In a new research note, IOSG describes quantum risk as a growing security debt for Web3 rather than a cinematic one-day collapse scenario. The firm argues that the industry’s real challenge is not whether blockchains will suddenly stop producing blocks when quantum machines mature, but whether the ecosystem can coordinate a full-stack migration before that threshold is crossed. In this framing, Q-Day is the moment when a fault-tolerant quantum computer becomes practically capable of breaking widely used public-key cryptography at scale.
The report opens with a hypothetical but pointed scenario: one night in the 2030s, long-dormant early Bitcoin addresses begin moving funds without signs of wallet compromise, exchange intrusion, or leaked private keys. The only plausible explanation would be that an attacker has derived private keys from historically exposed public keys and generated cryptographically valid signatures. In that world, the chain itself keeps running, but the crisis moves immediately into markets, custody, and governance.
IOSG says this is why the quantum problem should be viewed as a pressure test of blockchain architecture itself. Public ledgers are transparent by design, asset transfers are irreversible, and users are responsible for self-custodied keys. Once the cryptographic assumptions underneath that model are broken, there is no centralized reset button comparable to certificate rotation, account recovery, or transaction reversal in traditional Web2 systems.
Q-Day is uncertain, but the migration clock is already running
According to IOSG, current mainstream expectations place Q-Day roughly in the 2035 to 2045 range, with more aggressive scenarios pulling that forward to 2030–2035. Anything before 2030 remains a lower-probability tail risk. Even so, the firm argues that migration urgency is real today because systems do not need Q-Day to be imminent in calendar terms for them to already be late operationally.
The report leans on Mosca’s inequality, X + Y > Z, to explain that urgency. Here, X represents how long sensitive data must remain secure, Y is the time required to migrate systems, and Z is the time remaining before Q-Day. If the confidentiality lifetime of data plus migration time exceeds the time left before practical quantum attacks arrive, then organizations are already in the danger zone. This logic underpins the “harvest now, decrypt later” concern that has become central in quantum security discussions.
IOSG differentiates sharply between the two canonical quantum threats. Shor’s algorithm is the existential one for blockchains because it can directly attack the mathematical foundations of RSA and elliptic-curve cryptography. Grover’s algorithm, while important, mostly weakens the security margin of hashing and symmetric cryptography by accelerating brute-force search. That type of risk can usually be mitigated by increasing key sizes, hash lengths, or security parameters. Shor risk is fundamentally harder because it targets the trust root itself.
The report also notes that quantum computing is not inherently a negative technology. Its positive value proposition remains strongest in quantum simulation, including chemistry, drug discovery, materials, and energy systems, and potentially in complex optimization for logistics, finance, supply chains, and chip design. But those beneficial use cases do not remove the need to prepare for the downside, especially given the uncertainty around hardware progress, error correction, and classified state-backed programs.
PQC is maturing, but blockchain migration is a coordination problem
IOSG’s central point is that the crypto industry is not waiting for a miracle cryptographic breakthrough. Post-quantum cryptography, or PQC, is already emerging as the main migration path. The report identifies lattice-based cryptography and hash-based signatures as the leading approaches, with ML-KEM, ML-DSA, and SLH-DSA highlighted as representative standards or standard-track schemes.
Standardization has advanced materially. IOSG notes that in August 2024, NIST formally published FIPS 203, FIPS 204, and FIPS 205, corresponding to ML-KEM, ML-DSA, and SLH-DSA. That effectively established the early migration structure of one key encapsulation mechanism and two digital signature standards. It also points out that HQC was selected in March 2025 as a fifth PQC algorithm, expected to serve as a non-lattice backup to ML-KEM, with a draft standard anticipated in 2026 and a final standard in 2027.
Still, the report says the hardest part is no longer algorithm discovery. In blockchains, the bottleneck is social coordination across infrastructure and governance. Wallets, nodes, miners or validators, exchanges, bridges, custodians, and hardware vendors all need to upgrade around shared rules. Unlike enterprise systems, no single operator can unilaterally replace keys or roll new cryptographic standards across an entire public network.
That is why IOSG treats blockchain as a uniquely severe quantum stress case. The problem is not merely that cryptography could be weakened; it is that exposed cryptography maps directly into irreversible asset risk. Once a signature scheme is structurally broken, losses may be immediate and final, while governance debates over how to respond can take far longer than the attack itself.
Bitcoin: exposed public keys, dormant UTXOs, and governance collision
For Bitcoin, IOSG argues that quantum risk is highly uneven. Not all BTC is equally vulnerable. The highest-risk set consists of UTXOs whose public keys are already exposed on-chain and still control value. That category includes early P2PK outputs, Taproot outputs in certain contexts, and reused addresses where the full public key has already been revealed and funds remain. In a post-CRQC world, these would be direct Shor targets.
By contrast, unspent P2PKH and P2WPKH outputs that have not yet exposed their full public keys are relatively safer for now, because the chain reveals only the public-key hash until a spend is attempted. Their quantum risk is concentrated in the short interval between transaction broadcast and confirmation, where a sufficiently capable attacker might front-run the spend after seeing the revealed key material.
IOSG suggests that the more realistic migration path for Bitcoin is a soft-fork-based introduction of new post-quantum output types rather than a politically explosive hard fork that deprecates ECDSA or Schnorr outright. It references discussion tracks such as BIP-360 and P2MR as examples of exploratory directions, while noting that any path to activation remains long and uncertain.
