Beyond Bitcoin: Ethereum's Largest Quantum Exposures Sit in Admin Keys and Consensus

In 2026 the estimated hardware needed to break crypto's elliptic-curve keys fell about 20-fold, and Google's research mapped five Ethereum exposure types, of which the largest by value are admin keys (more than $200 billion in stablecoins and RWAs) and consensus (about 37 million staked ETH). Institutional preparation has begun, but none of the sources reviewed reports an activated protocol-level post-quantum migration on a major chain. StarkWare's QSB transaction protects only coins deliberately moved into it.

Executive Summary

In 2026 the estimated hardware needed to break the elliptic-curve keys that secure crypto fell by about 20-fold. Google Quantum AI's whitepaper, dated March 30, 2026, put the requirement at fewer than 500,000 physical qubits, with an attack running in minutes. The same research reframed the problem. On Ethereum, the largest exposure is not retail wallets. It is the admin and upgrade keys that control more than $200 billion in stablecoins and tokenized real-world assets. Ethereum's BLS consensus signatures, exposed accounts, L2 code and the KZG trusted setup make up the rest of the map.

Preparation has started, and it is real. Coinbase formed an advisory board, Galaxy launched a developer grants program, nine firms pledged $15 million over three years, and the Ethereum Foundation set a December 2029 target for a quantum-resistant L1. None of the sources reviewed here, however, reports an activated protocol-level post-quantum migration on any major chain. BIP-360, the soft-fork proposal merged into Bitcoin's BIPs repository, remains a Draft.

StarkWare's Quantum Safe Bitcoin (QSB) transaction, confirmed in block 964,199 on August 26, does not change that conclusion. It was a script-only, nonstandard spend on Bitcoin itself. No Layer 2 or bridge was involved, and the sources describe no STARK proof. It protects only coins deliberately moved into a QSB output.

Market Context

As of October 7, 2026, Bitcoin traded at about $83,375, for a market capitalization of about $1.68 trillion on 20,094,853 BTC in circulation (DefiLlama, CoinGecko data). Ether traded at about $2,561, a market capitalization of about $312.75 billion. Solana traded at about $116.03 ($68.35 billion) and XRP at about $1.43 ($89.91 billion).

Total stablecoin supply was about $314.38 billion on the same date (DefiLlama Stablecoins). USDT accounted for about $184.27 billion, or 58.6%, and USDC for about $73.87 billion, or 23.5%. Tether Gold (XAUT) had a market capitalization of about $3.32 billion.

On-chain deployed capital is smaller than market capitalization and heavily concentrated. Ethereum's DeFi TVL was about $52.35 billion on October 7, against $6.45 billion on Solana, $6.25 billion on Base and $4.46 billion on Bitcoin (DefiLlama).

These numbers matter for quantum analysis because exposure is not uniform. The relevant question is not how large an asset is. It is how much value sits behind keys or code that cannot be upgraded quickly. At least one allocator has acted on the narrative. In January 2026, Jefferies' Christopher Wood removed a 10% bitcoin allocation from his model portfolio, citing quantum computing risk.

What Changed in 2026: Cheaper Attacks and an On-Spend Window

Google narrowed the hardware gap

In a whitepaper dated March 30, Google Quantum AI published compiled circuits for breaking 256-bit elliptic-curve keys (ECDLP-256). One circuit uses 1,200 logical qubits and 90 million Toffoli gates. The other uses 1,450 logical qubits and 70 million Toffoli gates. Google estimated that either could run on a superconducting cryptographically relevant quantum computer (CRQC) with fewer than 500,000 physical qubits in a few minutes.

That is about a 20-fold reduction from prior resource estimates. It builds on Google's 2024 demonstration, with its Willow chip, of quantum error correction below the surface-code threshold.

Spending a coin became a race

The paper also set out a sharper threat model. Google warned that fast CRQCs could launch "on-spend" attacks inside Bitcoin's 10-minute block time. Its researchers estimated a private key could be derived 9 to 12 minutes after a public key becomes visible.

