PaperlayerView exact revision on arXiv

Source-linked AI summary

Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations

Ryan Babbush, Adam Zalcman, Craig Gidney, Michael Broughton, Tanuj Khattar, Hartmut Neven, Thiago Bergamaschi, Justin Drake, Dan Boneh

arXiv:2603.28846v2quant-phcs.CR

TL;DR

The paper examines how developing quantum architectures threaten blockchain cryptography and how those risks can be mitigated. It combines updated ECDLP resource estimates, verifiable disclosure, cryptocurrency vulnerability analysis, and policy discussion, finding that fast-clock CRQCs could enable on-spend attacks while dormant assets remain unresolved migration targets.

  • Problem

    Blockchain systems depend critically on quantum-vulnerable ECDLP cryptography, while prior work under-explored current quantum resource estimates, broader cryptocurrency vulnerabilities, and tokenization.

  • Method

    The paper combines updated quantum circuit resource estimates with zero-knowledge verification, architecture-specific timing analysis, cryptocurrency vulnerability analysis, and discussion of PQC and digital-salvage policies.

  • Results

    Fast-clock CRQCs are estimated to solve ECDLP in minutes and could enable on-spend attacks, while superconducting implementations require fewer than half a million physical qubits.

  • Takeaways & Limitations

    Cryptocurrency communities have a migration path through mature PQC, but dormant quantum-vulnerable assets require additional protocol, economic, and policy decisions.

Abstract

from arXiv · show

This whitepaper seeks to elucidate implications that the capabilities of developing quantum architectures have on blockchain vulnerabilities and mitigation strategies. First, we provide new resource estimates for breaking the 256-bit Elliptic Curve Discrete Logarithm Problem, the core of modern blockchain cryptography. We demonstrate that Shor's algorithm for this problem can execute with either <1200 logical qubits and <90 million Toffoli gates or <1450 logical qubits and <70 million Toffoli gates. In the interest of responsible disclosure, we use a zero-knowledge proof to validate these results without disclosing attack vectors. On superconducting architectures with 1e-3 physical error rates and planar connectivity, those circuits can execute in minutes using fewer than half a million physical qubits. We introduce a critical distinction between fast-clock (such as superconducting and photonic) and slow-clock (such as neutral atom and ion trap) architectures. Our analysis reveals that the first fast-clock CRQCs would enable on-spend attacks on public mempool transactions of some cryptocurrencies. We survey major cryptocurrency vulnerabilities through this lens, identifying systemic risks associated with advanced features in some blockchains such as smart contracts, Proof-of-Stake consensus, and Data Availability Sampling, as well as the enduring concern of abandoned assets. We argue that technical solutions would benefit from accompanying public policy and discuss various frameworks of digital salvage to regulate the recovery or destruction of dormant assets while preventing adversarial seizure. We also discuss implications for other digital assets and tokenization as well as challenges and successful examples of the ongoing transition to Post-Quantum Cryptography (PQC). Finally, we urge all vulnerable cryptocurrency communities to join the ongoing migration to PQC without delay.

I. INTRODUCTION

The paper updates quantum resource estimates for attacking blockchain cryptography, broadens the analysis beyond Bitcoin, and examines technical, policy, and migration responses. It emphasizes that fast-clock quantum computers could enable attacks on transactions before confirmation, while dormant assets remain a distinct unresolved risk.

  • Cryptocurrencies are especially exposed because they rely on smaller ECDLP-based keys and generally lack recourse after fraudulent signatures.These properties distinguish blockchain systems from traditional finance and make a single forged signature potentially unrecoverable.
  • The paper addresses an under-explored intersection by combining updated quantum attack estimates with analysis of broader cryptocurrency systems, tokenization, and novel exploit modes.Prior work largely focused on Bitcoin and historical CRQC timelines rather than current resource estimates or systemic vulnerabilities beyond Bitcoin.
  • Technical contributions: 1200 logical qubits and 90 million Toffoli gates, or 1450 logical qubits and 70 million Toffoli gates, are reported for two 256-bit ECDLP circuits verified through a zero-knowledge proof.The proof allows third parties to verify the estimates without access to the underlying attack details.
  • Technical contributions: Fewer than half a million physical qubits are estimated for these computations on a standard superconducting architecture, nearly a 20-fold reduction over prior estimates.The estimate uses surface-code error correction and supports the paper’s assessment of practical attack proximity.
  • Mitigation and policy: PQC offers a migration path, but dormant assets remain fixed quantum-vulnerable targets, including more than 1.7 million BTC in P2PK scripts and potentially 2.3 million BTC across script types.The paper therefore discusses responsible disclosure, public policy, and regulated digital salvage alongside technical migration.
  • Attack implications: Fast-clock CRQCs could solve ECDLP in minutes and launch on-spend attacks, whereas neutral-atom and ion-trap architectures are not expected to do so because their operations are two to three orders of magnitude slower.The distinction is based on wall-clock execution time rather than asymptotic quantum speedup.