The engineering burden is substantial. Current ECDSA and Schnorr signatures are roughly 64 to 72 bytes, whereas candidate post-quantum signatures are far larger. IOSG cites ranges of about 2.4 to 4.6 KB for ML-DSA and 7 to 49 KB for SLH-DSA. That magnitude of signature growth would have cascading effects on block weight, fees, storage, bandwidth, UTXO management, and wallet UX. In other words, quantum migration on Bitcoin comes with a meaningful and visible systems cost.
The most politically difficult issue, however, concerns dormant legacy coins. If PQ-safe addresses are introduced, what should happen to old outputs that never migrate, including long-dormant holdings often associated in market narratives with the Satoshi era? IOSG says both extreme answers are destabilizing. Doing nothing could leave those coins as an open bounty for the first actor with practical quantum capability. Freezing or invalidating them, on the other hand, would directly challenge Bitcoin’s immutability ethic and the property-rights principle behind “Not your keys, not your coins.”
The report therefore presents a more pragmatic middle path: a multi-year legacy sunset. That could involve repeated deprecation warnings, gradually increased relay or spending friction for old signature types, and eventual soft-fork constraints after prolonged ecosystem coordination. It places discussions such as BIP-361 in that broader category of trying to reconcile survivability with Bitcoin’s political values.
IOSG’s conclusion on Bitcoin is blunt: the problem is not the absence of PQ algorithms. Those exist, and they can in principle be integrated. The real bottleneck is social consensus over immutability, ownership, and whether it is legitimate to declare certain assets quantum-insecure and subject to policy pressure. For Bitcoin, quantum risk is therefore a governance process long before it becomes a cryptographic event.
Ethereum: a broader but more deliberate full-stack migration path
Ethereum appears more proactive in IOSG’s assessment. The report says the Ethereum Foundation’s post-quantum research efforts, advancing through open governance processes such as All Core Devs, are focused less on betting everything on one algorithm and more on improving cryptographic agility across the stack. That means ensuring that account authentication, consensus signatures, proof systems, and data commitments can all be upgraded or replaced over time.
IOSG identifies four main areas of quantum exposure in Ethereum: EOA accounts using ECDSA/secp256k1, validator consensus using BLS signatures, data availability mechanisms relying on KZG commitments, and parts of the zero-knowledge proving stack. To address those risks, the report outlines a “Lean” roadmap spanning execution, consensus, and data layers in parallel.
On the execution layer, account abstraction is presented as a key buffer. Mechanisms such as ERC-4337 and EIP-7702 can give smart contract wallets signature agility, making hybrid signing and gradual migration possible without forcing a synchronized network-wide cutover for all EOAs at once. IOSG also notes that L2s, because of their comparatively flexible governance and faster iteration cycles, are natural testbeds for post-quantum deployments.
On the consensus layer, Ethereum’s long-term target is to move beyond BLS. IOSG references leanXMSS, a hash-based signature approach, alongside leanVM, a minimalist zkVM intended to support SNARK aggregation. The report highlights a notable engineering claim here: leanVM could compress the practical burden of hash-based signatures by around 250x, helping preserve aggregation-related scalability advantages even as the network transitions toward post-quantum security assumptions.
For the data layer, IOSG says KZG commitments will likely require a long-term rethink under fault-tolerant quantum conditions. The likely end state is not an emergency patch but a multi-year transition toward more PQ-friendly commitment or proof systems, potentially including hash-based STARK-style approaches or lattice-based commitment constructions. This is framed as foundational protocol work rather than an immediate point of failure.
The report adds that Ethereum’s risk distribution is not uniform either. The biggest pools of value remain in EOAs, but some of the earliest pressure may hit operational keys first: exchange wallets, bridges, custodial hot wallets, governance and upgrade keys, L2 sequencer keys, and admin keys. That makes Ethereum’s migration challenge broader than simple signature replacement. It is an ecosystem-wide engineering program touching accounts, consensus, DA, ZK, L2s, bridges, custody, and formal verification.
Broader market implications: repricing may begin before Q-Day
IOSG emphasizes that quantum computing should not be viewed as a single doomsday switch for crypto. Instead, it is a long-range systemic reset of public-key assumptions. The report’s broader warning is that markets may start repricing that risk before Q-Day itself if quantum resource estimates fall sharply, hardware roadmaps accelerate, or regulators and major custodians move early on PQC compliance requirements.
In that scenario, Bitcoin and Ethereum face different terminal tests. Bitcoin’s challenge is political and philosophical: how to reconcile dormant exposed UTXOs, property rights, and immutability under quantum pressure. Ethereum’s challenge is engineering and architectural: how to replace cryptographic assumptions across accounts, consensus, data availability, and ZK systems without introducing unacceptable disruption or losing scalability.
IOSG concludes that the broader preparation period may span 5 to 15 years, but the practical engineering comfort window could be only 5 to 8 years. That means the migration burden cannot wait for a definitive Q-Day announcement. Proposal processes, node implementations, wallet support, exchange integrations, and custody compliance all need lead time. In that sense, the post-quantum transition is no longer a niche research topic. It is becoming a core infrastructure agenda for the next phase of crypto market security.