- Research shows hypothetical Bitcoin encryption risk via short-range attack
- Current quantum hardware lags behind required scale to crack cryptography
- Breakthrough heightens urgency for Post-Quantum Cryptography solutions
- Near-term alarm unwarranted, focus on preparation against long-range attacks
Quantum leap. While quantum computing has been a known risk to cryptocurrency for some time, a recent Mar 2026 whitepaper by Google Quantum AI and researchers from Stanford suggests that a cryptographically relevant quantum computer (CRQC) could break Bitcoin's elliptic curve cryptography (ECC) encryption with 500,000 qubits, a c.20x improvement over previous estimates, shaving the time required from hours down to just c.9 minutes. This raises more serious concerns for Bitcoin, given that the Bitcoin blockchain currently takes c.10 minutes for transactions to be mined. That one-minute margin now poses a threat to every live transaction in the mempool.
Risks will go beyond crypto. It is important to note that this technology does not yet exist today – Google’s most advanced chip (“Willow”) has merely 105 qubits, a far cry from the 500,000 qubit theoretical requirement. The discovery, however, brings forward the advent of Q-day (Quantum Day) – the hypothetical future date when quantum computers become powerful enough to break widely used encryption protocols such as RSA and ECC – that will threaten not only cryptocurrency, but all manner of global data security, affecting major industries including banking, government, communications infrastructure, and much more. At that point, Bitcoin might be the least of one’s concerns. The upshot is that the need to discover quantum-resistant solutions is now accelerated across industries – solutions that can also be adopted by the cryptosphere at large. We discuss the implications of this quantum breakthrough for cryptocurrency below.
How does quantum break crypto? While classical computers operate on bits that represent either 0 or 1, quantum computers use quantum bits (qubits) that can exist in multiple states simultaneously, enabling them to solve complex problems much faster than classical computing technology. This poses acute risks for cryptocurrency wallets, which rely on asymmetric ECC to derive the public-private key pair (see our publication “The Cryptocurrency Handbook”, published 13 Mar 2026, for a deeper dive on how it works). Should quantum computing be able to derive private keys from public keys – a feat that would require classical computers longer than the age of the universe to do – it would be akin to reverse-engineering a bank PIN code from any bank account number, leaving vast amounts of cryptocurrency at risk of misappropriation.
Preparing for the apocalypse.That said, steps have already been taken to mitigate “long-range” or “at-rest” quantum attacks – referring to the extraction of cryptocurrencies from dormant wallets whose public keys have been exposed. Recognising this critical vulnerability, Pay-to-Public-Key (P2PK) addresses are no longer supported by most wallets today. Additionally, addresses that have been reused are also at risk because the act of transacting reveals the public key, which is why modern wallet software typically avoid address reuse. Current estimates place the number of at-risk Bitcoin from P2PK addresses and reused addresses at c.6.7mn – a third of total supply – which must be migrated to modern wallets to prevent “long-range” attacks. .
Like catching a bullet. Google’s white paper, however, opens the door to the possibility to a “short-range” or “on-spend” attack, which targets transactions in transit. In theory, an attacker with access to advanced quantum architecture could intercept the public key of a Bitcoin transaction after it is broadcast to the mempool, derive the private key, and upload a fraudulent competing transaction before the 10 minute window of confirmation of the original block. While block times of Ethereum (12-15s), Solana (0.4-0.5s), and XRP (3-5s) greatly reduce the probability of a successful on-spend attack using early fast-clock CRQCs, theoretical advances and increases in the number of qubits could eventually introduce vulnerabilities to these blockchains as well.
Solutions to the quantum problem. Major cryptocurrency blockchains are already moving towards Post-Quantum Cryptography (PQC). The Ethereum Foundation, for example, launched a website dedicated to post-quantum security, targeting full migration by 2029. Bitcoin, meanwhile, has a widely known proposal BIP-360, which introduces a new Pay-to-Merkle-Root address type that would render Taproot addresses immune to “long-range” attacks. Replacing Bitcoin’s signature ECDSA/Schnorr algorithms with quantum-resistant alternatives, however, is more complicated and will take further proposals and consensus. These need to be extensively reviewed and tested to gain the trust of the developer community, while also satisfying Blockchain’s limited block space and throughput efficiency.
