Quantum-Safe Blockchain — Bitcoin BIP-360, Ethereum PQ Roadmap, and the Custodial Migration Plan

Manish Garg
Manish Garg Associate of (ISC)² · RingSafe
May 8, 2026
5 min read
Read as
Bitcoin uses ECDSA. Ethereum uses ECDSA (and BLS12-381 for staking). Both fall to Shor when CRQC arrives. The blockchain industry is debating PQ migration mechanics: Bitcoin proposes BIP-360 (post-quantum signatures) and various opt-in soft-forks; Ethereum has the Verkle-tree + PQ-signature roadmap. Migration is unique in blockchain context — wallets are user-owned, can’t be force-upgraded; “lost-key” coins have public keys revealed; the social-coordination problem dominates the technical one. This module covers the threat model, the proposed migrations, and what custodial / institutional wallet operators should plan for.

Blockchain post-quantum migration is a 10-year governance project, not a technical project. The cryptographic primitives are well-understood; persuading 10 million Bitcoin holders and 200 million Ethereum users to migrate their assets to PQ addresses is the actual problem.

The threat model — what’s actually at risk

Three categories of blockchain assets:

  • Funds in addresses where the public key has NEVER been revealed (unspent UTXOs in P2PKH or P2WPKH addresses, only the hash of the pubkey is on-chain). Pre-CRQC: derive pubkey from hash requires preimage attack on SHA-256 — infeasible. Post-CRQC: still infeasible (Grover only halves to 2¹²⁸). These funds are safe.
  • Funds in addresses where the public key HAS been revealed (any address that’s been spent from, P2PK addresses, taproot keypath spends with revealed pubkey). Post-CRQC: Shor recovers the private key from the public key; attacker can spend the funds. These funds are at risk.
  • Future transactions at any address: in-flight transactions in the mempool are vulnerable to a quantum attacker who can derive the private key faster than the transaction is mined.

Estimates of “Bitcoin at risk to Shor” vary: lower bound ~25% (publicly-keyed addresses + Satoshi’s coins at P2PK), upper bound ~70% (counting any address that has ever been spent from). Either way, hundreds of billions of dollars are at quantum risk.

Bitcoin’s PQ roadmap

BIP-360 / draft NIST-aligned schemes: introduce ML-DSA-65 or hybrid signatures as a soft-fork. New addresses opt in to PQ; existing addresses unchanged. Migration is voluntary.

Drawbacks: ML-DSA-65 signatures are ~3.3 KB vs ECDSA’s 64 bytes. Bitcoin’s per-byte fee structure makes PQ transactions ~50x more expensive. Mempool / block-size constraints become tighter.

Hash-based alternative: SLH-DSA-128f signatures are 17 KB — even worse for fee economics. Reasonable only for high-value, infrequent signatures.

Status as of late 2025: BIP-360 is draft, no specific activation timeline. Community is pre-debating; conservative estimate is activation in 2027-2030.

Ethereum’s PQ roadmap

Ethereum’s PQ migration is intertwined with the Verkle-tree and statelessness roadmap.

Account abstraction (ERC-4337) already in production. Custom signature verification via smart contract — paves the way for PQ verification logic without protocol-level changes. Wallets can opt into ML-DSA or other PQ scheme via account-abstraction module.

BLS12-381 in staking: Ethereum validators sign attestations with BLS. BLS is also broken by Shor (it’s pairing-based, related to ECDLP). Migration to PQ-resistant aggregation signature is a serious open research question (no efficient PQ aggregation scheme exists with BLS-comparable performance).

L2 ecosystem: Optimism, Arbitrum, zkSync — all use Ethereum-compatible signing. PQ migration follows L1.

Other chains — varied posture

  • Solana: ed25519 signatures. Quantum-broken (DLP). No public PQ roadmap.
  • Cardano: ed25519. Plutus smart contracts could enable PQ signature verification.
  • Quant Network’s Overledger: explicitly PQ-resistant in design.
  • QRL (Quantum Resistant Ledger): a Bitcoin-derivative using XMSS hash-based signatures from launch. Niche but proves the concept.

Custodial / institutional implications

For custodians, exchanges, and institutional wallets:

  1. Inventory all keys you control. For each, decide migration timeline based on how long you’ll hold the asset.
  2. For long-term cold storage (multi-year), plan to migrate to PQ-resistant addresses BEFORE the threat materialises. Move funds from currently-revealed-pubkey addresses to fresh, never-spent-from addresses (which protects until first spend).
  3. For active hot wallets, follow the chain’s official PQ roadmap timing.
  4. Customer communication: prepare educational material for customers on PQ migration. The “your bitcoins might disappear” framing is alarmist; the “address-rotation hygiene” framing is constructive.
  5. Multi-sig governance: for institutional treasuries, consider hybrid multi-sig (some sigs ECDSA, some ML-DSA). Even more robust to algorithm-failure.

The “lost key” coin recovery question

An unfortunate side-effect of PQ migration: public-keyed addresses that are at risk are also addresses where the original owner’s private key is known to them. If they don’t migrate proactively, those coins can be quantum-stolen. If they DO migrate, no problem.

For coins with truly lost keys (forgotten seed phrases, dead owners): when CRQC arrives, attackers can spend them. This will be a one-time mass-redistribution event in Bitcoin economics. Estimates: 20-40% of “lost” Bitcoin will be re-spent into the active market when CRQC matures. This is a non-technical concern that affects market dynamics.

What to do this year

  • If you hold long-term Bitcoin: rotate to fresh addresses regularly (don’t reuse addresses; spend, leave change in new address). Avoids public-key exposure.
  • If you’re an exchange / custodian: monitor BIP-360 and Ethereum PQ proposals; prepare for opt-in support.
  • If you’re building DeFi / smart-contract systems: design for crypto-agility — algorithm choice in proxy patterns, account abstraction.
  • If you’re holding NFTs or other on-chain assets: consider whether their value horizon extends past CRQC arrival; rotate if yes.

FAQ

When will Bitcoin be quantum-broken?

“Broken” is gradual. First practical Shor attack on a 256-bit ECDSA key likely 2030-2040. Bitcoin’s market response will start before the first attack — when CRQC capability becomes credible (probably 2028-2030), the market repricing of quantum-vulnerable BTC may begin.

Should I sell my Bitcoin because of quantum?

Not financial advice. The market hasn’t priced this in heavily as of 2026. Migration to PQ-resistant addresses is the technical answer; market timing is separate question.

Is there a PQ-Bitcoin fork already?

Bitcoin Post-Quantum (BPQ) and similar forks exist but have negligible adoption. The interesting work is the soft-fork upgrade path on the main chain.

Does NFT ownership become unprovable post-quantum?

NFT metadata and image storage (IPFS, Arweave) is unaffected. Ownership transfer requires signing — broken if pre-quantum. Migration follows the underlying chain.

Are blockchain bridges quantum-safe?

Cross-chain bridges (Wormhole, LayerZero) sign messages between chains. Same quantum risk as the underlying chains. Bridge protocols will need PQ migration on each leg.


⚖️ Module 15 of 20. Advanced complete. Modules 16-20 (Expert) cover lattice cryptanalysis, isogeny-based crypto, quantum + AI, and threat-modelling for the Q-era.

Want this for your team?

Custom team training + practitioner advisory

Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.

Book team training call Replies in 4 working hrs · India-only · Senior consultants