Policy · Analysis
Nobody Said 'Blockchain' in the G7's Quantum Warning
The Cybersecurity Working Group's September 3 call to action never mentions cryptocurrency once. It does not need to. The public-key math it tells governments to start replacing is the same math that signs every transaction on every chain.
On September 3 the G7 Cybersecurity Working Group published a document with a title that sounds like a conference panel and reads like a deadline. "Preparing for the Post-Quantum Era: A Call to Action" went out through ANSSI, France's cybersecurity agency, which chairs the working group under France's 2026 G7 presidency, and was simultaneously carried by the Canadian Centre for Cyber Security, which held the chair the year before.
The core sentence is careful in a way that is worth reading twice. "Although the exact timeline is uncertain," the working group writes, "several recent advances suggest an anticipation of the development of quantum computers able to break widely used public-key cryptography mechanisms." That is a hedge and a warning in the same breath: we do not know when, and we are telling you to move anyway.
Search the document for "cryptocurrency" and you will not find it. Search for "blockchain" and you will not find that either. Both Decrypt and Cryptopolitan made the same observation in their coverage this week, and both drew the same conclusion, which is the right one. The omission is not an oversight and it is not a reprieve. The G7 is describing the cryptographic primitive; blockchains are downstream of it.
What the document actually asks for
Strip away the diplomatic register and the call to action is an inventory order. It sets out five priorities: raise awareness of quantum-related cyber risk, develop national post-quantum cryptography strategies, advance research and deployment, strengthen public-private coordination, and fold PQC into cybersecurity requirements and procurement.
The operational advice underneath is more concrete. Organisations are told to take a phased, risk-based approach — inventory your cryptographic assets, identify which systems actually matter, map the dependencies between them, then write a transition plan. Anyone who has tried to answer the question "where, exactly, is elliptic-curve cryptography used in our stack" already knows that the inventory step is the hard one, not the flourish before the hard one.
The urgency argument does not depend on a quantum computer existing. It rests on harvest now, decrypt later: an adversary captures encrypted traffic today and stores it against the day the hardware arrives. Data with a long confidentiality half-life is therefore already exposed, whatever the timeline turns out to be. And the working group is blunt that no one solves this alone — the transition, it says, "is not a problem for individual organizations to solve in isolation, but rather a collective transition."
That framing matters for anyone reading it from crypto. A collective transition is exactly what a permissionless network with no upgrade authority is worst at.
Why a paper that never says "blockchain" is about blockchain
Every chain in production authenticates spending with elliptic-curve signatures — secp256k1 on Bitcoin and Ethereum accounts, Ed25519 on Solana. Shor's algorithm, run on a sufficiently large quantum computer, recovers a private key from a public key. That is the entire exposure, and it is not a smart-contract bug or an implementation flaw that anyone can patch. It is load-bearing.
The awkward part specific to public ledgers is that the public keys are public. In conventional infrastructure, an attacker with a future quantum computer must first capture your traffic. On a blockchain, the material is already published, permanently, by design, for anyone who cares to index it. There is no harvesting step because the harvest is the chain.
The replacements are known — NIST standardised them — but they are not free. Post-quantum signatures are dramatically larger than what chains carry today, and block space is the one resource these systems ration hardest.
What a signature costs, before and after
Read that against the 1,232-byte limit and the shape of the problem is obvious. Two of these four signature schemes do not fit inside a single Solana transaction at all.
Bitcoin's problem is the coins that already moved
Bitcoin's response is BIP-360, published in February 2026 by Hunter Beast, Ethan Heilman and Isabel Foxen Duke, and since merged into the BIP repository. It defines a new output type, Pay-to-Merkle-Root, structurally close to Taproot but with the key-path spend — the quantum-vulnerable part — removed. It commits to a script-tree Merkle root and nothing else.
BIP-360 is a rail, not a cure. It has no activation date. And it protects coins going forward, which is precisely not where the exposure sits: the estimates carried in coverage of the proposal put roughly 6 to 7 million BTC, somewhere between a quarter and a third of circulating supply, in addresses whose public keys are already visible on-chain. Those coins do not become safe because a better output type exists. Somebody has to move them.
