“Quantum computers will break all blockchains” is imprecise. A quantum computer breaks a few specific kinds of cryptographic math; any blockchain is at risk where that math is used. Find the math and you find the risk.
This guide walks you through how this math is used and where it can affect a blockchain. First let’s establish the math.
Three kinds of math quantum breaks
Almost all of the risk comes down to three kinds of cryptography, and a quantum computer treats each one differently.
- Signatures: The math that proves a transaction is yours, a wallet signature only you can produce. A quantum computer running Shor’s algorithm can work backwards from your public key to your secret private key, then sign as you.
- Encryption: What keeps data private when it travels. Shor’s algorithm breaks this too. A quantum computer can record encrypted traffic today and decrypt it years later.
- Hashing: The one-way fingerprints behind proofs, addresses, and the chain’s state. Most are only affected by Grover’s algorithm which helps guess the input produced a given fingerprint, this is rarely an issue but some hashes still rely on elliptic curve signatures so once again Shor’s algorithm breaks them.
Each of these has a concrete fix, and the replacements are already standardised.
- Signatures: Move to a post-quantum signature scheme such as ML-DSA, SLH-DSA or the proposed Falcon-512.
- Encryption: Move to a post-quantum key-exchange, ML-KEM (FIPS 203)
- Hashing: no new math needed – a large enough hash, utilising SHA-256 or SHA-3, stays secure against quantum attack.
Across a blockchain, that math shows up on five migration surfaces. The rest of this guide walks each one: how it works, what’s at risk, and how it’s fixed.
Surface 1 – Keys & accounts
The mechanism. Every transaction is authorised by a signature from your account’s secret key – your wallet. Today that signature uses elliptic-curve math: for example ECDSA, the scheme behind most blockchain wallets.
The risk. This surface loses funds directly. The moment you transact, your public key becomes visible, and a quantum computer can derive your private key from it and sign as you. Splitting the key across several parties (multisig or MPC) doesn’t help – the underlying scheme is what breaks. One nuance decides who’s exposed: on most chains your address is only a hash of your key, so untouched funds stay hidden until you first spend.
The fix. Swap the account’s signature for a post-quantum one. The hard part isn’t the cryptography – it’s the migration. Most signature schemes are baked into the protocol, changing it needs a hard fork and a coordinated move of everyone’s funds. Where an account is programmable, it can change its own signature with no protocol changes. Starknet works this way, and post-quantum wallets already run on mainnet, Open Zeppelins implementation as an example.
Surface 2 – Apps & inputs
The mechanism. The programs running on-chain and the outside data they trust: signature checks inside smart contracts, price oracles feeding in signed data, and on-chain randomness.
The risk. A contract that hard-codes an old signature check keeps trusting it long after it’s broken. Worse, oracle and randomness keys are usually shared, so one break is systemic – forge the oracle’s signature and every contract that reads its feed is corrupted at once.
The fix. Contracts and data providers move to post-quantum signatures. Most of this is ecosystem work on any chain; a protocol helps mainly by letting contracts verify new schemes without waiting for a protocol change.
Surface 3 – Proving
The mechanism. For rollups, the machinery between “transactions submitted” and “state final”: the sequencer that orders them, the proof that the work was done correctly, the record that the data was published, and the storage trie that commits to the chain’s state with hashes.
The risk. This is where designs differ most, so the damage depends on the build. If the proof relies on elliptic-curve math – as pairing-based proofs like KZG do – a quantum computer can forge a proof for a state that never happened. Hash-based proofs don’t have that weakness. The same is true of the commitments in the storage trie, where an elliptic-curve hash can be forged into a state that was never stored. Hash-based versions of both have no known weakness.
The fix. Build this layer on hashes, not elliptic curves. Hash-based proofs (STARKs) have no known quantum weakness and need no trusted setup. Starknet is a working example: its proofs are quantum-resistant by design, and parts of its state already use hash functions, with a committed roadmap for the rest. The honest exception is data availability, which as an Ethereum layer-2 it inherits from Ethereum.
Surface 4 – Consensus, finality & cross-chain
The mechanism. How the network agrees a block is final, how one chain checks another’s word (light clients and bridges), and how a layer-2 anchors to the chain beneath it. All of it comes down to checking a set of validator or committee signatures and then trusting the result.
The risk. Forge that set of signatures and you can forge finality itself, or a fraudulent bridge withdrawal. Bridges are already the most-attacked part of crypto, with billions stolen, and quantum adds another way in.
The fix. Move validator, committee, and settlement signatures to post-quantum schemes. It’s easier where signing lives in upgradeable contracts – Starknet is planning to migrate its consensus signing on that basis. But cross-chain is a shared ceiling: a layer-2 inherits its base chain’s cryptography, so none is fully safe until the layer-1 moves too.
Surface 5 – Networking & transport encryption
The mechanism. The encrypted connections underneath everything – between the network’s nodes, and between your wallet and the network.
The risk. A public ledger isn’t secret, so the target is data in transit – traffic recorded today and decrypted later – plus impersonating a node once its key breaks.
The fix. Move that traffic to post-quantum encryption, which is already deploying across the internet. This surface isn’t chain-specific – every chain inherits it from the same internet-wide migration, so it’s rarely where chains differ.
The exposure window
This cuts across all five surfaces, the clock before quantum computers arrive. An attacker can harvest public keys and encrypted data today, then wait for the hardware. The risk sits in reused or already-spent addresses, where the key is permanently on show, not in coins that have never moved.
Bitcoin is the clearest case. Millions of coins sit in exposed addresses, and it has no way to upgrade the accounts behind them. That leaves two options: a new quantum-safe address type, and eventually freezing whatever is left. Almost every chain is vulnerable. What separates them is whether they can move exposed accounts to safety without freezing them.
The bottom line
The surfaces are independent, so meet any one-line “we’re quantum-safe” claim with a simple question: safe where? Walk the five and ask two things of each. Does it run on breakable signatures or durable hashes? Can it migrate without freezing users? No chain passes cleanly today, because the vulnerable schemes are still in use almost everywhere. So judge chains on how much already runs on hashes and how cheaply the rest can move.
Two advantages count most: a hash-based proof system and programmable accounts. Starknet has both, so it has less to move than most chains, you can review the roadmap publicly to check for the rest. Don’t trust “fully quantum-safe.” Trust a chain that shows you which surfaces are done and what is not.
