with no centralized safeguards. Even more critically, the elliptic curve and BLS signature systems heavily relied upon by mainstream public chains face structural breaches in the face of Shor's algorithm; once fault-tolerant quantum computers (CRQC) become available, attackers can deduce private keys from exposed public keys on the chain and forge signatures, fundamentally undermining the trust foundation of blockchain.

Threat Map of Cryptographic Components in Blockchain Systems

For the blockchain industry, the core issue is not dealing with immediate hackers, but rather initiating a "migration countdown" in a race against time. Quantum computing will not instantly destroy the blockchain, but it will force the industry to undergo a more difficult underlying cryptographic reconstruction than Web2.

For the blockchain industry, the core issue is not dealing with immediate hackers, but initiating a "migration countdown" in a race against time. Quantum computing will not instantly destroy the blockchain, but it will force the industry to undergo a more difficult underlying cryptographic reconstruction than Web2.

Bitcoin and Ethereum's Quantum-Resistant Practices

Bitcoin's Quantum Risk Resistance: Public Key Exposure, Signature Inflation, and Governance Friction

Bitcoin's quantum risk is not evenly distributed across all BTC, but rather highly dependent on whether the public key has been exposed on-chain. The real high risk lies not in all UTXOs across the network, but rather in early legacy outputs, addresses with exposed public keys and still holding balances, and long-dormant high-value UTXOs. Bitcoin's hash components (SHA-256, SHA256d, and RIPEMD-160) primarily face a decrease in security margin due to the Grover algorithm, rather than being structurally breached by Shor's algorithm like ECDSA/Schnorr. High Risk: UTXOs with Statically Exposed Public Keys: Early P2PK and Taproot (P2TR) outputs, and P2PKH/P2WPKH addresses that have been spent, reused, and still hold balances. Their complete public keys are permanently on-chain, and once CRQC is introduced, they will be the first to be directly breached by Shor's algorithm. Medium Risk: UTXOs whose public keys have not yet been exposed but will be exposed in the future: Unspent and unreused P2PKH/P2WPKH addresses. Only the public key hash is exposed on-chain, and the risk exists only within the brief "quantum pre-race window" from transaction broadcast to confirmation. Low Risk: Assets Already Migrated to Quantum-Safe Addresses: Assets that will migrate to Quantum-resistant (PQ) addresses via soft forks in the future will have significantly reduced risk, but this highly depends on long-term collaborative upgrades across the entire ecosystem. Engineering Challenges: Signature Inflation and the "Soft Fork Priority" Path. Under Bitcoin's governance structure, the political cost of a one-time hard fork to remove ECDSA/Schnorr is extremely high. Introducing new quantum-safe output types through soft forks is one of the more realistic, gradual paths. Current discussions include draft directions such as BIP-360/P2MR (Pay-to-Merkle-Root), but there is still a long way to go before network-wide consensus and activation. This move incurs a hefty "engineering tax": the current ECDSA/Schnorr signature is only about 64–72 bytes, while the candidate ML-DSA (2.4–4.6 KB) and SLH-DSA (7–49 KB) are dozens of times larger. This order-of-magnitude expansion will trigger a systemic chain reaction: directly increasing block weight and transaction fees, exacerbating the storage and bandwidth burden on nodes, leading to a significant deterioration in UTXO sets and wallet UX, ultimately creating a negative feedback loop that further increases the network's resistance to quantum migration. More importantly, Bitcoin lacks the ability to quickly switch algorithms. Unlike centralized systems where certificates can be upgraded or algorithms replaced by a single entity, it requires consensus rules, address formats, wallets, mining pools, exchanges, custodians, and hardware wallets to adapt synchronously. Therefore, quantum migration resistance is not a single-point technological upgrade, but a long-term coordinated project across the entire ecosystem. Governance Game: The "Value Dilemma" of Legacy UTXOs Even if the PQ address is successfully launched, how to deal with long-term unmigrated legacy UTXOs, including the early dormant BTC generally considered to belong to the Satoshi Nakamoto era, remains the ultimate problem. Both extreme solutions conflict with Bitcoin's core values: Inaction: Legacy coins will become a "free lunch" for the first attacker with CRQC capabilities, triggering market panic. Forced freezing/cancellation directly violates the "Not your keys, not your coins" principle of property rights and the narrative of immutability, easily tearing apart community consensus and even triggering chain forks. A pragmatic compromise is the "Legacy Sunset" mechanism, which has been implemented for many years: through long-term issuance of abandonment warnings and a gradual increase in the cost of old outputs as a relay strategy, friction is created, ultimately imposing constraints through a soft fork under multi-party coordination. Discussions on legacy signature sunsets like BIP-361 are essentially exploring this path. Therefore, Bitcoin migration is fundamentally not a cryptographic issue. The PQ algorithm already exists and can be integrated; the real bottleneck lies in the social consensus surrounding issues such as immutability, property rights, and the legitimacy of "declaring assets quantum insecure." In other words, the quantum risk of Bitcoin is not a doomsday scenario where it suddenly goes to zero, but a gradual process from theoretical feasibility and economic cost to practical feasibility; what the industry really needs to strive for is to complete the migration coordination before the economics of attacking it become possible. Figure 5: Bitcoin's Quantum-Resistant Migration: A Long-Term Governance Process. Ethereum's Quantum-Resistant Migration—Full-Stack Restructuring and the "Lean" Roadmap. Ethereum is proactively addressing the quantum threat. Led by the Ethereum Foundation (EF) Post-Quantum team (https://pq.ethereum.org/), research is progressing steadily through open governance processes such as All Core Devs. Its core strategy is not a "one-time bet on a single quantum-resistant (PQ) algorithm," but rather a comprehensive enhancement of the network's cryptographic agility—ensuring that account authentication, consensus signatures, proof systems, and data layer commitments are long-term replaceable, upgradeable, and verifiable. Ethereum's quantum risk is highly concentrated in four cryptographic components: EOA accounts (ECDSA/secp256k1), validator consensus (BLS signatures), data availability (KZG commitments), and parts of the ZK proof system. To address this, EF has designed a "Lean" roadmap that advances in parallel along three tracks: execution, consensus, and data.

