How could quantum computing undermine digital signatures?

Quantum security deserves attention because the authority to move an asset depends on cryptographic assumptions. If those assumptions fail, a transaction can carry a mathematically valid signature without having been authorised by the legitimate owner.

A digital signature is not an encrypted transaction that validators decrypt. A signing algorithm uses a private key to produce evidence tied to a message; a verification algorithm checks that evidence using the public key. Security depends on an outsider being unable to manufacture valid authorisation with the information available to them.¹

Bitcoin uses elliptic-curve signature schemes, including ECDSA and Schnorr signatures. Ethereum's conventional externally owned accounts use ECDSA; its validators use a different scheme, BLS. These distinctions matter operationally, but all rely on mathematical problems threatened by sufficiently capable quantum computation.²³⁴⁵

Shor's algorithm is the central concern. It provides efficient quantum methods for factoring and discrete logarithms. For the elliptic-curve systems relevant here, the important application is recovering a private key from its corresponding public key. This would permit impersonation of a signer without stealing a hardware wallet, obtaining a seed phrase or persuading the owner to approve anything.⁶

The consequence is therefore more specific than “quantum computers break blockchain.” Potential outcomes include unauthorised asset transfers and forged validator or administrative signatures. The effect depends on which keys and protocol components become vulnerable. Breaking a spending signature does not, by itself, rewrite the entire historical ledger or confer majority hash power.

The mathematics, exposure and attack window — Why a very large key space is not the whole answer

In simplified elliptic-curve notation:

Q = dG,

where d is the private scalar, G a publicly known base point and Q the public key. The multiplication denotes an elliptic-curve group operation, not ordinary multiplication where division immediately recovers d.

Computing Q from d is efficient. Recovering d from Q is the elliptic-curve discrete-logarithm problem. Shor's approach uses quantum operations and interference to extract structure in the underlying periodic relationships, followed by classical processing. It is not simply a machine checking every possible key more quickly.⁶

This explains why counting the number of possible 256-bit strings does not settle the issue. An algorithm exploiting mathematical structure can change the problem being solved. Also, a 256-bit elliptic-curve key should not be confused with 256 bits of classical attack resistance: standard generic classical attacks already have approximately square-root complexity in the group size. BIP 340 discusses the security assumptions for Bitcoin's Schnorr construction.²

For a generic full 256-bit hash preimage problem, Grover's idealised query count is of order 2¹²⁸, rather than 2²⁵⁶. That is not a runtime forecast. Building the reversible computation, correcting errors and sustaining the required operations impose additional costs. Collision resistance is a different property and must not be assigned the same security estimate.⁷

Bitcoin mining searches for a hash below a target with many acceptable solutions, so the full-preimage calculation is not a direct mining estimate. Nor does SHA-256's continued usefulness protect a separate signature scheme from Shor's algorithm. The signature and hash layers perform different jobs.

A public key and an address are not interchangeable

Some address or output formats commit to a hash of a public key or script, while others expose an elliptic-curve public key directly. The timing of that disclosure changes the attack opportunity.

Bitcoin's transaction formats and Taproot specification, together with Ethereum's account and validator-key documentation, support these distinctions.⁸⁹³⁴

Hashing can delay exposure; it does not convert ECDSA or Schnorr into a post-quantum signature. Different commitments also have different lengths and constructions, so a statement about SHA-256 should not be applied indiscriminately to every address format.

Bitcoin's approximately ten-minute target block interval is not a universal deadline for a quantum attack. For a long-exposed public key, an attacker may have substantial time to perform key recovery. For a key revealed only by a pending spend, the attacker may need to recover it and get a competing transaction accepted during a much shorter window. These are different capability thresholds. If the key controls other remaining assets, however, an earlier disclosure can leave a longer-lived target.

The practical inventory must therefore examine assets, spending conditions and disclosure history. Calling a balance “cold storage” describes how the institution protects signing material. It does not establish that the relevant public key is hidden or that the signature's mathematics resists quantum attack.