Quantum risk hits signatures first, not blockchains all at once
Quantum computing does not make blockchains instantly obsolete. It makes the public-key cryptography that authorizes ownership the first critical failure point. Shor’s algorithm targets the discrete logarithm problem behind elliptic-curve systems, while symmetric primitives and hash-based constructions are less dramatically affected because Grover-style attacks offer weaker and less parallelizable speedups. That is why wallet signatures, validator signatures, and pairing-based commitments matter before the more theatrical idea of a quantum machine “breaking the chain.”
This is already a migration problem, not just a laboratory curiosity. NIST finalized its first three post-quantum standards on August 13, 2024, including ML-DSA for digital signatures and SLH-DSA for stateless hash-based signatures, and said the standards were ready for immediate use. NSA guidance now targets quantum resistance across National Security Systems by 2035, and the U.S. GAO reported in November 2024 that some experts place a cryptographically relevant quantum computer in the next 10 to 20 years. The right reading is not panic. It is that serious systems have already moved from “if” to “how.”
The timeline is still uncertain, and that uncertainty cuts both ways. NIST explicitly notes that Grover-based attacks may provide little or no practical advantage against AES for a long time, while GAO highlights disagreement over when a cryptographically relevant quantum computer will exist. The most defensible position today is narrower and more useful: public-key cryptography on major chains has a real future replacement cost, and governance delay may become more dangerous than cryptographic delay.
The attack surface is uneven across chains, address types, and user cohorts
Quantum exposure is not evenly distributed. Bitcoin’s draft BIP 360 separates “long exposure” attacks from “short exposure” attacks and explicitly identifies already exposed public-key situations as the earliest practical target set. In that model, legacy P2PK outputs, reused outputs, and Taproot outputs are the most structurally exposed, while several other output types become vulnerable once spending activity reveals public-key material. This is a security map, but it is also a distribution map. Early holders and careless address reusers carry more direct cryptographic baggage than users who kept keys hidden behind hashes.
Ethereum’s exposure is broader than retail wallet signatures alone. Ethereum’s own roadmap says current protocol components rely on BLS signatures and KZG commitments, and both are quantum-vulnerable in their present form. The February 18, 2026 protocol priorities update also connects native account abstraction directly to post-quantum readiness, describing it as a migration path away from ECDSA-based authentication. In other words, Ethereum is not only protecting user keys. It is also planning around validator authentication, data availability commitments, and protocol-level crypto-agility.
The practical implication is that quantum risk is path dependent. Users who can rotate keys cheaply, wrap assets inside upgradeable account logic, or move to script-based controls are in a much better position than dormant holders, rigid custodial systems, or protocols that hard-coded one signature primitive into settlement and governance. Inference: if quantum migration arrives under time pressure, the first winners will not be the most principled users. They will be the most operationally prepared ones. The power effect comes from coordination capacity, not only cryptographic strength.
Post-quantum cryptography exists, but it is not a free swap
NIST’s standards answer the question of whether credible post-quantum signatures exist. They do not erase the engineering cost of using them on-chain. ML-DSA is NIST’s primary post-quantum signature standard for general use, and SLH-DSA is the stateless hash-based alternative. Both are credible. Neither behaves like a 64-byte ECDSA or Schnorr signature in a fee-sensitive, bandwidth-sensitive blockchain environment.
| Scheme | Public key bytes | Signature bytes | Blockchain read-through |
|---|---|---|---|
| ECDSA | 64 | 64 | Current baseline for user transactions on major chains using secp256k1. |
| ML-DSA-44 | 1312 | 2420 | Much larger than ECDSA, but still in the low-kilobyte range. |
| ML-DSA-65 | 1952 | 3309 | More conservative security with another step up in storage and bandwidth. |
| ML-DSA-87 | 2592 | 4627 | Heavy for retail transaction formats, more plausible for high-value systems. |
| SLH-DSA-SHA2-128s | 32 | 7856 | Tiny public key, very large signature. |
| SLH-DSA-SHA2-128f | 32 | 17088 | Operationally expensive for base-layer transaction throughput. |
One DLT study estimated that replacing Bitcoin’s current signature assumptions with Dilithium-like signatures would raise average transaction size from 552 bytes to 2,956 bytes, while a SPHINCS+-style choice pushed it to 17,624 bytes. Under the same block budget, the study estimated transactions per block falling from 1,993 to 365 for Dilithium and to 60 for SPHINCS+. The exact numbers will vary with implementation choices, but the mechanism is clear: signature bytes become blockspace politics.
Performance is less one-sided than the size numbers suggest. In an Ethereum-based benchmarking paper, Dilithium2 verification averaged 17.3 ms against 71.4 ms for ECDSA, while signature generation was slower and signatures were far larger. SPHINCS+ was much slower. For blockchains, that matters because nodes verify far more often than they sign. The near-term bottleneck is therefore more likely to be bandwidth, storage, and fee market pressure than raw verifier CPU.
