Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations

I. INTRODUCTION

• Cryptocurrencies face especially severe ECDLP risks because smaller keys require smaller CRQCs and fraudulent signatures can cause unrecoverable theft without traditional financial safeguards.Modern smart-contract, privacy, scalability, and tokenization features further expand the quantum attack surface.Source: §I · pp. 3–4
• The paper broadens prior Bitcoin-focused work by examining modern cryptocurrencies, systemic vulnerabilities, stablecoins, tokenization, and reusable classical exploits absent from Bitcoin.It identifies novel attack modes emerging from contemporary cryptographic features.Source: §I · p. 3

A. Attack Types and Disclosure Models

• Responsible disclosure combines public resource estimates with withheld attack circuits, using zero-knowledge proofs to preserve verifiability while reducing weaponization risk.The proof verifies a specified reversible secp256k1 point-addition circuit, the main bottleneck in Shor’s algorithm, over most inputs.Source: §I · p. 3, A. Attack Types and Disclosure Models · pp. 6–7

I. INTRODUCTION

• Two compiled 256-bit ECDLP circuits use 1200 logical qubits and 90 million Toffoli gates, or 1450 logical qubits and 70 million Toffoli gates.A cryptographic zero-knowledge proof enables trustless third parties to verify these resource estimates without access to the underlying attack details.Source: §I · p. 4
• Fewer than half a million physical qubits could enable attacks within Bitcoin and Bitcoin Cash block times, making on-spend attacks feasible.The estimate assumes superconducting architectures with surface-code error correction; private mempools and commit-reveal schemes are proposed mitigations.Source: §I · p. 4
• PQC migration is technically feasible but urgent because deployment is slow, consensus and resource costs impede upgrades, and dormant assets remain permanently exposed.Bitcoin’s P2PK scripts secure over 1.7 million BTC, while all dormant quantum-vulnerable bitcoin may total 2.3 million BTC; policy options include regulated digital salvage or burning salvageable coins.Source: §I · pp. 4–5

A. Attack Types and Disclosure Models

• On-spend attacks target transactions before confirmation, at-rest attacks target long-exposed public keys, and on-setup attacks create reusable protocol backdoors.On-setup vulnerabilities include Ethereum Data Availability Sampling and Tornado Cash, while Bitcoin is described as immune to this attack mode.Source: A. Attack Types and Disclosure Models · p. 6
• Fast-clock superconducting, photonic, and silicon CRQCs could launch on-spend attacks, whereas slow-clock neutral-atom and ion-trap systems likely enable only at-rest attacks.The slower architectures’ elementary operations are about two to three orders of magnitude slower.Source: §I · p. 4, A. Attack Types and Disclosure Models · p. 6

Updated estimates

• 1200 logical qubits and 90 million Toffoli gates, or 1450 logical qubits and 70 million Toffoli gates, break 256-bit ECDLP with roughly an order-of-magnitude lower spacetime volume than prior single-instance work.The estimates apply directly to secp256k1 and are validated using the paper’s zero-knowledge proof methodology.Source: B. Updated Quantum Resource Estimates · p. 7

Physical realization

• Fewer than half a million physical qubits and 18–23 minutes suffice on superconducting architectures with 10^-3 physical error rates, planar connectivity, and 10-microsecond control reactions.The runtime assumes a 50% overhead per Toffoli gate and reaction-limited execution.Source: B. Updated Quantum Resource Estimates · p. 8

On-spend attacks

• 9 or 12 minutes from a primed state halves the time to derive a revealed public key’s private key, implying that fast-clock CRQCs enabling at-rest attacks could also attack active transactions.Multiple primed machines could reduce this duration further; eleven machines provide a stated 6.5x speedup.Source: B. Updated Quantum Resource Estimates · pp. 8–9

Clock-speed distinction

• 25,000 physical qubits suffice for fast-clock magic production, whereas 2.5 million are needed with 100-microsecond slow-clock rounds, so at-rest attacks may precede on-spend attacks on slow-clock systems.Future magic-production techniques could nevertheless enable slow-clock on-spend attacks.Source: B. Updated Quantum Resource Estimates · p. 9

Engineering constraints

• Half a million physical qubits remains the better-understood and likely more feasible path than sub-100,000-qubit architectures requiring un demonstrated nonlocal connectivity, despite potentially lower theoretical qubit counts.The comparison reflects engineering concerns including connectivity, decoder maturity, physical error rates, and runtime.Source: B. Updated Quantum Resource Estimates · pp. 9–10