The implication is significant. An ordinary spend reveals the public key while the transaction waits for confirmation. If an attacker can derive the key within roughly one block interval, a pending transaction can be raced with a conflicting one. Coins that have never exposed a key are not safe once their owner tries to move them.

The timeline argument is about migration, not arrival

Google's own assessment is measured. Google Research said the time before CRQCs arrive still exceeds the time needed to migrate blockchains to post-quantum cryptography (PQC). It added that the margin is "increasingly narrow." Google had earlier set 2029 as the target for its own full PQC migration.

We read this as follows. The useful variable is not the date a CRQC appears, which no source in our evidence pins down. It is whether migration can finish first. For systems that require social coordination, such as Bitcoin's soft-fork process or users moving funds by hand, migration time is long and uncertain.

StarkWare's QSB Transaction Is a Lifeboat, Not a Migration

What the transaction actually was

StarkWare researcher Avihu Levy's QSB transaction was confirmed in Bitcoin block 964,199 on Wednesday, August 26, 2026, mined by MARA Pool (Cointelegraph). The design combines hash-based one-time signatures with computational searches that bind an authorization to a specific transaction.

Its quantum-resistant lock relies on RIPEMD-160 pre-image resistance rather than on secp256k1, Bitcoin's elliptic curve (PostQuantum.com). It fits inside legacy Script limits of 201 non-push opcodes and 10,000 bytes. Bitcoin's existing consensus layer already validates it. No protocol change, soft fork or Layer 2 was involved.

The sources describe no STARK proof or bridge. The construction is ordinary Bitcoin script built from hash functions.

Why it is not production infrastructure

QSB transactions are nonstandard under Bitcoin Core relay policy, so ordinary nodes will not propagate them. StarkWare submitted the transaction directly to a miner through MARA's Slipstream service. Any user relying on QSB therefore depends on miners willing to accept direct submissions.

Cost is the second constraint. A StarkWare spokesperson said the transaction cost "low hundreds of dollars," around $150 to $200. Levy's April 2026 proposal had estimated $75 to $150 in GPU computation per transaction. That is workable for a large holder protecting a cold-storage position. It is not a design for routine payments.

What it cannot protect

StarkWare was explicit that QSB does not make Bitcoin quantum-safe. It protects holdings only after they move into a QSB output. It does not retrofit ordinary ECDSA- or Schnorr-secured holdings, Taproot outputs or Lightning channels. It cannot help addresses whose public keys are already exposed, which PostQuantum.com puts at roughly 6 million BTC.

StarkWare CEO Eli Ben-Sasson framed QSB accordingly. He said a Bitcoin soft fork "should happen" and that he believes it will, describing QSB as a safety net while protocol-level protections are developed. The competing view deserves its due: QSB proves Bitcoin can host quantum-resistant spends today without a fork. But a last-resort option for coins actively moved is not a migration path for the network.

Bitcoin's Exposure Comes From Revealed Keys, and BIP-360 Is Still a Draft

Where the exposed coins are

Per the Google paper, about 1.7 million BTC sit in Satoshi-era Pay-to-Public-Key (P2PK) scripts with permanently exposed public keys. About 600,000 more are exposed through address reuse and similar vectors. That gives about 2.3 million BTC of dormant vulnerable supply that cannot be migrated, because the keys are lost.

At the October 7 price, 2.3 million BTC is worth roughly $192 billion, about 11% of circulating supply (our calculation). The broader 6 million BTC with visible public keys is worth roughly $500 billion, about 30% of supply (our calculation). The two figures come from different sources and measure different things. One counts lost-key dormant coins; the other counts all coins with on-chain public keys.

Multisig does not solve it

A common claim holds that locking coins in multisig minimizes quantum exposure. BIP-360's own analysis contradicts this. It states that most Bitcoin outputs are vulnerable to "short exposure" attacks because spending reveals the public key. Its table lists P2PK, bare multisig (P2MS) and Pay-to-Taproot (P2TR) as vulnerable to long-exposure attacks.

