4 ms·

I would be quite worried about advances in quantum computers if I had any Bitcoin after watching this DEFCON talk: https://www.youtube.com/watch?v=OkVYJx1iLNs h

I would be quite worried about advances in quantum computers if I had any Bitcoin after watching this DEFCON talk: https://www.youtube.com/watch?v=OkVYJx1iLNs https://www.youtube.com/watch?v=OkVYJx1iLNs

IAmGraydon 1y ago
Every time I mention quantum computing as a threat to crypto (which I have been for years), I get downvoted to oblivion. I guess we have a lot of HODLers here. A bet on crypto is a bet against quantum computing.
- mikestorrent 1y ago
  I haven't seen anyone post any progress on factoring large numbers with quantum computers in a while. Annealers won't do it efficiently, but probably still hold the record anyway, for a relatively small number you could do classical hardware. Gate model machines with enough qubits to do it are still ages off. Bitcoin should find a way to transition to a post-quantum algorithm, but that's about it. As long as they do it before anyone has a big enough QPU, they're fine, and nobody is even close, it seems.
- tsimionescu 1y ago
  I haven't once even thought of investing in crypto, and think that the technology is mostly useless and proof of work schemes should be banned on environmental grounds. Even so, I don't agree that quantum is a threat to crypto. There are already well known quantum-resistant encryption schemes being deployed live in browsers, today. Crypto can just start adopting one of these schemes today, and we're still probably decades away from a QC that can factor the kinds of primes that crypto security uses. The transition will be slightly more complex for proof of work schemes, since those typically have dedicated hardware - but other types of crypto coins can switch in months, most likely, if they decide to, at least by offering new wallet types or something.
  - IAmGraydon 1y ago
    >There are already well known quantum-resistant encryption schemes being deployed live in browsers, today. Crypto can just start adopting one of these schemes today, and we're still probably decades away from a QC that can factor the kinds of primes that crypto security uses. It's very strange that some people act like switching over to a post quantum cryptography scheme is trivial. Did you watch the video I replied to, which is a talk by an actual quantum computing researcher?
    - Jommi 1y ago
      https://ethresear.ch/t/how-to-hard-fork-to-save-most-users-funds-in-a-quantum-emergency/18901 https://ethresear.ch/t/how-to-hard-fork-to-save-most-users-f...
    - tsimionescu 1y ago
      I hadn't watched the video, but I cam away even more confused by your comment. The video, while very alarmist about the threat of QC, is also very explicit that switching to PQE is very easy. The whole point of the talk is "switching is easy, the costs are huge, start doing it today". I also think the talk vastly overestimates the urgency of this, based on little more than marketing projections. The reality is that many of those claims are hugely optimistic, and ignore some fundamental difficulties. Mainly, the qubits / quantum gates being produced today are not at all as programmable as the logical qubits used in the theoretical results presented in those papers. So, even if they do achieve the projected marketing numbers, it's likely that they won't be able to run Shor's or Grover's algorithm on those QCs. Not to mention, we've had many periods of flimsy encryption being used for important infrastructure, and it has not resulted in wide scale disasters. Of course we should be responsible and avoid this, but I think the doomsday scenario suggested is way overblown, even if it were true that a 1500 logical qbit programmable QC would be available in 2030.
- bottlepalm 1y ago
  Unless advances in QC could rewrite the blockchain then there's not much to worry about. If the crypto algorithms are compromised, you coins are pretty much frozen on the chain until a new algorithms are implemented. Are you're arguing QC makes signatures/verification/mining impossible?
  - ziofill 1y ago
    Why though? Who is to decide which point of the blockchain is the good one and which blocks to “reject”?
    - krater23 1y ago
      Think twice. Everyone who hosts the blockchain would decide to stop because he invested in crypto, at least with some hardware costs. Beside of the small group of people that owns a quantum computer. I don't expect that this group is >50% of the people that hosts the blockchain.
      - gingerceo 1y ago
        You don't need >50% of bad actors to compromise the blockchain, but rather >50% of the total hashing power. This could very well be achievable by a small group of people with QC at some point.
        15155 1y ago
        How does QC aid SHA256 hash throughput?
  - Libidinalecon 1y ago
    Before things were frozen you would have the biggest crash in market history. Then it would be like a futures market that has gone limit down. The panic during this time would be unbelievable. Then when it reopens it would crash further and effectively end trust in crypto.