• Because the timing of offensive quantum capabilities depends on uncertain platform scaling barriers, cryptocurrency communities should begin preparing against quantum attacks immediately.The recommended preparation includes contingency planning for both attack-timing scenarios and continued development of mitigation strategies.Source: C. The Evolution of Offensive Quantum… · pp. 10–11
• Fast-clock CRQCs could make on-spend attacks viable alongside at-rest attacks, whereas faster progress on slow-clock platforms could make at-rest attacks viable substantially earlier.Fast-clock architectures include superconducting, photonic, and spin-qubit systems; slow-clock platforms include ion-trap and neutral-atom systems.Source: C. The Evolution of Offensive Quantum… · p. 11
• Quantum computing remains in an era of ferment, so progress is better measured by overcoming scaling thresholds than by counting physical qubits or solving progressively larger ECDLP instances.Relevant breakthroughs include lowering device error rates below error-correction thresholds and implementing coherent interconnects for modular architectures.Source: C. The Evolution of Offensive Quantum… · p. 11
• A successful public demonstration of Shor’s algorithm on a 32-bit elliptic curve may signal that PQC adoption has already failed rather than provide adequate advance warning.Scaling breakthroughs could leave little time between breaking 32-bit and 256-bit ECDLP, while advanced architectures and algorithms may not be publicly demonstrated.Source: C. The Evolution of Offensive Quantum… · p. 11
• Cryptocurrency communities should urgently deploy interim at-rest mitigations, including removing vulnerable spending paths, warning about weak addresses, disabling exposed Rootstock deposits, and rotating validator and staking keys.These measures do not eliminate quantum vulnerabilities but make attacks more difficult while communities prepare for a full PQC transition.Source: C. The Evolution of Offensive Quantum… · p. 11
• Uncertainty about the first CRQCs may increase as late-joining efforts, intellectual-property theft, industrial espionage, and reduced research transparency obscure their arrival and capabilities.Early CRQCs could conceivably be detected through blockchain activity before being publicly announced.Source: C. The Evolution of Offensive Quantum… · p. 11

A. Public Key Exposure in Bitcoin Transactions

• CRQCs can derive private keys from exposed ECDLP public keys, overturning Bitcoin’s current model in which ownership means knowing the private key.Bitcoin UTXOs are protected by locking scripts and spent with unlocking scripts containing valid digital signatures.Source: A. Public Key Exposure in Bitcoin… · p. 12
• P2PK, P2MS, and P2TR expose public keys onchain and therefore permit at-rest attacks; more than 1.7 million BTC, nearly 9%, use P2PK scripts.P2MS requires deriving multiple private keys, while P2TR’s tweaked-key design reintroduces the at-rest vulnerability associated with P2PK and P2MS.Source: A. Public Key Exposure in Bitcoin… · pp. 12–13
• P2PKH, P2WPKH, P2SH, and P2WSH generally hide public keys behind hashes and resist at-rest attacks, but spending reveals keys and enables on-spend attacks.P2SH/P2WSH scripts can also fail to bind unlocking scripts to transactions, requiring trusted miners or self-mining for some uses.Source: A. Public Key Exposure in Bitcoin… · p. 12

B. The Mechanics of a Quantum Attack on Bitcoin

• During an on-spend attack, the attacker extracts a public key from the mempool, applies Shor’s algorithm, and broadcasts a higher-fee forged transaction before the original is finalized.Bitcoin’s roughly ten-minute average block interval and congestion-dependent mempool delays provide time for key derivation; attackers can also flood the mempool with high-fee transactions.Source: B. The Mechanics of a Quantum Attack… · pp. 14–15
• Slightly less than 41% is the estimated success probability for a superconducting-CRQC on-spend attack against Bitcoin under idealized assumptions; shorter block intervals sharply reduce risk.The corresponding estimates are below 3% for Litecoin, below one in 1,300 for Zcash, and below one in 8,000 for Dogecoin.Source: B. The Mechanics of a Quantum Attack… · p. 15, Figure 6 · p. 16
• Replace-By-Fee bidding can force victims into fees approaching the asset’s value, while miners may gain new MEV opportunities by prioritizing quantum theft transactions.Disabling RBF is not reliable because the first-seen rule is unenforceable and miners have incentives to prioritize higher fees.Source: B. The Mechanics of a Quantum Attack… · pp. 15–16
• High fees, multisignatures, and direct miner submission can reduce on-spend risk, but none eliminates it; trusted-miner protection can fail if an orphaned block exposes the public key.Multisignature attack cost increases linearly with required signatures, though attacks parallelize for sufficiently many CRQCs.Source: B. The Mechanics of a Quantum Attack… · pp. 15–16
• Quantum attackers could disrupt consensus by bribing miners to orphan a block revealing a high-value public key, then stealing the assets in the next block.The attacker finances the reorganization using the stolen funds and makes it possible through the CRQC’s rapid key recovery.Source: B. The Mechanics of a Quantum Attack… · p. 16

Vulnerability origins

• Four exposure routes—locking scripts, unlocking scripts, public mempool transactions, and off-chain records—define Bitcoin’s quantum vulnerabilities because CRQCs derive private keys from known public keys.These routes produce Weak Address, Address Reuse, Public Mempool Exposure, and Offchain Exposure vulnerabilities.Source: C. The Origins of Quantum… · p. 17

Attack timing and scope

• On-chain and off-chain exposure enable both on-spend and at-rest attacks, whereas Public Mempool Exposure enables only on-spend attacks; every existing script type remains vulnerable to fast-clock CRQCs.Slow-clock CRQCs can launch at-rest attacks against exposed keys, including old P2PK and modern P2TR outputs.Source: C. The Origins of Quantum… · p. 17, Table I · p. 18

Script and address behavior

• Address reuse exposes previously hidden public keys and makes remaining funds vulnerable to both attack types, while P2TR exposes keys immediately and unused P2WPKH/P2WSH addresses can resist at-rest attacks until spending or disclosure.Once a public key is exposed or reused, safer hashed scripts become as vulnerable as directly exposed scripts.Source: C. The Origins of Quantum… · p. 17

Operational practices

• Public-key reuse is widespread because merchants, exchanges, and other services value stable addresses, lower fees, reserve proofs, and simpler account management, but cross-chain reuse extends at-rest exposure across blockchains.The same risk also arises when a private key is reused across Bitcoin, forks, or other chains.Source: C. The Origins of Quantum… · p. 18