• Execution Layer (User Accounts): AA Buffer and L2 Testbed

  Faced with massive EOAs, a direct hard fork faces enormous resistance. Ethereum, relying on account abstractions (such as ERC-4337 and EIP-7702), endows smart contract wallets with "signature agility," supports hybrid signatures and gradual migration, and avoids forced coordination across the entire network. At the same time, L2, with its flexible governance, becomes a natural testbed for PQ deployment;

• Consensus Layer (Validator Signatures): The "Combination Punch" of leanXMSS and leanVM

  Aims to completely replace BLS signatures that rely on elliptic curve pairing.

• The core strategy is to use hash-based leanXMSS and combine it with the minimalist zkVM (leanVM) for SNARK aggregation. Key engineering breakthrough: leanVM is expected to compress massive hash signature data by approximately 250 times, offsetting the expansion of PQ signature size and retaining the scalability advantage of "multi-signature integration" while entering the post-quantum era. Data Layer (Blob, DA, and KZG): Long-Term Reconstruction of Underlying Commitments Under CRQC conditions, the underlying security assumptions of KZG still need to be re-evaluated and migrated to a more PQ-friendly commitment or proof system in the long term. The ultimate direction is to evolve towards hash-based STARK or lattice-based commitment schemes. This is a multi-year, protocol-level underlying reconstruction, not an immediate failure. Furthermore, Ethereum's quantum risk is not evenly distributed. EOA is the largest value pool; exchanges, bridges, custodial hot wallets, governance/upgrade keys, L2 sequencers, and admin keys are high-value operational keys that may be pressured before the protocol itself. Overall, Ethereum's resistance to quantum migration is not a single-point signature replacement, but a multi-year, full-stack engineering effort involving accounts, consensus, DA, ZK, L2, bridges, custody, and formal verification. Figure 6: Ethereum Post-Quantum Migration: Execution (User Accounts), Consensus (Validator Signatures), and Data (Commitments and Proofs).