B. Updated Quantum Resource Estimates

The paper presents new single-instance resource estimates for breaking 256-bit ECDLP and translates them into physical-qubit and runtime estimates under superconducting-hardware assumptions. It also frames these estimates against prior space-time tradeoffs and broader reductions in quantum-computing resource requirements.

  • Resource tradeoffs: The two circuit variants expose a space-time tradeoff: fewer logical qubits require more Toffoli gates, while fewer gates require more logical qubits.Prior work similarly traded more than twice the logical-qubit count for a lower Toffoli count, with additional physical-qubit costs after error correction.
  • New resource estimates: 1200 logical qubits and 90 million Toffoli gates, or 1450 logical qubits and 70 million Toffoli gates, suffice for 256-bit ECDLP.These circuits apply directly to secp256k1 and improve single-instance spacetime volume by roughly an order of magnitude over prior work.
  • Scaling with curve size: 4.5n space is required by the reported circuits for ECDLP over elliptic curves with n-bit prime modulus and group order.The estimates are shown for curve sizes n = 32, 64, 128, and 256.
  • Algorithmic optimizations: State reuse and div batching can reduce amortized resources across multiple instances, but the paper’s main estimates exclude these optimizations.State reuse derives nine private keys in one execution; div batching parallelizes instances and merges modular inversion operations.
  • Physical implementation: Fewer than half a million physical qubits and 18 or 23 minutes are estimated for the circuits under superconducting assumptions.The estimate assumes planar degree-four connectivity, 10^-3 physical error rates, 10-microsecond control reaction time, and 50% Toffoli overhead.
  • Attack timing: A primed computation reduces the time from public-key disclosure to private-key resolution to roughly 9 or 12 minutes, enabling potential on-spend attacks.The first half of the algorithm can be precomputed because it depends only on shared protocol parameters.

C. The Evolution of Offensive Quantum Capabilities

The paper distinguishes fast-clock and slow-clock quantum platforms because their relative progress determines whether at-rest and on-spend attacks emerge together or at different times. It argues that gradual warning metrics may be unreliable and recommends immediate mitigations while communities prepare for PQC.

  • Possible attack timelines: Fast-clock platforms could make on-spend attacks viable about as soon as at-rest attacks, whereas faster progress on slow-clock platforms could separate the two capabilities.The paper identifies these as two possible scenarios because platform scaling barriers and development rates remain uncertain.
  • Architectural uncertainty: Quantum architectures under development span fast-clock superconducting and photonic systems alongside other platforms, leaving the dominant design uncertain.The paper links this architectural diversity to uncertainty about which attack scenario will occur first.
  • Limits of warning signals: A successful demonstration of Shor’s algorithm on a 32-bit elliptic curve may provide little warning before 256-bit ECDLP becomes solvable.The paper states that challenge ladders may fail as early-warning measures if scaling barriers are overcome before small demonstrations appear.
  • Interim mitigation: Communities are urged to deploy interim at-rest mitigations, including removing vulnerable spending paths, warning about weak addresses, and rotating validator or staking keys.These measures do not remove quantum vulnerabilities but make attacks more difficult while broader preparation continues.
  • Preparation urgency: The paper recommends beginning preparation against quantum attacks immediately because progress in hardware, error correction, and compilation can lower the barrier to cryptographic relevance.It characterizes the approach to cryptographically relevant quantum computers as increasingly opaque and difficult to time precisely.