Hashed outputs, including P2WSH multisig, are protected only until a key is revealed. Every key in a standard multisig is still an ECDSA or Schnorr key. Multisig raises the number of keys an attacker must break. It does not change the type of mathematics that a CRQC breaks.

BIP-360 is a soft fork, not a hard fork

Bitcoin does not need a hard fork to begin a quantum migration. BIP-360, Pay-to-Merkle-Root (P2MR), carries Status: Draft and Layer: Consensus (soft fork) in the official repository. It proposes an output type that omits Taproot's quantum-vulnerable key-path spend.

An updated BIP-360 introducing P2MR was merged into the Bitcoin BIPs repository on February 11, 2026. Its changelog shows the rename from P2TSH to P2MR in v0.11.0, dated February 10. The latest version is 0.12.1, dated July 24, 2026. It has not been activated.

Two limits follow from its design. First, a new output type protects only coins that owners actively move into it. Second, lost-key coins can never be moved, so P2MR does nothing for the dormant supply. Bitcoin's hardest quantum question is therefore not technical. It is what to do about coins nobody can migrate.

Beyond Bitcoin: Ethereum's Five Exposure Surfaces

The Google paper's map

The Google paper, co-authored with Ethereum Foundation and Stanford researchers, lists five Ethereum vulnerability types. The table converts its ETH figures to dollars at the October 7 price of about $2,561. Categories can overlap, so the rows should not be added together.

Exposure type (Google paper, Mar 30, 2026)	Paper's estimate	Approx. value at Oct 7, 2026 ETH price (our calculation)	Why it is hard to fix
Account	~20.5M ETH in top 1,000 exposed accounts	~$52.5B	Each owner must move funds
Admin	~2.5M ETH plus more than $200B in stablecoins/RWAs under admin keys	~$6.4B in ETH, plus the stablecoin/RWA figure	One key can control an entire asset
Code	~15M ETH in L2 total value secured	~$38.4B	L2 verification logic must be rebuilt
Consensus	~37M staked ETH, BLS12-381 signatures	~$94.8B	Requires a protocol-level change
Data availability	KZG trusted setup	Not a balance	A recovered secret becomes a reusable exploit

Admin keys are the largest single point of failure

The admin category is the most important finding for markets. A stablecoin or tokenized asset is usually governed by upgrade or administrative keys. Depending on the contract's design, whoever derives such a key may be able to change contract logic or control issuance. A single compromised key therefore puts an entire asset at risk, not one holder.

For scale, total stablecoin supply was cited above at about $314 billion on October 7. Google's admin figure dates from March and includes RWAs, so the two cannot be read as a share.

L2 code, consensus and the KZG setup

The code category covers L2 systems, which hold about 15 million ETH in value secured. If the cryptography behind an L2's proofs or bridge verification fails, the funds it secures fail with it. The consensus category covers about 37 million staked ETH signed with BLS12-381, an elliptic-curve-based scheme.

The KZG finding is the most structurally unusual. Per the Google paper, a CRQC could recover the secret value, the "toxic waste," from the KZG trusted setup used in Ethereum's data availability sampling. That would create a reusable classical exploit to forge data-availability proofs. Once the secret is recovered, the attacker no longer needs a quantum computer to keep exploiting it.

Ethereum's near-term risk is not on-spend

Ethereum produces blocks in 12-second slots, far shorter than a 9-to-12-minute key derivation, and the Google paper's own analysis finds the on-spend threat largely does not apply to Ethereum. This shifts Ethereum's near-term risk toward static targets: exposed accounts, admin keys and the KZG setup. Those can be attacked at leisure, without racing a block.

The Ethereum Foundation has a dated plan, not a deployed one

The Ethereum Foundation made post-quantum security a top priority in January 2026. It formed a dedicated Post Quantum team led by Thomas Coratger, launched two $1 million prizes and started biweekly developer sessions on post-quantum transactions. The Block reported on September 8, 2026 that the EF had set a December 2029 target for a quantum-resistant L1.

