Blockchain post-quantum migration is a 10-year governance project, not a technical project. The cryptographic primitives are well-understood; persuading 10 million Bitcoin holders and 200 million Ethereum users to migrate their assets to PQ addresses is the actual problem.
The threat model — what’s actually at risk
Three categories of blockchain assets:
- Funds in addresses where the public key has NEVER been revealed (unspent UTXOs in P2PKH or P2WPKH addresses, only the hash of the pubkey is on-chain). Pre-CRQC: derive pubkey from hash requires preimage attack on SHA-256 — infeasible. Post-CRQC: still infeasible (Grover only halves to 2¹²⁸). These funds are safe.
- Funds in addresses where the public key HAS been revealed (any address that’s been spent from, P2PK addresses, taproot keypath spends with revealed pubkey). Post-CRQC: Shor recovers the private key from the public key; attacker can spend the funds. These funds are at risk.
- Future transactions at any address: in-flight transactions in the mempool are vulnerable to a quantum attacker who can derive the private key faster than the transaction is mined.
Estimates of “Bitcoin at risk to Shor” vary: lower bound ~25% (publicly-keyed addresses + Satoshi’s coins at P2PK), upper bound ~70% (counting any address that has ever been spent from). Either way, hundreds of billions of dollars are at quantum risk.
Bitcoin’s PQ roadmap
BIP-360 / draft NIST-aligned schemes: introduce ML-DSA-65 or hybrid signatures as a soft-fork. New addresses opt in to PQ; existing addresses unchanged. Migration is voluntary.
Drawbacks: ML-DSA-65 signatures are ~3.3 KB vs ECDSA’s 64 bytes. Bitcoin’s per-byte fee structure makes PQ transactions ~50x more expensive. Mempool / block-size constraints become tighter.
Hash-based alternative: SLH-DSA-128f signatures are 17 KB — even worse for fee economics. Reasonable only for high-value, infrequent signatures.
Status as of late 2025: BIP-360 is draft, no specific activation timeline. Community is pre-debating; conservative estimate is activation in 2027-2030.
Ethereum’s PQ roadmap
Ethereum’s PQ migration is intertwined with the Verkle-tree and statelessness roadmap.
Account abstraction (ERC-4337) already in production. Custom signature verification via smart contract — paves the way for PQ verification logic without protocol-level changes. Wallets can opt into ML-DSA or other PQ scheme via account-abstraction module.
BLS12-381 in staking: Ethereum validators sign attestations with BLS. BLS is also broken by Shor (it’s pairing-based, related to ECDLP). Migration to PQ-resistant aggregation signature is a serious open research question (no efficient PQ aggregation scheme exists with BLS-comparable performance).
L2 ecosystem: Optimism, Arbitrum, zkSync — all use Ethereum-compatible signing. PQ migration follows L1.
Other chains — varied posture
- Solana: ed25519 signatures. Quantum-broken (DLP). No public PQ roadmap.
- Cardano: ed25519. Plutus smart contracts could enable PQ signature verification.
- Quant Network’s Overledger: explicitly PQ-resistant in design.
- QRL (Quantum Resistant Ledger): a Bitcoin-derivative using XMSS hash-based signatures from launch. Niche but proves the concept.
Custodial / institutional implications
For custodians, exchanges, and institutional wallets:
- Inventory all keys you control. For each, decide migration timeline based on how long you’ll hold the asset.
- For long-term cold storage (multi-year), plan to migrate to PQ-resistant addresses BEFORE the threat materialises. Move funds from currently-revealed-pubkey addresses to fresh, never-spent-from addresses (which protects until first spend).
- For active hot wallets, follow the chain’s official PQ roadmap timing.
- Customer communication: prepare educational material for customers on PQ migration. The “your bitcoins might disappear” framing is alarmist; the “address-rotation hygiene” framing is constructive.
- Multi-sig governance: for institutional treasuries, consider hybrid multi-sig (some sigs ECDSA, some ML-DSA). Even more robust to algorithm-failure.
The “lost key” coin recovery question
An unfortunate side-effect of PQ migration: public-keyed addresses that are at risk are also addresses where the original owner’s private key is known to them. If they don’t migrate proactively, those coins can be quantum-stolen. If they DO migrate, no problem.
For coins with truly lost keys (forgotten seed phrases, dead owners): when CRQC arrives, attackers can spend them. This will be a one-time mass-redistribution event in Bitcoin economics. Estimates: 20-40% of “lost” Bitcoin will be re-spent into the active market when CRQC matures. This is a non-technical concern that affects market dynamics.
What to do this year
- If you hold long-term Bitcoin: rotate to fresh addresses regularly (don’t reuse addresses; spend, leave change in new address). Avoids public-key exposure.
- If you’re an exchange / custodian: monitor BIP-360 and Ethereum PQ proposals; prepare for opt-in support.
- If you’re building DeFi / smart-contract systems: design for crypto-agility — algorithm choice in proxy patterns, account abstraction.
- If you’re holding NFTs or other on-chain assets: consider whether their value horizon extends past CRQC arrival; rotate if yes.
FAQ
When will Bitcoin be quantum-broken?
“Broken” is gradual. First practical Shor attack on a 256-bit ECDSA key likely 2030-2040. Bitcoin’s market response will start before the first attack — when CRQC capability becomes credible (probably 2028-2030), the market repricing of quantum-vulnerable BTC may begin.
Should I sell my Bitcoin because of quantum?
Not financial advice. The market hasn’t priced this in heavily as of 2026. Migration to PQ-resistant addresses is the technical answer; market timing is separate question.
Is there a PQ-Bitcoin fork already?
Bitcoin Post-Quantum (BPQ) and similar forks exist but have negligible adoption. The interesting work is the soft-fork upgrade path on the main chain.
Does NFT ownership become unprovable post-quantum?
NFT metadata and image storage (IPFS, Arweave) is unaffected. Ownership transfer requires signing — broken if pre-quantum. Migration follows the underlying chain.
Are blockchain bridges quantum-safe?
Cross-chain bridges (Wormhole, LayerZero) sign messages between chains. Same quantum risk as the underlying chains. Bridge protocols will need PQ migration on each leg.
⚖️ Module 15 of 20. Advanced complete. Modules 16-20 (Expert) cover lattice cryptanalysis, isogeny-based crypto, quantum + AI, and threat-modelling for the Q-era.
Custom team training + practitioner advisory
Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.