III. ATTACKS ON BITCOIN’S DIGITAL SIGNATURE SCHEME

Bitcoin’s transaction model exposes different public-key attack surfaces depending on script type and transaction stage. Quantum attackers can exploit public mempool visibility, fee incentives, and block-production mechanisms to forge or displace legitimate spends.

  • Transaction and signature mechanics: Bitcoin UTXOs are locked by scripts requiring a valid digital signature matching the owner’s public key.Spending requires an unlocking script containing a valid signature, while ownership is tied to the corresponding private key.
  • Script-dependent exposure: P2PK directly exposes recipient public keys, whereas P2PKH hides them behind hashes until spending reveals the key.A quantum computer can derive a private key from a public key, but cannot derive the public key from its hash alone.
  • Script-dependent exposure: P2MS records multiple public keys and therefore requires an attacker to derive m private keys, making attacks harder as the signature threshold increases.The cost increases with the number of required signatures, although sufficiently many quantum computers can parallelize the derivations.
  • Script-dependent exposure: P2TR improves flexibility and privacy but stores a tweaked public key directly, restoring the at-rest vulnerability associated with P2PK and P2MS.P2MR removes the quantum-vulnerable key path and is presented as a patch for this Taproot regression, while remaining vulnerable to on-spend attacks.
  • On-spend attack mechanics: On-spend attacks use public keys in the mempool to derive private keys before confirmation, then exploit transaction replacement, miner incentives, or block reorganization.The attacker may offer higher fees, induce a block to be orphaned, or replace the victim’s transaction after deriving the key.
  • Mitigations and residual risk: Direct-to-miner submission can reduce public-mempool exposure but does not eliminate quantum risk, because reorganizations may later reveal the public key.The mitigation relies on a trusted miner and remains vulnerable if the miner’s block is orphaned.

C. The Origins of Quantum Vulnerabilities in Bitcoin

Bitcoin’s quantum vulnerabilities arise from several ways public keys become exposed, with exposure determining whether attacks can occur only during spending or also against stored balances. Key reuse and exposed-key script types substantially broaden the affected asset base, while migration to PQC remains the long-term remedy.

  • Exposure categories: Bitcoin quantum attacks depend on public-key exposure through locking or unlocking scripts, the mempool, or offchain practices.These exposure routes determine when an attacker can attempt to derive the corresponding private key.
  • Exposure categories: Onchain and offchain exposure enable both on-spend and at-rest attacks, whereas public-mempool exposure enables only on-spend attacks.Slow-clock quantum computers can exploit onchain and offchain exposure because those attacks do not depend on the short confirmation window.
  • Script and address effects: P2TR creates immediate onchain exposure by recording a public key, while a previously unused hashed address avoids that exposure until the key is disclosed.Address reuse defeats the protection normally provided by the hash because an earlier transaction reveals the public key.
  • Script and address effects: Every existing Bitcoin transaction type remains vulnerable to on-spend attacks by a future fast-clock CRQC, while P2PK and P2TR balances also face at-rest attacks from slow-clock CRQCs.Table I identifies approximately 1.7 million BTC in Satoshi-era P2PK mining rewards and modern P2TR activity as especially exposed categories.
  • Mitigation and limits: Reducing address reuse offers limited protection for security-conscious users, but migrating transaction signing to PQC is described as Bitcoin’s only real long-term remedy.Operational mitigations can reduce exposure without resolving the underlying vulnerability of ECDLP-based signatures.
  • Mitigation and limits: Hierarchical deterministic wallets simplify generating new keys and addresses, but shared extended public keys and centralized repositories can aggravate quantum vulnerabilities.The broader ecosystem often relies on sharing and reusing ECDLP-based public keys for business and monitoring purposes.
  • Scale of exposure: Approximately 6.7 million BTC are held in vulnerable addresses, including large exposed balances from early P2PK mining rewards and reused keys.Public-key reuse makes otherwise hashed script types vulnerable once their keys have appeared in prior spending transactions.

D. The Infeasibility of Quantum Attacks on Proof-of-Work

The paper argues that Grover-based quantum attacks on Bitcoin’s Proof-of-Work mining are not practically relevant because error-correction overhead and poor parallelization outweigh the algorithm’s speedup. It distinguishes this mining threat from quantum vulnerabilities affecting other cryptographic protocols and transaction mechanisms.

