Hadamard Get the app

Can Quantum Computers Break Ethereum? Risks, Qubits and the 2029 Plan

Can Quantum Computers Break Ethereum? Risks, Qubits and the 2029 Plan — Hadamard

Can quantum computers break Ethereum? Not today. No existing machine can run the attack, but the elliptic-curve signatures that protect Ethereum accounts and validators would fall to a large, fault-tolerant quantum computer running Shor’s algorithm. Google’s March 2026 resource estimates cut the hardware requirement roughly 20-fold, and the Ethereum Foundation now targets full post-quantum protection by 2029.

This article separates established facts from estimates. It covers which cryptography is vulnerable, how much ETH is exposed, what the latest qubit counts say, and what Ethereum and its users can do in the meantime.

Can quantum computers break Ethereum? Which cryptography is at risk

Ethereum relies on several cryptographic systems, and they are not equally vulnerable. Shor’s algorithm solves the elliptic-curve discrete logarithm problem efficiently on a fault-tolerant quantum computer. That breaks every scheme whose security rests on that problem:

  • Account signatures. Every ordinary transaction is signed with ECDSA over the secp256k1 curve.
  • Validator signatures. Proof-of-stake validators sign with BLS signatures over BLS12-381. According to a PostQuantum.com threat overview, these secure about 36M ETH across roughly 1.1M validators.
  • The data-availability setup. Google’s whitepaper lists the one-time setup behind Ethereum’s data-availability commitments as a separate attack path. That setup relies on elliptic-curve pairings.
  • Application ZK proofs. Proof systems built on elliptic-curve pairings inherit the same weakness. Hash-based STARKs do not.

The table below summarizes the status of each scheme, following LambdaClass’s overview of Ethereum signature schemes.

Scheme Where Ethereum uses it Quantum status
ECDSA (secp256k1) User accounts Broken in polynomial time by Shor
BLS (BLS12-381) Validators Not quantum-safe
Hash-based (Winternitz, XMSS, leanSig) Proposed for validators and accounts Secure as long as the hash function is
Keccak-256 hashing Addresses, state Weakened by Grover, not broken

Why hashes are a different story

Ethereum derives an address from a Keccak-256 hash of the public key. Some older articles claim Ethereum relies on SHA-256. It does not. Hash functions face Grover’s algorithm, not Shor’s, and Grover offers at most a quadratic speedup on brute-force search. We cover the details in our explainer on whether quantum computers can break SHA-256. In short, hashes are weakened rather than broken. That is why hash-based signatures are central to Ethereum’s migration plan.

Exposed public keys on Ethereum: what’s actually at risk

Because an address is a hash of the public key, an account that has never sent a transaction keeps its public key hidden. Once an account signs anything, its public key can be recovered from the signature using ecrecover. Every account that has ever sent a transaction effectively has its public key on record.

A June 2026 preprint, “Quantum Horizon”, estimates that 50–65% of all ETH (about 61–79M ETH) sits in accounts with revealed public keys. It calls 55–60% the most defensible figure. The paper also cites a 2021 Deloitte measurement of “over 65%”. It is not peer-reviewed, so treat the range as an estimate. The same paper describes the “harvest now, attack later” problem: exposed keys can be collected today and attacked once a capable machine exists.

Google’s whitepaper, as reported by CoinDesk, names at least five Ethereum attack paths: wallets, smart contracts, staking, layer 2s and the data-availability setup. It puts combined exposure above $100B. Among its specific figures:

  • The top 1,000 wallets hold about 20.5M ETH with exposed public keys.
  • At least 70 major contracts have exposed admin keys controlling about 2.5M ETH.
  • Some of those admin keys control minting for stablecoins such as USDT and USDC.

Two structural problems make this harder. First, legacy Ethereum accounts have no built-in way to rotate keys. Second, PostQuantum.com estimates that stablecoins and tokenized assets worth over $200B sit behind admin keys already exposed on-chain. Dormant and lost accounts are the hardest case, because nobody is around to migrate them.

How many qubits it takes, and when that could exist

In March 2026, Google Quantum AI, the Ethereum Foundation and Stanford published updated resource estimates for breaking secp256k1. They describe two circuits:

  • About 1,200 logical qubits and 90M Toffoli gates
  • About 1,450 logical qubits and 70M Toffoli gates

On superconducting hardware with a 10-3 physical error rate and surface-code error correction, either circuit needs fewer than 500,000 physical qubits. Google published a zero-knowledge proof that the circuits exist rather than the circuits themselves, as explained in its cryptocurrency whitepaper.

Safeheron’s analysis describes this as about a 20x reduction from the previous best estimates. It also notes that the paper does not show machines able to run the attack are close. The widely shared “nine minutes per key” figure assumes the first phase of the computation has already been precomputed, PostQuantum.com notes. It is not an end-to-end runtime from scratch.

RSA estimates follow the same trend. In 2019, Craig Gidney estimated that factoring RSA-2048 would take 20M noisy qubits and about 8 hours. In his May 2025 paper, he put it at fewer than 1M noisy qubits in under a week. Algorithmic improvements keep lowering the bar, a pattern The Quantum Insider tracked across several 2026 papers.

Realistic timelines

We could not verify a reliable like-for-like figure for today’s largest machines, so we do not quote one. The target is clear from the estimates: hundreds of thousands of physical qubits, running error-corrected for an extended computation.

