How much ETH is vulnerable to quantum attacks?

Approximately 40% of circulating ETH sits in externally owned accounts (EOAs) that have previously sent transactions, meaning their public keys are permanently recorded on-chain. This represents hundreds of billions of dollars in assets at risk from a quantum adversary capable of running Shor's algorithm against secp256k1.

Why is Ethereum more exposed than Bitcoin?

Ethereum uses an account model where the public key is revealed on the first outgoing transaction from any account. Bitcoin uses a UTXO model where the public key is only revealed when a UTXO is spent. Because most active Ethereum wallets have sent at least one transaction, the proportion of ETH with exposed public keys is higher than for BTC.

What is EIP-7560 and how does it help?

EIP-7560 proposes generalized account abstraction for Ethereum transactions, allowing individual accounts to define their own signature validation logic. This could enable accounts to use post-quantum signature schemes like ML-DSA instead of secp256k1 ECDSA. It requires a network upgrade and individual account migration rather than a protocol-level switch.

Can smart contract accounts be quantum-attacked directly?

Smart contract accounts do not hold secp256k1 keys directly. However, most contracts have privileged controller EOAs — owner addresses, admin keys, multi-sig participants, oracle signers. If those controlling EOAs have exposed public keys, the contracts they govern are indirectly quantum-vulnerable through the controlling key compromise.

What should ETH holders do about quantum risk now?

Individual holders with ETH in accounts that have previously sent transactions can move funds to a fresh unused account to remove the exposed public key exposure (noting that the new account becomes exposed on its first send). Institutions holding large positions should audit controlling key exposure and rotate to unexposed key sets where possible. Monitor Ethereum's EIP-7560 progress for the network-level solution.

Ethereum's Quantum Vulnerability: How Many Wallets Are at Risk?

Ethereum Uses the Same Vulnerable Cryptography as Bitcoin

Like Bitcoin, Ethereum uses the secp256k1 elliptic curve for its signature scheme. Where Bitcoin uses ECDSA, Ethereum uses ECDSA on the same curve. Shor's algorithm can break both in equivalent resources — approximately 29,588 physical qubits using Alice & Bob's October 2026 revised estimates.

There is one structural difference that changes the exposure profile between the two networks. Bitcoin's UTXO model means that a public key is only revealed when a UTXO is spent. Ethereum's account model means that a public key is revealed the first time any transaction is sent from an account. Once an Ethereum externally owned account (EOA) has ever sent a transaction, its public key is permanently recorded on-chain.

Because most active Ethereum wallets have sent at least one transaction, the fraction of Ethereum's total supply sitting in accounts with exposed public keys is substantially higher than in Bitcoin.

Quantifying the Exposed ETH Supply

Researchers have analyzed Ethereum's account state and transaction history to estimate how much ETH is at risk. The methodology involves identifying accounts where:

The account has a positive ETH balance, and
The account has at least one transaction in the outgoing direction, meaning the public key appears in the transaction's ecrecover data

Estimates from blockchain analytics research consistently find that approximately 40% of circulating ETH sits in accounts that have previously sent transactions — and therefore have exposed public keys permanently on-chain. At current ETH prices and supply figures, this represents hundreds of billions of dollars in assets with permanently recorded public keys available for quantum attack.

The 40% figure covers EOAs. Smart contract accounts are not directly controlled by secp256k1 keys, but most smart contracts have privileged controller addresses that are EOAs. The quantum exposure of smart contract ownership extends through the EOA controlling keys.

The Attack Scenario

The attack against an exposed Ethereum account would proceed as follows:

Extract the public key from any historical transaction sent by the target account. This is trivially easy — all Ethereum transaction data is public and indexed by multiple providers.
Run Shor's algorithm on a fault-tolerant quantum computer with approximately 29,588 physical qubits (per Alice & Bob's October 2026 estimate) to solve the elliptic curve discrete logarithm problem and derive the private key.
Construct and broadcast a transaction transferring all ETH from the target account to an attacker-controlled address. Include a gas fee sufficient to front-run any legitimate transaction from the account owner.

The attack is irreversible. Ethereum has no mechanism for recovering funds stolen through a valid private key. The transaction signature would be cryptographically valid from the network's perspective.

The time required for step 2 depends on the quantum hardware available. Alice & Bob's estimates suggest several hours to days of quantum computation per key at the threshold qubit count. Faster hardware or higher qubit counts would compress this. An adversary with access to multiple quantum processors could attack multiple accounts in parallel.

Smart Contract Exposure

Beyond individual EOA wallets, Ethereum's quantum vulnerability extends to smart contract infrastructure through the controlling key problem:

Multi-sig wallets: Most Ethereum multi-sig contracts (Gnosis Safe, etc.) are controlled by a set of EOA keys. If a sufficient number of those keys have exposed public keys, the multi-sig can be compromised.
DAO governance: DAO governance tokens grant voting rights. If token holders with enough voting power have exposed keys, governance decisions could be forced.
DeFi protocol admin keys: Many DeFi protocols have privileged admin or owner keys that can pause contracts, upgrade implementations, or withdraw funds. If these are EOAs with transaction history, they are quantum-vulnerable.
Oracle operator keys: Price oracle systems rely on trusted signers. Compromising oracle keys could corrupt price feeds used in DeFi liquidations and settlements.
Cross-chain bridge validators: Bridge smart contracts often require validator signatures. Compromising validator keys could allow arbitrary minting of wrapped assets on one side of a bridge.

Ethereum's Post-Quantum Roadmap

The Ethereum Foundation is aware of the quantum threat and has proposals under development for quantum-resistant transaction signing. The primary proposal relevant to quantum resistance is EIP-7560, which generalizes transaction validation through account abstraction to allow pluggable signature schemes at the account level.

EIP-7560 would allow individual accounts to specify their own signature validation logic, including post-quantum schemes like ML-DSA. This is a significant step but requires wallet software updates, user action to migrate each account, and a network upgrade to enable the account abstraction layer.

Ethereum researcher Justin Drake has also discussed longer-term consensus layer changes to integrate post-quantum signatures for validator attestations, which is a distinct problem from user account security. The Ethereum roadmap for quantum resistance spans multiple years and requires coordinated upgrades across a complex ecosystem.

The Window for Migration

With Alice & Bob's revised 29,588-qubit estimate placing the technical threshold potentially within reach on a 5-to-10 year timeline, the migration window for Ethereum accounts with exposed keys is finite.

For individual ETH holders, the actionable step is to move funds from accounts that have previously sent transactions to fresh accounts that have never been used to send. A fresh account reveals only the hash of its public key until its first outgoing transaction. This does not permanently solve the problem — the new account becomes exposed on its first send — but it buys time in the migration period.

For institutional operators holding large ETH positions in multi-sig arrangements, auditing whether controlling keys have exposed public keys and rotating to unexposed key sets is a practical near-term step that does not require protocol changes.

The longer-term solution requires Ethereum network upgrades to support post-quantum signatures natively. Until those upgrades are deployed, the 40% of ETH in accounts with exposed public keys remains permanently vulnerable to a sufficiently capable quantum adversary.