PQC for Blockchain and Distributed Ledgers

Quick answer: Blockchain’s quantum exposure is real and specific, not hype: Bitcoin and Ethereum both rely on ECDSA, which Shor’s algorithm breaks, and a meaningful share of coins on both chains have already exposed their public keys through reuse or address type, making them a standing target for harvest-now-decrypt-later attacks against exposed keys. Migration governance is where blockchain diverges sharply from enterprise PKI: there is no central authority that can mandate an algorithm change, so Bitcoin’s post-quantum proposals (BIP-360 and BIP-361) and Ethereum’s account abstraction path both depend on community consensus and coordinated hard or soft forks, not a vendor patch cycle. Custody and wallet infrastructure face their own distinct problem, since standard post-quantum signature algorithms are single-signer and need dedicated threshold cryptography work before they fit multi-signature and MPC custody models.

Blockchain quantum risk gets discussed in extremes: dismissed as science fiction, or treated as an imminent collapse of digital asset value. Neither framing is accurate. The actual risk is specific, well-documented, and already being addressed through concrete proposals with real timelines, even without a single vendor able to force adoption. This guide covers the risk without the hype.

Key Takeaways

• Bitcoin and Ethereum both rely on ECDSA for transaction signatures, and a sufficiently capable quantum computer running Shor’s algorithm could derive a private key from an exposed public key.
• Address exposure varies structurally by chain: Bitcoin’s UTXO model exposes public keys only for certain address types or once spent, while Ethereum’s account model exposes the public key of any address that has ever sent a transaction.
• Bitcoin’s BIP-360 (introduced February 2026) defines a new output type that keeps public keys off-chain until spending; BIP-361 outlines a three-phase migration including a mechanism to eventually freeze coins in unmigrated wallets.
• Migration requires social and technical consensus across a decentralized community rather than a vendor mandate, making it a fundamentally different governance problem than enterprise PKI migration.
• Standard post-quantum signature algorithms are single-signer; custody providers using multi-signature or MPC wallets need dedicated threshold-signature research and tooling, which is still maturing.

Wallet Signatures and Consensus: What’s Actually at Risk

Owning cryptocurrency means knowing a private key; a wallet signature is the proof of that knowledge without revealing the key itself, using ECDSA on most major chains or Ed25519 on some others like Solana. A cryptographically relevant quantum computer running Shor’s algorithm could derive that private key from the corresponding public key, letting an attacker forge signatures and move funds without the legitimate owner’s involvement. The threat is not to a blockchain’s ability to produce blocks or reach consensus; it is to an individual holder’s ability to prove exclusive ownership of their own coins.

Address Exposure: A Structurally Different Problem by Chain

Bitcoin’s UTXO model means a public key is only exposed on-chain under specific conditions: certain older address types (like P2PK) expose it directly, and any address exposes its public key the moment it spends from that address, even if the address type would otherwise hash it. Estimates place roughly a quarter of circulating Bitcoin in outputs that have already exposed their public keys, making those specific coins the priority migration target, not the entire supply uniformly.

Ethereum’s account-based model is structurally more exposed: every externally owned account reveals its public key the moment it sends any transaction, which means essentially every Ethereum wallet that has ever transacted has a permanently exposed public key sitting on a public, immutable ledger. This is a meaningfully larger exposed surface than Bitcoin’s, and it shapes why Ethereum’s migration proposals lean toward account abstraction, letting a wallet change its underlying signature scheme, rather than a new address type.

Migration Proposals and Hard Forks

Bitcoin’s leading post-quantum proposal, BIP-360, introduced in February 2026, defines a new output type (Pay-to-Merkle-Root) that keeps a spender’s public key off-chain until the moment of spending, reducing the exposed attack surface for new addresses using it. A companion proposal, BIP-361, outlines a three-phase migration: a window for voluntary migration, a legacy sunset phase, and eventual recovery mechanisms, including a mechanism to freeze coins that remain in unmigrated, vulnerable output types past a defined deadline. Neither proposal has reached full community consensus as of this guide’s publication, which is itself the central governance challenge: Bitcoin’s protocol changes require broad agreement across a decentralized set of node operators, miners, and users, not a single authority’s sign-off.

Ethereum’s path centers on account abstraction, a mechanism that would let individual wallets adopt post-quantum signature schemes without requiring every user to migrate simultaneously through a single coordinated hard fork. This has been publicly described by Ethereum’s own core developers as a medium-term security priority rather than an immediate one, reflecting a judgment that the exposure, while real, does not require the most disruptive possible migration path today.