Mitigation

• HD wallets can automate fresh address generation, but sharing extended public keys creates an Offchain Exposure vulnerability that can let a CRQC compromise multiple derived private keys; migrating to PQC signing keys is the only durable remedy.Normal derivation permits broad public-key derivation and therefore makes extended-public-key disclosure especially consequential in the presence of CRQCs.Source: C. The Origins of Quantum… · pp. 18–19

Scale of exposure

• 6.7 million BTC are held in addresses vulnerable to at-rest attacks from exposed or reused keys, with large early P2PK balances contributing substantially to the total.Figure 7 ranks the top 100,000 vulnerable addresses by value and highlights exposed 50 BTC mining-era rewards.Source: C. The Origins of Quantum… · p. 18, Figure 7 · p. 19

D. The Infeasibility of Quantum Attacks on Proof-of-Work

• CRQCs pose no direct threat to Bitcoin mining because error-correction overheads consume Grover’s quadratic speedup and the algorithm parallelizes poorly.Hardware acceleration and massive parallelization give classical Bitcoin mining a much greater advantage.Source: D. The Infeasibility of Quantum… · p. 20
• 0.25 TH/s is over two orders of magnitude below 110 ± 3% TH/s for an S19 Pro even under a fantastical 1-microsecond quantum error-correction cycle.Under realistic assumptions, a quantum miner’s hashrate falls by over 10 orders of magnitude.Source: D. The Infeasibility of Quantum… · p. 20
• Quantum mining remains science fiction for now, although future architectures with much faster error-correction cycles could make Grover speedup relevant.The long-term trajectory of quantum hardware is difficult to predict.Source: D. The Infeasibility of Quantum… · p. 20
• Quantum attacks on Bitcoin transactions could indirectly make mining unprofitable, slow blocks, reduce transaction capacity, and make on-spend attacks easier before difficulty adjusts.Bitcoin recalculates difficulty every 2016 blocks, whereas Bitcoin Cash adjusts after every block [158].Source: D. The Infeasibility of Quantum… · p. 20

IV. QUANTUM VULNERABILITIES OF OTHER ECDLP-BASED CRYPTOGRAPHIC PROTOCOLS

• CRQCs can recover shared secrets from DH and ECDH, breaking privacy in protocols used by Zcash, Monero, and Litecoin’s Mimblewimble.Both key-exchange schemes are based on the discrete logarithm problem.Source: §IV · p. 20
• Quantum attacks can destroy ElGamal commitment hiding, Pedersen binding, and thereby expose transaction values or enable new-coin creation; KZG is used in Ethereum’s DAS.BLS signature aggregation and related protocols use pairing-friendly curves such as alt bn128 and BLS12-381.Source: §IV · pp. 20–21
• CRQCs can derive fixed-parameter secrets once and reuse them for classical attacks, threatening Pedersen, KZG, and BulletProofs commitments and enabling forged SNARK validity proofs.In Tornado Cash, such on-setup attacks could withdraw more funds than deposited and drain an anonymity pool undetected until its balance reaches zero.Source: §IV · p. 21
• Quantum-vulnerable SNARKs can validate invalid zk-rollup batches, while larger elliptic curves offer at best partial, temporary protection and may provide little defense against at-rest attacks.ECDLP on BLS12-381 may require a somewhat larger CRQC, but the first CRQCs are still expected to access it; hash-based Starknet protocols are believed quantum-resistant.Source: §IV · pp. 21–22

V. QUANTUM VULNERABILITIES OF THE ETHEREUM BLOCKCHAIN

• Ethereum’s large economic scope extends beyond ETH to stablecoins, tokenized real-world assets, Layer 2 systems, and applications executed through smart contracts.The network functions as a decentralized computer supporting DeFi, DAOs, NFTs, voting, lending, derivatives, and other financial and non-financial systems.Source: §V · p. 22
• Ethereum’s deterministic 12-second slots and sophisticated private mempools make early fast-clock on-spend attacks unlikely.TEE-based BuilderNet allows users to submit transactions directly to builders, mitigating potential on-spend attacks.Source: §V · p. 22
• Ethereum’s persistent account model, smart contracts, and Proof-of-Stake produce five vulnerabilities: Account, Admin, Code, Consensus, and Data Availability.Their cryptographic roots are ECDSA, BLS signatures, and KZG commitments, respectively, and all are characterized as at-rest attacks.Source: §V · pp. 22–23, Table II · p. 23

A. Account Vulnerability

• Unlike Bitcoin’s rotatable UTXO addresses, Ethereum EOAs expose their full public keys after the first transaction and cannot rotate keys without abandoning the account.Users often retain EOAs for assets, reputation, DeFi positions, and governance history, making Account Vulnerability systemic and unavoidable without protocol-wide PQC migration.Source: A. Account Vulnerability · p. 23, §V · p. 23
• Account Vulnerability could forge DAO governance votes and drain exchange hot-wallet liquidity, potentially inducing broader market panic.The danger extends beyond the ETH balance held in any individual hot wallet because custodial liquidity may be affected.Source: A. Account Vulnerability · p. 23
• Account Abstraction via ERC-4337 and EIP-7702 improve authentication flexibility, key rotation, and migration of legacy accounts but do not remove vulnerable EOAs as Ethereum’s external-agency gateways.These measures mitigate symptoms rather than providing a fully quantum-secure interface.Source: A. Account Vulnerability · pp. 23–24
• <9 days: a fast-clock CRQC could crack the 1,000 highest-net-worth Ethereum accounts holding approximately 20.5 million ETH.Figure 8 identifies these accounts and marks those whose public keys were exposed by initiated transactions.Source: A. Account Vulnerability · p. 23, Figure 8 · p. 24

