The cryptocurrency industry is confronting a long-feared security challenge that extends far beyond digital assets: the eventual ability of quantum computers to break the public-key cryptography underpinning virtually all online transactions. With recent advances suggesting cryptographically relevant quantum systems could emerge faster than once anticipated, blockchain networks, exchanges, and cybersecurity firms are accelerating work on post-quantum cryptography (PQC) to counter the "harvest now, decrypt later" risk that already threatens sensitive data.
According to a Reuters report and multiple recent analyses, the growing anxiety is justified. Google researchers earlier this year indicated that quantum computers capable of cracking RSA and Elliptic Curve Cryptography—standards securing most internet traffic—may arrive sooner than previous forecasts. Meanwhile, a Citigroup study highlighted how the convergence of quantum computing and artificial intelligence is compressing the timeline for cybersecurity threats. In response, the U.S. National Institute of Standards and Technology (NIST) released three PQC standards in 2024—ML-KEM, ML-DSA, and SLH-DSA—that are now being integrated into vendor roadmaps.
Bitcoin’s transparency and permanence make it a uniquely visible target. Because transactions are permanently recorded on a public ledger, years of historical public keys are already exposed. Several researchers estimate that between one-third and one-half of Bitcoin’s circulating supply could become vulnerable if quantum computers reach the required capability before the network migrates to quantum-resistant cryptography. As Simon Pamplin, CTO of Certes, explained, "Blockchain transactions are permanent and public. Years of visible public keys represent a ready-made target set for any adversary with sufficient quantum capability." Other blockchains face similar risks, and the governance of decentralized networks adds complexity: "Upgrading a centralised organisation's cryptographic infrastructure is complex enough. Upgrading a decentralised network that requires community consensus... introduces a coordination problem that has no straightforward solution," Pamplin noted.
Despite the daunting challenge, practical solutions are emerging. Cloudflare recently became the first SASE provider to incorporate PQC on all layers of its technology stack, offering hybrid ML-KEM for IPsec and planning post-quantum authentication by mid-2027 at no extra cost. IBM embedded quantum-safe features into its new z17 mainframe, which includes cryptographic discovery tools to inventory vulnerable systems. Thales and other hardware security module (HSM) vendors now support PQC for root-key management, while DigiCert offers quantum-resistant digital certificates. ISARA provides crypto-agility toolkits enabling algorithm swaps as standards evolve. On the blockchain side, the Ethereum Foundation has outlined a post-quantum roadmap targeting later this decade, and the Algorand Foundation published its own strategy—though no top-20 blockchain has yet implemented a live quantum-resistant signature algorithm.
The migration process is complex. Enterprises are advised to start with a cryptographic inventory, classify data sensitivity and shelf life, deploy hybrid classical/post-quantum schemes, and update protocols like TLS, IPsec, and SSH to accommodate larger key sizes. Crypto-agility—the ability to swap algorithms without rebuilding infrastructure—is now considered essential. As Pamplin warns, "Waiting for quantum capability to mature before acting is not a strategy. Data-centric, quantum-safe protection applied now ensures that what is harvested today remains unreadable regardless of what computing power eventually brings to bear." For the crypto sector and beyond, the race to quantum resilience is no longer a distant future-proofing exercise but an urgent security priority.