  • Quantum mining: Grover-based attacks on Bitcoin mining are not practically relevant because error-correction overhead consumes the quadratic speedup and the algorithm parallelizes poorly.The paper says hardware acceleration and massive parallelization give classical Bitcoin mining a much greater advantage.
  • Quantum mining: 0.25 TH/s is the estimated quantum mining hashrate under a fantastical 1 microsecond error-correction cycle, versus 110 ± 3% TH/s for an S19 Pro ASIC.Under realistic assumptions, the quantum miner’s hashrate falls by over 10 orders of magnitude.
  • Scope boundary: Future architectures with very fast error-correction cycles could make Grover speedup relevant to Proof-of-Work mining, although the paper currently characterizes quantum mining as science fiction.The authors emphasize that long-term quantum-hardware development is difficult to predict.
  • Indirect effects: CRQCs pose no direct threat to Bitcoin mining, but transaction attacks could indirectly make mining unprofitable by rapidly reducing cryptocurrency value before difficulty adjusts.The paper identifies possible mining-pool capacity reductions as a consequence.
  • Other cryptographic protocols: Quantum attacks remain relevant to ECDLP-based signatures, key exchange, commitments, ZK protocols, and SNARK-based systems despite mining’s infeasibility.The supplied passages describe risks including shared-secret recovery, privacy loss, forged coins, forged validity proofs, and compromised rollups.

V. QUANTUM VULNERABILITIES OF THE ETHEREUM BLOCKCHAIN

Ethereum’s programmable, persistent-account architecture creates a broader quantum vulnerability profile than Bitcoin’s transaction-focused ledger. Early fast-clock CRQCs are unlikely to attack Ethereum transactions while they are being spent, but at-rest risks affect accounts, smart contracts, consensus, and data availability.

  • Economic scope: Over 600 billion USD is Ethereum’s estimated aggregate economy when native ether, stablecoins, tokenized RWAs, and Layer 2 assets are included.The paper contrasts this Total Value Secured measure with Ethereum’s approximately 400 billion USD ETH market capitalization as of February 2026.
  • Architecture: Ethereum’s smart-contract platform executes financial, semi-financial, and non-financial applications rather than merely recording balances.Persistent code and state extend the value exposed to Ethereum’s security model beyond native ETH.
  • On-spend exposure: Early fast-clock CRQCs are unlikely to launch on-spend attacks against Ethereum because blocks use deterministic 12-second slots and most transactions process in less than a minute.Private mempools, including TEE-based BuilderNet, provide an additional transaction-submission feature discussed by the paper.
  • Vulnerability taxonomy: Ethereum’s architecture produces five quantum vulnerabilities: Account, Admin, Code, Consensus, and Data Availability Vulnerability.The account model uses quantum-vulnerable ECDSA, while validator and data-availability cryptography rely on BLS signatures and KZG commitments.
  • Account vulnerability: Once an Ethereum account transacts, its public key remains exposed indefinitely, making account vulnerability systemic and not mitigated by ordinary address rotation.Replacing the key pair requires abandoning the account entirely.
  • Mitigation: Account Abstraction via ERC-4337 decouples identity from a single static key, enabling more frequent key rotation and easing migration of legacy accounts to PQC.EIP-7702 subsequently expanded these capabilities by allowing EOAs to temporarily function as smart-contract accounts.

B. Admin Vulnerability

Ethereum smart contracts expose administrative control points whose rarely rotated keys can become high-value at-rest targets for quantum attackers. These privileges can affect contract execution, bridges, oracles, guardians, and tokenized real-world assets, making aggregate exposure difficult to quantify.