Smart-Contract Scope

• Ethereum’s persistent-state smart contracts and ERC standards support a tokenized economy whose quantum exposure extends beyond native ETH to fungible tokens, NFTs, and RWAs [185–200].Smart contracts can initiate transactions, access blockchain data, and deploy other contracts, while ERC-20, ERC-721, and ERC-3643 support tokenized assets.Source: B. Admin Vulnerability · p. 24

Admin Vulnerability

• At least 70 of the top 500 contract accounts, holding about 2.5 million ETH, face Admin Vulnerability and could be attacked in under 15 hours by a fast-clock CRQC.The vulnerability affects accounts with privileged administrative control, including pausing execution, upgrading code, or extracting funds.Source: B. Admin Vulnerability · p. 24, Figure 9 · p. 25

Administrative Consequences

• Compromised administrative keys could fraudulently mint or burn RWA tokens, drain bridge liquidity, falsify oracle prices, or pause, freeze, and update DeFi systems.These effects include depegging tokenized assets, triggering automated liquidations, and bypassing security time-locks.Source: B. Admin Vulnerability · p. 25

Aggregate Exposure

• First-order exposure includes about 2.5 million ETH and approximately 200 billion USD in stablecoins and tokenized RWAs, while second-order effects could reach substantial fractions of ecosystem TVS.The broader impact is difficult to estimate because bridges, oracles, and guardians can cause mass liquidations, peg collapse, or frozen cross-chain liquidity.Source: B. Admin Vulnerability · p. 25, Figure 9 · p. 25, Figure 10 · p. 26

RWA Exposure

• RWA risks include arbitrary minting, manipulated onchain credit, and seizure of digital ownership rights, and estimates are rapidly changing across the evolving multichain landscape.Ethereum currently holds most RWA market share, but other networks also need to assess their quantum vulnerabilities [201].Source: Figure 10 · p. 26

C. Code Vulnerability

• Ethereum smart contracts lack precompiles for post-quantum protocols such as ZK arguments, leaving their deployed cryptographic primitives quantum-vulnerable.Gas metering discourages implementing complex cryptography directly in EVM bytecode, so contracts depend on standard precompiled cryptographic primitives.Source: C. Code Vulnerability · p. 26
• L2 networks and bridges inherit smart-contract and account vulnerabilities, while deployed contracts cannot be automatically recompiled after a quantum-secure base-layer upgrade.Removing this exposure requires stakeholders and governance councils to migrate bridge contracts and administrative multisignature schemes individually.Source: C. Code Vulnerability · pp. 26–27
• At least 15 million ETH is exposed through quantum-vulnerable L2 protocols and bridges, although centralized security councils may temporarily pause or override affected systems.Figure 11 identifies optimistic rollups, bridges, and zkSNARKs as vulnerable, while zkSTARKs use hash-based proofs currently believed resistant to quantum attacks.Source: C. Code Vulnerability · p. 27, Figure 11 · p. 27

D. Consensus Vulnerability

• Ethereum’s Proof-of-Stake consensus uses BLS12-381 signature aggregation, making the consensus layer at-rest vulnerable to the same first-generation CRQCs as accounts and smart contracts.BLS aggregation compresses tens of thousands of validator signatures into a few dozen, and its additional quantum resource cost is estimated to be modest.Source: D. Consensus Vulnerability · p. 28
• Compromising more than one third of validators can halt finality, more than half can stop chain growth or reorganize history, and more than two thirds can finalize inconsistent chains.Less than one third enables equivocation and slashing, whereas over one third causes an activity-leak-mediated denial of service on finality.Source: D. Consensus Vulnerability · p. 28
• About 37 million ETH was staked and exposed to quantum consensus attacks as of February 2026, with potential cascading DeFi liquidations and cross-chain double-spending.A finality breach could also undermine Ethereum’s credible neutrality and institutional trust, while a supermajority attack requires social-consensus intervention outside protocol rules.Source: D. Consensus Vulnerability · p. 28
• Public validator keys and slow key rotation expose consensus, but roughly one million validators make attacks costly: 20 CRQCs would need over nine months to derive a two-thirds supermajority.This safety margin assumes uniformly decentralized stake; concentration in large pools such as Lido could enable faster provider-infrastructure compromise.Source: D. Consensus Vulnerability · pp. 28–29
• The long-term remedy is phased migration to post-quantum validator credentials, with rapid key rotation as a stopgap and eventual removal of non-migrated validators.Ethereum Foundation research is evaluating hash-based replacements for BLS12-381; after sufficient stake migrates, legacy credentials may need ejection or slashing.Source: D. Consensus Vulnerability · p. 29

