Quantum computers cannot break Bitcoin or Ethereum today, but the threat is real enough that major blockchain networks are already building defenses. As quantum computing advances, the public-key cryptography that secures most blockchains faces a deadline. Bitcoin uses ECDSA signatures, Ethereum relies on secp256k1 keys, and many newer systems use EdDSA variants. All of these schemes are vulnerable in principle to Shor's algorithm, a quantum computing technique that could solve the mathematical problems underlying modern cryptography once sufficiently powerful quantum computers exist.

The challenge is not picking a new algorithm. It is moving millions of wallets, validators, smart contracts, bridges, custody systems, and audit processes without breaking the network. Migration for large cryptographic systems typically takes five to ten years, and public blockchains add layers of complexity: exchanges, hardware wallets, inactive users, and decentralized governance all slow the transition.

Which Parts of Blockchain Are Most at Risk?

Not every component of a blockchain faces equal danger from quantum attacks. Hash functions such as SHA-256 and SHA-3 are in a stronger position because Grover's algorithm only provides a quadratic speedup against them. Larger output sizes can compensate for this advantage. That means proof-of-work hashing, Merkle trees, and hash commitments are less urgent priorities than signatures and key exchange.

The security split is clear. Account signatures, validator signatures, cross-chain proofs, exposed public keys, and custody authorization represent the highest risk. Zero-knowledge systems based on elliptic curves and pairings face moderate risk. SHA-256, SHA-3, hash-based Merkle proofs, and AES with suitable key sizes remain lower risk.

Bitcoin has a particular vulnerability. In pay-to-public-key-hash outputs, the public key stays hidden until the coin is spent. Once revealed, a future quantum attacker with sufficient speed could try to derive the private key before confirmation. Old pay-to-public-key outputs and reused addresses are worse because the public key may already be visible on-chain.

How Are Blockchain Networks Preparing for the Quantum Era?

• Algorand's Falcon Signatures: Algorand is one of the clearest production examples of quantum-resistant blockchain security. It uses Falcon signatures in its State Proofs, which let light clients and other chains verify Algorand state in a post-quantum resistant way. In 2025, Algorand demonstrated a quantum-resistant mainnet transaction using Falcon. The network's 2026 roadmap points toward broader quantum resilience by the end of 2027, including native post-quantum accounts, post-quantum-ready software development kits (SDKs), post-quantum multisig for institutions, and research into quantum-resistant verifiable random functions (VRFs) and consensus signatures.
• Ethereum's Signature Agility Approach: Ethereum cannot simply swap ECDSA and move on because account abstraction, smart contract wallets, Layer 2 systems, bridges, and validator infrastructure all complicate the change. Technical assessments in 2026 describe Ethereum work around leanXMSS, leanVM, and account-level signature agility. The goal is to let accounts support new signature schemes, including hybrid classical plus post-quantum signatures, without forcing every change through a network-wide hard fork.
• The Quantum Resistant Ledger's XMSS Standard: The Quantum Resistant Ledger (QRL) uses XMSS, the eXtended Merkle Signature Scheme, for addresses and transactions. XMSS is hash-based and designed for post-quantum security. The trade-off is that XMSS is stateful; you must never reuse a one-time signature leaf. In real systems, that means wallet state management is not a small implementation detail. If two devices sign from the same XMSS index after a bad backup restore, you have a serious cryptographic failure, not just a sync bug.
• Solana's Targeted Hardening: Solana has explored a Winternitz Vault based on Winternitz One-Time Signatures for account recovery and key rotation. This is targeted hardening, not a complete replacement of daily transaction signatures, but it makes sense because recovery and rotation are exactly where high-value accounts need extra protection.

The National Institute of Standards and Technology (NIST) has already set the direction for the industry. Its post-quantum standards include ML-KEM, based on CRYSTALS-Kyber, for key encapsulation, and ML-DSA, based on CRYSTALS-Dilithium, for signatures. It also standardized SLH-DSA, based on SPHINCS+, for stateless hash-based signatures. Falcon has been selected by NIST for future standardization as a compact lattice-based signature scheme.

NIST IR 8547 points to deprecating quantum-vulnerable algorithms by 2030 and disallowing them by 2035, with narrow hybrid exceptions. US and EU policy signals are lining up around the same period for critical infrastructure. Crypto networks that wait until 2030 to start will be late.

What Is the Timeline for Quantum Threats?

Recent research cited by Cambridge Judge Business School put the estimated logical qubit requirement for breaking RSA-2048 at roughly 1,399 logical qubits. Other simulation work shows RSA-2048 decryption time falling as quantum resources scale, from minutes at lower qubit counts to shorter windows as qubit counts rise.

These numbers do not mean quantum computers will break blockchain encryption tomorrow. Logical qubits are not the same as noisy physical qubits, and error correction remains a major engineering challenge. Still, the trend matters. The direction is clear, and serious crypto networks are already testing post-quantum cryptography, hybrid signatures, and account migration plans.

Enterprise blockchains can move faster because they have fewer unknown participants. Research on Hyperledger-based post-quantum frameworks has combined Kyber for key encapsulation with Dilithium and Falcon for signatures. A hospital data management scenario showed quantum-resistant encryption of patient data, verifiable records, and immutable audit trails. Reported metrics from that research included quantum attack resistance above 90 percent, a 95.8 percent quantum security margin, and a cost optimization score of 0.92 compared with alternative designs.

Why Hybrid Cryptography Is the Near-Term Answer

The near-term answer for major public chains is hybrid cryptography. A transaction, account, or validator message can require both a classical signature and a post-quantum signature. If the post-quantum scheme has an unforeseen flaw, classical security still helps. If elliptic curves fall to quantum attacks, the post-quantum signature remains.

Hybrid designs cost more. Signatures get larger. Verification takes longer. Wallet user experience becomes more complex. But for the 2026-2030 window, hybrid is the most defensible migration strategy for major public chains. Bitcoin's post-quantum path remains mostly conceptual. Proposals include a hard fork with a migration window, or a new quantum-safe signature scheme with deadlines for moving funds. The controversial part is what to do with coins left in vulnerable outputs. Burning un-migrated coins may protect the network from theft, but it would be a brutal governance decision.

The hard part is not choosing a new algorithm. It is moving millions of wallets, validators, contracts, bridges, custody systems, and audit processes without breaking the network. Anyone who has shipped a wallet migration knows the ugly detail: users do not rotate keys just because a protocol team asks politely. That is the real challenge ahead for blockchain security in the quantum era.