The EF labeled Frame Transactions (EIP-8141) and FOCIL (EIP-7805) as "must-ship" for the Hegotá upgrade. EIP-8141 provides native account abstraction that allows custom signatures, aimed at post-quantum readiness. This is a credible engineering path. It is also a target, not an activation, and it addresses accounts more directly than consensus or KZG.

Immutable Contracts Cannot Be Voted Into Safety

Immutable and upgradeable contracts face different problems. Immutable code cannot be changed by a governance vote. The only remedy is to deploy a new contract and have users move funds into it.

This creates a dilemma with no clean exit. Immutable contracts avoid admin-key risk but guarantee a slow, voluntary migration in which many users will lag. Upgradeable contracts can be patched quickly, but the upgrade key is itself one of the largest exposures in the Google paper. The flexibility that enables a fast fix also creates the single point of failure.

For builders, the practical consequence is that post-quantum readiness must cover the upgrade path itself. Patching user-facing signatures while leaving an elliptic-curve admin key in place moves the risk without removing it. Governance systems that execute through signed transactions inherit the same issue.

Solana and Other Chains: Progress on Paper, Activation Unreported

Solana signs transactions with Ed25519. Ethereum accounts use ECDSA, and its consensus layer uses BLS12-381 signatures. All three are elliptic-curve schemes and therefore quantum-vulnerable.

The Google paper notes that Algorand, Solana, the XRP Ledger, QRL, Abelian and Mochimo have made real progress toward post-quantum migration. Solana and the XRP Ledger are large enough for that progress to matter. Our sources do not detail what each chain has deployed or activated.

We therefore make a narrow claim. None of the sources reviewed for this report describes an activated, protocol-level post-quantum migration on Bitcoin, Ethereum, Solana or the XRP Ledger. "Progress" in the Google paper should not be read as "migrated."

Custody and Institutions: Migration Lag and Early Funding

Self-custody spreads keys, and spreads the work

On April 14, 2026, Tether launched tether.wallet, a self-custodial wallet in which users control their own private keys. It supports USDT, USAT, XAUT and bitcoin across multiple chains.

Because users hold their own keys, the wallet does not concentrate keys at Tether.

The real risk is the opposite of concentration. When millions of users hold their own keys, migration depends on millions of individual actions. Wallet vendors can ship post-quantum signing, but users must still move funds. Dormant and inattentive holders will lag.

Institutions have committed money and attention

On January 21, 2026, Coinbase established its Independent Advisory Board on Quantum Computing and Blockchain. Members include Scott Aaronson, Dan Boneh and Justin Drake.

The board published a 51-page position paper in April 2026. It said quantum computers pose no immediate threat but that preparation should begin now, because migration could take years. On July 21, Galaxy launched the Bitcoin Quantum Readiness Initiative, committing up to $5 million in developer grants, plus an advisory council and research program.

Two days later, nine firms launched the Bitcoin Security Consortium. Members include BlackRock, Coinbase, Strategy, Galaxy and Fidelity Digital Assets. They pledged a combined $15 million over three years for Bitcoin security research, including quantum resistance.

Scale and context

These commitments are real but modest against a trillion-dollar asset. The consortium pledge averages $5 million a year. That funds research and developer time; it does not fund a migration. The money buys proposals, reviews and tooling, which is the right first step.

The crypto sector is also not uniquely behind. DigiCert's second annual PQC survey of 1,001 IT and security decision-makers in May 2026 found 87% of organizations planning, testing or implementing PQC. Only 7% had deployed quantum-safe or hybrid cryptography across most of their digital certificates. The survey is cross-sector, not crypto-specific, and no comparable crypto custody figure exists in our sources.

Privacy DeFi: Confidentiality Is Not Quantum Resistance

Starknet's Shinobi was a privacy upgrade

Starknet v0.14.2, "Shinobi," went live on mainnet on April 21, 2026. It added SNIP-36 native STARK proof verification for private transactions. It laid groundwork for STRK20, a shielded ERC-20 framework, and strkBTC, a privacy-preserving BTC bridge.

