Nine blockchain companies launched the Quantum Alliance in Lisbon on October 15, 2026, an open standards body tasked with defining what "post-quantum readiness" means for blockchain networks, wallets, and infrastructure. The group estimates 6.04 million BTC — 30.2% of issued supply, valued at app...
"In the future, 'post-quantum cryptography' will just be called 'cryptography' and everything else will be in a museum." — Christopher Smith, Founder & CEO, Quantus
Nine blockchain companies launched the Quantum Alliance in Lisbon on October 15, 2026, an open standards body tasked with defining what "post-quantum readiness" means for blockchain networks, wallets, and infrastructure. The group estimates 6.04 million BTC — 30.2% of issued supply, valued at approximately $490 billion at current prices — sit in addresses with public keys permanently exposed on-chain. Approximately $2.9 trillion in crypto market capitalization relies on classical elliptic-curve signatures that a sufficiently powerful quantum computer could break.
The Alliance's formation follows three research papers published between September 2025 and September 2026 that collectively shortened the estimated timeline to a cryptographically relevant quantum computer (CRQC). Google Quantum AI's March 2026 paper cut the estimated hardware requirement to fewer than 500,000 physical qubits — a 20x reduction from prior best estimates. IonQ published a complete end-to-end resource estimate in September 2026 showing 19,397 physical trapped-ion qubits could derive a Bitcoin private key in 25.7 days. The Alliance's own "Quantum Doom Clock" model places a 10% probability of a CRQC arriving by March 2028.
No quantum computer currently in existence can execute these attacks. Google's Willow chip operates at 105 qubits. The gap between current hardware and the estimated attack threshold remains large — but it is closing faster than the blockchain industry's migration plans are progressing.
The Quantum Alliance was established by nine organizations: Quantus, American Fortress, Intmax, Keystone, Midnight Foundation, Postquant Labs, Abelian, The Vault, and Hacken. The body is modeled on the Internet Engineering Task Force (IETF) and will publish open testing criteria, benchmarks, and migration guidance rather than build a competing blockchain.
Four initial workstreams cover the scope of the problem:
According to Sebastien Guillemot, CTO of the Midnight Foundation: "Zero-knowledge systems carry some of the most sensitive data on any chain, and their security assumptions have to survive the same transition as signatures." Aaron Chen, CTO of Keystone, noted that "hardware wallets sit at the point where new cryptography meets real users."
The Alliance will collaborate with the IETF to release open migration and testing guidelines. Standards will cover transaction signatures, key management, consensus mechanisms, zero-knowledge proofs, and peer-to-peer network connections.
Notably absent from the founding roster: any Bitcoin Core contributors. The Alliance acknowledged this gap but stated it intends to work with the Bitcoin development community separately.
The quantum threat to cryptocurrency is not theoretical in scope — only in timing. The attack surface is quantifiable.
According to Glassnode data cited by the Alliance, 6.04 million BTC (30.2% of the 20 million BTC issued to date) have their public keys exposed on the blockchain. This exposure occurs in two primary ways:
Of the 6.04 million exposed BTC, approximately 2.3 million are both vulnerable and dormant — they have not moved in at least five years. These coins cannot be protected by their holders migrating to new address types, because the holders are either lost, deceased, or unaware.
The economic value at risk extends beyond Bitcoin. The Alliance estimates approximately $2.9 trillion in crypto market value relies on classical elliptic-curve digital signature algorithms (ECDSA or EdDSA). This includes Ethereum's validator set (approximately 36 million staked ETH secured by BLS signatures), stablecoin issuer keys, cross-chain bridge signing keys, oracle network credentials, and governance multisigs.
Between late 2025 and September 2026, three research publications materially revised the resource estimates for a quantum attack on elliptic-curve cryptography:
1. Google Quantum AI (March 30, 2026)
Google Quantum AI, in collaboration with researchers from the Ethereum Foundation and Stanford University, published a paper estimating that breaking 256-bit elliptic-curve cryptography (the standard protecting Bitcoin and Ethereum) would require fewer than 500,000 physical qubits — roughly 20x fewer than prior best estimates. The paper cited approximately 1,200 to 1,450 logical qubits and 70 to 90 million Toffoli gates. Notably, the team did not publish the actual quantum circuits but instead released a zero-knowledge proof verifying the circuits' existence.
2. IonQ End-to-End Resource Estimate (September 8, 2026)
IonQ published the first complete fault-tolerant resource estimate for running Shor's algorithm against secp256k1. Their analysis showed that a trapped-ion quantum computer with 19,397 physical qubits, organized into 1,457 logical qubits, requiring 39 million Toffoli gates, could derive a private key in 25.7 days per attempt. Unlike prior estimates, IonQ compiled every operation down to actual error-correction primitives rather than approximating the operations that typically dominate runtime.
3. Google Willow Error Correction Advances (July 2026)
Google's Willow chip, operating at 105 qubits, demonstrated below-threshold quantum error correction across surface code distances 3, 5, and 7. Reinforcement-learning calibration improved logical stability 3.5x and reduced surface-code quantum-memory errors below one per 1,000 cycles. While 105 qubits is orders of magnitude below the attack threshold, the error-correction milestone validates the scaling assumptions underpinning the larger resource estimates.
The Alliance's "Quantum Doom Clock," built by contributors Richard T. Carback III and Colton Dillion, models the probability of a CRQC arriving based on hardware scaling trends.
