Will Quantum Computers Break USDS?

Will quantum computers break USDS — the Sky Money (formerly MakerDAO) stablecoin — is a question more analysts are asking as fault-tolerant quantum hardware edges closer to viability. USDS inherits its security assumptions from the Ethereum stack, meaning its on-chain integrity ultimately rests on elliptic-curve cryptography that a sufficiently powerful quantum computer could theoretically compromise. This article works through the exact mechanisms involved, what conditions would need to be met, where the realistic timeline sits today, what the attack would actually look like, and what USDS holders and protocol designers can do in response.

What Underpins USDS Security Today

USDS is an ERC-20 stablecoin deployed on Ethereum. Like every other asset on the network, its security model rests on two distinct layers:

1. The Ethereum signature scheme. Ethereum uses the Elliptic Curve Digital Signature Algorithm (ECDSA) on the secp256k1 curve. Every wallet address is derived from a secp256k1 public key. To move tokens, an owner must produce a valid ECDSA signature with their private key.
2. The smart contract logic. The USDS minting, burning, and governance mechanisms live in Solidity contracts. These are secured by the same signature infrastructure — any administrative action (e.g., adding a collateral type, upgrading a contract module) requires a valid signature from an authorised key or a multisig threshold.

Neither layer uses quantum-resistant cryptography today. That is not a criticism unique to USDS — it applies to virtually every token and wallet on Ethereum, Bitcoin, Solana, and most other major networks.

ECDSA and the Discrete Logarithm Problem

ECDSA security rests on the elliptic-curve discrete logarithm problem (ECDLP). Given a public key *Q* and the generator point *G*, it is computationally infeasible — on classical hardware — to recover the private key *k* such that *Q = k · G*.

The operative phrase is "classical hardware." In 1994, mathematician Peter Shor published an algorithm that solves the discrete logarithm problem in polynomial time on a quantum computer. That means a quantum machine running Shor's algorithm could, in principle, derive a private key directly from a public key.

What Has to Be True for This to Work

Running Shor's algorithm against secp256k1 requires a fault-tolerant quantum computer with roughly 2,000 to 4,000 logical qubits (estimates vary by implementation and error-correction overhead). Current leading machines — IBM's Condor processor, Google's Willow chip — operate in the hundreds of physical qubits with error rates that are still far too high for the fault-tolerant regime needed.

Physical qubits are noisy. Converting them into reliable logical qubits via quantum error correction (QEC) requires anywhere from dozens to thousands of physical qubits per logical qubit, depending on the code and target error rate. The most credible academic estimates place a cryptographically relevant quantum computer (CRQC) at 10 to 20 years away, with some institutional security agencies citing 2030–2035 as the earliest plausible window for narrow attacks and 2040+ for broad capability.

That range is wide, and it should be. The engineering challenges are substantial. But "wide range" is not the same as "impossible."

---

The Specific Attack Vectors Against USDS

Not every quantum attack scenario is equally severe. It helps to separate them.

Scenario 1: Address-Level Key Recovery

When you send USDS from a wallet, Ethereum broadcasts your public key on-chain (it is recoverable from the transaction signature). At that moment, a CRQC could — in theory — run Shor's algorithm on the public key and recover the private key before the transaction is confirmed, allowing an attacker to redirect funds.

For this to succeed, the attacker would need to:

• Extract the public key from the mempool.
• Run Shor's algorithm fast enough to beat block confirmation (~12 seconds on Ethereum post-Merge).
• Broadcast a competing transaction with a higher gas price.

This "harvest-now, decrypt-later" race against block time is the most acute form of the threat. It applies to any Ethereum address that has ever sent a transaction (exposing its public key).

Addresses that have never broadcast a transaction only expose a hash of the public key (Keccak-256). Grover's algorithm can accelerate brute-force hash searches, but the speedup is square-root, not exponential. A Grover attack on a Keccak-256 address hash is not practically feasible even with a CRQC. So unused addresses carry a lower quantum risk profile.

Scenario 2: Governance and Admin Key Compromise

USDS protocol governance involves multisig contracts and time-locked executive votes. If any governance key is associated with a public key that has been exposed on-chain, a CRQC could compromise that key and manipulate protocol parameters — collateral ratios, debt ceilings, oracle addresses. This is the more systemically dangerous scenario, because it could affect not just individual holders but the entire stablecoin's collateral backing.

Scenario 3: Oracle and Relayer Infrastructure

Price oracles and keeper bots submit frequent on-chain transactions, constantly re-exposing public keys. These infrastructure components are high-frequency, high-exposure targets under a CRQC model.

---

Realistic Timeline: Where Does Quantum Hardware Actually Stand?

Sources: NIST IR 8105, NSA CNSA 2.0 Suite guidance (2022), IBM Quantum roadmap, and peer-reviewed estimates from Webber et al. (2022) in *AVS Quantum Science*.

