Imagine a padlock hanging on a public fence. Anyone can walk up and study it. Today, staring at the lock does not give a thief a working key. That is the bargain behind the cryptography that secures most cryptocurrencies. A future quantum computer could look at the lock already sitting on the blockchain and cut a key that gives an unauthorized third-party access to someone else’s coins.
That lock is elliptic curve public key cryptography (ECC). Cryptocurrency networks such as Bitcoin, Ethereum, and Solana all use the same kind of setup: a published elliptic curve, a starting point on that curve, and a rule that takes two points on the curve and produces a third point also on the curve. Your private key is a secret number that tells the cryptosystem how many times to apply that rule, beginning at the starting point. The point where you stop is your public key. A wallet uses the secret number to attach a proof to a specific payment; anyone can check that proof against the public point and the payment details, but an ordinary computer cannot work backward from the public point to the secret number, which is the only thing that would let someone else access the wallet and spend the coins.[1]
Blockchains adopted this design because the keys and signatures are small and rapidly verified. That efficiency is important when every payment is copied across a public network. Bitcoin uses the scheme to authorize spending from an address. Ethereum uses it so ordinary accounts can sign transfers, and so validators can prove who they are when they vote on the next block. Solana uses a related elliptic-curve scheme, Ed25519, as an account’s identity. In each case the same tool accomplishes the fundamental tasks that make the cryptocurrency work: prove ownership, approve a payment, and identify the people who run the chain.
A quantum computer running Shor’s algorithm makes ECC’s one-way mathematics into something bidirectional. Given a public landing spot (the public key), it enables recovery of the secret step count (the private key). A forged signature then looks identical to a real one. On a blockchain, that is usually enough to enable an attacker to steal a legitimate user’s coins. There is no central desk that reverses the transfer. A forged signature can empty an account, mint or freeze a stablecoin, upgrade a smart contract, or control a bridge.
Aleksei Kodukhov’s paper “Cryptocurrencies in the Quantum Age: Migration Paths to PQC” (arXiv:2608.22924) maps that risk against cryptographically relevant quantum computers (CRQCs): by when a public key becomes visible, and by how much time an attacker then has to recover the private key. In an at-rest attack, the public key has been in the open for hours, days, or years. A relatively slow quantum machine can work offline and return with a private key. Dormant wallets, reused addresses, validator keys, and administrator keys sit in this category. In an on-spend attack, the key appears only when someone broadcasts a transaction. The attacker must finish before the network confirms the payment. Bitcoin’s blocks arrive about every ten minutes. Ethereum’s arrive in roughly twelve seconds. Solana’s arrive in a few hundred milliseconds. The research therefore treats Bitcoin as the wider window for a race-the-clock theft and Solana as the narrower one, while noting that Solana shows keys earlier. A third class, on-setup attacks, involves a one-time break against a proof system, a bridge, or a privacy protocol that could leave a reusable backdoor.
How each chain publishes keys decides which of those attacks can reach it.
Bitcoin often hides the public key behind a hash until coins are spent. Until that moment, an at-rest attacker has no lock to study. The protection ends the first time the owner spends. It never applied to older pay-to-public-key outputs, where the key was written on the ledger from the start, or to Taproot outputs, which also expose a public key once they are created. Address reuse and any earlier leak put more coins into the at-rest group. Lost and abandoned wallets cannot be moved unless someone still controls the keys. Bitcoin mining is a separate question. Hash-based proof of work is only reduced in a limited way by Grover’s algorithm, and specialized mining hardware remains highly optimized. The paper’s focus is on the signature layer.
Ethereum shortens the on-spend window and keeps elliptic-curve signatures at several layers. User accounts sign transactions with ECDSA. Validators use BLS signatures that can be aggregated. Above those are privileged keys: upgrade authorities, multi-signature treasuries, oracle operators, and stablecoin administrator keys. Compromise there can mean unauthorized minting, burning, freezing, or a rewriting of a contract that holds other people’s assets.
Solana makes the public key the account. Creating an address publishes the lock. No prior outgoing payment is required. Once a capable quantum machine exists, externally owned accounts become targets at-rest. Program-derived addresses are generated from hashes and do not correspond to ordinary Ed25519 private keys, so they resist this attack. Many of those addresses are steered by upgrade keys or multi-signature signers that do use Ed25519. The derived address can be resistant while the controlling key is not.
The research then measures value behind those mechanisms. Using public blockchain datasets from July 2026 and related market tallies, it estimates that about 6.9 million bitcoins are quantum vulnerable. That figure includes coins in scripts that show keys now and coins whose keys have already appeared through spending or reuse. About 1.7 million bitcoins remain in classic pay-to-public-key scripts. Dormant holdings raise a governance question, because coins with no reachable owner have no owner-driven migration path.
On Ethereum, the same inventory finds about 21.4 million ETH in externally owned accounts among the 1,000 largest accounts whose public keys have already appeared; about 41 million ETH securing proof-of-stake validation; more than $200 billion in stablecoins and tokenized real-world assets issued on the chain; and at least 15 million ETH of value secured across major layer-2 systems and bridges. Solana is not given a single headline coin total. The paper’s claim there is about account design: externally owned accounts reveal Ed25519 public keys from creation.