Hybrid migration is possible, but it adds its own attack surface. NIST says dual-signature approaches can be accommodated, yet leaves each application to weigh the cost in implementation complexity, performance reduction, and engineering risk. That trade-off is especially relevant for blockchains because a “temporary” hybrid path can linger for years and quietly harden into a new dependency stack.
Migration is a governance problem before it becomes a cryptographic emergency
The hardest question is not which post-quantum algorithm wins. The hardest question is who pays to move, who gets stranded, and who is allowed to keep old claims if they never migrate. That is why quantum readiness is inseparable from protocol governance. Any eventual deadline, deprecation rule, or emergency fork will sort assets and users into active, inactive, recoverable, and abandoned categories. That sorting is economic policy in technical clothing.
Bitcoin’s current public proposal is deliberately limited. BIP 360 is still a draft, and it only addresses resistance to long-exposure attacks on outputs by removing Taproot’s key-path spend. The proposal explicitly says that protection against short-exposure attacks, including attacks on public keys revealed while a transaction waits in the mempool, may still require post-quantum signatures in the future. That modesty is important. It shows how difficult full migration is even for the most conservative change set.
Ethereum’s current posture is more overtly crypto-agile. The public roadmap points to STARK-based and lattice-based replacements for BLS, and the Foundation’s 2026 priorities explicitly elevate native account abstraction because it creates a migration path away from ECDSA-based authentication. That is not a final design. It is a governance-friendly direction of travel: separate account control logic from one fixed signature scheme so the system can rotate cryptography without forcing the entire economy to refactor in one event.
Inference: optional migration is politically easier at first, but it has fairness costs. Sophisticated custodians, exchanges, staking businesses, and protocol teams will rotate first because they have engineering staff, signing infrastructure, and treasury discipline. Retail users, inactive addresses, and dead governance vaults will lag. If a chain later freezes, discounts, or socially ostracizes quantum-vulnerable outputs, the protocol will be redistributing value and voting power. The debate will not be “technical versus political.” It will be both at once.
Token economies will feel quantum risk through custody, staking, and concentration
For token economies, quantum preparedness is partly a treasury and control-structure problem. Foundation multisigs, bridge signers, vesting vaults, validator keys, sequencer keys, and exchange custody clusters are concentrated points of failure. An attacker does not need to compromise an entire network to change a token economy’s power structure. Compromising a small number of concentrated keys can be enough to seize treasury assets, swing governance, or force emergency issuance and recovery measures.
Quantum migration can also reinforce centralization if protocols handle it lazily. Larger signatures mean higher storage demand, more bandwidth pressure, more expensive wallet flows, and more complicated client code. Organizations with dedicated infrastructure can absorb those costs first. Smaller validators, independent wallet teams, DAOs with fragmented ops, and long-tail users pay a higher relative price. The technical upgrade can therefore become a market-structure upgrade, pushing more influence toward custodians and middleware that can industrialize the transition.
This is the part the industry still understates. The cryptography problem is shared. The migration burden is not. Early ownership structure, operational maturity, and custody concentration will shape who can preserve economic participation during the transition. From FinDaS Tokenomics’ perspective, that makes quantum readiness part of token economy design, not a side quest for security engineers. A credible plan belongs next to treasury segmentation, governance hardening, validator architecture, and emergency powers design.
What serious preparation looks like now
The evidence does not support countdown theatrics. It does support immediate architecture work. NIST has already standardized the first PQC primitives, federal guidance is already operating on a 2030 to 2035 transition frame, and major public-chain ecosystems are already discussing post-quantum readiness in official roadmaps. “Wait for certainty” is not a neutral strategy. It is a decision to compress future governance into a shorter window.
- Inventory cryptographic dependencies. Separate user signatures, validator signatures, bridge keys, MPC systems, commitment schemes, and any already-exposed key material. Bitcoin’s own quantum discussion shows why exposed versus unexposed states matter.
- Design for crypto-agility. Ethereum’s native account abstraction push is relevant beyond Ethereum because it treats signature replacement as an account-layer problem, not only a chain-wide hard fork problem.
- Model data and fee impact with kilobyte-sized signatures. The NIST parameter sizes and blockchain benchmark results are large enough to change throughput, state growth, and user cost assumptions.
- Use hybrid paths selectively. NIST permits dual-signature approaches, but also warns that applications must judge complexity and performance costs case by case. Hybrid is a bridge, not a magic exemption from trade-offs.
- Prioritize concentrated power centers first. Foundation wallets, exchange custody, bridges, relayers, and validator operations should migrate before long-tail retail flows because their compromise would reshape the token economy fastest.
- Publish migration rules early. If a protocol may one day freeze vulnerable outputs, force key rotation, or define recovery windows, those distributional rules should be debated before stress conditions arrive.
The cleanest conclusion is also the least sensational. Quantum computing is a real future threat to blockchain security, but the decisive battle will be won or lost in migration design, not in headline timing. The chains that navigate it best will be the ones that treat cryptographic replacement as a governance, custody, and economic participation problem from the start. The chains that ignore those power dynamics may still upgrade their signatures and yet emerge more concentrated than before.
