Crypto Quantum Risk Assessment: How to Audit Your Portfolio and Protocol

What Is a Crypto Quantum Risk Assessment?

A crypto quantum risk assessment is a structured audit of how vulnerable your cryptocurrency holdings and protocols are to a cryptographically relevant quantum computer. It is not a theoretical exercise. NIST finalised post-quantum standards in 2024. NSA's CNSA 2.0 requires national security systems to complete quantum-safe migration by 2033. Google and IBM have both named 2029 as a meaningful planning horizon. The question for cryptocurrency holders and protocol developers is not whether to assess quantum risk but how systematically to do it.

The assessment covers five dimensions: the signature algorithm your chain uses, how much of your public key history is already on-chain, whether your chain has a credible post-quantum migration path, whether your custody infrastructure can support quantum-safe keys, and how your time horizon compares to realistic Q-Day estimates. Each dimension has a concrete score and a concrete action.

Dimension 1: Signature Algorithm Risk

The signature algorithm is the primary determinant of quantum exposure. All chains that use ECDSA or Schnorr signatures over secp256k1 share the same vulnerability: Shor's algorithm can derive the private key from the public key in polynomial time on a sufficiently powerful quantum computer. The chains this covers include Bitcoin, Ethereum, and virtually every EVM-compatible chain.

Chains using Ed25519 (Solana, Cardano, Algorand, Monero) use a different elliptic curve but face the same mathematical vulnerability through a different instance of the discrete logarithm problem. The quantum threat to Ed25519 is the same as to secp256k1 at comparable qubit counts. Chains using hash-based signatures (QRL uses XMSS) or purpose-built post-quantum signature schemes from genesis have no exposure at the signature layer.

Dimension 2: Public Key Exposure History

Knowing that a chain is algorithmically vulnerable is only the first step. The second step is assessing how much of your specific address history has been exposed. In Bitcoin's UTXO model, public keys are revealed only when an output is spent. An address that has only ever received funds has never published its public key to the blockchain. A quantum adversary cannot derive the private key without the public key, so unspent, never-spent addresses have meaningful protection today.

The exposure categories for Bitcoin addresses are:

• P2PK (Pay-to-Public-Key): Raw public key embedded in the UTXO scriptPubKey. Quantum-exposed unconditionally, even without a single spend.
• P2PKH/P2WPKH, spent at least once: Public key revealed on first spend. Quantum-exposed from that point forward.
• P2PKH/P2WPKH, never spent: Public key not yet on-chain. Lowest exposure, but key is revealed the moment you spend.

For Ethereum, the situation is more uniform: the first outbound transaction from any account publishes the public key in the transaction signature. Nearly every active Ethereum account is quantum-exposed. The only exceptions are accounts that have received ETH but never signed any outbound transaction, including most CEX-controlled addresses (where the exchange holds the key).

Dimension 3: Chain Migration Readiness

Even if your holdings are currently unexposed, a future spend will expose the key. The question is whether your chain will have a post-quantum migration path in place before Q-Day. This is the migration readiness dimension of the assessment.

Bitcoin's migration readiness is low. BIP-360 (P2QRH, Pay-to-Quantum-Resistant-Hash) proposes a Taproot-compatible post-quantum address type using ML-DSA or SPHINCS+ signatures, but as of September 2026 it is a proposal with no activation timeline. Bitcoin's governance process is slow by design. A soft fork enabling quantum-resistant addresses requires broad miner and node operator consensus, and no such consensus is forming yet.

Ethereum's migration readiness is higher. EIP-7560 (Native Account Abstraction) provides a technical path for users to migrate from externally owned accounts to smart contract accounts with custom signature verification. This would allow ML-DSA or SPHINCS+ signatures at the account layer. The EIP is in development, but the migration is not automatic: users would need to consciously move their assets to new smart contract accounts with quantum-safe signing logic.

Chains built with post-quantum algorithms from genesis have no migration problem. The assessment score for these chains on this dimension is zero: there is nothing to migrate.

Dimension 4: Custody Infrastructure

Custody infrastructure is the overlooked dimension of quantum risk assessment. Even if a chain supports post-quantum signatures, your ability to use them depends on whether your wallet, hardware security module, or custody provider can generate and store ML-DSA keys and sign transactions with them.