  • Exposure: At least 70 of the top 500 contract accounts, holding about 2.5 million ETH, are exposed to quantum takeover through Admin Vulnerability.The paper estimates private-key derivation for these accounts using a fast-clock CRQC would take less than 15 hours.
  • Definition: Admin Vulnerability arises when smart contracts grant privileged keys powers to pause execution, upgrade code, or extract funds.Administrative keys are rarely rotated and are often publicly used for governance voting or contract upgrades.
  • Real World Assets: Compromised RWA administrative keys could authorize fraudulent token minting or burning and collapse the peg to offchain collateral.Figure 10 concerns distributed onchain tokens and excludes the underlying offchain assets.
  • Bridges: Compromised bridge administrators could drain the liquidity backing wrapped cross-chain assets, making admin failure more catastrophic than ordinary protocol failure for L2 scaling solutions.Bridge administrators manage multisignature schemes that lock assets on one blockchain and mint equivalents on another.
  • Oracles: Hijacked oracle keys could broadcast false price data, triggering automated liquidations across decentralized lending protocols.Oracle nodes provide authoritative feeds such as ETH/USD prices to smart contracts.
  • Privileged accounts: Guardians can pause execution, freeze user funds, or bypass security timelocks to inject code updates, making low-ETH privileged accounts high-leverage targets.The paper notes that second-order risks from bridges, oracles, and guardians complicate aggregate exposure estimates.
  • Aggregate exposure: ∼200 billion USD in stablecoins and tokenized RWAs is tied to admin-vulnerable contracts, while second-order exposure remains difficult to quantify.The estimate is described as first-order exposure alongside 2.5 million ETH held by admin-vulnerable contracts.

C. Code Vulnerability

Ethereum’s smart-contract ecosystem has quantum vulnerabilities in both administrative control and EVM cryptographic code, with Proof-of-Stake adding consensus-layer exposure. These risks affect substantial assets but remain partly mitigated by centralized safeguards and proposed key upgrades.

  • Code Vulnerability: No EVM precompiles currently implement modern post-quantum cryptographic primitives, creating a Code Vulnerability in smart-contract execution.The missing support affects protocols such as post-quantum signatures and zero-knowledge arguments.
  • Code Vulnerability: At least 15 million ETH is exposed through major quantum-vulnerable Layer 2 protocols and cross-chain bridges.Stage 0 and Stage 1 administrative councils can sometimes pause bridges or override proof verification, providing temporary mitigation.
  • Consensus Vulnerability: BLS12-381 signature aggregation makes Ethereum’s consensus layer at-rest vulnerable to the same first-generation CRQCs as accounts and smart contracts.The additional quantum memory cost for BLS12-381 is estimated to be modest relative to secp256k1.
  • Consensus Vulnerability: More than one third of compromised validators can halt finality, while more than two thirds can finalize inconsistent chains.Intermediate thresholds also enable equivocation, chain-growth disruption, or deep reorganizations.
  • Consensus Vulnerability: 37 million ETH is staked and exposed to slashing and ejection from quantum attacks against Ethereum’s consensus layer.Liquid-staking integration could amplify large slashing events through peg collapses and cascading DeFi liquidations.
  • Consensus Vulnerability: A phased transition to post-quantum validator credentials and faster key rotation is proposed as the long-term remedy.Candidate hash-based replacements for BLS12-381 are under study, while rapid rotation is presented as a stopgap.

E. Data Availability Vulnerability

Ethereum’s Data Availability Sampling relies on the quantum-vulnerable KZG commitment scheme over BLS12-381. Recovering its trusted-setup secret could enable persistent proof forgery and disrupt Layer 2 data availability, motivating migration to post-quantum commitments.

  • Data Availability Vulnerability: DAS uses KZG polynomial commitments on BLS12-381 to authenticate blob cells.The scheme supports inexpensive transient onchain storage for Layer 2 data.
  • Data Availability Vulnerability: Quantum attackers could forge cell authentication proofs and deceive validators into accepting unreconstructable blobs.The resulting data-availability failure can stall rollups and create ransom opportunities.
  • Data Availability Vulnerability: A single recovered KZG toxic-waste scalar creates a persistent universal backdoor for low-cost proof forgery.The scalar can be derived from publicly available SRS points using a CRQC, eliminating the need for repeated quantum computation.
  • Data Availability Vulnerability: Most modern Layer 2 data volume depends on KZG, so withholding batch data could halt L2 sequencers and validators.The ecosystem shifted toward this lower-cost architecture after the March 2024 Dencun upgrade.
  • Mitigation: Mitigation requires replacing DAS commitments with post-quantum alternatives such as hash-based polynomial commitments and Merkle-tree architectures.These alternatives are expected to impose higher bandwidth and storage overhead.