How does quantum break crypto?While classical computers operate on bits that represent either 0 or 1, quantum computers use quantum bits (qubits) that can exist in multiple states simultaneously, enabling them to solve complex problems much faster than classical computing technology. This poses acute risks for cryptocurrency wallets, which rely on asymmetric ECC to derive the public-private key pair (see our publication “The Cryptocurrency Handbook”, published 13 Mar 2026, for a deeper dive on how it works). Should quantum computing be able to derive private keys from public keys – a feat that would require classical computers longer than the age of the universe to do – it would be akin to reverse-engineering a bank PIN code from any bank account number, leaving vast amounts of cryptocurrency at risk of misappropriation.
A fork in the road.Should quantum computing become an existential threat, it is likely that the community of developers, users and nodes would eventually reach some consensus on quantum-resistant solutions and undergo a great migration of distributed keys. The issue would then become a philosophical one for those left behind: How does one treat “dormant” addresses that have not migrated post Q-day? It is not likely that consensus would be reached on this matter, leading to a controversial fork with two options.
Leaving stale addresses as is.This would leave dormant or lost Bitcoin vulnerable to attack and theft, including the c.1.1mn BTC that Satoshi Nakamoto has held dormant since genesis. Given that Bitcoin is an extremely hard asset, this could potentially become a means of “re-harvesting” lost or dormant coins and reintroducing them back into circulation, although it is unclear how these coins would be treated from a legal and regulatory perspective
Disabling/freezing dormant coins. This would prevent quantum theft but runs the risk of being confiscatory, as it is impossible to distinguish between dormant coins and truly “lost” coins. Disabling the use of dormant coins also runs counter to the ideals of Bitcoin’s “not your keys, not your coins” philosophy.
These are still speculative outcomes that will only matter post Q-day. For now, we think that it is still too early to be panic about this existential threat, considering that there are post-quantum solutions for every quantum breakthrough. Moreover, even if a fork were to occur, current Bitcoin owners would still own both versions, giving them – and the market – time to decide which should be worth more.
What should you do now?In conclusion, while the risks of a successful “short-range” attack have marginally risen following this breakthrough, the wide gulf between current technological limits and theoretical requirements is too far to be anxious about. One must also distinguish between what is possible and what is feasible; in theory, should all of big tech decide to channel their free cash flows towards purchasing ASIC chips to conduct a 51% attack, they could succeed but it would be highly economically unfeasible to do so. We think the outcome is no different here with quantum technology due to the high costs of compute required. Also, cryptocurrency communities have shown great propensity to galvanise together to overcome the frictions of decentralised consensus when the need arises (e.g. Ethereum’s migration to Proof-of-Stake), and they have survived philosophical forks before (e.g. Ethereum Classic and Bitcoin Cash); this would just be another obstacle to overcome in the name of progress.
More urgently for now, cryptocurrency holders should adopt best practices to guard against “long-range” attacks, including (a) holding coins in fresh, unused addresses, (b) avoiding address reuse in transactions, or simply (c) using more updated wallet software. Keep informed on new developments, especially for post-quantum compatibility from wallets, exchanges, and custody providers, as early adopters will be far better prepared for Q-day when it comes.
Figure 1: The race against the block – attack speed versus block confirmation
Source: Google Quantum AI, University of California Berkeley, Ethereum Foundation, Stanford University, DBS
Download the PDF to read the full report.
Topic
This information is for your private use only and may not be passed on, reposted or reproduced. The contents of this information are strictly confidential and are not transferrable, assignable or meant for reissuance to any third party, whether in whole or in part.
This information does not constitute or form part of any offer, recommendation, invitation or solicitation to subscribe to or to enter into any transaction. It does not have regard to your specific investment objectives, financial situation or particular needs. It is not intended to provide, and should not be relied upon for accounting, legal or tax advice.
All investments involve risks and you can lose part or all of your investment. You should carefully read the product offering documentation and any product terms before making any investment. If you have any doubt, please seek independent professional advice or otherwise you should carefully consider whether any product mentioned in this publication is suitable for you. Any investment product(s) mentioned herein is/are not the only product(s) that is/are aligned with views stated herein and may not be the most preferred or suitable product for you. There are other investment product(s) available in the market which may better suit your investment profile, objectives and financial situation.
