Will Quantum Computers Break Tezos?
Will quantum computers break Tezos? It is one of the more precise questions you can ask about long-term crypto security, and it deserves a precise answer. Tezos uses elliptic-curve cryptography to secure accounts and sign transactions, which places it in the same category as Bitcoin and Ethereum when a sufficiently powerful quantum computer eventually arrives. This article walks through the exact mechanism of the threat, what would have to be true for XTZ holders to face real losses, what the realistic timeline looks like, and what practical steps exist for reducing exposure today.
How Tezos Secures Accounts Right Now
Tezos accounts are protected by public-key cryptography. When you create a wallet, a private key is generated, and a corresponding public key is derived from it. Your public address is then derived from that public key. The security guarantee is simple: knowing the public key (or address) should tell an attacker nothing useful about the private key.
Tezos is notable for supporting multiple signature schemes simultaneously, which is relatively rare among layer-1 blockchains:
- Ed25519 (Edwards-curve Digital Signature Algorithm on Curve25519) — the default for most Tezos wallets.
- Secp256k1 — the same elliptic curve used by Bitcoin, available for compatibility.
- Secp256r1 (P-256) — used primarily for hardware-security-module integrations and some mobile wallet flows.
- BLS12-381 — used in Tezos smart rollups and some consensus-layer operations.
All four of these schemes rely on the hardness of the elliptic-curve discrete logarithm problem (ECDLP). A classical computer cannot solve ECDLP in practical time. A large-scale quantum computer running Shor's algorithm can, in principle, solve it efficiently.
What Shor's Algorithm Actually Does
Shor's algorithm, first described in 1994, solves integer factorisation and discrete logarithm problems in polynomial time on a quantum computer. For elliptic-curve keys, the relevant version runs in roughly O(n³) quantum gate operations, where n is the bit-length of the key.
For a 256-bit elliptic-curve key (covering all four Tezos schemes above), credible academic estimates suggest that approximately 2,000 to 4,000 logical qubits would be required to break a single key, along with billions of physical qubits to implement the necessary error correction. No machine anywhere near this scale exists today.
The "Exposed Public Key" Problem
There is a subtlety worth understanding. Your Tezos address is a *hash* of your public key. As long as an address has never sent a transaction, the public key has never been broadcast to the network. A quantum attacker would need the public key to run Shor's algorithm, so:
- Addresses that have only received funds and never sent are protected by an additional layer — the hash function (Blake2b in Tezos). Breaking a hash with Grover's algorithm requires roughly 2^128 operations even on a quantum computer, which remains infeasible.
- Addresses that have sent at least one transaction have had their public key recorded on-chain. These are the addresses with direct ECDLP exposure once a cryptographically-relevant quantum computer (CRQC) exists.
This distinction matters practically. Many long-term XTZ holders who have moved funds, delegated to bakers, or interacted with DeFi protocols have already exposed their public keys.
---
What Would Have to Be True for Quantum Computers to Break Tezos
For a real attack to occur, the following conditions must hold simultaneously:
- A CRQC must exist — a fault-tolerant quantum computer with thousands of logical qubits and billions of physical qubits, running with error rates low enough to complete Shor's algorithm before decoherence disrupts the computation.
- The attacker must possess the target public key — trivially satisfied for any address that has sent a transaction.
- The attacker must complete the computation before the victim can react — if a protocol-level migration is underway, there may be a window to move funds.
- Tezos governance must not have migrated to post-quantum signatures — Tezos has on-chain governance and a track record of protocol upgrades (over a dozen major amendments since mainnet launch). A governance vote could, in theory, introduce post-quantum signature schemes before Q-day.
None of these conditions are currently met. Conditions 1 through 3 are contingent on hardware progress that most credible estimates place at least a decade away.
