Google and IBM Advances Push Bitcoin Quantum Threat Closer
Quantum computing is no longer a distant risk for crypto, according to a new report from Quantus. It is becoming a planning problem for an industry that still has no clear migration path.
The report, The State of Quantum: What Crypto Can’t Afford to Ignore, argues that advances in quantum hardware and cryptanalytic research have compressed the timeline for a possible attack on public-key cryptography. Quantus says more than $2 trillion in digital assets remain secured by systems that a sufficiently powerful quantum computer could break.
At the center of the concern is Shor’s algorithm. The math has been known for decades: a large enough quantum computer could break RSA and elliptic-curve cryptography, including ECDSA and Ed25519. Those signature schemes secure bitcoin, ethereum and many other blockchain systems.
The difference now is pace. Quantus points to recent work from Google, IBM, Quantinuum, and other researchers as evidence that error correction, gate fidelity, and resource estimates are improving faster than many crypto teams expected. The report says the planning horizon has shifted toward 2030, not some abstract point decades away.
Traditional internet companies can rotate cryptography through software updates. Blockchains face a much harder task. Public keys are visible forever once exposed on-chain. Users control their own assets. Wallet makers, exchanges, custodians, validators, and governance bodies would all need to coordinate a transition.
“ Crypto does not get a clean warning bell before Q-Day,” Quantus Chief Executive Officer Christopher Smith said in the report. “If the industry waits until the threat is obvious, users will be asked to move value under pressure.”
Bitcoin presents the hardest case. Quantus cites estimates that 2.3 million to 3.7 million bitcoin are permanently lost because owners no longer control the private keys. Those coins cannot be moved to quantum-safe addresses, leaving networks with a dilemma over whether vulnerable assets should remain exposed, be frozen, or be handled through another mechanism.
The technical cost is also steep. A standard bitcoin ECDSA signature and public key carry about 97 bytes of cryptographic payload. A comparable transaction using ML-DSA-87, a post-quantum signature scheme, carries about 7,187 bytes. That is roughly a 70-fold increase and would put pressure on block space without larger architectural changes.
BIP 360 has emerged as one possible bitcoin migration route, but Quantus says it does not solve every problem. Larger transactions, limited hardware wallet support, and unmigrated coins remain unresolved.
“The only practical solution is to set a hard deadline for account owners to migrate their tokens to quantum-safe accounts, after which all tokens held in vulnerable accounts will be permanently frozen,” said Auryn Macmillan, co-founder of Gnosis Guild, in response to the report.
The risk is not limited to individual wallets. The report warns that stablecoin administrator keys, bridge validators, oracle networks, multisig custody systems, and governance contracts also rely on classical signatures. A failure at those points could spill into lending markets, derivatives, automated market makers, and institutional custody.
NIST finalized its first post-quantum cryptography standards in August 2024, making the core tools available for migration. Signal, Apple, Google, and Cloudflare have already started moving parts of internet infrastructure toward quantum-resistant systems. Crypto, by contrast, is still debating how to begin.
Lana Ivina of CircuitLabs remarked that new quantum-resistant chains might not necessarily be the preference for crypto users. “Many users may prefer to remain on a chain with a smaller but well-understood quantum attack surface, especially if that chain has a credible path toward upgrades, hard forks, or user-level migration schemes.”
Quantus calls the coming divide the “Great Quantum Filter,” a period when capital may move from legacy chains toward networks built with post-quantum security from inception. That framing also serves its own market position, since Quantus is building a quantum-secure Layer 1 blockchain.
Still, the report’s broader warning is hard to dismiss. Crypto’s problem is not only whether quantum computers arrive. It is whether the industry can coordinate before they do.
