Transitioning Blockchain Infrastructure to Post-Quantum Cryptography Standards

For chains secured by ECDSA, the target is specific: every signature path on-chain.

Standards are settled. Migration is not.

FIPS 203 specifies ML-KEM for key encapsulation. FIPS 204 specifies ML-DSA for digital signatures. FIPS 205 specifies SLH-DSA, a hash-based alternative. FN-DSA, based on Falcon, is selected as FIPS 206. HQC has been selected as a second KEM, based on code-based cryptography, to provide algorithmic diversity if lattice-based assumptions fail.

Google set 2029 as its internal PQC migration target in March 2026. The BLimPQC project frames the remaining work as infrastructure transformation rather than algorithm replacement.

The ECDSA exposure, in numbers

Bitcoin and Ethereum sign transactions with ECDSA on secp256k1. Shor's algorithm reduces the Elliptic Curve Discrete Logarithm Problem to polynomial time. A sufficiently powerful quantum computer can derive any private key from its exposed public key.

The hardware threshold: roughly 2,330 to 2,500 logical qubits, translating to approximately 13 million physical qubits for a one-day attack on secp256k1. Current quantum processors operate at just over 100 qubits. The attack is not feasible today. The attack surface is permanent.

Grover's algorithm targets hash functions, reducing SHA-256's effective security from 256 to 128 bits. Still unbreakable. Proof-of-work is not at risk. Signatures are.

The Global Risk Institute's 2024 survey of 32 specialists placed the probability of a cryptographically relevant quantum computer within ten years at 19 to 34 percent, up from 17 to 31 percent the prior year. The consensus window is the early-to-mid 2030s.

Five major families of PQC algorithms have emerged from academic research. Each takes a different mathematical approach and carries distinct tradeoffs in signature size, computational speed, and security assumptions.

Audit checklist for on-chain exposure

• Map every ecrecover call path. Each is a direct dependency on secp256k1 hardness.
• Catalogue addresses whose public keys are already exposed on-chain. They are the first targets.
• Verify upgradeability. Crypto-agility requires a controlled migration path, not an emergency fork.
• Track wallet SDKs for ML-DSA and SLH-DSA support. Signing infrastructure must be ready.
• Review signature aggregation patterns. BLS, Schnorr, and ECDSA all share the same hard assumption.

Standards exist. The transition is the attack surface.