B. Privacy-Preserving Blockchains

Privacy-preserving blockchains combine quantum-vulnerable cryptographic primitives with distinct risks to asset integrity, confidentiality, and historical privacy. The surveyed ecosystems show both deployed PQC progress and design trade-offs that leave some protections incomplete.

  • Litecoin Mimblewimble: Litecoin’s Mimblewimble design rejected post-quantum zkSTARKs because of high resource costs.The adopted ElGamal-commitment option protects monetary binding but sacrifices privacy under quantum attack.
  • Litecoin Mimblewimble: Quantum attacks on ElGamal commitments can reveal transaction amounts without enabling coin theft or creation.The hiding property is vulnerable, while the binding property remains quantum-resistant.
  • Zcash: Zcash Sapling’s trusted setup leaves a recoverable toxic-waste secret that could enable stealth monetary inflation.A CRQC could extract the secret from the SRS and create a persistent tradable exploit.
  • Zcash: Zcash’s ECDH-derived encryption keys can be recovered by quantum attackers who know the target diversified address.This permits decryption of encrypted notes despite the use of quantum-resistant symmetric encryption.
  • Zcash: Turnstile provides a final defense against supply inflation by tracking monetary supply across Zcash shielded pools.Assets moving between shielded pools must pass through the transparent pool.
  • Post-Quantum Progress: PQC deployment is progressing through QRL’s XMSS foundation, planned ML-DSA support, and experimental deployments on Solana and the XRP Ledger.These examples show both post-quantum-by-design and retrofit approaches.

E. A Taxonomy of Quantum Risk Profiles for Distributed Ledgers

The paper classifies distributed ledgers by how their architectures expose assets and cryptographic state to quantum attacks. Migration is necessary but constrained by immature schemes, larger resource demands, operational bottlenecks, and persistent abandoned assets.

  • Risk Taxonomy: The taxonomy separates post-quantum blockchains, avoidable public-key exposure, inevitable long-term exposure, and quantum-vulnerable privacy-preserving ledgers.The categories distinguish architectural exposure and the type of quantum harm faced.
  • Risk Taxonomy: UTXO-based ledgers can hide ephemeral public keys behind hashes, allowing users to avoid long-term exposure in some cases.Bitcoin, Litecoin, Dogecoin, and Cardano are placed in this category.
  • Risk Taxonomy: Persistent-account blockchains make long-term exposure of quantum-vulnerable public keys inevitable.Examples include Ethereum, Solana, Rootstock, Algorand, TRON, and the XRP Ledger.
  • Risk Taxonomy: Privacy-preserving ledgers face retroactive privacy degradation in addition to forward-looking theft and supply-inflation threats.CRQCs could potentially deanonymize historical confidential transactions for known addresses.
  • Migration: Upgrading ECDLP-based schemes to post-quantum alternatives is the only durable long-term solution identified for these vulnerabilities.Migration may use aggregation, L2 amortization, or succinct post-quantum proofs to reduce resource costs.
  • Migration Challenges: PQC schemes and implementations remain less scrutinized, may introduce new weaknesses, and generally impose larger signature and resource requirements.Composite signatures increase performance costs further, while fixed Bitcoin block sizes would reduce transaction throughput.
  • Migration: Bitcoin asset migration could take several months at the current transaction rate even if transactions were dedicated solely to migration.This motivates beginning migration years before the quantum threat emerges.
  • Migration Challenges: Even after migration, abandoned assets such as Bitcoin’s P2PK coins remain quantum-vulnerable at rest.Most of the 1.7 million bitcoin in these scripts have not moved since 2009.

VIII. DORMANT DIGITAL ASSETS

Dormant quantum-vulnerable assets cannot migrate through ordinary upgrades, creating disputes over whether they should remain spendable, be destroyed, or be recovered under controlled rules. The section compares Bitcoin policy options and highlights unresolved consensus and economic risks.