E. Data Availability Vulnerability

• A quantum-capable adversary can forge KZG cell-authentication proofs, deceive validators about blob availability, stall rollups, and create ransom opportunities.Ethereum’s DAS uses KZG commitments on BLS12-381; the binding property is quantum-vulnerable.Source: E. Data Availability Vulnerability · p. 29
• A single quantum recovery of KZG trusted-setup toxic waste creates a persistent universal backdoor for cheaply forging proofs until a new setup is created.The attack extracts the discrete logarithm between public SRS points, eliminating the need for repeated CRQC use and creating a tradable exploit.Source: E. Data Availability Vulnerability · pp. 29–30
• Roughly 15 million ETH in TVS is exposed to Data Availability Vulnerability risk, whose liveness failures could halt Layer 2 networks and enable ransom attacks against bridged assets.Stage 0 and Stage 1 administrators could partially mitigate impacts by pausing Layer 2 activity while developing a workaround.Source: E. Data Availability Vulnerability · p. 30
• Ethereum must replace KZG with a post-quantum commitment scheme before CRQCs arrive, despite higher validator bandwidth and storage costs.Explored alternatives include hash-based polynomial commitments such as Fast Reed-Solomon Interactive Oracle Proofs of Proximity and Merkle-tree architectures.Source: E. Data Availability Vulnerability · p. 30
• Ethereum’s broader attack surface is offset by stronger foundation-led coordination, whereas Bitcoin’s decentralized governance may make PQC adoption slower and more contentious.The Ethereum Foundation supports research and coordination, while prior emergency interventions included the DAO bailout and a rejected 2018 intervention.Source: E. Data Availability Vulnerability · p. 30

VI. QUANTUM VULNERABILITIES OF OTHER BLOCKCHAINS

• Other blockchains continue introducing ECDLP-based quantum risks even as some pursue quantum security, motivating calls for a moratorium on vulnerable protocol development.The broader ecosystem contains substantial financial and cryptographic experimentation beyond Bitcoin and Ethereum.Source: §VI · p. 30

A. Bitcoin and Ethereum Derivatives

• Litecoin’s P2TR exposes public keys to at-rest attacks, whereas P2WPKH generally limits unreused keys to on-spend attacks; Dogecoin’s one-minute blocks impede early on-spend attacks but proposed zkSNARK support may add on-setup risk.Litecoin’s 2.5-minute blocks reduce early fast-clock attack probability, though future qubit increases could restore vulnerability.Source: A. Bitcoin and Ethereum Derivatives · p. 31
• Rootstock inherits Ethereum vulnerabilities and adds bridge-key theft and offchain-exposure risks that could bankrupt the sidechain or compromise deposited assets.A CRQC can derive multisignature keys despite HSM protection, while omitted destination addresses can reuse a Bitcoin transaction signer’s private key and expose its public key through sidechain activity.Source: A. Bitcoin and Ethereum Derivatives · p. 31

B. Privacy-Preserving Blockchains

• A CRQC could repeatedly break Mimblewimble’s Pedersen-commitment binding, enabling undetected inflation attacks; Litecoin therefore traded privacy for monetary-base protection by adopting quantum-vulnerable ElGamal commitments.Before the switch, quantum attackers could steal or create coins and recover transaction amounts through ECDH; afterward, they could learn amounts but not create coins.Source: B. Privacy-Preserving Blockchains · pp. 31–32
• Zcash’s Orchard removed trusted-setup backdoors, but ECDLP-based primitives still expose diversified-address unlinkability, encrypted notes, and zkSNARK soundness to quantum attacks.A CRQC can recover viewing keys, decrypt transaction amounts and memos, and potentially enable counterfeit-note creation, while the key hierarchy limits access to spending keys.Source: B. Privacy-Preserving Blockchains · p. 32
• Zcash’s Turnstile tracks monetary supply across shielded pools, while its 75-second average block interval makes on-spend attacks extremely challenging under the stated assumptions.Assets crossing shielded pools must pass through the transparent pool, providing a final defense against supply inflation.Source: B. Privacy-Preserving Blockchains · p. 32

C. Post-Quantum Blockchains

• QRL launched post-quantum, using XMSS and adding ML-DSA, while Mochimo and Abelian use hash-based and lattice-based post-quantum cryptography, respectively.These systems provide examples of post-quantum blockchains deployed from inception rather than retrofitted onto quantum-vulnerable infrastructure.Source: C. Post-Quantum Blockchains · p. 32
• Algorand deployed Falcon for smart transactions and state proofs, enabled Falcon verification in TEAL, and executed its first PQC-secured transaction in 2025.Users can also change account private keys, facilitating future migration despite not yet providing full quantum security.Source: C. Post-Quantum Blockchains · pp. 32–33
• Solana deployed an experimental WOTS vault, while XRP Ledger tested ML-DSA; XRP Ledger also supports RWA tokenization and holds about two thirds of TBILL tokens.The TBILL tokens are backed 1:1 by short-dated U.S. Treasury bills, with most of the remainder held on Ethereum.Source: C. Post-Quantum Blockchains · p. 33

D. Stablecoins and Real-World Asset Tokenization

• Stablecoins tokenize fiat or other backing assets, but USDT and USDC smart contracts concentrate quantum risk through exposed administrative keys controlling minting, freezing, and upgrades.A quantum attacker obtaining the multisignature upgrade privilege could take complete control and potentially mint unbacked tokens, threatening the peg.Source: D. Stablecoins and Real-World Asset… · p. 33
• Cross-chain stablecoins can inherit vulnerabilities from bridges and host chains, but migration to PQC systems may reduce exposure and pressure vulnerable ecosystems to accelerate adoption.Circle’s 2024 cessation of new USDC minting on TRON, followed by redemptions until February 2025, illustrates lingering-asset liabilities; USDC already operates on Algorand.Source: D. Stablecoins and Real-World Asset… · p. 33