The 2022 Webber et al. paper estimated that breaking Bitcoin's ECDSA in one hour would require approximately 317 × 10⁶ physical qubits — orders of magnitude beyond current hardware. Even their most optimistic scenario (28 days of processing time) required ~13 million physical qubits. The gap is real.

This does not mean complacency is warranted. Large cryptographic migrations take a decade or more to execute across an ecosystem. NIST completed its Post-Quantum Cryptography (PQC) standardisation process in 2024, publishing FIPS 203 (ML-KEM / Kyber), FIPS 204 (ML-DSA / Dilithium), and FIPS 205 (SLH-DSA / SPHINCS+). The standardisation is done. The migration is not.

---

What USDS Holders Can Do Right Now

Practical risk management does not require waiting for protocol-level changes. Several steps are available today.

Minimise Public Key Exposure

• Use a fresh Ethereum address for long-term USDS storage and never send a transaction from it. An unexposed address only reveals a hash, not a recoverable public key.
• Rotate to a new address after any outbound transaction. This is operationally awkward but is the cleanest address-hygiene practice.
• Avoid reusing addresses across different purposes or chains.

Prefer Smart Contract Wallets with Upgradeability

Account-abstraction wallets (ERC-4337 compatible) allow signature scheme upgrades without migrating funds to a new address. If Ethereum introduces a post-quantum signature scheme at the protocol layer, an upgradeable smart contract wallet can adopt it without moving assets.

Monitor NIST PQC Migration Progress on Ethereum

The Ethereum Foundation has active research threads on post-quantum migration. The Ethereum Improvement Proposal (EIP) process will eventually introduce quantum-resistant signature options. Following EIP discussions in this area gives holders early warning before any urgent migration window opens.

Diversify Custodial Arrangements

If holding significant USDS in a multisig, ensure the multisig uses addresses that have not previously broadcast transactions. For institutional holders, hardware security modules (HSMs) that can be upgraded to PQC algorithms offer a migration path without full key replacement.

---

How Natively Post-Quantum Designs Differ

The contrast between retrofitting quantum resistance onto a classical-cryptography stack versus building for it from the ground up is significant.

Protocols built natively on NIST-standardised lattice-based cryptography — such as ML-DSA (Dilithium) or ML-KEM (Kyber) — are not vulnerable to Shor's algorithm because their security hardness assumptions (Learning With Errors, Module-LWE) have no known quantum polynomial-time solution. Shor's algorithm simply does not apply to lattice problems.

BMIC.ai is one example of a project designed from the outset around post-quantum, lattice-based cryptography aligned with NIST PQC standards. Rather than inheriting ECDSA from an existing L1, it implements signature schemes that remain secure under a CRQC threat model, which is a fundamentally different architecture than wrapping a post-quantum layer around a classically designed chain.

The distinction matters for USDS specifically because USDS's quantum risk is not intrinsic to the stablecoin mechanism itself (collateral, peg maintenance, liquidation logic). The risk is entirely in the Ethereum cryptographic substrate. A stablecoin or DeFi protocol deployed natively on a post-quantum L1 would carry a different risk profile at the key-management layer, even if the economic mechanics were identical.

---

What Would a Protocol-Level Fix Actually Require?

Ethereum migrating to post-quantum signatures is technically feasible but would be one of the most complex upgrades the network has ever undertaken. The core challenges:

• Signature size. ML-DSA signatures are significantly larger than ECDSA signatures (~2–3 KB versus ~65 bytes). This affects gas costs, calldata bandwidth, and block space economics.
• Key derivation compatibility. Ethereum addresses are derived from ECDSA public keys. A new key scheme would require either a parallel address space or a coordinated migration event.
• Wallet software. Every wallet, hardware device, and key management system would need updates before users could sign with a new algorithm.
• Backward compatibility. Legacy ECDSA addresses holding assets would need a defined sunset period and migration path.

Ethereum researchers have outlined abstract paths (e.g., account abstraction as a vector for gradual adoption, a future hard fork replacing transaction signing). None are imminent. The realistic runway for a full migration is measured in years, not months.

---

Summary: How Worried Should USDS Holders Be?

The threat is real in structure and speculative in timing. A CRQC capable of breaking secp256k1 fast enough to matter does not exist and is unlikely to exist before the mid-2030s at earliest. That gives the Ethereum ecosystem roughly a decade to migrate, which is sufficient — if work begins promptly and proceeds consistently.

For USDS holders specifically, the near-term actions are operational (address hygiene, preferring unexposed addresses for storage) rather than existential. The protocol-level fix requires Ethereum to act, and that process has begun in research form but is years from production deployment.

The quantum threat to USDS is not a reason to panic. It is a reason to stay informed, adopt good key hygiene now, and track the Ethereum PQC roadmap as it matures.