Methodology: The model analyzes qubit counts, gate fidelity improvements, coherence times, and error-correction overhead across commercially available processors. These parameters are plotted on an exponential growth curve fitted to historical data points from IBM, Google, IonQ, and other manufacturers.
Key threshold: Approximately 856,000 physical qubits — the estimated requirement for breaking secp256k1 using superconducting architectures with current error-correction overhead.
Output: The model assigns a 10% probability that a CRQC arrives by March 2028.
Limitations: The Alliance itself describes this as a planning tool, not a scientific consensus. Multiple quantum computing researchers place the realistic threat window in the early-to-mid 2030s. The model does not account for potential plateaus in qubit quality, engineering bottlenecks in cryogenic cooling at scale, or the possibility that government-funded quantum programs may achieve capabilities before commercial manufacturers disclose them.
Christopher Smith of Quantus told CoinDesk: "The most likely scenario is that whoever gets the first CRQC will take them, probably with the blessing of whichever national government."
The U.S. National Institute of Standards and Technology (NIST) finalized three post-quantum cryptography standards in August 2024:
| Standard | Algorithm | Type | Signature Size | |----------|-----------|------|---------------| | FIPS 203 (ML-KEM) | CRYSTALS-Kyber | Key encapsulation | N/A | | FIPS 204 (ML-DSA) | CRYSTALS-Dilithium | Digital signature | 2,420–4,595 bytes | | FIPS 205 (SLH-DSA) | SPHINCS+ | Hash-based signature | 7,856–49,856 bytes |
A fourth standard, FIPS 206 (FN-DSA, based on Falcon), entered its initial public draft in September 2025, with finalization expected in late 2026 or early 2027.
NIST anticipates deprecating ECDSA by 2030 and disallowing it entirely by 2035. This timeline creates a compliance forcing function for regulated financial institutions holding crypto assets — including the estimated $104.3 billion in U.S. spot Bitcoin ETFs.
The signature size increase is a practical concern for blockchains. ML-DSA signatures are approximately 7x to 15x larger than current ECDSA signatures. SLH-DSA signatures are 250x to 1,600x larger. This inflates transaction sizes, block space consumption, and network bandwidth requirements. IonQ's research confirmed that ML-DSA and SLH-DSA are unaffected by the class of quantum attacks targeting elliptic-curve cryptography.
Ethereum has one of the most structured post-quantum migration programs of any blockchain, according to the Ethereum Foundation's published roadmap at pq.ethereum.org (launched March 2026).
Key components:
Vitalik Buterin has described Hegotá as likely Ethereum's last "normal" fork, with subsequent upgrades involving recursive STARKs, formal verification, and protocol-level quantum safety.
The Ethereum PoS consensus layer introduces a vulnerability that Bitcoin does not share: approximately 36 million staked ETH across 1.1 million validators, secured by BLS signatures, could be targeted to halt finality or manipulate fork choice. This makes the consensus layer's migration timeline as critical as the transaction-signing layer.
Bitcoin faces a harder migration path for structural reasons. The network has no foundation, no formal research group, and no hard-fork governance process with established legitimacy. Proposals for post-quantum migration — including BIP-360, which would introduce new quantum-resistant address types — have not reached consensus.
The 1.1 million BTC in Satoshi-era P2PK addresses present a policy dilemma with no clean resolution. Three options exist, each with tradeoffs:
No option has majority support. The governance friction is itself a risk factor: the longer consensus takes, the closer the threat window approaches.
Post-quantum migration is not free. Larger signatures increase storage, bandwidth, and verification costs across the entire network stack.
For Bitcoin, ML-DSA signatures would increase average transaction size by approximately 7x to 15x. At current block size limits, this implies either reduced transaction throughput or a block-size increase — another contentious governance issue. For Ethereum, the account-abstraction approach partially mitigates this by allowing incremental migration, but validators must still upgrade their BLS signatures.
Hardware wallet manufacturers face product-cycle pressure. Keystone, an Alliance member, acknowledged that existing secure elements may not support the computational requirements of post-quantum signature schemes. Firmware upgrades alone may be insufficient; new hardware may be required.
The institutional custody sector — now managing over $100 billion in Bitcoin ETF assets alone — must plan for key-management infrastructure that can handle quantum-resistant algorithms. Custodians using Hardware Security Modules (HSMs) will need vendor upgrades or replacements.
A consortium including BlackRock, Strategy, and Coinbase has committed $15 million to address quantum risk, according to reporting from Decrypt. This figure, while notable as a signal, is modest relative to the scale of infrastructure that requires upgrading.
The Quantum Alliance's formation marks the blockchain industry's first coordinated attempt to define post-quantum standards before the threat materializes. The timeline remains contested — the Alliance's own model gives only a 10% chance by March 2028, while broader scientific opinion leans toward the early 2030s.
The data, however, points to a structural problem: migration timelines for the largest blockchain networks are measured in years, and the three research papers published in the past twelve months have compressed the estimated threat window faster than protocol development has advanced. Ethereum's multi-year roadmap targeting 2029 completion is the most developed among major chains. Bitcoin has not yet agreed on a starting point.
The economic calculus is straightforward. The cost of premature migration is wasted engineering effort and increased transaction costs. The cost of late migration is the potential loss of hundreds of billions in assets that cannot be moved because their holders are unreachable, their governance is unresolved, or their hardware is obsolete. The asymmetry favors early action, which is precisely the argument the Quantum Alliance is making — not with urgency or alarm, but with open standards and testable benchmarks.