Post-Quantum Cryptography: A Plain-English Guide for Crypto Holders

Post-quantum cryptography is, despite the name, a present-tense problem. It’s about what’s already been written on every blockchain that uses elliptic-curve signatures, which is to say all of them.

The frame worth using here is what I’d call primitive risk. Cryptographic primitives are the math building blocks every higher-level system depends on, things like hash functions, signature schemes, key exchange protocols, and the symmetric ciphers underneath your VPN. Some primitives hold up under quantum attack. Others don’t. A crypto holder’s job is to know which is which, and act accordingly.

That’s the guide in two paragraphs. The rest is detail.

What survives, and what doesn’t

Quantum computers break some kinds of cryptography. Others come through unscathed.

Shor’s algorithm, the famous one, efficiently solves two math problems on a sufficiently large quantum computer. Those problems are factoring large integers and computing discrete logarithms. Those happen to be the foundation of almost every public-key cryptography scheme in use today, including RSA, Diffie-Hellman, ECDSA, and Schnorr signatures. Crypto holders care about ECDSA and Schnorr specifically because those are what Bitcoin and most other chains use to sign transactions.

Grover’s algorithm, the second-most-famous, gives quadratic speedup for unstructured search. Applied to symmetric encryption and hash functions, it effectively halves the security level. AES-256 drops to 128-bit security against a quantum attacker, which is still computationally infeasible. SHA-256 falls to 128-bit preimage resistance, also out of reach of any plausible attacker.

So the picture is asymmetric. Symmetric cryptography and hash functions survive with their security parameters doubled if needed. Public-key cryptography needs replacement.

That’s the gap PQC is built to close.

What NIST standardized

The U.S. National Institute of Standards and Technology ran a multi-year competition to standardize post-quantum cryptographic algorithms. The first three winners were finalized in August 2024.

Two of them cover digital signatures. ML-DSA (Module-Lattice-based Digital Signature Algorithm) is the workhorse, based on lattice math believed to resist both classical and quantum attacks. SLH-DSA (Stateless Hash-Based Digital Signature Algorithm) is the conservative option, based purely on hash functions that cryptographers have been beating on for fifty years. The trade-off with SLH-DSA is signature size, which can run to 49 KB at higher security levels.

The third is ML-KEM (Module-Lattice-based Key Encapsulation Mechanism), which replaces key exchange protocols like Diffie-Hellman. That one is more relevant to TLS than to crypto holders directly.

The crypto-specific wrinkle

Most discussion of PQC focuses on TLS and encrypted communications. The general framing is that data captured today can be decrypted later when quantum computers arrive. That problem is real.

Crypto holders have a sharper version of the same problem because of how blockchains work. On a blockchain, public-key cryptography is published in the clear by design. The protocol publishes everything that’s needed for verification, including the public key the moment you spend. Every time you’ve spent from a Bitcoin address, your public key sits on chain forever. Anyone who builds a working quantum computer in 2030 or 2035 can scroll back through 17 years of chain history to find exposed public keys that control real value.

This is the harvest-now-decrypt-later problem with the harvest step pre-done by the protocol. Every full node syncing the chain is doing the capture for any future attacker, for free.

Where the standards conversation is

The standards conversation in crypto is divided.

Bitcoin has a draft BIP-360 (Pay-to-Merkle-Root, or P2MR) co-authored by Hunter Beast with Ethan Heilman and Isabel Foxen Duke. It proposes a new quantum-resistant address type and removing Taproot’s quantum-vulnerable key-path spend. The draft is still being debated, and Bitcoin’s social process for consensus changes runs at a deliberate pace.

Ethereum has been more vocal. Vitalik Buterin published a roadmap entry in 2024 that describes a possible PQC migration. The plan uses STARKs (already quantum-safe for hash-based proofs) and a hard fork to swap signature schemes. The timeline is no more concrete than Bitcoin’s.

Solana, Cardano, Avalanche, Polkadot, and the rest of the L1 chains have no deployed quantum-resistant signature scheme. The standards bodies behind the underlying cryptography are further along than the blockchain communities adopting them.

The practical layer

This is where the calibrated answer beats the dramatic one.

If you hold Bitcoin in addresses that have spent (which is most of them, especially if you’ve moved coins between exchanges and wallets), your public keys are exposed. Today’s quantum computers can’t do anything with them. The future quantum computer that could is years to decades away under any forecast someone willing to defend it would offer.

The practical hygiene is the same as the hygiene I’ve recommended in earlier pieces in this series. Don’t reuse addresses. Use P2WPKH for long-term holdings rather than Taproot, which keeps the public key behind a hash until first spend. These steps buy time. They keep your specific holdings out of the easy-target pile while the standards conversation matures.

For holders of other chains, the equation is similar, but the practical hygiene is chain-specific. Watch for migration announcements from your chain’s developers, and don’t assume your hardware wallet will keep up automatically. Firmware updates will be required for whichever PQC scheme your chain adopts.

The honest picture

Plain English version. A small number of cryptographic primitives, the ones based on factoring or discrete logarithms, will eventually break under quantum attack. The replacements have been standardized. Crypto migration to those replacements hasn’t happened yet and is going to take years. Until it does, exposed public keys on chain are accumulating quantum exposure on a timer no one can quite size.

The asterisks. Quantum computers capable of running Shor at scale don’t exist yet, and the most credible forecasters won’t put a year on when they will. The threat itself is well-understood. The pipeline that delivers a solution is the variable to watch.

The cryptography under your coins has a finite shelf life. Pay attention to the standards and practice the hygiene, but don’t panic on someone else’s timeline. That’s the whole guide.