The blockchain industry confronts a decision with no room for delay: replace cryptographic primitives securing asset ownership and transaction integrity before a fault-tolerant quantum computer can execute Shor’s algorithm against production keys.
Simulation of quantum attacks against Web3 primitives confirms structural viability of compromising ECDSA, the signature scheme protecting Bitcoin and Ethereum wallets. The problem: the technically correct solution—post-quantum cryptography (PQC)—imposes operational costs most networks have not begun to quantify rigorously.
The threat is structural and cumulative
Risk does not materialize only when an adversary obtains a functional quantum computer. A present and cumulative threat exists: the harvest now, decrypt later (HNDL) attack. An adversary can collect public keys exposed on-chain today and store them until quantum capacity permits derivation of corresponding private keys.
Blockchains record public keys permanently and immutably. A later fork does not retroactively protect the keys. Assets linked to addresses whose public keys already reside on-chain are vulnerable once quantum capacity reaches the necessary threshold.
Solana co-founders have publicly warned Bitcoin developers to prepare in advance for advances in quantum computing. Reduction in resources required to execute Shor’s algorithm against ECDSA has been documented, shortening the estimated time horizon. The preparation window narrows.
Change of foundation: from computational advantage to mathematical soundness
Post-quantum cryptography (PQC) does not represent an incremental improvement. It represents a change in the foundation of security. Classical schemes such as ECDSA depend on computational difficulty of the elliptic curve discrete logarithm problem for a classical attacker. Shor’s algorithm solves the problem in polynomial time. Computational advantage disappears.
PQC shifts the security guarantee to mathematical problems for which no efficient quantum algorithm is known. Trust does not come from the magnitude of a number, but from formal reductions linking scheme breakage to resolution of a problem considered intractable, such as learning with errors (LWE) for lattice-based schemes.
NIST has completed the first standardization phase. In August 2024, the agency published FIPS 203 (ML-KEM, based on CRYSTALS-Kyber), FIPS 204 (ML-DSA, based on CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, based on SPHINCS+). The fourth round continues evaluating key establishment algorithms, with HQC selected for additional standardization.
Cryptographic families: technical trade-offs
Choice of cryptographic family determines a network’s performance profile.
- Lattice-based. Schemes ML-DSA and Falcon (FN-DSA) offer a balance between security and size. BNB Chain has tested ML-DSA-44 for transaction signing, with backward compatibility for existing wallets and addresses. Solana has selected Falcon as its post-quantum signature scheme, with two validator client teams reaching the same conclusion independently. Ethereum has proposed leanXMSS, a hash-based scheme replacing BLS12-381 validator keys.
- Hash-based. Considered the most conservative option, depending solely on collision and preimage resistance of cryptographic hash functions. SPHINCS+ and SHRINCS—proposed by Blockstream for Bitcoin—use SHA-256, a function already integrated into the network. The main disadvantage is signature size. SHRINCS has a minimum size of 548 bytes plus 48 bytes for the public key, approximately 9 times the size of a Schnorr signature.
Operational cost: data from the BNB Chain test
BNB Chain’s post-quantum migration test provides the most concrete available data on operational impact. Results show a 40% to 50% throughput reduction under high load between regions.
Signature size increased from 65 bytes to 2,420 bytes, a factor of 37 times. Average transaction size grew from 110 bytes to 2.5 KB. Block size increased from 110 KB to 2 MB. Native transfer throughput fell from 4,973 TPS to 2,997 TPS.
They are measurements from an executed test. The consensus layer maintained relative stability through pqSTARKÂ for validator vote aggregation, but the user transaction layer became the primary bottleneck. Increased data size raises bandwidth usage and propagation latency, affecting node synchronization, especially in cross-region scenarios.
Migration challenges: governance, inactive accounts, and compatibility
Post-quantum migration is not solely a cryptographic engineering problem. It involves governance decisions without precedent.
- Accounts with exposed public keys. Addresses whose public keys are already recorded on-chain are permanently vulnerable. A migration not addressing the accounts leaves a segment of assets exposed regardless of future updates. Retroactive protection is not possible without compromising immutability.
- Network coordination. The transition requires a coordinated soft or hard fork. In decentralized communities, the transition implies social and technical consensus processes extending over years. Blockstream has published SHRINCS as a Bitcoin Improvement Proposal (BIP), but the document remains in draft, with security proofs pending and software not audited.
- Backward compatibility. Solana has structured its migration in three phases with an address preservation mechanism based on zero-knowledge proofs over Ed25519 seeds. Ethereum has proposed a post-quantum key registry as a first concrete step. Viability of the approaches depends on the underlying key architecture.
- Hybrid schemes. Combining classical and post-quantum primitives offers a transitional path. A hybrid signature requires validation of both ECDSA and ML-DSA, preserving security if one scheme falls. Cost: doubled signature size and verification time. Networks with high throughput requirements must evaluate whether hybrid schemes provide sufficient benefit relative to full PQC migration.
- Scalability and storage. Increased block and transaction size affects not only immediate throughput. It increases state growth and pressure on node storage. Compensation through larger blocks restores TPS but amplifies propagation delay and fork risk.
Post-quantum cryptography is technically viable in blockchain. The BNB Chain test demonstrates a functional migration is possible without rebuilding the entire system. Technical viability does not equal operational viability without costs.
The industry must abandon the premise of post-quantum security without performance degradation. Available data indicate a throughput reduction of at least 40% in high-load scenarios. Transaction size multiplies by 20 or more. Block size can grow by an order of magnitude.