vayup 1y ago
Quantum is a known threat. There is enough time to fix it. Folks are working on the fixes. Cryptocurrencies would be the last thing I worry about w.r.t Quantum crypto attacks. Everything would be broken. Think banks, brokerage accounts, email, text messages - everything.
- acdha 1y ago
  I think that’s backwards: most of the stuff you mentioned is using TLS and can switch to post-quantum algorithms with a config change, and do so incrementally with no user-visible impact - e.g. right now I’m already using PQC for many sites and about half of the traffic Cloudflare sees is using PQC: https://radar.cloudflare.com/adoption-and-usage https://radar.cloudflare.com/adoption-and-usage In contrast, cryptocurrencies have to upgrade the entire network all at once or it’s effectively a painful fork. That effort appears to just be getting talked about now, without even starting to discuss timing: https://github.com/bitcoin/bips/pull/1895 https://github.com/bitcoin/bips/pull/1895
  - ziofill 1y ago
    Is this a purely server side migration? Do browsers/OSs need updating too?
    - acdha 1y ago
      Clients need to be updated, too, since what's happening is that the server and client need to agree on a common algorithm they both support, but that's been in progress for years and support is now pretty widespread in the current versions of most clients. Stragglers are a problem, of course, but that's why I thought this would be a harder problem for Bitcoin: for me to use PQC for HTTPS, only my browser and the server need to support it and past connections don't matter, whereas for a blockchain you need to upgrade the entire network to support it for new transactions _and_ have some kind of data migration for all of the existing data. I don't think that's insurmountable – Bitcoin is rather famously not as decentralized as the marketing would have you believe — but it seems like a harder level of coordination.
  - 1y ago
qnleigh 1y ago
The quantum algorithm that would break certain kinds of public key cryptography schemes (not even the core part of Bitcoin blockchains, which are not vulnerable to quantum computers) will take days to weeks to break a single key [0]. This is another reason why we will have plenty of warning before quantum computing causes any major disruptions to daily life. What I would start worrying about is the security of things like messages sent via end-to-end encrypted services like WhatsApp and Signal. Intercepted messages can be saved now and decrypted any time in the future, so it's better to switch to more robust cryptography sooner rather than later. Signal has taken steps in this direction recently: https://arstechnica.com/security/2025/10/why-signals-post-quantum-makeover-is-an-amazing-engineering-achievement/ https://arstechnica.com/security/2025/10/why-signals-post-qu.... [0] https://arxiv.org/pdf/2505.15917 https://arxiv.org/pdf/2505.15917
- twothreeone 1y ago
  Usually, the crypto should have Forward Secrecy already even without being PQ-safe (e.g., via https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm) so in practice the attacker would need to break many successive session keys - which rotates every time a new message is sent.
- dweekly 1y ago
  Meta has been rolling out PQC: https://engineering.fb.com/2024/05/22/security/post-quantum-readiness-tls-pqr-meta/ https://engineering.fb.com/2024/05/22/security/post-quantum-... And Apple: https://security.apple.com/blog/imessage-pq3/ https://security.apple.com/blog/imessage-pq3/ Cloudflare started rolling it out three years ago! https://developers.cloudflare.com/ssl/post-quantum-cryptography/ https://developers.cloudflare.com/ssl/post-quantum-cryptogra...
- johncolanduoni 1y ago
  > not even the core part of Bitcoin blockchains, which are not vulnerable to quantum computers Um, what? Shor’s algorithm can take the public key of a wallet (present on any outgoing transaction in the ledger) and produce its private key. So now you can hijack any wallet that has transferred any Bitcoin. Notably only one successful run of the algorithm is needed per wallet, so you could just pick a big one if it takes weeks. It probably wouldn’t help you mine in practice, sure. Technically it would give you better asymptotic mining performance (via Grover’s algorithm) but almost certainly worse in practice for the foreseeable future.
hoppp 1y ago
Amazing talk. Thanks for sharing
RLAIF 1y ago
[dead]
xtracto 1y ago
I would be more worried about everything else before Crypto... I would be worried about SSH, about blowfish (and all the dumped password databases) and TLS, and oh so many things.
josefx 1y ago
I feel bad about the quantum guru, elder of the quantum village. He starts of his talk by complaining that people assumed "we would have 10 to 20 years" when news about quantum computing hit. The quantum computing hype was 10 years ago. Microsofts attempt to sell people the Quantum computing cloud with Q# is already 8 years old by now. The people who said we had at least 10 years were right. Guy is in denial either about his age or how much of his life he spend trying to sell people on second hand hot air.