DBS or persons/entities connected to the DBS Group may, or in the future, have interests in and may affect transactions in the underlying product(s) mentioned. Companies connected to DBS may have arrangements with the issuer(s) of the underlying product(s) to market or sell its product(s). Where any company within the DBS Group is the product provider, such company may be receiving fees from the investors. In addition, companies within the DBS Group may also perform broking, investment banking and other banking or financial services to the issuers or the related companies.
DBS Group does not make any warranty as to this information’s accuracy, timeliness, adequacy or completeness for any particular purpose, and thus accepts no responsibility for any losses whatsoever arising from or in connection with the use or reliance on this information and any related documents. Past performance is no guarantee of future results, and future results may not meet your expectations due to a variety of economic, market and other factors. This information is subject to change without notice. All figures and amounts stated are for illustration purposes only and shall not bind DBS Group.
If this information has been distributed by electronic transmission, such as e-mail, then such transmission cannot be guaranteed to be secure or error-free.
This information is not directed to, or intended for distribution to anyone who is a citizen or resident of or located in any jurisdiction where such distribution, publication, availability or use would be contrary to law or regulation.
This publication has not been reviewed or authorised by any regulatory authority in Singapore, Hong Kong, Dubai International Financial Centre, Thailand, United Kingdom or elsewhere. There is no planned schedule or frequency for updating the information discussed in this publication.
If any specific product(s) are mentioned herein, such investment product(s) is/are are not the only product(s) that is/are aligned with the views stated in the research report(s) and may not be the most preferred or suitable product for you. There are other investment product(s) available in the market which may better suit your investment profile, objectives and financial situation.
The English version of all documents shall apply and prevail over that in other languages that may be provided for your reference.
Dubai International Financial Centre
This communication is provided to you as a Professional Client or Market Counterparty as defined in the DFSA Rulebook Conduct of Business Module (the "COB Module"), and should not be relied upon or acted on by any person which does not meet the criteria to be classified as a Professional Client or Market Counterparty under the DFSA rules.
This communication is from the branch of DBS Bank Ltd operating in the Dubai International Financial Centre (the "DIFC") under the trading name "DBS Bank Ltd. (DIFC Branch)" ("DBS DIFC"), registered with the DIFC Registrar of Companies under number 156 and having its registered office at units 608 - 610, 6th Floor, Gate Precinct Building 5, PO Box 506538, DIFC, Dubai, United Arab Emirates.
DBS DIFC is regulated by the Dubai Financial Services Authority (the "DFSA") with a DFSA reference number F000164.
Where this communication contains a research report, this research report is prepared by the entity referred to therein, which may be DBS Bank Ltd or a third party, and is provided to you by DBS DIFC. The research report has not been reviewed or authorised by the DFSA. Such research report is distributed on the express understanding that, whilst the information contained within is believed to be reliable, the information has not been independently verified by DBS DIFC.
Unless otherwise indicated, this communication does not constitute an "Offer of Securities to the Public" as defined under Article 12 of the Markets Law (DIFC Law No.1 of 2012) or an "Offer of a Unit of a Fund" as defined under Article 19(2) of the Collective Investment Law (DIFC Law No.2 of 2010).
The DFSA has no responsibility for reviewing or verifying this communication or any associated documents in connection with this investment and it is not subject to any form of regulation or approval by the DFSA. Accordingly, the DFSA has not approved this communication or any other associated documents in connection with this investment nor taken any steps to verify the information set out in this communication or any associated documents, and has no responsibility for them. The DFSA has not assessed the suitability of any investments to which the communication relates and, in respect of any Islamic investments (or other investments identified to be Shari'a compliant), neither we nor the DFSA has determined whether they are Shari'a compliant in any way.
Any investments which this communication relates to may be illiquid and/or subject to restrictions on their resale. Prospective purchasers should conduct their own due diligence on any investments. If you do not understand the contents of this document you should consult an authorised financial adviser.
Hong Kong
This publication is distributed by DBS Bank (Hong Kong) Limited (CE Number: AAL664) (“DBSHK”) which is regulated by the Hong Kong Monetary Authority (the "HKMA") and the Securities and Futures Commission. In Hong Kong, DBS Private Bank is the private banking division of DBS Bank (Hong Kong) Limited.
To the extent that DBSHK does not solicit the sale of or recommend any financial product to you or where any service is provided as a transactional execution service, DBSHK is not acting as your investment adviser or in a fiduciary capacity to you. If DBSHK solicits the sale of or recommends any financial product to you, the financial product must be reasonably suitable for you having regard to your financial situation, investment experience and investment objectives. No other provision of this document or any other document DBSHK may ask you to sign and no statement DBSHK may ask you to make derogates from this clause.