For forecasts, Vitalik Buterin has cited Metaculus at about a 20% chance of a cryptographically relevant quantum computer before 2030, with a median closer to 2040. This was reported by Cryptonews, a secondary source. Governments are working to similar horizons for classical public-key cryptography, as our article on NIST IR 8547’s deprecation deadlines explains.

Ethereum’s quantum resistance roadmap

A dedicated post-quantum team

On 23 January 2026, the Ethereum Foundation formed a dedicated post-quantum team. It is led by Thomas Coratger and joined by Emile from leanVM, and Justin Drake made the announcement, CoinDesk reported. The plan includes $2M in research prizes, live post-quantum devnets, and a biweekly breakout call on post-quantum transactions inside the All Core Developers process, according to The Quantum Insider.

Lean Ethereum and the 2029 target

Ethereum.org’s quantum-resistance page says the Lean Ethereum roadmap targets 2029 for full post-quantum protection. The page lists:

  • Weekly interop devnets with more than 10 client teams
  • A $1M Poseidon Prize for hash-based primitives
  • Open-source leanXMSS, leanVM, leanSpec, leanSig and leanMultisig
  • A foundation in the post-quantum standards NIST finalized in August 2024: ML-KEM, ML-DSA and SLH-DSA
  • A “PQ key registry” as the first milestone

2029 is a target, not a scheduled fork. A KuCoin News summary of Vitalik’s August 2026 “Strawmap” says it mentions leanSPHINCS and STARKs for quantum resistance, and notes that no activation forks are confirmed.

EIP-8141: choose your own signature scheme

EIP-8141 brings native account abstraction, so each account can define its own signature check. With it, an account could switch to quantum-safe signatures without waiting for a network-wide migration. Ethereum.org says it is being considered for the Hegotá upgrade.

Hash-based signatures for validators and accounts

On the consensus side, validators would sign with hash-based leanXMSS signatures, and leanVM would aggregate them. A Winternitz signature is a one-time signature built only from hash chains. XMSS arranges many one-time keys under a Merkle tree, so one public key can sign many messages. leanSig builds on XMSS and Winternitz, is designed to be SNARK-friendly, and has an 8-year key lifetime.

The trade-off is size. A 2026 preprint puts individual validator signatures at about 2–5 KB and aggregated certificates at tens of KB. That is far larger than BLS, which is why aggregation with STARK-style proofs matters.

Plan B: the emergency recovery fork

If a capable quantum computer arrived before the migration, Vitalik outlined a fallback in March 2024: “How to hard-fork to save most users’ funds in a quantum emergency”. The steps are:

  1. Roll the chain back to the last block before large-scale theft.
  2. Freeze ordinary ECDSA-based transactions from vulnerable accounts.
  3. Add a new transaction type that uses STARK proofs to move existing wallets to new, quantum-safe validation code. The post mentions Winternitz signatures as one option.

Users would need new wallet software, but in his words “few users would lose their funds”, CryptoPotato summarized. Accounts that have never sent a transaction are already in a better position, because only their address is public.

What holders, developers and merchants can do now

Holders. No emergency action is needed today. Keep your seed phrase backed up and private, since any recovery path will likely depend on proving control of the original wallet. For long-term holdings, an address that has never sent a transaction keeps its public key hidden. Be skeptical of urgent “quantum migration” prompts; the legitimate path will arrive through client upgrades and mainstream wallet software.

Developers. Build for crypto agility. Avoid hard-coding ecrecover or ECDSA assumptions into contract logic, and give admin keys a documented rotation path. Follow EIP-8141 and the post-quantum breakout calls. Where you choose a proof system, note that hash-based STARKs avoid the elliptic-curve weakness.

Merchants and founders. Your exposure includes the assets you settle in. Stablecoin minting is controlled by admin keys, so ask issuers and payment providers about their post-quantum plans. Quantum key distribution is sometimes pitched as an answer here. It does not protect on-chain signatures, and even the NSA remains unconvinced, as covered in our article on the NSA’s QKD position.

For context on our own work: Hadamard builds BB84, a hash-based, ECDSA-free layer 2 rollup on Ethereum mainnet. Accounts are one-time addresses based on hash commitments rather than ECDSA keys, and the BB84 Wallet handles USDC and EURC payments. Technical details are in the developer docs.

FAQ

Is my ETH safe from quantum computers right now, and does it matter if my wallet has never sent a transaction?

Yes, it is safe today; no machine can run the attack. It does matter whether you have sent a transaction. An account that has never sent one exposes only a Keccak-256 hash of its public key. Any account that has signed a transaction has a recoverable public key, so it would be exposed once a capable machine exists.

How many qubits would it take to break an Ethereum private key, and how long would it take?

Google’s March 2026 estimates put it at about 1,200–1,450 logical qubits, or fewer than 500,000 physical qubits at a 10-3 error rate. The “nine minutes” figure assumes a precomputed first phase, so it is not a full runtime from scratch.

When will Ethereum be quantum-resistant, and will I have to move my funds?

Ethereum.org gives 2029 as the target for full post-quantum protection, though no activation forks are confirmed. With account abstraction via EIP-8141, accounts could switch signature schemes. Expect some form of migration through wallet software, but the exact process is not yet defined.

What happens to dormant or lost wallets if a quantum computer arrives before the migration?

Dormant accounts with exposed public keys would be the most vulnerable, because nobody can migrate them. Vitalik’s emergency plan would freeze vulnerable accounts and require a STARK-based proof to move funds. Owners who still hold their keys could recover, while truly lost wallets would stay frozen.

Sources