Circle’s Quantum Warning Gets the Qubit Math Wrong

Can a stablecoin issuer make its token quantum-safe? Not unilaterally. This crucial detail is often overlooked in discussions surrounding Circle’s August 31 disclosure, and it offers more valuable insights than the headline figure that garnered widespread attention.

Let’s reframe the conversation. Circle published a post titled “The Quantum Gap Is Closing,” where it highlighted a record of 813 logical qubits and advised developers to audit their cryptography and prepare for key rotation. This advice is sound, and the urgency is justifiable. However, the use of a single qubit figure as a “threat clock” in the disclosure is where clarification is needed. This is what I refer to as the “coordinate problem”: a data point on a resource graph was presented as a countdown, and these aren’t the same.

What 813 Represents, and What It Doesn’t

Simply put, 813 represents a width, not a weapon. This figure originates from ECDSA.fail, a public challenge that optimizes a reversible point-addition circuit for secp256k1, the curve used by Bitcoin and Ethereum. Submissions are scored by multiplying the peak logical-qubit width by the average Toffoli-gate count. 

This scoring rule is key: you can reduce the qubit count by using more gates, or reduce the gate count by using more qubits. The 813 record represents one specific trade-off along this spectrum. It doesn’t indicate circuit depth, error-correction overhead, or the actual wall-clock time such a system would take to run on real hardware.

The phrase “813 logical qubits” might sound like a threshold that’s almost within reach. However, a March 2026 preprint provides a more comprehensive picture. Its authors estimate that a 256-bit elliptic-curve discrete-log attack would require fewer than 1,200 logical qubits with less than 90 million Toffoli gates, or fewer than 1,450 logical qubits with less than 70 million gates.

The “minutes-scale” version of this scenario assumed a fast-clock superconducting machine, physical error rates near 10^-3, planar connectivity, and fewer than 500,000 physical qubits. This resource model explicitly states its assumptions. However, it still doesn’t provide a delivery date, because a resource estimate and a build schedule are distinct concepts.

The Willow Comparison: A Misleading Analogy

Circle’s post states that Google achieved 105 logical qubits with Willow. This specific statement requires correction. Google describes Willow as a 105-qubit processor. The corresponding Nature paper details a 105-physical-qubit system performing a distance-7 surface-code logical-memory experiment across 101 of those qubits. The outcome was a single logical qubit maintained below threshold. This isn’t equivalent to 105 attack-ready logical qubits.

Therefore, the disclosure juxtaposes an 813-logical-qubit attack circuit with a device that demonstrated a single logical qubit of memory, presenting them as comparable on a single scale. They are, in fact, separated by the immense cost of error correction, a cost that the ECDSA.fail score does not include. No cryptographically relevant quantum computer (CRQC) exists today. The immediate threat remains “harvest-now-decrypt-later,” not an imminent breakthrough.

Where Circle’s Disclosure Excels

Despite the aforementioned issues, Circle’s disclosure deserves genuine commendation for its insights into operational planning, a topic often overlooked in post-quantum cryptography (PQC) discussions. Excluding the qubit figures, the disclosure effectively highlights a critical operational challenge.

 USDC operates across 37 mainnet contract rows and was valued at approximately $73.6 billion on September 2. Circle has the ability to rotate the keys it controls. It can freeze, pause, blacklist, mint, and upgrade its own token contracts through its EVM FiatToken roles. What it can’t do is rewrite a customer’s private key, re-sign a custodian’s stack, or unilaterally change the signature verifier on Ethereum, Solana, or the XRP Ledger.

This brings us back to the coordinate problem, but applied to governance rather than qubits. An XRPL amendment requires over 80% trusted-validator support sustained for two weeks. Algorand protocol changes demand an on-chain supermajority.

Stellar upgrades depend on validator consensus. None of these decisions are solely within Circle’s control. Solana signs with Ed25519, Polkadot accounts utilize sr25519, Ed25519, or ECDSA, and an Ethereum externally owned account reveals its public key the moment it signs. No single activation height can encompass this diverse landscape.

Rather than a simple cryptographic switch, this is a program with numerous veto points. The weakest link may not be the chain with the slowest proposal. Instead, it could be a custodian unable to rotate thousands of accounts in time, a bridge whose emergency controls still rely on an exposed key, or a group of users who fail to migrate before an old signature path becomes obsolete. A freeze can contain an incident, but it doesn’t make a stolen key secure, nor does it affect a host chain’s verifier.

Arc’s Support for Signatures Versus Switching Them

The phrase “supports SLH-DSA“ in the disclosure is doing subtle but important work. Arc’s execution layer includes a precompile that can verify SLH-DSA-SHA2-128s signatures. The ability to verify a signature type allows a contract to check it, but it doesn’t replace the signature that authorizes a typical transaction. Arc’s own custody guide still specifies secp256k1 ECDSA signing, and its post-quantum roadmap outlines opt-in beta wallet signatures at mainnet launch, with validator signatures following later. Circle hasn’t yet chosen a final transaction-signature scheme and anticipates using hybrid ECDSA during migration.

Therefore, Arc serves as a testing ground for a hybrid design on a controllable layer. It can’t make USDC quantum-safe on the other 35 mainnet rows simply by adopting something new.

Circle deserves full credit for its proactive approach. It has moved post-quantum work into present-tense planning, which is a direction that NIST also supports. FIPS 205 standardized SLH-DSA, and the 2035 horizon refers to deprecation from standards. Preparation now is prudent, even if the breakthrough is a decade or more away.

The flaw in the disclosure is narrow and specific. It leveraged a “threat clock” it didn’t need to make a scheduling argument it already had. A migration of this distributed nature doesn’t require a manufactured deadline to justify itself. It requires inventories, tested destination account types, and a clearly defined end state to prevent hybrid acceptance from becoming a permanent classical bypass. At a minimum, 813 should be viewed as a data point on a cost curve, not a number on a doomsday timer. The coordinate is genuine; the countdown was added later.