The source describes no quantum-signature feature. Starknet's chain TVL was about $163.13 million on October 7, and STRK had a market capitalization of about $360.37 million at about $0.0486.

Privacy capital is modest

Privacy protocols hold modest capital. Railgun had TVL of about $114.97 million and Tornado Cash about $731.84 million on October 7 (DefiLlama).

Whether privacy systems are quantum-resistant is a separate question that our sources do not answer for Railgun or Tornado Cash. Hiding a transaction graph today and keeping funds safe from a future CRQC are different properties, and buyers should ask about each separately.

Standards Exist, but Crypto-Specific Mandates Are Not in Evidence

The core standards exist. NIST approved three standards on August 13, 2024: FIPS 203 (ML-KEM, key encapsulation), FIPS 204 (ML-DSA, signatures) and FIPS 205 (SLH-DSA, hash-based signatures). ML-KEM protects key exchange, not signatures, so it is not a drop-in replacement for ECDSA. Blockchains need ML-DSA, SLH-DSA or comparable signature schemes.

Policy timelines are forming outside the crypto sector. The EU NIS Cooperation Group, supported by the European Commission, adopted the Coordinated Implementation Roadmap for the Transition to PQC in June 2025. All member states should start transitioning by end-2026, and high-risk use cases should move to PQC no later than end-2030. The Commission's PQC Recommendation dates from April 2024.

None of the sources reviewed for this report identifies a binding quantum-readiness requirement specific to crypto custodians, in the EU or elsewhere. The EU dates nonetheless line up with industry targets. Google's 2029 migration goal, the EF's December 2029 target and the EU's end-2030 high-risk milestone all fall in 2029-2030, though they cover different systems.

Exposure Data: Live Market Figures (October 7, 2026)

The table below sets live market data beside the quantum-relevant point for each asset. All figures are from DefiLlama and CoinGecko as of October 7, 2026.

Asset or metric	Value (Oct 7, 2026)	Quantum-relevant point	Evidence
BTC market cap	$1.68T	BIP-360 is a Draft soft fork, not activated	F1, F19
ETH market cap	$312.75B	EF targets a quantum-resistant L1 by Dec 2029	F2, F38
SOL market cap	$68.35B	Google paper credits PQ progress; activation unreported	F3, F29
XRP market cap	$89.91B	Google paper credits PQ progress; activation unreported	Live data, F29
USDT supply	$184.27B (58.6% share)	Issuer-controlled contracts match Google's admin category (paper covers Ethereum; supply is all chains)	F4, F25
USDC supply	$73.87B (23.5% share)	Issuer-controlled contracts match Google's admin category (paper covers Ethereum; supply is all chains)	F5, F25
XAUT market cap	$3.32B	Supported in self-custodial tether.wallet	F6, F31
Ethereum DeFi TVL	$52.35B	Immutable contracts require redeploy-and-migrate	F7; our analysis
Starknet TVL	$163.13M	Shinobi was a privacy upgrade, not a PQ signature upgrade	F8, F30
STRK market cap	$360.37M	No quantum-signature feature described	F9, F30
Railgun TVL	$114.97M	Quantum properties not addressed in sources	F10
Tornado Cash TVL	$731.84M	Quantum properties not addressed in sources	F11

A second comparison shows how the 2026 response stacks up by type and status.

Initiative	Date	Type	Status
Coinbase Independent Advisory Board	Jan 21, 2026	Research and recommendations	Position paper published Apr 2026
EF Post Quantum team	Jan 24, 2026	Protocol R&D, two $1M prizes	Active
BIP-360 (P2MR)	Merged Feb 11, 2026	Consensus soft fork proposal	Draft, not activated
Galaxy Bitcoin Quantum Readiness Initiative	Jul 21, 2026	Up to $5M grants	Launched
Bitcoin Security Consortium	Jul 23, 2026	$15M over three years	Launched
StarkWare QSB	Aug 26, 2026	Script-only spend, no fork	Nonstandard, last resort
EF quantum-resistant L1	Reported Sep 8, 2026	Dec 2029 target; EIP-8141 must-ship	Target, not deployed

Risks

Admin and upgrade keys on stablecoins and RWAs: High. A single derived key could compromise an entire asset. Trigger: a further cut in CRQC resource estimates before stablecoin and RWA issuers disclose how their admin keys will migrate.

