Coinbase Independent Advisory Board on Quantum Computing and Blockchains released a ~50-page paper authored by experts including Dan Boneh from Stanford, Scott Aaronson from UT Austin, Justin Drake from the Ethereum Foundation, and others assesses quantum computing’s impact on crypto.
Today’s quantum computers lack the scale; fault-tolerant, millions of logical qubits needed to break widely used cryptographic systems like ECDSA or RSA used in blockchains and wallets. A sufficiently powerful quantum computer remains years or decades away, though the board expresses high confidence one will eventually exist.
Primary risk: Harvest now, decrypt later attacks—bad actors could collect encrypted data e.g., public keys from wallets today and decrypt it later with a quantum machine. This mainly affects wallet-level digital signatures proving ownership, not core blockchain consensus or hash functions in most cases. Roughly 6.9 million BTC wallets with exposed public keys could be vulnerable.
Some proof-of-stake (PoS) networks face higher challenges due to validator signatures creating a larger attack surface. Coordination for upgrades in decentralized systems is complex and time-consuming. The board urges the industry to start planning and testing quantum-resistant upgrades now (e.g., post-quantum cryptography like lattice-based or hash-based signatures) to avoid rushed, insecure migrations later.
Why Algorand and Aptos Stand Out
The report specifically highlights Algorand and Aptos along with Solana in some contexts as more advanced in preparedness among layer-1 blockchains: Algorand has a staged roadmap toward full quantum readiness and is among the first to deploy quantum-resistant cryptography for transactions on mainnet. It already offers or plans options for users.
Aptos makes protocol upgrades relatively seamless and is advancing quantum-resistant features, positioning it well for a smooth transition. In contrast, some other PoS chains may require more significant work on validator signatures and overall architecture. Bitcoin and Ethereum are exploring roadmaps; Ethereum has a structured migration plan, while networks like Optimism have announced timelines.
Ripple aims for hybrid post-quantum testing by 2026–2028. Coinbase itself notes it’s adopting practices to simplify future updates. This isn’t panic—crypto is secure today—but it’s a prudent, forward-looking call to action. Quantum resistance is becoming a competitive differentiator for blockchains, much like scalability or fees.
Projects that move early like Algorand and Aptos appear to be doing reduce long-term risk for users and developers. The quantum threat to Bitcoin centers on its reliance on elliptic curve digital signature algorithm (ECDSA) for proving ownership of funds via public-private key pairs. A sufficiently powerful, fault-tolerant quantum computer could use Shor’s algorithm to derive a private key from a publicly exposed public key, allowing an attacker to forge signatures and steal coins.
Bitcoin remains secure today. Existing quantum computers like Google’s Willow with ~105 qubits are far from the scale needed—estimates for breaking ECDSA have dropped to under 500,000 physical qubits; a ~20x improvement from prior millions but building and error-correcting such a machine is still years or decades away in practice.
The Coinbase Quantum Advisory Board’s April 21, 2026 position paper states: No meaningful threat to Bitcoin’s core infrastructure: Mining via SHA-256 hashing, the historical ledger, or the blockchain’s consensus rules are largely unaffected. Grover’s algorithm offers only quadratic speedup for mining, not a game-changer.
The real exposure is at the wallet level, specifically digital signatures proving ownership. Harvest now, decrypt later risk: Adversaries can already collect on-chain data; public keys revealed in spent transactions or older address formats like Pay-to-Public-Key. They store it and attempt decryption later with a quantum machine. Privacy-focused protocols using zero-knowledge proofs are mathematically immune in many cases.
Roughly 6.9 million BTC ~33% of supply in some estimates sit in wallets with publicly visible or recoverable public keys, making them potentially vulnerable once a quantum threat materializes. This includes many dormant Satoshi-era coins. Newer Taproot addresses and unspent outputs where public keys remain hidden are safer for now.
Real-time attacks during transaction broadcasting are theoretically possible but even harder due to timing and network speed. Bitcoin’s hash functions like SHA-256 for proof-of-work and Merkle trees are considered quantum-resistant enough for the foreseeable future. Experts including the Coinbase board and prior Grayscale analysis agree there’s no “Q-Day” crypto doomsday this year or next. Current hardware gaps are massive.
Google’s March 2026 research lowered qubit requirements dramatically and suggested a credible attack window could open as early as 2029 in optimistic or pessimistic scenarios for quantum progress. Google itself is targeting post-quantum migration for its systems by 2029. Some analysts give Bitcoin 3–5+ years of breathing room; others note a full decentralized migration could realistically take 5–10 years due to coordination challenges.
Coinbase CEO Brian Armstrong has personally committed to pushing for solutions, calling it a defined engineering problem to solve sooner rather than later. Bitcoin’s decentralized governance makes upgrades slower than on chains like Ethereum, Solana, Algorand, or Aptos; the latter two highlighted by Coinbase as more advanced in quantum readiness with staged roadmaps and deployed/post-quantum options.
Ongoing efforts include: BIP 360 (Pay to Merkle Root) and related proposals for new quantum-resistant output types that maintain Taproot-like features while adding upgradability. Ideas for soft forks introducing post-quantum signatures, hybrid schemes (ECDSA + PQC), or time-bound migration windows where legacy outputs can no longer receive new funds.
Community discussions around commit-delay-reveal or recovery mechanisms for lost and dormant coins to avoid mass lockups. Consensus on activation; soft fork via BIP9/BIP8 or UASF-style, testing, and user migration. A full transition might require years of testnet work and incentives for users to move funds to new addresses. Some older coins may be effectively unrecoverable if owners are inactive.
Your Bitcoin is safe right now and will likely remain so for the medium term. The threat is a long-term engineering issue, not an existential crisis tomorrow—much like Y2K but with more time if the community acts prudently. Use hardware wallets and keep recovery phrases secure; seed phrases themselves are more resistant via hashing.