  • The challenge posed by dormant assets: Dormant assets may remain vulnerable because owners lose keys or fail to migrate before CRQCs arrive.The problem includes abandoned wallets and long-tail migration failures.
  • The challenge posed by dormant assets: 2.3 million BTC is the estimated vulnerable balance among the plotted dormant addresses.Figure 13 covers the top 100,000 vulnerable addresses that have not initiated a spend in five years.
  • Do Nothing, Burn, and Hourglass: Do Nothing preserves property rights and supply limits but permits quantum acquisition and may create price volatility.The proposal leaves the protocol unchanged while dormant coins return to circulation.
  • Do Nothing, Burn, and Hourglass: Burn makes dormant assets unspendable after a deadline, while Hourglass limits their spending rate.Both approaches require protocol changes and broad community agreement.
  • Quantum salvage: A single fast-clock quantum computer is modeled to derive keys in 9 minutes, whereas slow-clock architectures require approximately 14 hours to 12 days per derivation.The modeled salvage operation targets exposed P2PK public keys in decreasing order of locked value.
  • Governance and consensus: Consensus remains elusive because property-rights concerns, supply-shock fears, and mining incentives produce divergent preferences among stakeholders.An informal 2025 poll found roughly equal support for Do Nothing, Burn, and Hourglass.
  • Policy response: Governments may legalize salvage while the Bitcoin community considers burning dormant coins to limit adverse economic effects.The two positions address different legal and protocol consequences and are not mutually exclusive.

2. Bad Sidechain

The proposed Bad Sidechain would route quantum-recovered dormant assets through a separate resolution system that verifies ownership before returning funds. It offers a recovery mechanism, but unresolved political, technical, and governance barriers limit confidence in complete protection.

  • Bad Sidechain: A recovery sidechain could accept CRQC-recovered assets, verify ownership using offchain proofs, and return assets to the Bitcoin network.Bitcoin itself does not accept these ownership proofs, motivating a dedicated resolution environment.
  • Bad Sidechain: The sidechain could use a more centralized consortium to approve proof mechanisms, fees, burn schedules, pegs, and return rates.Greater centralization is proposed to expedite recovery compared with Bitcoin’s governance model.
  • Bad Sidechain: Multiple recovery sidechains could compete for recovered assets while bearing legal-return risks and charging owners fees.The proposal envisions a market ecosystem rather than one mandatory recovery operator.
  • Limits of mitigation: Protecting ongoing onchain activity may be achievable before CRQCs, but preserving retroactive privacy on Zcash and Monero cannot be fully achieved.Known ECDLP-protected addresses remain exposed to retrospective privacy degradation.
  • Limits of mitigation: Preventing rogue actors from acquiring dormant assets is unlikely to be fully achieved by cryptocurrency communities alone.Do Nothing and Hourglass explicitly permit acquisition, while Burn may only partially address unmigrated assets.
  • Policy constraints: Legally destroying dormant assets is difficult because rewriting historical blocks would require re-mining more than a decade of Bitcoin history.The paper treats mandated destruction as technically challenging and likely ineffective.
  • Policy constraints: Transaction censorship can delay spending but cannot reliably prevent settlement because foreign miners may include the transactions.Effective enforcement would require domestic miners to reject valid blocks mined elsewhere.
  • Policy constraints: Sustained censorship would require broad international coordination, yet mobile mining incentives and conflicting national interests create major barriers.The paper characterizes the resulting cooperation problem as a multi-party Prisoner’s Dilemma.

2. Digital Salvage

Digital salvage treats dormant quantum-vulnerable assets as a legal and governance problem in addition to a cryptographic one. The paper surveys regulated recovery, national-security action, and community engagement while emphasizing unresolved ownership and migration risks.

