Defining and verifying post-quantum readiness for blockchain.

"Very realistic and almost certain at this time barring unforeseen technical barriers. We predicted this and published it in 2024 on the Quantum Doom Clock. IonQ, a publicly traded quantum computer manufacturer, now says they will have a capable quantum computer in 2028."

"IonQ projects 800 logical qubits next year, which is already enough quantum memory to run Shor's algorithm against Bitcoin keys. For reference, the smallest number of logical qubits necessary is 680, achieved by ecdsa.fail participants. Of course, it remains to be seen if they achieve that goal and if the quantum computer can run long enough to complete the computation, but it's quite clear that AI is accelerating quantum in ways that nobody can fully predict. In my opinion, we shouldn't bet our trillion-dollar asset on quantum slowing down."

"Nobody knows the date, but the estimates keep falling and the risk is one we can already plan for. The question for custodians isn't whether the date is 2028 or 2035, it's whether you can migrate in time if it arrives early."

"Researchers disagree mainly on when error-corrected or physical qubits will reach the scale needed. Many still put it in the 2030s or later, but resource estimates for breaking elliptic-curve cryptography have been dropping."

"When we say 'exposed', we mean the public key is published in the blockchain data, which makes it possible to compute the private key with a quantum computer. To protect them, the owners need to move to a modern system that hides the public key or to a post-quantum secure signature system. The latter, post-quantum secure cryptography, is not yet supported by major cryptocurrency networks, but members of the Alliance do have various solutions we hope to standardize, some of which can be used to protect yourself today."

"Exposed means the lock is on public display, waiting for a key that doesn't exist yet. The coins are safe today, but the ledger is permanent, so the attacker can simply wait."

"For privacy, the risk is worse. Any chain that hides transaction data with classical cryptography faces 'harvest now, decrypt later': records collected today could be de-anonymised once quantum machines arrive. Privacy that expires isn't privacy. That's why we at Abelian built on lattice-based cryptography from launch."

"Exposed doesn't mean hacked. It means the public key is visible on-chain, so those coins become vulnerable once a powerful enough quantum computer exists to derive the private key from it."

"There is still time. The concrete steps are to move coins to fresh addresses, stop reusing addresses, and use Multi-Party Computation (MPC) custody solutions that can rotate keys and swap signature schemes without a rebuild. Note that MPC alone doesn't make a wallet quantum-safe, because the threshold signature still uses today's curves. The industry needs post-quantum threshold schemes, and since the development time for those is years, not months, we must act now to protect the future of digital assets."

"QPU operators will be able to recover those keys and claim those coins and tokens. There are proposals to freeze or block such operators, but I would prefer it if funds were moved into a trust where owners who can prove ownership can submit claims to recover their funds, and to work with existing organizations like the DAO fund where unclaimed funds are invested and profits used to support chain security efforts. The Alliance represents the first step to an organized response and I hope we will be able to work with quantum computer vendors to responsibly manage the Q-Day transition."

"There are technical solutions to the issue of Satoshi's keys, but none of them are politically feasible. The most likely scenario is that whoever gets the first CRQC will take them, probably with the blessing of whichever national government. Hopefully it's a government that likes Bitcoin."

"Nobody owns that issue, and that's the problem. A custodian protects its clients' assets, not abandoned ones. Freezing coins is a governance decision for the Bitcoin network, not for the industry."

"Any freeze would trade quantum risk for a precedent on property rights and neutrality, so it needs broad consensus from the Bitcoin community."

"The engineering cost of swapping in new cryptography varies from chain to chain. For Bitcoin, the chief difficulty is its lack of a clear upgrade process and decision makers, aka 'decentralization'. If someone could just decide to do it, the code could be ready and audited within a month. For Ethereum, the technical job is much bigger, as they have pre-quantum cryptography at both the consensus and transaction layer, along with all the L2s and pre-quantum ZK projects, but at least they have the ability to upgrade the network. Privacy chains have an additional layer of cryptography to deal with as well."

"We can speak to this from experience. Abelian has run a post-quantum chain in production since launch, so larger signatures and their effect on throughput and fees are engineering realities we've designed around, not theory."

"Larger signatures are a real cost, but a manageable one when designed in from the start. Retrofitting is much harder, because the cost lies in coordinating wallets, exchanges, custodians and hard forks across an ecosystem. One lesson we learned: no chain should assume its first post-quantum scheme is its last. Cryptographic agility, the ability to swap schemes without a rebuild, is on Abelian's published roadmap for that reason."

"Nobody has a credible single number, and anyone offering one is guessing. The real cost isn't the cryptography, it's coordinating wallets, exchanges, custodians and protocol developers."

"Expect a multi-year migration with multiple protocol upgrades. Post-quantum signatures are many times larger than today's, so fees and block capacity are a legitimate concern, especially for Bitcoin."

"The Alliance already represents a significant portion of the industry focused on post-quantum upgrades to cryptocurrency. Blockchain communities tend to silo around their preferred chain and technology under that chain's foundation or other nonprofit governance body, so they are not set up to work together. We hope that an open access body will facilitate a baseline level of standardization. Variation and optimizations will still occur on every chain, but we hope to avoid dozens of slightly incompatible versions of the same algorithm. We already have several standards in the pipe that we will be releasing in the next quarter, and simply having the reference will drive a lot of the conversation."

"The issue addressed by the Alliance is that applying the new cryptographic standards to blockchains does involve navigating some fairly complex tradeoff spaces. By pre-digesting these decisions, we can make it easier for other industry players to pull something off the shelf and apply it quickly without having to rediscover all the dead ends."

"Standards come from NIST and regulators, not alliances. An alliance earns trust by publishing measurable milestones and showing who has signed up."

"NIST finalised its first post-quantum standards in 2024, so the technical target already exists. The credible test is public milestones, such as migration guides, readiness benchmarks and named participants. For regulated custodians such as us, readiness will also be judged under regulations like MiCA and DORA, not by industry groups."