Blockchain × Quantum Computing

What Shor's algorithm breaks

Bitcoin, Ethereum, and most major blockchains sign transactions with ECDSA over the secp256k1 curve. ECDSA's security rests on the elliptic-curve discrete logarithm problem — infeasible for classical computers, polynomial-time for a large fault-tolerant quantum computer running Shor's algorithm (1994). Post-quantum, ECDSA/secp256k1 offers effectively ~0 bits of security: a private key can be derived from its public key.DeepBlue Alpha

A common confusion: Bitcoin does not use RSA. It is threatened by Shor's discrete-logarithm variant, not the factoring variant. Ethereum has wider exposure — BLS12-381 validator signatures, KZG polynomial commitments for blob data, and pairing-based SNARKs at the application layer are all Shor-vulnerable.DeepBlue Alphaw3pk

What Grover's algorithm does not break

Hash functions face only Grover's quadratic speedup: SHA-256's preimage resistance drops from ~2²⁵⁶ to ~2¹²⁸ operations — still far outside practical attack range, and the standard floor for symmetric cryptography. A Bitcoin address that has only ever receivedfunds exposes only a hash of the public key, which Shor's algorithm cannot reverse.ethnews

Proof-of-work survives for the same reason plus physics: Grover's algorithm parallelizes poorly, ASIC speeds already negate the quadratic edge at current difficulty, and difficulty adjustment cancels residual advantage. As one survey puts it: the quantum threat to Bitcoin is tospending authority (private keys), not to block production.Aggarwal et al., 2017 via CoinGeek

The exposure model

The critical variable is whether the public key is visible on-chain. An address that has only received funds shows a hash; the moment the owner spends, the public key appears. Early P2PK outputs published keys directly, and Taproot outputs expose keys at the output level.ethnewsDeepBlue Alpha

• ~6.04M BTC (~30.2% of supply) with visible public keys — 1.92M from script type, 4.12M from address reuse — per Glassnode's May 2026 analysis.postquantum.com
• ~1.7M BTC in ancient P2PK addresses, including roughly 1M believed to belong to Satoshi Nakamoto — unmigratable by anyone, so part of the exposure is permanent.crypto.news
• Two attack categories: at-rest (dormant coins, attackable at leisure) and on-spend/mempool (key exposed in an unconfirmed transaction — the attacker must derive it and front-run confirmation).Severin/Forq

The 2026 resource estimates

On March 30, 2026, a team led by Ryan Babbush, Adam Zalcman, and Craig Gidney (Google Quantum AI), with collaborators from UC Berkeley, the Ethereum Foundation's Justin Drake, and Stanford's Dan Boneh, published resource estimates for Shor's algorithm against secp256k1 that cut the best prior figures roughly 20-fold: under 1,200 logical qubits and 90 million Toffoli gates — translating to fewer than 500,000 physical qubits and about 9 minutes per key recovery, inside Bitcoin's ~10-minute block time. For scale, Google's Willow chip has 105 physical qubits; no machine today can run this attack. Google set an internal 2029 deadline to migrate its own systems to post-quantum cryptography.Digital Chamber analysisCryptoValley Journal

The pattern across all four: migration is a governance problem before it is a math problem. Coordinating wallets, exchanges, miners, and custodians takes longer than standardizing the algorithms — which is why the honest timelines are measured in years even after everyone agrees.

• No speedup for consensus. Quantum touches the cryptography layer only; there is no known quantum attack on BFT consensus or block production.
• Coins cannot be minted or history rewritten. The failure mode is theft of exposed keys and impersonation — past transactions stay valid regardless.
• Post-quantum signatures are much larger. ML-DSA-65 signatures are 3,309 bytes vs. 64 for ECDSA. Any "quantum-safe blockchain" narrative that omits the size and fee trade-off is incomplete.
• "Quantum-safe" ≠ "quantum-proof." PQ security rests on hardness assumptions younger than RSA/ECC's decades of cryptanalysis. SLH-DSA exists precisely as a hedge in case lattice assumptions fail.
• No CRQC exists. As of October 2026, no cryptographically relevant quantum computer has been demonstrated; all timelines are estimates with wide bands.

This research program is led by Dhruv Doshi, Principal of Arihant Global Ventures Inc. His published work includes"Blockchain-based decentralized cloud storage" (D. Doshi, S. Khara, International Conference on Mobile Computing and Sustainable Informatics, 2020) on decentralized peer-to-peer archival storage with privacy-preserving verification — listed on hisGoogle Scholar profile. His stated specialization for this program is blockchain and quantum computing, pursued through computational research methods.

Arihant Global Ventures Inc. is a Canadian enterprise technology consultancy; the research above is the principal's independent research agenda, distinct from client delivery work.