The Threat Is Not Theoretical Anymore
In 2026, the question most crypto holders are asking is no longer whether quantum computers will eventually break blockchain cryptography. The question is how much time remains, and whether the steps people are taking now actually reduce their risk. The honest answer to the second question is: usually less than they think.
This guide is a practical assessment tool. It covers how to determine your personal exposure, how different Bitcoin address types compare in real terms, what moving funds to a fresh address actually accomplishes, why hardware wallets and exchanges offer far less protection than their marketing implies, and what genuine quantum-resilient custody looks like. Bitcoin, Ethereum, and altcoin holders face meaningfully different threat profiles, so each is addressed separately.
For background on the core cryptographic mechanics, see how Shor's algorithm works and how many qubits it would take to break Bitcoin.
Assessing Your Personal Quantum Exposure
Before taking any action, you need to know where you actually stand. Quantum risk to crypto holdings is not uniform. It depends on three factors: the type of addresses holding your funds, whether those addresses have ever signed a transaction, and what chains your holdings are on.
Use the QuanChain Quantum Threat Calculator to score your specific exposure. The inputs are straightforward: address types, transaction history, and estimated time horizon.
The general principle is this. A blockchain address has two states from a quantum-risk perspective. If the address has never sent funds, only the public key hash is on-chain, and an attacker cannot reconstruct your public key from that hash alone. If the address has ever sent a transaction, the public key is permanently recorded in the blockchain's history, and a sufficiently powerful quantum computer running Shor's algorithm could use it to derive your private key. That is the attack surface. Everything else is downstream of that distinction.
The harvest now, decrypt later strategy makes this urgent. Adversaries are already archiving blockchain data, including every exposed public key, with the intent to decrypt it retroactively once quantum hardware matures. Waiting for quantum computers to arrive before acting misunderstands the threat entirely.
Bitcoin Holders: Address Type Differences That Actually Matter
Bitcoin has three main address formats in widespread use, and they carry very different quantum risk profiles.
P2PK (Pay-to-Public-Key)
These are the oldest Bitcoin outputs, common in Satoshi-era blocks and early mining rewards. P2PK outputs embed the full public key directly in the locking script, which means the public key is on-chain regardless of whether the address has ever sent a transaction. Funds locked in P2PK outputs are exposed to quantum attack from day one. Estimates suggest roughly 1.7 million BTC sit in P2PK outputs, including coins widely attributed to Satoshi Nakamoto. See the full breakdown at vulnerable wallets.
P2PKH (Pay-to-Public-Key-Hash, legacy addresses starting with "1")
P2PKH addresses hash the public key before putting it on-chain. As long as you have never spent from the address, an attacker sees only the hash, which is not sufficient input for Shor's algorithm. The moment you sign a transaction, however, your public key is revealed in the spending input and permanently recorded in the blockchain. Any funds remaining in that address after the first spend are exposed. This is the most common source of quantum risk for ordinary Bitcoin holders: people who receive funds to an address, spend part of it, and leave change at the same address.
Bech32 (Native SegWit, addresses starting with "bc1q")
Bech32 addresses use P2WPKH under the hood, which also hashes the public key. The quantum risk profile is the same as P2PKH: spend once and the public key is exposed. The structural difference is in how public keys are revealed during the signing process, not whether they are revealed. Bech32 offers no meaningful quantum advantage over P2PKH once a transaction has been signed.
The practical implication: if you have Bitcoin sitting in any address that has been used to send funds, those coins are already in the threat window. Read more in should you move your Bitcoin before the quantum threat arrives.
What Moving to a Fresh Address Does and Doesn't Fix
Moving funds to a new, never-spent address removes your exposure from the public-key-revealed category, but it does not eliminate your quantum risk entirely. It shifts you from the most immediately vulnerable group to a slightly less vulnerable one. Here is what it actually fixes and what it does not.
What it fixes: If you consolidate to a new address and never reuse it, the public key for that address remains hidden until you spend again. An attacker cannot derive your private key without it. This is meaningful near-term protection.