IAmGraydon 1y ago

Every time I mention quantum computing as a threat to crypto (which I have been for years), I get downvoted to oblivion. I guess we have a lot of HODLers here. A bet on crypto is a bet against quantum computing.

mikestorrent 1y ago
I haven't seen anyone post any progress on factoring large numbers with quantum computers in a while. Annealers won't do it efficiently, but probably still hold the record anyway, for a relatively small number you could do classical hardware. Gate model machines with enough qubits to do it are still ages off. Bitcoin should find a way to transition to a post-quantum algorithm, but that's about it. As long as they do it before anyone has a big enough QPU, they're fine, and nobody is even close, it seems.
tsimionescu 1y ago
I haven't once even thought of investing in crypto, and think that the technology is mostly useless and proof of work schemes should be banned on environmental grounds. Even so, I don't agree that quantum is a threat to crypto. There are already well known quantum-resistant encryption schemes being deployed live in browsers, today. Crypto can just start adopting one of these schemes today, and we're still probably decades away from a QC that can factor the kinds of primes that crypto security uses. The transition will be slightly more complex for proof of work schemes, since those typically have dedicated hardware - but other types of crypto coins can switch in months, most likely, if they decide to, at least by offering new wallet types or something.
- IAmGraydon 1y ago
  >There are already well known quantum-resistant encryption schemes being deployed live in browsers, today. Crypto can just start adopting one of these schemes today, and we're still probably decades away from a QC that can factor the kinds of primes that crypto security uses. It's very strange that some people act like switching over to a post quantum cryptography scheme is trivial. Did you watch the video I replied to, which is a talk by an actual quantum computing researcher?
  - Jommi 1y ago
    https://ethresear.ch/t/how-to-hard-fork-to-save-most-users-funds-in-a-quantum-emergency/18901 https://ethresear.ch/t/how-to-hard-fork-to-save-most-users-f...
  - tsimionescu 1y ago
    I hadn't watched the video, but I cam away even more confused by your comment. The video, while very alarmist about the threat of QC, is also very explicit that switching to PQE is very easy. The whole point of the talk is "switching is easy, the costs are huge, start doing it today". I also think the talk vastly overestimates the urgency of this, based on little more than marketing projections. The reality is that many of those claims are hugely optimistic, and ignore some fundamental difficulties. Mainly, the qubits / quantum gates being produced today are not at all as programmable as the logical qubits used in the theoretical results presented in those papers. So, even if they do achieve the projected marketing numbers, it's likely that they won't be able to run Shor's or Grover's algorithm on those QCs. Not to mention, we've had many periods of flimsy encryption being used for important infrastructure, and it has not resulted in wide scale disasters. Of course we should be responsible and avoid this, but I think the doomsday scenario suggested is way overblown, even if it were true that a 1500 logical qbit programmable QC would be available in 2030.
bottlepalm 1y ago
Unless advances in QC could rewrite the blockchain then there's not much to worry about. If the crypto algorithms are compromised, you coins are pretty much frozen on the chain until a new algorithms are implemented. Are you're arguing QC makes signatures/verification/mining impossible?
- ziofill 1y ago
  Why though? Who is to decide which point of the blockchain is the good one and which blocks to “reject”?
  - krater23 1y ago
    Think twice. Everyone who hosts the blockchain would decide to stop because he invested in crypto, at least with some hardware costs. Beside of the small group of people that owns a quantum computer. I don't expect that this group is >50% of the people that hosts the blockchain.
    - gingerceo 1y ago
      You don't need >50% of bad actors to compromise the blockchain, but rather >50% of the total hashing power. This could very well be achievable by a small group of people with QC at some point.
      - 15155 1y ago
        How does QC aid SHA256 hash throughput?
- Libidinalecon 1y ago
  Before things were frozen you would have the biggest crash in market history. Then it would be like a futures market that has gone limit down. The panic during this time would be unbelievable. Then when it reopens it would crash further and effectively end trust in crypto.

vayup 1y ago

Quantum is a known threat. There is enough time to fix it. Folks are working on the fixes. Cryptocurrencies would be the last thing I worry about w.r.t Quantum crypto attacks. Everything would be broken. Think banks, brokerage accounts, email, text messages - everything.

