Quantum computing threat

Bitcoin, Ethereum and most blockchains rely on elliptic curve signatures, whose security assumes that computing a private key from a public key is infeasible. Shor's algorithm, run on a sufficiently large, error-corrected quantum computer, would make that feasible. Hash functions are less affected: Grover's algorithm only weakens them, so SHA-256 would remain broadly secure.

Exposure depends on whether a public key is visible on-chain. Early Bitcoin outputs paid directly to public keys, including coins attributed to Satoshi Nakamoto, reused addresses and Taproot outputs reveal it; standard addresses reveal it only when coins are spent. On Ethereum, any account that has sent a transaction has exposed its public key. Estimates suggest that a few million bitcoin sit in exposed outputs.

Today's quantum machines are far from the millions of high-quality qubits estimated necessary, and expert timelines range from the 2030s to much later. The challenge is that migrating a decentralised network to new signatures takes years and requires users to move their coins, which raises hard questions about lost or dormant coins that never move.