On quantum risk

Last week, Luke covered the AI side of Justin Drake’s “bunker mode” argument. One of the replies to Drake’s post came from Dr. Richard Carback of Postquant Labs, who said that he thinks quantum will get there before AI does, but the timeline is under two years either way. I recently had the opportunity to sit in on a lecture of his, where the central premise of the discussion was his belief that cryptographically relevant quantum computers (CRQCs), quantum computers powerful enough to break the public-key cryptography used by most blockchains and much of the internet, will be a reality much sooner than most industry estimates predict. 

Carback’s own Quantum Doom Clock currently places this inflection point on March 8th 2028, while another calculator from Eigen Labs places the current frontier ~67% ahead of Google's most recently disclosed quantum circuit. The most-cited industry benchmark is the Global Risk Institute's annual Quantum Threat Timeline, which placed the odds of a viable CRQC at 28-49% by 2035 and 51-70% by 2040, though this survey assessed the likelihood of RSA-2048 being broken, not secp256k1, which is where the technology is more relevant to crypto. 

The true timeline relies on the answer to how many qubits can be fit into a circuit, and how many qubits are needed to break a given encryption standard. Earlier this year, Google Quantum AI published a paper with the EF’s Justin Drake attesting that an attacker would need fewer than 500K physical qubits, invalidating the widely held industry estimate of 10-20M, while a companion report from Oratomic (Caltech and Harvard) suggested that a neutral-atom machine could achieve the same result with ~10K qubits. Thus, the timeline has accelerated dramatically in 2026 as the maximum number of physical qubits on a circuit has increased while the number of qubits needed to carry out an attack has decreased, and most industry estimates have not caught up.

Within the crypto industry, Drake personally cited a 10% chance of a CRQC by 2032, and the Ethereum roadmap targets a completed post-quantum deployment by 2028-2029, which is the most developed plan of any major L1 to date. However, Carback’s concern is not with the base layer. He expects Ethereum to upgrade in time but wallet implementations to lag behind, which is why he helped to establish a DAO wallet security initiative.

For Bitcoin, BIP-360 was merged in February 2026, introducing Pay-to-Merkle-Root (P2MR), though this only serves as base infrastructure for adding post-quantum signatures in future soft forks, and no additional upgrades are scheduled. The more controversial element is April’s BIP-361, a proposal that would force migration and potentially freeze ~6.9M BTC currently stored in vulnerable legacy address formats, which would include Satoshi’s 1.7M tokens. The proposal has received some pushback from ecosystem leaders who favor voluntary migrations without freezes or deadlines. Optimistic community estimates currently place a full migration completion date between 2029 and 2033 if a plan is accepted today. 

In Solana land, the SF has stated that Anza and Firedancer have converged on Falcon, a scheme chosen for having the smallest signature size, and both teams have begun working on initial implementations. The plan is to monitor the likelihood of a credible threat, and at that point roll Falcon out to new wallets, then facilitate migration of existing wallets. Solana also has a cleaner answer to bunker mode than Drake’s. The SF’s Jacob Creech flagged that Solana signs with Ed25519, not ECDSA, and that the signing key is derived by hashing a seed that never touches the chain. 

All three rely on elliptic curve discrete log problems that would be broken under a CRQC today. The most vulnerable addresses today are idle exposed public keys (legacy Bitcoin accounts, any EVM account that has sent a transaction, and 100% of Solana addresses because the address is the public key). The next most critical risk, attacking a transaction prior to finalization, requires solving a problem inside the settlement window, so the rule of thumb is the faster the chain, the harder to attack in-flight, though keys at rest are equally doomed on Q-Day. For all systems, the best mental model is Mosca's inequality, which, applied to public blockchains, says that if migration takes 5+ years and a CRQC has meaningful odds by the early 2030s, the deadline to start is now.

A CRQC arriving today wouldn’t be armageddon as early machines will be slow, with current estimates ranging from minutes to weeks per key, which caps how many wallets an attacker could drain. The significantly larger issue is incentives. The first visible hack of a dormant whale wallet would crash prices, trigger emergency forks and freezes, and erase the value of everything left to steal. A rational CRQC owner would pick off a handful of targets without drawing attention, or leave crypto alone. That owner is also far more likely to be a nation-state or a lab like Google than a malicious attacker. If Q-Day arrives, your crypto wallet will be the least of your concerns, as the same math secures TLS, banking rails, source-controlled codebases, and government communications, and every encrypted packet harvested over the past decade becomes readable.

— Nick