acdha 1y ago
I think that’s backwards: most of the stuff you mentioned is using TLS and can switch to post-quantum algorithms with a config change, and do so incrementally with no user-visible impact - e.g. right now I’m already using PQC for many sites and about half of the traffic Cloudflare sees is using PQC: https://radar.cloudflare.com/adoption-and-usage https://radar.cloudflare.com/adoption-and-usage In contrast, cryptocurrencies have to upgrade the entire network all at once or it’s effectively a painful fork. That effort appears to just be getting talked about now, without even starting to discuss timing: https://github.com/bitcoin/bips/pull/1895 https://github.com/bitcoin/bips/pull/1895
- ziofill 1y ago
  Is this a purely server side migration? Do browsers/OSs need updating too?
  - acdha 1y ago
    Clients need to be updated, too, since what's happening is that the server and client need to agree on a common algorithm they both support, but that's been in progress for years and support is now pretty widespread in the current versions of most clients. Stragglers are a problem, of course, but that's why I thought this would be a harder problem for Bitcoin: for me to use PQC for HTTPS, only my browser and the server need to support it and past connections don't matter, whereas for a blockchain you need to upgrade the entire network to support it for new transactions _and_ have some kind of data migration for all of the existing data. I don't think that's insurmountable – Bitcoin is rather famously not as decentralized as the marketing would have you believe — but it seems like a harder level of coordination.
- 1y ago

qnleigh 1y ago

The quantum algorithm that would break certain kinds of public key cryptography schemes (not even the core part of Bitcoin blockchains, which are not vulnerable to quantum computers) will take days to weeks to break a single key [0]. This is another reason why we will have plenty of warning before quantum computing causes any major disruptions to daily life. What I would start worrying about is the security of things like messages sent via end-to-end encrypted services like WhatsApp and Signal. Intercepted messages can be saved now and decrypted any time in the future, so it's better to switch to more robust cryptography sooner rather than later. Signal has taken steps in this direction recently: https://arstechnica.com/security/2025/10/why-signals-post-quantum-makeover-is-an-amazing-engineering-achievement/ https://arstechnica.com/security/2025/10/why-signals-post-qu.... [0] https://arxiv.org/pdf/2505.15917 https://arxiv.org/pdf/2505.15917

twothreeone 1y ago
Usually, the crypto should have Forward Secrecy already even without being PQ-safe (e.g., via https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm) so in practice the attacker would need to break many successive session keys - which rotates every time a new message is sent.
dweekly 1y ago
Meta has been rolling out PQC: https://engineering.fb.com/2024/05/22/security/post-quantum-readiness-tls-pqr-meta/ https://engineering.fb.com/2024/05/22/security/post-quantum-... And Apple: https://security.apple.com/blog/imessage-pq3/ https://security.apple.com/blog/imessage-pq3/ Cloudflare started rolling it out three years ago! https://developers.cloudflare.com/ssl/post-quantum-cryptography/ https://developers.cloudflare.com/ssl/post-quantum-cryptogra...
johncolanduoni 1y ago
> not even the core part of Bitcoin blockchains, which are not vulnerable to quantum computers Um, what? Shor’s algorithm can take the public key of a wallet (present on any outgoing transaction in the ledger) and produce its private key. So now you can hijack any wallet that has transferred any Bitcoin. Notably only one successful run of the algorithm is needed per wallet, so you could just pick a big one if it takes weeks. It probably wouldn’t help you mine in practice, sure. Technically it would give you better asymptotic mining performance (via Grover’s algorithm) but almost certainly worse in practice for the foreseeable future.

hoppp 1y ago

Amazing talk. Thanks for sharing

RLAIF 1y ago

[dead]

xtracto 1y ago

I would be more worried about everything else before Crypto... I would be worried about SSH, about blowfish (and all the dumped password databases) and TLS, and oh so many things.

josefx 1y ago

I feel bad about the quantum guru, elder of the quantum village. He starts of his talk by complaining that people assumed "we would have 10 to 20 years" when news about quantum computing hit. The quantum computing hype was 10 years ago. Microsofts attempt to sell people the Quantum computing cloud with Q# is already 8 years old by now. The people who said we had at least 10 years were right. Guy is in denial either about his age or how much of his life he spend trying to sell people on second hand hot air.