On-chain analytics firm Glassnode has issued a stark warning that over 6 million bitcoins are sitting in addresses that use cryptography vulnerable to quantum attacks. According to Glassnode's latest analysis, these coins are parked in older address formats that haven't been updated to use more secure cryptographic methods, making them particularly exposed if quantum hardware catches up to the threat. The firm's warning represents a call to action for the broader crypto ecosystem, as the 6 million-plus bitcoins worth represents a massive chunk of the circulating supply that could face serious vulnerability if quantum computing advances faster than industry preparedness. Quantus has now reinforced this urgency, warning that the cryptocurrency industry may be entering a phase where technological risk is advancing faster than institutional and technical responses, with the $2.7 trillion crypto ecosystem currently at risk.
A new quantum computing report from Quantus warns that continued progress in quantum computing may be compressing cryptographic timelines for crypto, highlighting risks to blockchains, wallets, and exchanges. According to The State of Quantum report, recent breakthroughs in quantum hardware and error correction have collectively reduced prior assumptions about the computational requirements needed to threaten widely used public-key cryptography. The report argues that the digital asset sector may be entering a critical phase where technological advancement outpaces preparedness. While Glassnode notes that current quantum machines aren't capable of cracking bitcoin's cryptographic security, the rapid pace of development in the field is what's driving the urgency to prepare. Christopher Smith, CEO of Quantus, emphasized that "Crypto does not get a clean warning bell before Q-Day."
Among the most significant developments highlighted in the report was Google Quantum AI's March 2026 paper, which estimated that Shor's algorithm could break the secp256k1 elliptic curve used by Bitcoin with fewer than 500,000 physical qubits under certain hardware assumptions. The report noted that three research papers released within roughly a year reduced the projected quantum resources needed to attack elliptic curve cryptography by nearly an order of magnitude. While no existing machine can currently break Bitcoin encryption, the estimated resource requirements have dropped sharply within a short period, highlighting the accelerated pace of quantum computing development. Most major blockchain systems continue to rely on elliptic-curve-based signature schemes such as ECDSA and Ed25519, which are theoretically vulnerable to Shor's algorithm once sufficiently powerful quantum hardware becomes available.
The report highlights a critical difference between cryptocurrencies and traditional internet companies regarding quantum preparedness. Unlike centralized services that can quietly update encryption standards through software patches, blockchains expose public keys permanently on public ledgers, leaving millions of addresses visible for future attacks. This creates what the report describes as a 'harvest now, crack later' risk, where attackers could collect blockchain data today and wait for sufficiently powerful quantum systems to emerge later. Quantus notes that public keys recorded on-chain remain permanently visible, while repeated address usage and legacy wallet structures have contributed to a persistent exposure surface within older blockchain systems. Unlike conventional internet infrastructure, which can more easily rotate cryptographic primitives through software updates, blockchain networks face additional constraints due to decentralized governance structures and user-controlled asset custody.
Despite the accelerated quantum timeline, the report notes that much of the technology industry has already started preparing for post-quantum cryptography. NIST finalized post-quantum encryption standards, including ML-DSA, ML-KEM, and SLH-DSA in August 2024, while companies such as Google, Signal, Apple, and Cloudflare have already begun deploying post-quantum protections with migration targets extending into 2029 and 2030. However, as Glassnode emphasizes, the transition involves serious technical complexity - you can't just flip a switch and update every legacy address overnight. The migration requires coordination across developers, exchanges, custodians, and individual holders. Quantus warns that delayed implementation may increase the likelihood that any transition toward post-quantum security occurs under reactive and high-pressure conditions rather than through coordinated planning. A typical ECDSA transaction contains approximately 97 bytes of signature and public key data, while an equivalent transaction using ML-DSA-87 would expand to roughly 7,187 bytes, representing an increase of about 74 times.