Custody Challenges: Signature Size and Threshold Cryptography

Post-quantum signatures are dramatically larger than the 64 to 72-byte ECDSA or Ed25519 signatures blockchains use today. ML-DSA signatures run roughly 2.4 to 4.6 kilobytes depending on parameter set; more compact alternatives like FN-DSA (Falcon) produce signatures around 666 bytes, which is part of why some chains are specifically evaluating Falcon over ML-DSA for on-chain transaction size and storage impact.

Custody providers face an additional, distinct problem beyond raw signature size: standard ML-DSA is a single-signer scheme, but institutional and multi-party custody depends on threshold or multi-party computation (MPC) signing, where no single party ever holds the complete private key. Using a post-quantum algorithm in that model requires a genuine threshold variant, a protocol that distributes the private key into shares and produces a valid signature only through coordinated computation across those shares, and that threshold tooling for post-quantum algorithms is still maturing rather than broadly production-ready.

What We’d Actually Recommend, Without the Hype

For holders and custodians, minimizing address reuse and moving high-value holdings out of already-exposed address types is a concrete, available step today, well ahead of any protocol-level migration. For custody providers and exchanges, track threshold post-quantum signature tooling directly rather than assuming a chain-level fork solves the custody problem automatically; multi-signature and MPC infrastructure need their own migration path. For anyone evaluating this risk, treat the uncertainty in quantum computing timelines as a reason for prudent, early preparation rather than either panic or dismissal, since the migration governance problem, reaching consensus across a decentralized community, takes longer than the technical problem of choosing an algorithm.

How Encryption Consulting Can Help

Blockchain and digital asset custody risk does not map cleanly onto a single existing product, and Encryption Consulting’s honest starting point here is advisory: our PQC Advisory Services help custody providers and enterprises holding digital assets build a migration posture around the specific risks this guide covers, address exposure assessment, threshold signature readiness, and governance planning for a migration that depends on protocol-level consensus outside any single organization’s control.

Where an organization’s exposure includes classical PKI adjacent to its digital asset operations, custody platform TLS, internal signing infrastructure, API authentication, CBOM Secure covers that conventional cryptographic estate the same way it would for any enterprise.

Our PQC Advisory Services help custody providers and enterprises holding digital assets build a migration posture around the specific risks this guide covers, address exposure assessment, threshold signature readiness, and governance planning for a migration that depends on protocol-level consensus outside any single organization’s control.

A Real Risk on a Genuinely Different Migration Clock

Blockchain’s quantum exposure is specific and well documented: exposed public keys sitting permanently on public ledgers, ECDSA signatures a sufficiently capable quantum computer could break, and migration proposals already in active development on both Bitcoin and Ethereum. What makes this migration genuinely different from an enterprise PKI transition is governance: no vendor can mandate a protocol change, and reaching the community consensus these proposals require is a slower, more uncertain process than issuing a new certificate policy. That uncertainty argues for early, deliberate preparation, reducing address exposure now and tracking threshold signature tooling for custody, rather than waiting for a fork date that depends on consensus nobody can guarantee on a fixed timeline.

Frequently Asked Questions

Is Bitcoin currently vulnerable to a quantum attack?

Not from any quantum computer that exists today. The risk is that a future cryptographically relevant quantum computer could derive a private key from an already-exposed public key, which is why coins in address types that have exposed their public key, roughly a quarter of circulating Bitcoin by some estimates, are the specific priority for migration, not the entire supply uniformly.

Why is Ethereum’s quantum exposure different from Bitcoin’s?

Ethereum’s account-based model exposes a wallet’s public key the moment it sends any transaction, meaning nearly every active Ethereum wallet has a permanently exposed public key. Bitcoin’s UTXO model exposes public keys only for specific address types or once an address has spent, giving it a structurally smaller exposed surface today.

Has Bitcoin agreed on a post-quantum migration plan?

Not yet fully. BIP-360 and BIP-361 are active proposals, introduced in 2026, that define a new quantum-resistant output type and a phased migration plan, but Bitcoin’s decentralized governance model means full community consensus, not a single authority’s decision, is required before either activates.

Why can’t standard post-quantum signatures be used directly in multi-signature or MPC custody wallets?

Standard ML-DSA is a single-signer scheme. Multi-signature and MPC custody require a threshold variant, a protocol that splits the private key into shares and produces a valid signature only through coordinated multi-party computation, and post-quantum threshold signature tooling is still maturing rather than broadly production-ready.

What can crypto holders do about quantum risk today?

Minimize address reuse and avoid keeping high-value holdings in address types that have already exposed their public key, since this reduces exposed attack surface immediately, well ahead of any protocol-level fork or migration deadline.