Circle has warned that the resources required for quantum circuits to break mainstream blockchain signature algorithms are continuing to fall, citing a low-resource record of 813 logical qubits. For USDC, though, that warning quickly turns into a broader dependency problem: a post-quantum migration would reach far beyond Circle’s own infrastructure.
Circle’s current contract documentation lists USDC deployments on 37 mainnets. The company can protect infrastructure it controls and exercise token-contract permissions on supported networks, but it cannot rotate user private keys, rewrite custodians’ signing systems, or unilaterally change the signature rules of Ethereum, Solana, XRPL, and other host chains.
In a disclosure dated Aug. 31, Circle urged developers to map their cryptographic systems, check third-party dependencies, and prepare for key rotation. As of Sept. 2, USDC’s market capitalization stood at about $73.6 billion, putting a large asset base at the center of the coordination problem. If the migration only hardens Circle’s own keys while legacy wallets, bridges, or underlying chain paths remain exposed, the wider USDC system would still not be secure.
Why 813 logical qubits are not a countdown clock
Circle said the 813-logical-qubit figure came from a low-resource record published by ECDSA.fail in an August 2026 update. The number shows that quantum circuit design is becoming more resource-efficient, but the article argues that the figure can be easily misunderstood.
The public challenge specification targets the secp256k1 elliptic curve used by Bitcoin and Ethereum and focuses on optimizing reversible point-addition circuits. Its scoring method multiplies peak logical-qubit width by the average number of Toffoli gates. Developers can trade one resource for another: they can add logical-gate count to reduce qubit width, or increase qubit width to lower gate consumption. On its own, 813 does not fully describe a Shor’s algorithm attack, circuit depth, error-correction overhead, or real execution time on physical hardware.
The piece notes that Toffoli gates are a core instruction in quantum computing. Quantum programs designed to break cryptography require a large number of them, so any estimate of attack capability has to account for both qubit count and gate demand.
A paper published in March 2026 illustrates that trade-off more clearly. Researchers estimated that an attack on a 256-bit elliptic-curve discrete logarithm could be carried out under one design with fewer than 1,200 logical qubits and no more than 90 million Toffoli gates. A second design would require no more than 1,450 logical qubits and 70 million Toffoli gates. That minute-scale attack model also assumed a high-clock-speed superconducting architecture, a physical error rate of 10⁻³, a planar connectivity architecture, and fewer than 500,000 physical qubits.
Those estimates are more complete than a qubit-width metric alone, yet they still do not say when hardware of that class will arrive.
The report questions Circle’s hardware comparison
The article also argues that Circle’s public comparison with Google’s Willow is imprecise. Circle said Google achieved 105 logical qubits with Willow. Google, however, described Willow as a 105-qubit processor. The related Nature paper recorded an experiment that used 105 physical qubits to perform a distance-7 surface-code logical memory experiment, with 101 qubits actually used. That is not the same thing as 105 logical qubits available for a cryptographic attack.
The piece adds that migration does not require an artificially defined final date. The U.S. National Institute of Standards and Technology, or NIST, has already included SLH-DSSA in FIPS 205 and told institutions to begin replacing cryptographic schemes that are vulnerable to quantum attacks. NIST’s 2035 marker refers to algorithm deprecation and removal from the standard, not a forecast of a so-called quantum attack day.
What matters, according to the article, is ecosystem readiness. Public blockchains need time to add new signature-verification rules. Wallets and custodians need tested key-rotation procedures. Users need a transition period in which traditional cryptographic authorization and post-quantum authorization can run in parallel, so liquidity is not fragmented and assets do not become stranded.
Arc covers only one layer Circle can control
Circle’s Arc stack gives the company a more direct place to build post-quantum support, but the official documentation separates that work into several layers. In external communications, the article says, that structure was simplified into a claim that Arc “supports SLH-DSA.”
Arc’s execution-layer documentation describes a precompile that can verify SLH-DSA-SHA2-128s signatures. That component allows smart contracts to verify that signature type, but it does not automatically replace the signature mechanism used by standard network transactions.
Arc’s custody guide still uses standard secp256k1 ECDSA for transaction signing. Under its post-quantum roadmap, mainnet launch would include an optional beta post-quantum wallet signature, while post-quantum validator signatures would come later. Circle also said Arc has not finalized its post-quantum transaction-signing scheme and that the migration phase would remain compatible with hybrid ECDSA signatures.