In any case, DBSHK has not given and will not give any representation, guarantee or other assurance as to the outcome of any investment based on the information provided. “Financial product” means any securities, futures contracts or leveraged foreign exchange contracts as defined under the Securities and Futures Ordinance (Cap.571 of the Laws of Hong Kong). Regarding “leveraged foreign exchange contracts”, it is only applicable to those traded by persons licensed for Type 3 regulated activity. The Information has not been reviewed or authorised by the HKMA, or any regulatory authority elsewhere.
This publication is provided to you as a “Professional Investor” (defined under the Securities and Futures Ordinance of Hong Kong).
DBSHK is not the issuer of the research report unless otherwise stated therein. Such research report is distributed on the express understanding that, whilst the information contained within is believed to be reliable, the information has not been independently verified by DBSHK.
India
This document is provided by DBS Bank India Ltd. (“DBIL”) for information purpose only, on “as is” basis. It does not create any legally binding obligations on DBIL. This document is not intended to be source of advice in respect of the material presented or information published, and shall not be construed to be legal, tax, financial or investment advisory. This document is not, and should not be construed as, an offer, invitation, recommendation or solicitation to enter into any transaction in relation to any of the products and services mentioned herein. DBIL does not make any warranty of any kind, express or implied, including but not limited to warranties of completeness, accuracy of information, merchantability or fitness for a particular purpose. This document has not been registered and/or approved by any governmental or regulatory authority in any jurisdiction including but not limited to the Securities and Exchange Board of India, the Reserve Bank of India or any other governmental or regulatory body in India.
Indonesia
This publication is distributed by PT Bank DBS Indonesia (DBSI). DBSI is licensed and supervised by the Indonesia Financial Services Authority (OJK). This publication is not and does not constitute or form part of any offer, recommendation, invitation or solicitation to you to subscribe to or to enter into any transaction as described, nor is it calculated to invite or permit the making of offers to the public to subscribe to or enter into any transaction for cash or other consideration and should not be viewed as such. The Customer should not rely on the information set out herein as the sole basis for any financial decision.
Singapore
This publication is distributed by DBS Bank Ltd (Company Regn. No. 196800306E) ("DBS") which is an Exempt Financial Adviser as defined in the Financial Advisers Act and regulated by the Monetary Authority of Singapore (the "MAS").
This publication is provided to you as an “Accredited Investor” (defined under the Securities and Futures Act of Singapore and the Securities and Futures (Classes of Investors) Regulations 2018) or an “Institutional Investor” (defined under the Securities and Futures Act of Singapore and the Securities and Futures (Classes of Investors) Regulations 2018) for your private use only and may not be passed on or disclosed to any person nor copied or reproduced in any manner.
Thailand
This publication is distributed by DBS Vickers Securities (Thailand) Co., Ltd. (“DBSVT”).
The information contained in this publication is not intended to be either an offer, invitation or solicitation to buy or sell any securities, derivatives, or any other financial products or services, provide financial advice or investment advice, facilitate or take deposits, or provide any other financial products or financial services of any kind in any jurisdiction. This publication is provided for information purposes only and is not intended to provide, and should not be construed as, advice.
This publication has not been reviewed by any regulatory authority in Thailand and has not been registered as a prospectus with the Office of the Securities and Exchange Commission of Thailand. Accordingly, any documents and materials, in connection with the offer or sale, or invitation for subscription or purchase of the securities, derivatives, or any other financial products or services, may only be circulated or distributed by an entity as permitted by applicable laws and regulations. DBS and DBSVT does not have any intention to solicit you for any investment or subscription in the securities, derivatives, or any other financial products or services, and any such solicitation will be made by an entity permitted by applicable laws and regulations.
United Kingdom
This communication is from DBS Bank Ltd., London Branch located at 9th Floor, One London Wall, London EC2Y 5EA. DBS Bank Ltd. is regulated by the Monetary Authority of Singapore and is authorised and regulated by the Prudential Regulation Authority. DBS Bank Ltd. is subject to regulation by the Financial Conduct Authority and limited regulation by the Prudential Regulation Authority. Details about the extent of DBS Bank Ltd., London Branch’s regulation by the Prudential Regulation Authority are available upon request.