Dormant Bitcoin with exposed keys: High. Lost-key coins with exposed public keys cannot be migrated. Trigger: credible CRQC hardware progress that forces Bitcoin to choose whether and how to restrict those coins, a contested social decision.

Bitcoin soft-fork coordination: High. BIP-360 is a Draft and has not been activated. Trigger: hardware milestones arriving faster than proposal review, leaving holders with only costly, nonstandard options like QSB.

KZG trusted setup: Medium. Recovery of the setup secret would create a reusable classical exploit for forging data-availability proofs. Trigger: a working CRQC before Ethereum replaces or hardens the setup; low near-term likelihood, severe impact.

BLS consensus signatures: Medium. Ethereum's staked ETH depends on BLS12-381 signatures. Trigger: slippage in the EF's December 2029 target or a narrowed CRQC timeline.

Self-custody migration lag: Medium. Users must move funds themselves, and many will not. Trigger: wallets shipping post-quantum options that see low adoption.

Misreading QSB as a solution: Medium. Treating a last-resort script as network protection could delay real work. Trigger: custodians or treasuries citing QSB in place of a migration plan.

Narrative-driven repricing: Medium. At least one allocator, Jefferies' Christopher Wood, has cited quantum risk when cutting bitcoin exposure. Trigger: a headline paper or hardware result that moves timelines and prompts more allocation changes.

Regulatory mandates on crypto custodians: Low. No crypto-specific binding requirement appears in our sources. Trigger: authorities extending the EU's end-2030 high-risk milestone explicitly to crypto custody.

Outlook

Our evidence supports a measured stance. The threat estimate moved materially in 2026, and the industry responded with money, teams and targets. Protocol-level activation is still absent, and Google judges that migration time remains shorter than the time to a CRQC. The next three to six months are unlikely to resolve either side. The scenarios below are our estimates, not forecasts drawn from any source.

Base case: research advances, no activation (estimated 65%)

BIP-360 remains a Draft. The EF continues Hegotá work on EIP-8141. The Coinbase board, Galaxy and the consortium publish research and fund grants. No major chain activates a post-quantum migration, and QSB stays a niche tool for a few large holders. We weight this highest because every 2026 initiative is at the research or target stage, and nothing in the evidence points to near-term activation.

Upside case: concrete steps on the hardest exposures (estimated 20%)

A major stablecoin or tokenized-asset issuer publishes a post-quantum plan for its admin keys. BIP-360 advances beyond Draft status, or EIP-8141 reaches public testing. Either would address the exposures this report ranks highest. We keep this at 20% because none of these steps is announced in our sources.

Downside case: timelines compress faster than plans (estimated 15%)

A new resource estimate or hardware result narrows the migration margin again. More allocators follow Jefferies in cutting exposure, and debate over dormant BTC turns contentious. We keep this lower because Google's own assessment still places CRQC arrival beyond migration time.

Takeaways

Traders: Quantum headlines can move allocations before they move risk. Distinguish resource-estimate papers and hardware results, which change timelines, from demonstrations like QSB, which do not protect existing coins.

Builders: Treat upgrade and admin keys as the primary exposure, not an afterthought. Design for post-quantum signatures through account abstraction where available, and plan redeploy-and-migrate paths for immutable contracts. Do not market privacy features as quantum resistance.

Investors: Ask issuers and custodians three questions. Which keys control the asset, and what is the post-quantum plan for them? Is there a dated migration target? Does the plan depend on a protocol change that is still a draft? Dated public targets, such as the EF's L1 goal, offer a reference point for judging whether a plan is on time.

Updated October 2026: this report was reviewed against primary sources and live market data. Figures, dates and claims were corrected where needed, and a sources list was added.