Converted to dollars, the exposed bitcoin is worth about $500 billion and the stablecoins plus tokenized assets on Ethereum exceed $200 billion. The research leaves the large Ethereum account, staking, and bridge balances in ETH, so the value those represent sits on top of that combined $700 billion.
The research argues that a quantum computer costly enough to break these keys would not be aimed first at ordinary wallets. It would be aimed first at the accounts that hold the most coins or the most control: huge untouched balances, very old bitcoin addresses, the hot wallets exchanges use to pay withdrawals, the master keys that can mint or freeze stablecoins, the keys that run validators, the keys that lock funds in cross-chain bridges, the treasuries of DAOs, and the wallets of firms that hold coins for clients.
Bridges and stablecoin issuers often secure large sums with a short list of keys. The research notes that impacts on the market could include loss of trust in ledger finality, liquidity stress, damage to collateral used in decentralized finance, stablecoin disruption, validator concentration, forced hard forks, and regulatory intervention.
Traditional payment networks face a different version of the same future. Visa, Mastercard, and SWIFT can mandate upgrades, revoke credentials, and sometimes reverse fraud. Their constraint is physical: hundreds of millions of terminals, cards, ATMs, and embedded devices. For cryptocurrency networks, the challenges are in a different place. Software wallets can be updated without swapping hardware. The constraint is agreement among validators, developers, custodians, exchanges, and users, including the question of coins nobody can move.
The research is a survey that provides a risk map. It reviews the quantum algorithms that matter for these systems, classifies attack timing, walks through the account models of Bitcoin, Ethereum, and Solana, assembles exposure estimates from public data, compares those systems with conventional finance, and inventories post-quantum tools already in view. Its finding is that the assumption on which these ledgers rest, that a public key does not reveal a private key, does not hold against a cryptographically relevant quantum computer, and that many high-value keys are already public.
The map also shows why a single upgrade path will not fit every cryptocurrency. Hash-protected bitcoin addresses conceal keys until a spend. Solana’s short block time narrows the on-spend window and leaves at-rest exposure as the main near-term concern. Ethereum adds application keys that can move assets belonging to other people. Signature size then limits which replacements fit inside transaction rules. Among the NIST-selected schemes, ML-DSA is a finalized standard with large signatures. SLH-DSA is a finalized hash-based standard whose signatures are larger still. FN-DSA produces a smaller signature and faster verification; the paper treats that balance as the closer fit for bandwidth-limited chains. FN-DSA, however, is still undergoing standardization.
Fortunately, preparation for the quantum future is not an all-or-nothing proposition. On Solana, Winternitz vaults wrap selected deposits in hash-based one-time signatures. Funds moved into such a vault are no longer sitting behind an elliptic-curve private key. Validators, fee payers, and programs outside the vault remain on the existing scheme, so the vault covers deposited assets rather than the whole account model. Algorand uses Falcon (the algorithm being standardized as FN-DSA) in state proofs and has shown Falcon-controlled accounts that pass through the existing transaction pipeline. Its roadmap describes native post-quantum accounts that keep short addresses by hashing the larger public keys, then hybrid accounts and mixed scheme multi-signature. Ethereum’s EIP-8052 would add precompiled contracts so the virtual machine can check Falcon signatures, giving rollups, wallets, and account-abstraction systems an on-chain way to verify the new locks without replacing every native account at once.
The research recommends treating the change as infrastructure work. Start with the keys that control the most value. Give users a path to send coins from old locks to new ones. Use hybrid checks, where a transaction must satisfy both the familiar signature and a post-quantum one, during the transition. Plan separately for consensus keys, because those keep the chain running. Match the sequence to each network. Bitcoin must address dormant and previously exposed keys. Ethereum must cover user accounts, validator signatures, and application admin keys. Solana must change how accounts are identified or wrap the assets those accounts hold.
The operational consequences follow from a single forged signature. A forged stablecoin issuer key can print, burn, freeze, or transfer tokens people treat as cash. A forged bridge key can move assets that were supposed to remain locked. A forged validator key can impersonate a participant in consensus. The paper notes that tokenized real-world assets, decentralized finance, and fiat-backed stablecoins are increasing the value governed by these keys.
The research also offers suggestions for a set of concrete next steps. Custodians and exchanges can inventory which keys are already public and rotate the ones they control. Stablecoin issuers and bridge operators can place administrator powers behind post-quantum schemes or behind hash-based vaults. Wallet makers can add receiving addresses derived from post-quantum keys and treat migration as an ordinary send. Developers can keep Falcon verification, hash-based vaults, and hybrid multi-signature designs inside existing size limits. Communities will have to decide what to do with unused Satoshi-era outputs and other abandoned coins, because those balances have no owner-driven migration path.
The public keys are already on the fence. The research argues for changing the lock before a CRQC can turn those published keys into working keys and put the value they protect at risk.
This AI created article is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification/Tier I analysis service (RedXray) or an analysis service (CTAC). For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/7855487668891299929
[1] https://six3ro.substack.com/p/when-cryptocurrencys-lock-gives-away
Comments