E. A Taxonomy of Quantum Risk Profiles for Distributed Ledgers

• Four risk profiles span post-quantum blockchains, UTXO ledgers with avoidable long-term key exposure, persistent-account chains with inevitable exposure, and quantum-vulnerable privacy-preserving blockchains.The taxonomy includes QRL, Mochimo, Abelian, QDay, Bitcoin-family ledgers, Ethereum-family ledgers, and Zcash, Monero, and Mimblewimble.Source: E. A Taxonomy of Quantum Risk Profiles… · p. 34
• UTXO designs can hide ephemeral spending keys and limit cautious users primarily to harder on-spend attacks, but address reuse, staking, and governance-key exposure create systemic risks.Bitcoin derivatives mainly suffer from address reuse, while Cardano exposes staking and voting keys through registration certificates despite protecting spending keys.Source: E. A Taxonomy of Quantum Risk Profiles… · p. 34
• Persistent-account blockchains expose active keys more readily, and smart contracts, stablecoins, tokenization, and bridge administration amplify the potential scale of quantum attacks.Legacy accounts on Ethereum and Rootstock and standard Solana keypair accounts lack key rotation, while Algorand, TRON, and the XRP Ledger support native rotation.Source: E. A Taxonomy of Quantum Risk Profiles… · p. 34
• Privacy-preserving blockchains face asset theft and supply inflation, but CRQCs could also deanonymize years of historical confidential transactions, making PQC migration a privacy imperative.This risk applies to Zcash, Monero, and Litecoin’s Mimblewimble sidechain.Source: E. A Taxonomy of Quantum Risk Profiles… · p. 34

VII. RISKS AND CHALLENGES IN MIGRATING TO POST-QUANTUM CRYPTOGRAPHY

• ECDLP-based signatures are efficiently solvable by quantum machines, so upgrading underlying schemes to PQC is the only durable long-term solution.PQC schemes remain relatively new and span lattice-, hash-, code-, multivariate-, and isogeny-based categories, with lattice- and hash-based systems currently standardized by NIST.Source: §VII · pp. 34–35
• PQC migration remains uncertain because schemes and implementations have less scrutiny, new attacks may undermine assumptions, and blockchain requirements include signature and recursive proof aggregation.SIKE has suffered a classical attack, DQI and Kikuchi-related results affect confidence in lattice assumptions, and Falcon’s discrete-Gaussian sampling has prior side-channel vulnerabilities.Source: §VII · pp. 34–35
• 1280-byte Falcon signatures on Algorand contrast with 64–73-byte Bitcoin ECDSA signatures, while PQC’s greater storage, bandwidth, and computation costs can reduce throughput and increase centralization concerns.Composite signatures cost more than PQC alone; unchanged Bitcoin block sizes would fit fewer transactions, although L2s, aggregation, and succinct proofs could mitigate costs.Source: §VII · p. 35
• Bitcoin migration could take several months at the current transaction rate, requires years of preparation, and still leaves dormant P2PK assets vulnerable; Algorand, Solana, and XRP Ledger demonstrate feasible progress.Commit-reveal schemes can protect non-migrated assets at added complexity, while user education and quantum-safe defaults are needed; lost P2PK coins cannot be safely migrated, creating policy challenges.Source: §VII · pp. 35–36

A. The Challenge Posed by Dormant Assets

• Dormant assets may never migrate because owners miss the threat or lose private keys, while Ethereum contract accounts create similar long-tail migration problems.These assets and smart contracts may remain vulnerable on public blockchains for extended or indefinite periods.Source: A. The Challenge Posed by Dormant Assets · p. 36
• Without protocol changes, vulnerable assets will eventually be targeted by quantum attackers, while legal prohibitions alone may leave them exposed to nefarious agents.Possible attack paths include adversaries operating, compromising, coercing access to, or misusing quantum computers.Source: A. The Challenge Posed by Dormant Assets · p. 36
• The paper proposes technical and policy responses including a proof-of-ownership sidechain, regulated digital salvage, national-security action, and government engagement.The sidechain is called “bad sidechain” and is inspired by the “bad bank” model.Source: A. The Challenge Posed by Dormant Assets · p. 36
• ∼2.3 million BTC are held in vulnerable Bitcoin addresses that have not initiated a spend in five years, quantifying the dormant-asset exposure.Figure 13 covers the top 100,000 addresses vulnerable to at-rest attacks from exposed or reused keys.Source: A. The Challenge Posed by Dormant Assets · p. 36, Figure 13 · p. 37

1. Do Nothing, Burn, and Hourglass

• Do Nothing preserves property rights and fixed supply but risks price volatility; Burn prevents supply shock by confiscating dormant assets; Hourglass limits spending to stabilize prices without confiscation.Hourglass may create a spending bottleneck that incentivizes CRQC holders to bid for abandoned wealth through miners.Source: §1 · p. 37
• A fast-clock quantum computer could harvest the approximately 2.3 million BTC trove in months, whereas a slow-clock computer could require years.Figure 14 assumes roughly 9 minutes per key derivation for fast-clock hardware and approximately 14 hours to 12 days for slow-clock hardware.Source: §1 · p. 37, Figure 14 · p. 38
• Burn and Hourglass can be implemented as soft forks, but both require broad community support because protocol changes depend on decentralized consensus.Hard forks may otherwise create multiple cryptocurrency versions, while community incentives and beliefs keep consensus unresolved.Source: §1 · pp. 37–38
• Roughly equal support exists for Do Nothing, Burn, and Hourglass, and governments may legalize salvage while recommending that Bitcoin burn dormant assets.The authors expect the Bitcoin community’s ultimate decision to remain difficult to predict because stakeholders have conflicting beliefs and incentives.Source: §1 · pp. 38–39