What it does not fix: The moment you make your next transaction from that new address, the public key is exposed again. ECDSA, which all major blockchains currently use, inherently exposes the public key at signing time. There is no way to make ECDSA quantum-safe while remaining on ECDSA. Additionally, moving funds does not address the hash function weakening that Grover's algorithm introduces, or the systemic risk of being on a network that has not upgraded its cryptographic primitives. The long-term protection ceiling for "move to a fresh address" is low.
Ethereum Holders: A Structurally Different Problem
Ethereum's account model creates a more severe default exposure than Bitcoin's UTXO model. Unlike Bitcoin, where you can receive funds to an address and spend from a different UTXO without touching the receiving address, Ethereum accounts are persistent. The same address signs every transaction from that account.
If you have ever sent a transaction from an Ethereum address, the public key is on-chain. For most active Ethereum users, every wallet they have regularly used falls into the exposed category. DeFi interactions, NFT purchases, contract deployments, and simple ETH transfers all expose the signing key.
Ethereum's roadmap includes plans for account abstraction and potential post-quantum signature schemes, but as of mid-2026, no cryptographic migration has been deployed to mainnet. The EIP process for quantum-resistant signatures is ongoing and contested. Ethereum holders cannot rely on the base layer protecting them on any near-term timeline.
For holders using smart contract wallets such as Gnosis Safe or similar multisig setups, the exposure surface may differ depending on signer key management, but the underlying ECDSA problem remains. The signers' keys are still classical.
Altcoin Holders: Varied Timelines, Mostly the Same Core Problem
The vast majority of altcoins use ECDSA or EdDSA over classical elliptic curves, which means they share Bitcoin and Ethereum's fundamental vulnerability to Shor's algorithm. The differences between chains are mostly about timing, community preparedness, and whether post-quantum roadmap work has begun.
A detailed breakdown by chain is available in which cryptocurrencies are most vulnerable to quantum attacks. The short version: Solana, Cardano, Polkadot, and most EVM-compatible chains are in the same structural position as Ethereum. None have deployed quantum-resistant signature schemes to mainnet. Some have published research or proposals; none have shipped solutions.
Holders of smaller altcoins face an additional risk that Bitcoin and Ethereum holders do not: if the project is small or abandoned, there is no realistic path to a coordinated cryptographic migration even if the developer community wanted one. Funds on those chains could become unrecoverable in a post-quantum environment if the chain itself cannot upgrade.
Hardware Wallets: The Limitation Nobody Talks About
Hardware wallets are frequently marketed as the gold standard of crypto security, and for classical threats (phishing, malware, key theft) they are excellent. For quantum threats, they offer almost no protection at all.
A hardware wallet stores your private key in a secure element and signs transactions without exposing the key to your computer. That protects you from an attacker who compromises your device today. It does nothing to change the fact that your public key is revealed on-chain every time you sign a transaction. The quantum attacker does not need to compromise your hardware wallet. They need only read the blockchain, where your public key is already permanently recorded.
The signing happens inside the secure element, but the resulting signature, and the public key embedded in it, are broadcast to the entire network and written into block history forever. No hardware security model prevents that exposure. Hardware wallet vendors have begun discussing post-quantum signature support at the firmware level, but signing with a quantum-resistant algorithm is only useful if the underlying blockchain also validates that signature scheme. For all major chains today, it does not.
Exchange Custody: A Different Risk Model Entirely
Funds held on a centralized exchange are controlled by the exchange's private keys, not yours. This means the exchange's internal key management practices determine your quantum exposure, not your own address hygiene. That is both a potential advantage and a significant additional risk.
The potential advantage: a large exchange could, in principle, migrate its internal cold storage to quantum-resistant key management before public blockchains upgrade, protecting customer funds at the custody layer even if the underlying chain remains vulnerable. Some institutions are actively working on this.
The additional risks are more numerous. Exchange custody means counterparty risk, regulatory risk, and operational risk on top of the cryptographic risk. You also have no visibility into whether the exchange's internal key management is actually quantum-hardened, or whether their hot wallets have repeatedly exposed public keys through high-volume transaction signing. Large exchanges sign thousands of transactions daily; their hot wallet keys are continuously exposed in a way that would be considered catastrophically risky by any post-quantum standard.
