Quantum computing and blockchains: Matching urgency to actual threats

A post on a16z crypto's blog argues that timelines to a cryptographically relevant quantum computer are frequently overstated, and that calls for wholesale transitions to post-quantum cryptography often overlook the costs and risks of premature migration as well as the differing risk profiles of cryptographic primitives. The author, a16z crypto's researcher writing under a personal byline, states that a CRQC, defined as a fault-tolerant, error-corrected machine able to run Shor's algorithm against secp256k1 or RSA-2048 within roughly one month of sustained computation, is "highly unlikely" in the 2020s. He notes that current platforms, across trapped ions, superconducting qubits and neutral atoms, fall far short of the hundreds of thousands to millions of physical qubits required, and that qubit count alone is misleading without adequate connectivity, gate fidelity and sustained error-corrected circuit depth.

The article identifies several sources of public confusion, including "quantum advantage" demos targeting contrived tasks, claims of many thousands of physical qubits that refer to quantum annealers rather than gate-model machines, and loose use of the term "logical qubit." It cites one announcement claiming 48 logical qubits using a distance-2 code with two physical qubits per logical qubit, which the author calls absurd because such codes can only detect errors. He also cites Scott Aaronson's statement that a fault-tolerant Shor's run is a live possibility before the next U.S. presidential election, while noting Aaronson's bar is factoring 15, not a cryptographically relevant calculation. On the U.S. government's 2035 target for wholesale post-quantum migration of government systems, the author calls this a reasonable transition timeline but not a forecast of CRQC arrival by that date.

On HNDL, the article argues encryption must transition now for data requiring 10 to 50-plus years of confidentiality, since nation-state adversaries may already be archiving encrypted traffic. Digital signatures, which underpin blockchains, face no retroactive confidentiality risk: signatures generated before a CRQC arrives cannot be forged after the fact, so the signature migration is less urgent. Chrome and Cloudflare have deployed hybrid X25519+ML-KEM for TLS, and Apple's iMessage PQ3 and Signal's PQXDH and SPQR protocols use similar hybrid approaches, while rollout of post-quantum signatures in critical web infrastructure is being delayed because current schemes impose performance regressions. The author also argues zkSNARKs face a situation similar to signatures, since their zero-knowledge property remains post-quantum secure even where the underlying elliptic curve cryptography is not, though a CRQC could eventually enable forged proofs.

For blockchains, the article concludes that most non-privacy chains such as Bitcoin and Ethereum are not exposed to HNDL attacks because they use signatures for transaction authorization rather than encryption. Bitcoin's ledger is public, and the quantum threat is private-key derivation and fund theft via signature forgery rather than decryption of already public data. The post's central thesis is that migration planning should match urgency to actual threats rather than to hype.