2. Bad Sidechain

• A pegged recovery sidechain could identify true owners using offchain proofs and return recovered dormant assets to Bitcoin after ownership resolution.The design could use post-quantum smart contracts, a Rootstock-based bridge, and incentives or mandates directing CRQC operators to deposit recovered coins.Source: §2 · p. 39
• A consortium could govern the recovery sidechain, approving ownership proofs, setting fees and burn schedules, adjusting the peg, and controlling coin returns.The model permits greater centralization than Bitcoin and is analogous to a traditional-finance bad bank for distressed assets.Source: §2 · p. 39

C. Public Policy Options for the Challenge of Dormant Assets

• Quantum-secure migration can protect ongoing onchain activity, but retroactive privacy for known addresses on Zcash and Monero cannot be fully preserved against quantum adversaries.Preventing rogue actors from acquiring substantial quantum-vulnerable assets is also unlikely to be achieved by cryptocurrency communities alone.Source: C. Public Policy Options for the… · p. 39
• Dormant-asset risks may remain unresolved before CRQCs because migration to post-quantum protocols can be slow, while hard forks and lost keys complicate comprehensive recovery or burning.Do Nothing and Hourglass permit CRQC acquisition, Burn may leave a long tail of unmigrated assets, and policy disagreements may preserve valuable dormant assets on forked chains.Source: C. Public Policy Options for the… · p. 40

1. Regulated Destruction of Dormant Assets is Not Viable Policy

• Directly erasing dormant assets is infeasible because many P2PK coins lie in old blocks, requiring reconstruction of essentially the entire Bitcoin history.The computational cost would equal re-mining more than a decade of Bitcoin’s history, and legal systems may restrict government destruction of private property.Source: §1 · p. 40
• Transaction censorship would delay spending but not prevent settlement, as foreign miners could include banned transactions and uncooperating participants ultimately settled Tornado Cash transactions.Rejecting valid foreign-mined blocks could drive mining abroad or create censored and uncensored forks, leaving dormant assets vulnerable on the uncensored chain.Source: §1 · p. 40
• Effective censorship would require coordinated global miner participation, yet mobile mining, competing national incentives, weak international cooperation, and community opposition create immense practical barriers.The United States, China, Kazakhstan, Canada, and the European Union together account for roughly 85% of estimated mining power, below Taproot’s 99.85% support.Source: §1 · pp. 40–41

2. Digital Salvage

• Digital salvage could treat dormant assets as abandoned property, using escheatment, treasure-trove, adverse-possession, or laches principles to regulate recovery when ownership is unidentifiable.Offchain information may sometimes distinguish owners from CRQC users, while prolonged inaction after known risk may weaken owners’ claims under laches.Source: §2 · p. 41
• The Revised Uniform Unclaimed Property Act (2016) offers a possible blueprint for identifying exposed assets and transferring custody, but its holder requirement and state-by-state structure fit Bitcoin poorly.A contract auditor could examine blockchain records and facilitate transfers, yet no clear holder controls dormant coins and conflicts across states remain unresolved.Source: §2 · p. 41

3. National Security Response

• Governments could acquire and burn vulnerable assets as a national-security response, arguing that owner-identification failures and prolonged inaction support intervention.Governments might use CRQCs or pay companies to send assets to the unspendable OP_RETURN address, with laches supporting the policy argument.Source: §3 · pp. 41–42

4. Engagement with Bitcoin Community

• Governments should engage Bitcoin’s consensus-oriented but historically anti-interventionist community, whose financial and ecosystem interests may create openings for cooperation on dormant assets.The community’s techno-libertarian ethos and “code is law” philosophy complicate intervention, but broader social alignment may make productive dialogue possible.Source: §4 · p. 42

IX. OUTLOOK

• Fewer than half a million physical qubits could threaten 256-bit ECDLP, putting active Bitcoin transactions and dormant assets at immediate risk from fast-clock CRQCs.Fast-clock CRQCs could launch on-spend attacks within Bitcoin’s ten-minute average block time, while 1.7 million bitcoin in P2PK scripts remain vulnerable.Source: §IX · p. 42
• Ethereum faces broader at-rest exposure than Bitcoin: vulnerable accounts, difficult-to-rotate contract keys, validator compromise, and Data Availability Sampling attacks threaten assets, contracts, and consensus.Ethereum’s active PQC migration could enable a more expedient transition despite risks to exchanges, tokenized-asset infrastructure, bridges, guardians, and Proof-of-Stake integrity.Source: §IX · p. 42
• Tokenization could place more than 16 trillion USD of quantum-vulnerable assets in markets by 2030, potentially justifying mandates for post-quantum cryptography.The paper contends that migration remains feasible but urgent, citing post-quantum efforts by QRL, Abelian, Algorand, Solana, XRP Ledger, and the Ethereum Foundation.Source: §IX · p. 43

Financial Conflict of Interest Statement

• The authors report no short positions in cryptocurrency assets at publication, while some hold long positions, including assets using post-quantum cryptography.They reserve the right to initiate future positions in these assets.Source: Financial Conflict of Interest Statement · p. 43

