Almost every cryptocurrency in use today — Bitcoin, Ethereum, Solana, you name it — depends on elliptic-curve digital signatures (ECDSA) to prove that the holder of a private key authorised a transaction. ECDSA is fast, compact, and battle-tested against classical computers.
It's not safe against quantum computers.
The actual threat
In 1994, mathematician Peter Shor published an algorithm that, given a sufficiently large and stable quantum computer, can factor large integers and solve the elliptic-curve discrete logarithm problem. Both are problems whose hardness underlies classical public-key cryptography. Shor's algorithm doesn't slowly grind through possibilities the way classical brute-force does — it solves these problems in polynomial time, which is categorically faster.
What this means concretely: a quantum computer running Shor's algorithm could take an ECDSA public key and derive the matching private key from it.
A few important caveats:
- No quantum computer that exists today can do this at cryptographically-relevant scale. The largest publicly-disclosed quantum systems have on the order of 1000 noisy qubits; breaking ECDSA requires millions of high-fidelity qubits.
- Timeline estimates vary wildly. Optimists (or pessimists, depending on your seat) say within 10-15 years; sceptics argue practical fault-tolerant quantum computers may never arrive. Nobody knows.
- The threat is asymmetric. Even a 1% probability of breakage within the lifetime of your savings is, for many people, an unacceptable tail risk.
"Harvest now, decrypt later"
The most plausible attack vector isn't a future quantum computer rewriting today's transactions — it's an adversary that records public-key data today, stores it, and decrypts it years from now when quantum hardware matures.
For a blockchain this matters because every transaction reveals the sender's public key. The moment you sign a transaction with an address, that address's public key is on chain forever. If quantum computers arrive in 15 years, every public key recorded today is at risk.
This is why "we can migrate when we need to" is not a satisfying answer. By the time a working quantum computer is announced, the historical record is already exposed.
What "post-quantum" actually means
Post-quantum cryptography (PQC) is a family of cryptographic schemes whose security does not rest on the problems Shor's algorithm efficiently solves. Active research areas include:
- Hash-based signatures — security follows from the difficulty of inverting cryptographic hash functions. Includes XMSS, LMS, SPHINCS+. QRL Legacy uses XMSS.
- Lattice-based cryptography — security rests on the hardness of finding short vectors in high-dimensional lattices. Includes ML-KEM (encryption) and ML-DSA (signatures, formerly known as Dilithium). QRL 2.0 uses ML-DSA-87.
- Code-based cryptography — security from the difficulty of decoding random linear codes (e.g. McEliece).
- Multivariate cryptography — security from solving systems of multivariate quadratic equations.
In 2024 NIST finalised its first three post-quantum standards: ML-KEM (key encapsulation), ML-DSA (signatures), and SLH-DSA (stateless hash-based signatures). These are the schemes the U.S. federal government will move to. Picking schemes from this set means betting on cryptography that has been publicly analysed for over a decade by hundreds of researchers.
Trade-offs
Post-quantum signatures aren't a free upgrade. Compared to ECDSA they tend to have:
- Larger keys and signatures — kilobytes instead of dozens of bytes. This affects transaction sizes and on-chain storage costs.
- Slower signing or verification (depending on the scheme).
- State for one-time hash-based schemes (XMSS requires careful key management — never sign the same one-time key twice).
These trade-offs are why most chains haven't migrated yet: there's no urgent threat today, and the costs are visible. Chains designed around PQC from day one — like QRL — absorbed these costs in their core protocol design rather than retrofitting later.
Why this matters for you
If you hold any cryptocurrency today, your risk profile depends on:
- Whether you believe practical quantum computers will arrive within the lifetime of your holdings, and
- Whether the chain you hold can migrate before that happens.
QRL is one of the few chains where the answer to #2 is "the design already anticipated it." That doesn't make it the best chain on every other dimension — it just removes one specific tail risk.
For how QRL puts this into practice across its two chains — XMSS on QRL Legacy, ML-DSA-87 on QRL 2.0 — see what is QRL.