  • Why digital salvage matters: A CRQC can derive a private key from a public key, undermining the private-key basis of cryptocurrency ownership.This creates the central legal and practical problem for dormant assets.
  • Regulated digital salvage: Regulated digital salvage would treat dormant assets as abandoned property using analogies such as escheatment, treasure trove, adverse possession, and maritime salvage.These frameworks provide possible design precedents rather than a complete solution.
  • Regulated digital salvage: The Revised Uniform Unclaimed Property Act offers a possible blueprint for examining and transferring custody of unclaimed virtual currency.Its applicability is presented as a concrete policy reference in the United States.
  • Regulated digital salvage: Existing unclaimed-property laws do not directly solve Bitcoin’s dormant-asset problem because no blockchain participant clearly qualifies as the legal holder.The mismatch concerns possession and control of the coins.
  • National-security response: Governments could treat dormant assets as a national-security risk and acquire or burn them, while relying on prolonged owner inaction in legal arguments.The paper identifies this as one possible response to rogue quantum actors.
  • Community engagement: Community-government dialogue could favor consensus-based technical solutions over forceful intervention.Bitcoin’s cypherpunk origins and preference for autonomy shape this policy option.
  • Urgency: Fewer than half a million physical qubits are estimated to suffice for breaking 256-bit ECDLP on a superconducting architecture.The estimate motivates convergence between quantum-computing and cryptocurrency communities.
  • Urgency: Dormant assets cannot migrate through standard software updates, making them a fixed target as quantum capabilities mature.The paper identifies legacy Bitcoin holdings and address-reuse exposure as urgent cases.

Appendix A: Appendix: Zero-Knowledge Proof of Resource Costs

The appendix uses zero-knowledge proofs to substantiate resource claims for secp256k1 point-addition circuits without revealing the underlying attack circuits. It records two committed circuit variants and their tested resource bounds.

  • Proof construction: A Groth16 SNARK generated with the SP1 zkVM proves possession of a quantum circuit implementing secp256k1 point addition without disclosing improved logical circuits.The proof evaluates deterministic pseudo-random inputs derived from the circuit hash.
  • Low-qubit variant: 1,175 logical qubits is the stated bound for the low-qubit circuit variant.The circuit is tested across 9,024 pseudo-random inputs.
  • Low-qubit variant: 2,700,000 non-Clifford gates is the stated bound for the low-qubit circuit variant.The gate count is reported for CCX and CCZ gates.
  • Low-gate variant: 2,100,000 non-Clifford gates is the stated bound for the low-gate circuit variant.The variant also reports 17,000,000 total operations.
  • Low-gate variant: The low-gate circuit also correctly computes secp256k1 point addition across 9,024 deterministic pseudo-random inputs.The inputs are derived from the circuit’s own cryptographic hash.

3. Circuit Architecture and Approximate Correctness

The circuit architecture uses windowed elliptic-curve point additions to construct the 256-bit ECDLP algorithm, with resource costs determined by the point-addition circuit and window size. The analysis reports an optimal window size of w = 16 and distinguishes average executed Toffoli counts from nominal gate descriptions.

  • The reported Toffoli count is an average over 9024 evaluated test cases because classically conditioned gates may or may not execute.
  • The 256-bit ECDLP algorithm performs windowed point additions, each built from elliptic-curve point additions and three table lookups.
  • The total Toffoli count combines the point-addition cost, the window size, and the overhead of merging windowed additions.
  • Qubit cost is reduced by recycling a single w-length phase register instead of maintaining two full phase-estimation registers.
  • w = 16 is the optimal window size given the costs of the point-addition circuit.

4. Measurement Based Uncomputation and Kickmix Circuits

Measurement-based uncomputation clears intermediate ancillas more cheaply than reversing the full computation, while kickmix circuits restrict the gate set to classically simulable operations. Approximate correctness is established through randomized testing and publicly verifiable zero-knowledge attestation, with a caveat that the Groth16 proof is quantum-vulnerable in principle.

  • Measurement Based Uncomputation: Measurement-based uncomputation replaces full inverse-circuit cleanup with Pauli-X-basis measurement and conditional phase correction.
  • Kickmix Circuits: Kickmix circuits use classical reversible gates, measurement-based uncomputation, and diagonal phasing gates, making them efficiently classically simulable.
  • Approximate Correctness: 9024 Fiat-Shamir-selected random tests support 128 bits of cryptographic security for circuits that are correct on at least 99% of inputs.
  • Cryptographic Attestation: The SP1 zkVM publicly verifies the testing procedure and resource bounds without publishing the underlying circuit.
  • Cryptographic Attestation: Groth16 soundness is vulnerable to sufficiently large fault-tolerant quantum computers, although no such computers currently exist.
Loading 2603.28846v2…