That makes Arc a possible proving ground for hybrid signatures. It does not make USDC on Ethereum, Solana, or the other 35 mainnets quantum-safe by itself.
USDC faces 37 independent migration paths
The network count itself has shifted in Circle’s disclosures. On June 29, 2026, Circle’s USDC page said 35 networks in text while listing 37 names. The contract-address table referenced in the article records 37 mainnets. If the Arc testnet were included, the Circle Mint list would reach 38, so the article excludes the Arc testnet from the tally.
The underlying table distinguishes between signature types that can be verified and host chains that require separate cryptographic review. An “EVM path” refers to Ethereum-style externally owned accounts, which use secp256k1 ECDSA by default and allow public-key recovery from a signature. Smart-contract accounts can use custom verification logic. A “chain-specific approach” means a blockchain’s official documentation does not define one uniform signing algorithm, so the article does not force a single classification. Its status column tracks whether a chain has rolled out a network-wide post-quantum upgrade, not whether exploratory work exists on-chain.
The main conclusion is that a quantum-safe USDC upgrade cannot be carried out by Circle alone. All 37 chains, along with wallets, custodians, bridges, and users, would need to upgrade in step and fully retire old signing mechanisms before the full system could be considered secure.
Examples in the report show why no single deadline can cover the entire ecosystem. Solana transactions use Ed25519 signatures. Polkadot supports sr25519, Ed25519, and ECDSA accounts. Even inside Ethereum, externally owned accounts and smart-contract wallets would follow different migration paths, before accounting for non-EVM networks at all.
Governance also differs from chain to chain. XRPL amendments require support from more than 80% of trusted validators for two consecutive weeks. Algorand protocol changes require an on-chain absolute majority vote. Stellar network upgrades depend on validator consensus. Circle has no authority over those decisions.
Freezing and reissuing tokens cannot rotate user keys
At the token layer, Circle holds several control powers. Its EVM fiat-token design includes permissions for minting, burning, pausing transfers, blacklisting, and contract upgrades. USDC’s terms of service also say the company may freeze addresses or suspend services in certain circumstances.
Those powers can help contain damage during a contract security incident. Where conditions allow, Circle can freeze addresses, stop minting or transfers, and carry out redemption or reissuance under legal and business rules. But freezing an address does not repair the risk created by a compromised private key, and it does not alter the signature-validation logic of the underlying blockchain.
The article breaks responsibility for key risk into several groups:
- Circle must rotate issuer credentials and contract-management credentials under its control.
- Users and custodians must move assets out of risky accounts through wallets and chains that support the new signature methods.
- Bridge operators must protect their own signing systems and contract permissions while coordinating liquidity on both sides.
- Underlying chain communities must approve and implement protocol-level changes.
- Wallet vendors, hardware wallets, and exchanges must support both legacy and new signature algorithms during the transition.
That means the weakest point may not be the slowest-moving blockchain. Custodians may struggle to rotate keys across thousands of accounts. Emergency bridge controls may still depend on vulnerable keys. Many users may simply fail to move their assets before legacy signatures are retired. Any of those could become an attack path.
The article says an implementable plan cannot rely on a single block-height switch. Operators need inventories of risky and safe keys, validated destination account types, software and hardware support for new signatures, and policies for balances that never migrate. Hybrid-signature modes also need a clear end point, so legacy signatures do not remain indefinitely as a bypass route. Circle can set milestones for its own contracts and services, but each blockchain ecosystem still has to decide when and how its legacy signing path will be shut down.
Urgency is real, but this is not a one-switch migration
The article’s final assessment is that Circle’s disclosure matters because it turns post-quantum preparation into an operational planning issue that needs attention now. The 813-qubit record shows that attack circuits can keep improving while hardware teams work on error correction. NIST’s published standards also give developers something concrete to test against.
At the same time, the report says Circle’s framing overstates some points. It places 813 attack-oriented logical qubits on the same scale as Willow’s 105 physical qubits, even though the two are not directly comparable. It also understates the real gap between verifying an SLH-DSA signature inside Arc and implementing USDC authorization, settlement, and asset recovery across dozens of production blockchains.
Circle can tighten the systems it governs. But the article argues that Circle can only claim system-wide quantum safety for USDC after host chains, wallets, custodians, bridges, and users complete the migration, and after all legacy signing paths are either retired or tightly constrained. In that framing, this is a large migration program with many veto points, not a simple cryptographic switch.