A new academic survey is putting numbers to the more intensifying queries about how close quantum computers are to breaking blockchain security, essentially making today’s cryptographic locks obsolete?
The paper, published in Computer Science Review by researchers Hassan Khodaiemehr, Khadijeh Bagheri, and Chen Feng at the University of British Columbia’s Okanagan campus. Rather than offering another abstract warning about “Q-Day,” the scientists screened more than 2,000 papers, narrowed an initial set to over 400, and then folded in 60 more recent studies pulled from a search of over 3,700 journal articles published between 2023 and early 2025.
The result is one of the more granular technical accountings yet of exactly where blockchains stand exposed and where they don’t.
Two Algorithms, Two Different Kinds of Damage
The threat breaks down into two distinct mathematical attacks, and the researchers are careful to separate them because they hit blockchains in different ways.
The first is Shor’s algorithm, which can solve the integer factorization and discrete logarithm problems that underpin RSA, Diffie-Hellman, and elliptic curve cryptography — the exact math behind the ECDSA signatures that secure Bitcoin, Ethereum, and dozens of other cryptocurrencies. A classical computer would need roughly 13.7 billion years to brute-force RSA-2048; a sufficiently powerful quantum computer, according to figures cited in the survey, could theoretically do it in around 42 minutes, though building a machine with the necessary qubit capacity remains the hard part. Other estimates referenced in the paper put a quantum computer capable of cracking RSA-2048 as plausible by around 2035.
For blockchain wallets specifically, the exposure has a narrow but real window. A private key stays hidden until its owner broadcasts a transaction — at which point the public key becomes visible on the network for the minutes it takes to confirm. A quantum attacker who could derive the private key from that exposed public key quickly enough could, in principle, submit a competing transaction with a higher fee and effectively hijack the funds before the original transaction settles. The researchers note that a market-cap snapshot from February 2021 found 74 of the top 100 cryptocurrencies, including Bitcoin and Ethereum, rely on ECDSA over the secp256k1 curve — meaning the exposure isn’t a fringe issue.
The second attack vector, Grover’s algorithm, delivers only a quadratic speedup rather than an exponential one, but it still matters for two reasons the researchers lay out: it can accelerate the search for hash collisions, and it can speed up the brute-force nonce-guessing that underlies proof-of-work mining. In the mining scenario, a quantum-equipped miner with enough hash-rate advantage could approach the kind of 51% control needed to rewrite transaction history. The paper’s own calculations, however, suggest that at current gate speeds and error rates, a quantum computer running Grover’s algorithm against Bitcoin’s SHA-256 puzzle would produce an effective hash rate roughly a thousand times slower than commercial ASIC mining rigs — meaning the quadratic speedup doesn’t currently translate into a practical advantage.
Signatures Are the Weak Point, Not Hashing
The survey emphasizes that hash functions — the workhorses behind block headers and mining — are in comparatively good shape. Doubling relevant output sizes largely neutralizes Grover’s algorithm, and the researchers’ own benchmarking, run against live Bitcoin block data using SHA-512, SHA-256, Keccak-512, BLAKE3, and BLAKE2b, points to SHA-512 as the strongest near-term candidate for a quantum-resistant Bitcoin, offering roughly a 2^343 quantum attack cost compared with SHA-256’s approximately 2^188.
Digital signatures are an urgent problem, according to the study. The U.S. National Institute of Standards and Technology finalized its first three post-quantum cryptography standards in August 2024 — ML-KEM (built on CRYSTALS-Kyber), ML-DSA (built on CRYSTALS-Dilithium), and SLH-DSA (built on SPHINCS+) — and selected the HQC algorithm for key encapsulation in March 2025 after a fourth standardization round. A FALCON-based standard, to be designated FN-DSA, remains in draft.