---
Realistic Q-Day Timeline
"Q-day" is the informal term for the point at which a CRQC capable of breaking 256-bit elliptic-curve keys is deployed. Estimating when this occurs is genuinely difficult, and published timelines vary enormously.
| Source / Framework | Estimated Range for CRQC |
|---|---|
| NIST Post-Quantum Cryptography project (implicit from urgency) | 10–20 years |
| IBM quantum roadmap (extrapolated from error-correction targets) | 2030s, at the earliest for fault-tolerant scale |
| Global Risk Institute quantum threat report (2023) | 17% probability within 10 years; 50%+ within 15–20 years |
| NSA CNSA 2.0 migration deadline | 2030–2035 for new systems |
| "Harvest now, decrypt later" concern | Relevant today for long-lived encrypted data; less so for blockchain (signatures are not stored encrypted) |
The important takeaway for XTZ holders is not "this happens next year" — it does not. The takeaway is that the migration window is measured in years, not decades, and blockchain governance processes are slow. Tezos' track record on upgrades is better than most, but introducing and testing post-quantum signature schemes at a protocol level is non-trivial.
Why "Harvest Now, Decrypt Later" Is Less Relevant for Tezos
The "harvest now, decrypt later" attack is critical for encrypted communications (state actors collect encrypted traffic today, decrypt it once a CRQC exists). Blockchain transactions are not encrypted, so this attack vector is largely inapplicable. The risk for Tezos is a future, real-time private-key derivation attack, not a retroactive data-decryption attack.
---
Tezos Governance and a Potential Post-Quantum Migration
One of Tezos' genuine structural advantages is its on-chain governance mechanism. Protocol amendments go through a multi-period voting process involving bakers (validators), and upgrades have been deployed consistently since 2018.
What a Post-Quantum Tezos Amendment Could Look Like
A future post-quantum amendment could, in principle:
- Add a new supported signature scheme based on a NIST-standardised post-quantum algorithm. NIST finalised its first post-quantum standards in 2024, including CRYSTALS-Dilithium (lattice-based, now designated ML-DSA) and SPHINCS+ (hash-based, now SLH-DSA).
- Require active address rotation: users move funds to new addresses protected by post-quantum keys before a deprecation deadline.
- Implement a hybrid scheme during a transition period, accepting both ECDSA-style signatures and post-quantum signatures simultaneously.
The Tezos development community (Nomadic Labs, Marigold, Trili Tech, and others) has demonstrated the ability to execute technically complex protocol changes. However, no formally announced post-quantum roadmap has been published as of the time of writing. This is not unusual — the majority of major blockchains are in a similar position.
Baker Participation Risk
Tezos uses a delegated proof-of-stake model. Bakers sign blocks, and their signing keys are exposed with every baked block. This means baker keys are among the *most* exposed public keys on the network. A future CRQC could theoretically target high-value baker keys to attempt consensus manipulation. This is an area where the Tezos security community would need to act ahead of ordinary wallet holders.
---
What XTZ Holders Can Do Right Now
The threat is not imminent, but taking low-cost precautionary steps today is rational.
Immediate Low-Effort Steps
- Audit which of your addresses have sent transactions. Addresses that have only received funds and never signed an outgoing transaction have not yet exposed their public keys on-chain.
- Avoid address reuse where possible. For new holdings, use fresh addresses that have no transaction history.
- Monitor Tezos governance proposals. The Tezos Agora governance forum is the authoritative place to track any future quantum-migration proposals.
Medium-Term Steps
- Stay informed on NIST PQC standards adoption. As hardware wallets (Ledger, Trezor) and software wallets add support for post-quantum key types, migrating XTZ holdings to post-quantum-protected addresses will become feasible.
- Consider diversification into natively post-quantum architectures. Projects designed from the ground up around post-quantum cryptography, rather than retrofitting it, offer a structurally different risk profile. BMIC, for example, is built on lattice-based, NIST PQC-aligned cryptography as a core design requirement rather than a planned upgrade.
- Keep software wallets and hardware firmware updated. Cryptographic vulnerabilities are frequently patched at the implementation layer, even without underlying scheme changes.