  

  A panoramic comparison of the post-quantum migration profiles of Bitcoin and Ethereum

  Theoretically, all public blockchains relying on traditional public-key cryptography face quantum risks. However, the ones that truly constitute a systemic resistance to quantum migration are mainly Bitcoin and Ethereum: the former involves legacy UTXO, immutability, and property rights governance, while the latter involves a full-stack reconstruction of accounts, consensus, DA, ZK, and L2. Other public chains are more suitable as supplementary references for technical paths and risk scenarios. Solana represents a high-throughput chain's engineering exploration of PQ signature verification costs. Its community has already discussed Falcon-512 / FN-DSA verification syscalls, but this solution is still an exploratory supplement and does not replace the existing Ed25519, nor does it represent an official migration route for Solana. Starknet / STARK represents a more PQ-friendly ZK route for hash-based proof systems. Compared to SNARK systems that rely on pairing/KZG, STARK's underlying proof mechanism is more suitable as a post-quantum ZK direction; however, this does not mean that the entire Starknet network is quantum secure. Wallet signatures, hash parameters, bridging mechanisms, and Ethereum L1 settlement still need to be migrated synchronously. Native or quasi-native PQ chains such as QRL, Quantus, and Abelian provide technical references for clean-slate post-quantum design: QRL represents the early hash-based signature route, Quantus represents the native PQ L1 of the new generation NIST PQC narrative, and Abelian leans towards lattice-based privacy-preserving L1. They represent a feasible path to "build quantum-resistant chains from day one," but their network effects, liquidity, and application ecosystem are still far weaker than BTC/ETH, making them more suitable as technical examples. Conclusion: Security Debt Maturity and the Countdown to "Q-Day" for the Entire Ecosystem Quantum computing is not the "doomsday weapon" that will end blockchain, but rather a systemic reset of the modern public-key cryptography system. The core threat lies in the future large-scale fault-tolerant quantum computers (CRQC) with strategic-level cracking capabilities. The real risk to the industry is not the lack of post-quantum algorithms (PQC), but whether the entire Web3 ecosystem can complete a coordinated migration across the entire chain before Q-Day (the quantum cracking tipping point). In the short to medium term, the risk of failure of the existing signature system and the high cost of full-stack upgrades constitute a heavy "security debt"; in the long term, survival pressure will transform into an industry catalyst, directly giving rise to new security infrastructure tracks such as PQ hybrid wallets, quantum-resistant institutional custody, quantum risk radar, and PQ signature aggregation. While the macro-level preparation period may last 5–15 years, the truly comfortable "engineering window" is only 5–8 years. This requires a high degree of coordination across the entire chain (from BIP/EIP proposals, node implementation, wallet adaptation to compliance upgrades for exchanges and custodians). More importantly, market repricing may occur earlier than Q-Day itself: once quantum resource estimates continue to decline, hardware roadmaps are significantly accelerated, or regulatory agencies and large custodians take the lead in proposing PQC compliance requirements, the market may examine the cryptographic security model of blockchain assets ahead of time. During this window, the two core ecosystems will face drastically different ultimate tests: Bitcoin: The core challenge is not cryptography, but global social consensus and property rights governance. How to handle long-dormant Legacy UTXOs with exposed public keys is a political game concerning the bottom line of the "immutability" narrative. Ethereum: The core challenge lies in the engineering complexity of its multi-layered protocols and full-stack ecosystem. How to complete cross-layered cryptographic replacements of accounts, consensus, DA, and ZK layers without causing network paralysis, and hedging against signature volume expansion. In long-term asset allocation, post-quantum governance friction constitutes a "structural tail risk" for BTC, but it is by no means a reason to be bearish at present. Its "unchangeable" extremely conservative governance presents a double-edged sword effect: it is both the biggest obstacle to quantum migration and the core moat for maintaining its value store narrative and resisting centralized intervention. This requires investors to abandon the static belief that "BTC will never need major upgrades." In the future, if any of the following scenarios occur: the Q-Day timeline is substantially brought forward, the community refuses to proceed with the PQ migration while the surrounding ecosystem has already taken action, high-value exposed public key UTXOs trigger panic selling, or the disposal of Legacy assets leads to a complete split, the market will revalue BTC's security model and underlying consensus.