None of the replacement candidates are drop-in fixes to solving quantum computers threat to breaking blockchain security, though. The survey’s side-by-side comparisons show Dilithium offering fast verification but signatures roughly 40 times larger than ECDSA’s; FALCON producing more compact signatures but requiring heavier floating-point computation prone to implementation pitfalls; and SPHINCS+ offering conservative, hash-based security at the cost of signatures that can run past 16,000 bytes versus ECDSA’s 64. Scaled across an entire ledger, the researchers estimate Bitcoin’s blockchain would balloon by a factor of 6.8 under Dilithium, 2.2 under FALCON, and nearly 75-fold under SPHINCS+.
Why Swapping Out ECDSA Isn’t Simple
Beyond raw performance, the paper spends considerable space on the operational mess a cryptographic migration would create. Bitcoin wallets generated through the BIP39 standard derive keys from a recovery phrase; users who stay offline or fail to move funds into a new key scheme before a hard fork could find their holdings stranded and, per the researchers’ framing, exposed to impersonation once a capable quantum computer exists.
One study the survey cites calculates a hard lower bound of roughly 76 days of network downtime to migrate all of Bitcoin’s unspent transaction outputs to post-quantum signatures under current conditions — or, spread across about 152 days, continued operation at roughly half of normal transaction throughput.
Consensus mechanisms don’t fare identically, either. The researchers’ comparative modeling finds proof-of-stake systems more exposed than proof-of-work overall, because PoS validator security rests directly on private-key integrity — the exact target of Shor’s algorithm — while PoW’s main quantum weak point, Grover-accelerated mining, is currently kept in check by the sheer scale of existing ASIC hardware.
Individual blockchain risk assessments cited in the paper rank Bitcoin, Ethereum, and Litecoin as facing high quantum exposure through their transaction and account systems, Monero and similar privacy coins as medium risk thanks to obfuscation features that reduce attacker motivation, and Zcash as facing the most severe exposure of all — not through its signatures, but through the trusted public parameters underlying its zero-knowledge proof system, which if compromised could allow unlimited token forgery.
Who’s Already Moving
The survey catalogs a growing list of projects attempting to get ahead of the problem of quantum computers threat to breaking blockchain security. The Quantum Resistant Ledger uses the hash-based XMSS scheme and recently introduced an Ethereum-compatible successor called Zond. Algorand has adopted FALCON alongside state proofs. Solana, Cardano’s Ouroboros protocol, and Komodo (via Dilithium integration) are each exploring or building in post-quantum components, while IOTA has long used one-time hash-based signatures instead of elliptic curve cryptography. On the enterprise side, the researchers highlight PQFabric, a hybrid signature approach for Hyperledger Fabric that pairs classical and quantum-resistant algorithms during the transition period.
A separate branch of the paper looks past post-quantum cryptography entirely, toward blockchains secured by quantum mechanics itself — quantum key distribution, entanglement-based consensus, and quantum digital signatures that exploit the no-cloning theorem rather than computational hardness assumptions.
The scientists report, however, that the U.S. National Security Agency has explicitly advised against relying on quantum key distribution for national security systems, citing implementation risks and a lack of built-in source authentication, and has instead pointed organizations toward post-quantum cryptography as the more mature path.
How Close Are Quantum Computers to Breaking Blockchain Security? What’s Still Unknown
The researchers are candid about the gaps in their own analysis. Quantum attacks against zero-knowledge proof systems such as ZK-SNARKs and ZK-STARKs remain comparatively unstudied, despite these tools underpinning privacy coins and rollup scaling solutions.
Real-world deployment testing is thin — most of the field’s work remains theoretical or confined to prototypes. And newer research the scientists flag shows that even NIST-selected algorithms aren’t automatically safe in practice: side-channel attacks exploiting rejected signatures during Dilithium’s rejection-sampling process have already been demonstrated, and the once-promising SIKE isogeny scheme was broken outright using an ordinary computer, a reminder that quantum resistance on paper doesn’t guarantee resistance in deployed code.
Public Safety Canada supported this research.