---
How Natively Post-Quantum Designs Differ from Retrofitted Protection
There is a meaningful architectural difference between:
- A blockchain that uses ECDSA today and plans to add post-quantum signatures via a future governance vote, and
- A blockchain or wallet system that was designed from inception with post-quantum algorithms as the primary signing mechanism.
Retrofitting is not inherently impossible. Tezos' multi-scheme architecture makes it more tractable than Bitcoin, for instance. But a retrofit requires:
- Protocol-level governance consensus (which can stall or be delayed).
- Wallet software updates across every app and integration.
- Active user migration, with all the coordination risk that entails.
- A window of dual-scheme coexistence during which legacy addresses remain vulnerable.
A native post-quantum design avoids each of these coordination risks because the quantum-resistant assumption is baked into every key pair from day one. The cryptographic surface area that needs to be defended before Q-day is zero, rather than "all existing addresses."
---
Summary: The Honest Risk Assessment
Quantum computers do not break Tezos today, and they will not do so in the next several years under any credible hardware roadmap. However:
- All four signature schemes Tezos currently supports are theoretically vulnerable to a sufficiently powerful CRQC running Shor's algorithm.
- Addresses that have signed at least one outgoing transaction have their public keys recorded on-chain and face direct ECDLP exposure at Q-day.
- Tezos has structural governance advantages that could enable a post-quantum migration, but no formal roadmap exists yet.
- Practical, low-cost steps exist for holders who want to reduce exposure without waiting for a protocol-level fix.
- The question is not whether the threat is real — it is — but whether the blockchain and its ecosystem can complete a migration before Q-day arrives. For Tezos, that is an open question with a reasonably optimistic baseline, given its upgrade history.
The prudent posture is neither panic nor complacency. It is informed preparation.
Frequently Asked Questions
Will quantum computers break Tezos in the near future?
No. Current quantum computers are nowhere near the scale required to run Shor's algorithm against 256-bit elliptic-curve keys. Credible estimates from bodies like the Global Risk Institute and NSA place a cryptographically-relevant quantum computer at least 10-15 years away. Tezos holdings are not at immediate risk.
Which Tezos signature scheme is most vulnerable to quantum attacks?
All four schemes Tezos supports — Ed25519, Secp256k1, Secp256r1, and BLS12-381 — rely on the elliptic-curve discrete logarithm problem, which Shor's algorithm can solve on a large quantum computer. None is meaningfully more vulnerable than the others at a fundamental level; they all share the same underlying mathematical assumption that quantum computing undermines.
Are Tezos addresses that have never sent a transaction safer from quantum attacks?
Yes, relatively. Addresses that have only received funds have not broadcast their public key to the network. An attacker running Shor's algorithm needs the public key, not just the address. Since the address is a hash of the public key, breaking it additionally requires inverting a hash function, which remains infeasible even for quantum computers using Grover's algorithm.
Can Tezos upgrade to post-quantum cryptography through governance?
In principle, yes. Tezos has on-chain governance and has successfully deployed over a dozen major protocol amendments. A future amendment could add NIST-standardised post-quantum signature schemes such as ML-DSA (CRYSTALS-Dilithium). However, no formal post-quantum roadmap has been announced as of the time of writing, and the coordination required — protocol changes, wallet updates, and user migration — would take considerable time.
What is the 'harvest now, decrypt later' attack, and does it apply to Tezos?
Harvest now, decrypt later refers to adversaries collecting encrypted data today to decrypt it once a quantum computer exists. This is a major concern for encrypted communications. It is largely inapplicable to Tezos because blockchain transactions are not stored in encrypted form — the quantum risk for XTZ is a future real-time private-key derivation attack, not retroactive decryption of stored data.
What practical steps can XTZ holders take to reduce quantum risk?
Right now: identify which of your addresses have sent transactions (those have exposed public keys), avoid address reuse for new holdings, and monitor Tezos governance for any post-quantum proposals. Medium-term: watch for hardware and software wallet support for post-quantum key types as NIST standards propagate through the ecosystem, and consider the risk profile of any new positions alongside the availability of natively post-quantum alternatives.