# Demystifying the Quantum Threat

By [0xDanki ( Tin Erispe )](https://paragraph.com/@tinerispe) · 2023-08-03

post-quantum-cryptography, cryptography, blockchain, ethereum, pqc, quantum

---

In da past two weeks, I have encountered at least 3 people who talk about quantum menace as if it will be the end of all existing blockchains today. So here are some facts:

*   Most blockchains today rely on elliptic curve signatures (like ECDSA/EdDSA). These are [**not post-quantum secure**](https://math.mit.edu/~apost/courses/18.204-2016/18.204_Jeremy_Wohlwend_final_paper.pdfhttps://math.mit.edu/~apost/courses/18.204-2016/18.204_Jeremy_Wohlwend_final_paper.pdf). A sufficiently powerful quantum computer _could_ forge signatures and spend funds from exposed keys. This is probably where they’re coming from.
    
*   Hash functions like Keccak256 (used in Ethereum) are **more resilient**, [even under quantum attacks](https://cryptobook.nakov.com/quantum-safe-cryptography). Grover’s algorithm weakens them, but doesn’t break them outright. So no, a quantum attacker doesn’t just rewrite chain history or magically “undo hashes.”
    
*   This means the real risk is key compromise, not instant consensus collapse. But note: signatures are also used in validators, bridges, multisigs, etc. so it’s not just wallets.
    
*   Blockchains are not static. They can upgrade. Ethereum alone has already coordinated massive changes (see: EIP-4844, account abstraction direction, etc.). Migration to post-quantum signatures is hard — but very doable with enough lead time.
    
*   Post-quantum cryptography isn’t hypothetical. We already have standardized schemes (like lattice-based signatures from NIST). The problem is **efficiency and integration**, not existence.
    
*   ZK systems are a mixed bag. Many SNARKs today rely on algebraic assumptions (pairings, discrete logs) that are **not quantum-safe**. Most of today’s widely used ZK opt for [statistical zero-knowledge over statistical soundness](https://www.cs.cmu.edu/~goyal/ConSZK.pdf)… which means a quantum adversary may break soundness in terms of deriving toxic waste from a trusted setup ceremony and fake a ZK-SNARK. A strong enough quantum adversary could forge proofs in some setups. STARKs and hash-based systems are generally more post-quantum friendly.
    
*   Also, please stop quoting raw qubit numbers like it’s a countdown timer. Breaking ECC requires **error-corrected (logical) qubits**, not the noisy ones you see in headlines. We are not there yet. Not even close.
    

Now there are a lot of ways quantum computing can potentially break the blockchain. But right now it’s mostly a **migration problem**, not an extinction event.

As for me, I’ll only start panicking if someone figures out how to efficiently reverse hash functions. [I don’t think it will happen though](https://en.wikipedia.org/wiki/Post-quantum_cryptography). But to each his own.

Ok now go, have better discussions about post-quantum cryptography in da blockchainz 🐴

---

*Originally published on [0xDanki ( Tin Erispe )](https://paragraph.com/@tinerispe/demystifying-the-quantum-threat)*