The conclusion is that exchange custody is not a quantum-resilience strategy. It is a trade of one set of risks for another.
What Genuine Long-Term Protection Looks Like
The three steps most often recommended, moving to a fresh address, using a hardware wallet, and choosing a major exchange, are all harm-reduction measures. None of them address the root cause, which is that every major blockchain uses classical elliptic-curve cryptography that is algorithmically broken by quantum computers. Harm reduction buys time; it does not solve the problem.
Genuine long-term protection requires infrastructure that was designed for the post-quantum threat from the ground up. That means post-quantum signature schemes (NIST-standardized algorithms such as CRYSTALS-Dilithium or SPHINCS+), key architectures that never expose public keys on-chain, and consensus mechanisms that can adapt their cryptographic parameters as the threat landscape evolves.
This is precisely the design constraint that motivated QuanChain. What is a quantum-resistant blockchain explains the architectural requirements in detail. The core systems at QuanChain, including TADEQS key rotation, the Quantum Oracle for real-time threat monitoring, and Proof of Coherence consensus, were built specifically because retrofitting quantum resistance onto an existing classical blockchain is technically inadequate. The exposed public keys in Bitcoin and Ethereum's history cannot be deleted. They are permanent attack surface.
For a comparison of how quantum-native infrastructure differs from classical chains with post-quantum add-ons, see quantum-resistant blockchain vs traditional blockchain. For the migration challenge facing existing networks, the blockchain quantum migration problem in 2026 is essential reading.
A Practical Action Plan by Holder Type
Bitcoin Holders
- Identify any funds sitting in P2PK outputs or in addresses that have signed transactions. These are your highest-priority exposures.
- Consolidate those funds to fresh, never-used native SegWit addresses as a near-term step, understanding this reduces but does not eliminate risk.
- Do not reuse the new addresses. Treat each address as single-use.
- Monitor Bitcoin's post-quantum signature proposals (BIP process) and set a concrete migration date for moving to a quantum-native network if Bitcoin's own upgrade timeline slips.
Ethereum Holders
- Assume all frequently used Ethereum addresses have exposed public keys. This is true for the vast majority of active wallets.
- There is no address hygiene step that meaningfully reduces this exposure given Ethereum's account model. The exposure is structural.
- Monitor Ethereum's EIP process for account abstraction and post-quantum signature integration, but do not assume mainnet deployment on any specific timeline.
- For large holdings, evaluate bridge and migration paths to quantum-native infrastructure before quantum hardware crosses critical thresholds.
Altcoin Holders
- Evaluate whether the project has a credible post-quantum roadmap. If it does not, treat it as a higher-risk position.
- For small or illiquid altcoins with no developer activity, the quantum timeline matters less than the project survival timeline. Both risks compound.
- Reduce concentration in chains with no realistic path to cryptographic migration.
The Window Is Narrowing
Quantum hardware is not yet capable of breaking ECDSA-256. The honest estimate as of mid-2026 remains that a cryptographically relevant attack requires millions of error-corrected logical qubits, and today's machines are well below that threshold. But the gap is closing on a measurable trajectory, and the harvest-now-decrypt-later threat is not future tense. Data is being collected today.
The right time to protect your holdings is before the threat is imminent, not after. Every month you hold classical-key assets in exposed addresses is a month of data being collected by adversaries who are playing a longer game than most crypto holders are thinking about.
For a quantified look at when different threat levels become critical, see Q-Day: what happens when quantum breaks Bitcoin. For an overview of which post-quantum projects have made the most progress on genuine resistance, see top 5 quantum-resistant crypto coins in 2026. And for the foundational question of what post-quantum cryptography actually means, what is post-quantum cryptography is the right starting point.
Protecting crypto from quantum computers is not a single action. It is a posture, a set of architectural decisions, and ultimately a choice of which infrastructure to trust with long-term value. The infrastructure that was built for this threat from day one is not the same as the infrastructure hoping to patch its way there.