Appendix A: Appendix: Zero-Knowledge Proof of Resource Costs

• SP1 generates a Groth16 SNARK proving possession of committed quantum circuits that correctly implement secp256k1 point addition under specified resource constraints.The appendix provides verification keys, circuit hashes, and proof bytes while withholding the improved logical circuits.Source: Appendix A · p. 54

1. Low-Qubit Circuit Variant

• The low-qubit statement commits to a quantum kickmix circuit with resource counts bounded by the specified proof statement.Its resources are verified through a cryptographic hash commitment rather than publicly revealing the circuit.Source: §1 · p. 54
• 1,175 logical qubits and at most 2,700,000 non-Clifford gates characterize the low-qubit circuit variant.The gate count comprises CCX and CCZ gates.Source: §1 · p. 54
• Across all 9,024 pseudo-random inputs derived deterministically from its hash, the low-qubit circuit correctly computes secp256k1 point addition.The input set is tied to the circuit’s own cryptographic commitment.Source: §1 · p. 54

2. Low-Gate Circuit Variant

• The low-gate statement commits to a quantum kickmix circuit bounded by 2,100,000 non-Clifford gates and 17,000,000 total operations.The non-Clifford count consists of CCX and CCZ gates.Source: §2 · pp. 54–55
• Across all 9,024 pseudo-random inputs deterministically derived from the circuit’s own hash, the circuit correctly computes point addition on the elliptic curve secp256k1.Source: §2 · p. 55

Point-addition construction

• The core circuit performs in-place windowed elliptic-curve point additions, each requiring three table lookups, and focuses approximate-correctness analysis on the Q += P[k] subroutine.The subroutine evaluates a classical Boolean function within an algorithm that otherwise relies on quantum interference; measurement-based uncomputation reduces non-Clifford gate counts.Source: §3 · p. 55

ECDLP circuit construction

• The 256-bit ECDLP circuit uses phase estimation across two variables, merges w additions into windowed operations, replaces the first with a direct lookup, and skips the last three via post-processing.Each phase-estimation variable requires n = 256 controlled elliptic-curve point additions, while merging w additions costs 3 × 2^w Toffolis.Source: §3 · p. 55

Logical-qubit optimization

• Qubit-recycled Quantum Fourier transforms reduce the phase-estimation workspace from two 2n-register requirements to a single w-length phase register.This recycling determines the logical-qubit scaling of the final ECDLP circuit from the point-addition circuit and window size.Source: §3 · pp. 55–56

Parameter optimization

• The cost analysis identifies w = 16 as the optimal window size for the point-addition circuit and reports the resulting number of windowed additions for the 256-bit ECDLP algorithm.The supplied passages do not include the numerical value of the resulting addition count.Source: §3 · p. 56

Overhead accounting

• Additional costs from measurement-based lookup uncomputation and qubit-recycled Fourier transforms are negligible compared with the millions of gates used by windowed lookup point additions.Toffoli counts are reported as average executed CCX and CCZ gates over 9024 test cases because classically conditioned instructions may not execute.Source: §3 · pp. 55–56

4. Measurement Based Uncomputation and Kickmix Circuits

• Measuring an ancilla in the Pauli-X basis either disentangles it directly or produces a phase kickback requiring correction on the preserved data register.The correction is usually slightly cheaper, and sometimes much cheaper, than recomputing the ancilla function.Source: §4 · p. 56
• Traditional reversible uncomputation would require applying the inverse circuit and effectively doubling logical gate counts, whereas measurement-based uncomputation offers a cheaper measurement-driven alternative.When the |−⟩ outcome occurs, phase correction completes the uncomputation using the preserved data register.Source: §4 · p. 56
• Kickmix circuits combine reversible classical logic, Pauli-X measurement-based uncomputation, and diagonal phase corrections while remaining efficiently classically simulable.This restricted gate set avoids intractable quantum entanglement while supporting phase kickback and mixing classical states.Source: §4 · p. 56

5. Verifiable Fuzz Testing via the Fiat-Shamir Heuristic

• 9024 Fiat–Shamir-selected tests provide 128-bit security that the circuit is correct on at least 99% of inputs, since passing all tests under a 1% error rate has probability at most approximately 2^-130.SHAKE256 seeded by the secret circuit generates the test scalars and corresponding secp256k1 points.Source: §5 · p. 56

6. Cryptographic Attestation via SP1 and Groth16 SNARK

• SP1 simulates the secret circuit, runs the 9024 tests, records non-Clifford gates, and asserts resource limits of 1175 logical qubits with 2,700,000 Toffoli gates or 1425 logical qubits with 2,100,000 Toffoli gates.The resulting execution is compressed through recursive STARK composition and wrapped in Groth16 to provide zero knowledge and succinctness.Source: §6 · p. 57
• The Groth16 attestation remains sound today but could theoretically be forged by a sufficiently large fault-tolerant quantum computer because it relies on pairing-friendly elliptic curves.The paper notes that cryptographically relevant quantum computers do not currently exist.Source: §6 · p. 57

7. Code Availability for Zero-Knowledge Proof

• The ZK-proof source code and artifacts are publicly archived in Zenodo, while v1 and v2 circuit hashes differ because v2 hashes circuit-file contents instead of serialized parsed objects.The underlying circuits remain identical, and v1 hashes remain verifiable by reverting to the earlier repository version.Source: §7 · p. 57