Field notes · Crypto custody · Post-quantum
What Q-Day means for crypto custody
Bitcoin and Ethereum rely on elliptic-curve signatures that a large quantum computer could break. Which coins are exposed first, why address reuse matters, and what custodians can do now.
“Q-Day” is shorthand for the day a quantum computer can break the public-key cryptography in wide use today. For most systems, that’s a confidentiality problem. For cryptocurrency, it’s a direct path to theft: Bitcoin and Ethereum authorize every transaction with elliptic-curve signatures (ECDSA and, for Bitcoin Taproot, Schnorr), and Shor’s algorithm can recover a private key from its public key.
Exposure depends on whether the public key is visible
A quantum attacker needs your public key, not just your address. Many address types are a hash of the public key, and the public key itself only appears on-chain when you spend from the address. That makes exposure uneven:
- Exposed now: outputs that put the public key directly on-chain, such as early pay-to-public-key outputs; Taproot outputs, which commit to a tweaked public key that a quantum attacker could work from; and any hashed address that has already spent funds and still holds a balance, because spending revealed its public key.
- Exposed only while spending: funds in a never-used hashed address. The public key appears when the spending transaction is broadcast, so an attacker would have to break it in the minutes before the transaction confirms. That’s a far harder race, but not one to bet on indefinitely.
- Ethereum accounts: an externally owned account reveals its public key with its first outgoing transaction. Any account that has ever sent a transaction should be treated as exposed.
What custodians can do now
- Stop reusing addresses. Send change to fresh addresses and sweep balances off any address that has already spent. It costs little and removes the easiest targets.
- Inventory exposure. Know how much of your holdings sit in outputs with visible public keys, and plan to consolidate them into fresh, unused addresses.
- Prefer hashed address types for cold storage. Long-term holdings are better in outputs whose public keys haven’t been revealed.
- Make your signing stack algorithm-agile. Proposals for quantum-resistant output types are under active discussion in both ecosystems. Custody platforms that can add a new signature scheme without a rebuild will move first when one is adopted.
- Watch the long tail. Coins in exposed outputs whose owners have lost their keys can’t be moved by anyone legitimate. How each network handles them is still an open question, and it could affect markets on Q-Day.
Why this shapes how we work
Years of tracing stolen cryptocurrency taught me that funds are rarely lost to broken math. They’re lost to key handling, reused addresses and processes nobody tested. A quantum computer adds a new way to exploit those same weaknesses, which is why the fixes above are worth making regardless of when Q-Day arrives.
If you run custody or treasury infrastructure and want a quantum-exposure review, talk to us.