01Quantum riskCopy today, read tomorrow
Locked now, open later?
Anyone on the path can keep a copy of today's encrypted traffic. Should a big enough quantum computer ever run Shor's algorithm on the key exchange, that copy becomes plain text. Drag the lens across the capture, then flip the session over to ML-KEM.
A drawing, not a demo of a real attack. Today's quantum hardware cannot touch ECDH, secp256k1 or Ed25519. What matters is the copy: traffic stored now could be read on the day a big enough machine runs, so secrets that must last years move to ML-KEM first. CRQC means a quantum computer strong enough to matter for cryptography.
02CryptographySnapped or bent
Some crypto snaps, some bends
Every public-key scheme a wallet uses today rests on factoring or on elliptic-curve discrete logs, and those are precisely what Shor's algorithm solves. Such schemes are not dented by it; they simply stop protecting anything.
Grover's algorithm is milder. It only accelerates guessing, which in the best case takes half the bits off a cipher or hash and in practice less. 256-bit ciphers and hashes keep a wide margin.
The new NIST families rest on lattices and hash functions, where nobody has found a fast quantum shortcut, and each parameter set is sized against an AES key search.
- RSA-2048Public key, classicalbroken
- secp256k1 ECDSAPublic key, classicalbroken
- Ed25519Public key, classicalbroken
- AES-128Symmetric64
- AES-256Symmetric128
- SHA-256 preimageHash128
- ML-KEM-768Post-quantum, category 396
- ML-DSA-65Post-quantum, category 396
- SLH-DSA-SHA2-128sPost-quantum, category 164
Bars run from 0 to 256 bits, the thin mark shows the present value. Grover rows assume a perfect attacker. Post-quantum rows copy the AES size of their NIST category (1 matches AES-128, 3 matches AES-192).
03WalletsWhen the key goes public
The key stays hidden until you sign
What the world sees of an EVM account is 20 bytes cut from a keccak hash, and a hash gives Shor nothing to work with. Your first signed transaction changes that: from the signature alone anyone can rebuild the full key, and the chain keeps it.
01 · Inbound only
A hash, nothing more
0x5be1…c40d · keccak(pubkey)[12:]Coins can arrive for years and the chain still holds only a digest. A quantum attacker has no starting point.
02 · First outbound
The key can be rebuilt
ecrecover(sig) → 02 d1 7e 3a 90 …Given a signature, anyone can work out which public key produced it. From this block on the key is public, and the same key serves every EVM network.
03 · Hypothetical machine
Then the secret half
shor(pubkey) → ?? ?? ?? …Only a future, much larger quantum computer could go from public key to private key. Nothing like it runs today, yet step 02 is permanent, which is why planning starts now.
| Network and address kind | Key visible from |
|---|---|
| Robinhood Chain, Ethereum, Base · EVM accounts | On signingits first signed transaction |
| Bitcoin · P2PKH, P2WPKH | On spendingthe first spend from it |
| Bitcoin · P2TR (Taproot), P2PK | Day oneday one: each output embeds the key |
| Solana | Day oneday one: an account id is its Ed25519 key |
That single question is what Exposure Scan answers, for any address you paste, free and without a wallet.
Scan an address04TimelineWith a source per line
From a 1994 paper to retirement dates
Theory, standards and proposed cut-off years on the left; on the right, how much hardware papers think an attack would take. An estimate is a paper, not a device.
- 1994
Peter Shor shows that a quantum computer could factor integers and take discrete logs efficiently. In theory that finishes off RSA and every elliptic-curve scheme.
arXiv quant-ph/9508027 ↗ - 1996
Lov Grover finds a square-root speed-up for blind search. Applied to a symmetric key, it roughly halves its bit security in the best case for the attacker.
arXiv quant-ph/9605043 ↗ - 2016
NIST launches an open call for public-key algorithms that resist quantum attacks.
NIST PQC project ↗ - 2019
A paper by Gidney and Ekerå puts the cost of one RSA-2048 key at around twenty million noisy qubits running for about eight hours.
arXiv 1905.09749 ↗ - 2022
Four winners are named for standardization: Falcon, SPHINCS+, and the two CRYSTALS schemes, Dilithium and Kyber.
NIST, July 2022 ↗ - 2022
Webber and co-authors estimate that breaking a Bitcoin key within a day would take around 13 million physical qubits; within an hour, around 317 million.
AVS Quantum Science 4, 013801 ↗ - Aug 2024
The first three post-quantum standards become final: ML-KEM as FIPS 203, ML-DSA as FIPS 204, SLH-DSA as FIPS 205.
NIST, 13 August 2024 ↗ - Nov 2024
Draft report IR 8547 sketches the exit: 112-bit RSA and ECC deprecated once 2030 has passed, both families off the approved list from 2035.
NIST IR 8547 ipd ↗ - Mar 2025
HQC, a code-based scheme, is chosen as the fallback key-encapsulation method in case lattices ever disappoint.
NIST, March 2025 ↗ - May 2025
Gidney cuts his own RSA-2048 figure below one million noisy qubits, with a run time under seven days.
arXiv 2505.15917 ↗ - Now
No existing device comes close. The paper estimates keep dropping, and whatever is copied today stays copied.
Status - 2030
If the draft holds: 112-bit RSA and ECC become deprecated.
Planned, draft guidance - 2035
If the draft holds: RSA and ECC leave the approved list entirely.
Planned, draft guidance