As of September 2026, no major consumer hardware wallet (Ledger, Trezor) supports ML-DSA key generation or transaction signing. Enterprise HSMs from Thales and Entrust have added ML-DSA in recent firmware, but integration with blockchain signing workflows requires custom development. Most custody providers and exchanges hold customer assets in ECDSA-signed accounts with no post-quantum upgrade timeline.

The custody infrastructure gap means that even users who want to migrate to post-quantum addresses on chains that support them may not be able to do so with their current hardware. This is a concrete, near-term risk factor that belongs in every quantum risk assessment.

Dimension 5: Time Horizon vs Q-Day Estimates

The final dimension is time. A quantum risk assessment that ignores timeline estimates is incomplete. If Q-Day is realistically 15 years away, the urgency calculation differs from a 5-year horizon. The current credible institutional estimates range from 2029 (Google's internal planning horizon) to 2033 (NSA CNSA 2.0 compliance deadline for national security systems). The QLDPC research revision has compressed the physical qubit requirement from ~13 million to approximately 800,000, tightening the hardware gap meaningfully.

For a holder with a 10-year time horizon, quantum risk is a medium-term planning concern. For an institution holding long-dated assets or classified data, it is an immediate compliance concern. The harvest-now-decrypt-later threat means that adversaries who are recording blockchain transactions today may be able to decrypt private keys retroactively once a CRQC becomes available, making the time horizon for sensitive addresses shorter than the estimated Q-Day date.

Q-Day Quantum Threat: Putting the Bitcoin Risk in Context

The q-day quantum threat to Bitcoin is often described in catastrophic terms. A more structured assessment finds that the risk is real but differentiated. Approximately 1.7 million BTC in P2PK outputs are quantum-exposed right now, regardless of any future action. A further estimated 3.3 million BTC in addresses that have signed at least one transaction are exposed to a harvest-and-wait attack. The remaining supply sits in addresses whose public keys have not yet been published, with degrees of protection that depend on custody practices and migration readiness when they next need to spend.

For individual holders, the Q-Day risk to their specific holdings depends on their address types and spending history, not on aggregate Bitcoin statistics. Running a personal assessment against the five dimensions above gives a more useful picture than aggregate market statistics.

Frequently Asked Questions

How do I assess my Bitcoin quantum risk specifically?

Check each Bitcoin address you hold using a block explorer. If an address has no outbound transactions, its public key is not yet on-chain and it is not currently quantum-exposed. If it has any outbound transaction, its public key was published at that point. P2PK addresses (identifiable by their 65-byte uncompressed or 33-byte compressed public key in the scriptPubKey) are exposed regardless of spending history.

Is Ethereum more quantum-exposed than Bitcoin?

Yes, for most active accounts. Ethereum's account model means the public key is published on the first outbound transaction. Nearly every account that has ever sent ETH, interacted with a DeFi protocol, or minted an NFT has a published public key. Bitcoin's UTXO model allows unspent addresses to keep their public keys private indefinitely.

What should institutional crypto holders do right now?

Run the five-dimension assessment above and document the results. Prioritise: (1) identify any P2PK Bitcoin holdings and consider moving them to fresh P2WPKH addresses; (2) assess your custody provider's post-quantum roadmap; (3) identify your chain migration readiness scores; (4) build a timeline comparison against the 2029–2033 institutional planning horizon. Then engage your security team and legal counsel on whether CNSA 2.0 or similar standards create compliance obligations for your organisation.

Does holding crypto on a CEX reduce quantum risk?

It transfers the risk to the exchange. The exchange holds your private keys in their custody infrastructure, which almost certainly uses ECDSA. If the exchange's signing infrastructure is not upgraded to quantum-safe algorithms before Q-Day, your assets are as exposed as self-custodied ECDSA holdings. The advantage is that the exchange may have more resources to upgrade faster than individual users. The risk is that you cannot verify their migration timeline independently.

What is the fastest action I can take to reduce quantum exposure today?

For Bitcoin: consolidate funds from any address that has signed a transaction into a fresh, never-spent P2WPKH address in a single transaction, then do not spend from that address until Bitcoin has a deployed post-quantum address type. For Ethereum: there is no comparable action available on the base layer today; the best current option is monitoring EIP-7560 development and considering chains with native post-quantum support for new holdings.