Which is why a second proposal, BIP-361, appeared in April, and why it is the one that will generate the argument. It proposes a structured sunset of legacy signature types: a deadline after which the network stops honouring spends from quantum-vulnerable scripts. In plain terms, that is a proposal to make a large quantity of very old bitcoin permanently unspendable in order to stop somebody else spending it first. Both readings of that sentence are defensible, and Bitcoin has never resolved an argument shaped like this one.
Ethereum has a date; Solana has something running
Ethereum's answer is the most explicit. Its quantum-resistance roadmap names four vulnerable components — consensus-layer BLS signatures, KZG polynomial commitments, account-level ECDSA, and application-layer ZK proofs — and a replacement for each: leanXMSS hash-based signatures for BLS, STARK- or lattice-based alternatives for KZG, post-quantum schemes reachable through account abstraction for ECDSA, and STARKs, which are already quantum-resistant, for the proof layer. Completion of core post-quantum infrastructure is targeted at approximately 2029, with EIP-8141 — native account abstraction, the piece that lets individual accounts adopt a quantum-safe scheme before the protocol finishes migrating — under consideration for the Hegotá fork.
The page is also unusually calm about it: "Your funds are safe today and wallet software will guide you through future migration." That is preparation talking, not incident response, and the distinction is worth preserving.
Solana's position is the odd one, because part of it already shipped. Blueshift's Winternitz Vault — a hash-based one-time-signature scheme, described in Dean Little's April research — runs as an ordinary Solana program. No SIMD, no validator upgrade, no governance vote. It uses truncated SHA-256 with a tuned Winternitz parameter specifically so the signature fits inside the existing 1,232-byte transaction limit, which buys 176 bits of post-quantum security rather than the full 256. SIMD-0296, which would raise the limit to 4,096 bytes, is what closes that gap.
The network-wide direction is Falcon-512, and the numbers explain why: about 666 bytes of signature, about 897 bytes of public key, and verification roughly three times faster than the Ed25519 it would replace. Solana's own write-up — which names Anza, Firedancer, Blueshift and Google Quantum AI as the parties involved, and notes that Google Quantum AI cited the Winternitz Vault as a leading example of proactive work — says network performance "is not expected to see a meaningful impact." On the Falcon figures, that claim is at least arguable rather than merely hopeful.
The number nobody agrees on
None of this settles the only question anyone actually wants answered, which is when. The most-cited recent input is a March 2026 resource estimate from Google Quantum AI for attacking 256-bit elliptic curves, and the reporting around it does not agree with itself: summaries variously put the requirement at roughly 1,175 logical qubits and about 2.6 million Toffoli gates, or approximately 1,200 logical qubits and about 90 million Toffoli gates, with separate physical-qubit estimates below 500,000. Those are different circuits doing different trade-offs, and this desk has not read the paper itself — we flag the spread rather than pick a number out of it.
One detail about that publication is independently interesting. On March 31, Google's team released the resource estimate while withholding the actual circuits, publishing instead a zero-knowledge proof that circuits meeting the claimed counts exist. A quantum-attack paper that proves its own results without disclosing them is a fairly precise summary of where this field currently sits.
Meanwhile the regulatory clock is not waiting for the physics. The EU's roadmap, developed through the NIS Cooperation Group, requires member states to begin transitioning in 2026, to have critical infrastructure migrated by the end of 2030, and to finish by the end of 2035. Those dates are binding on European institutions in a way no G7 call to action is, and they will reach crypto through the custodians, exchanges and market infrastructure that sit inside that perimeter long before they reach a base layer.
The Take
The interesting thing about this document is not the warning, which is by now routine. It is the word "collective." Every mechanism the G7 reaches for — national strategies, procurement requirements, public-private coordination — assumes somebody can compel an upgrade. Ethereum can approximate that through a fork schedule and a foundation. Solana can approximate it through a validator-client duopoly. Bitcoin cannot, and BIP-361 is the honest admission of it: the only remaining lever is to make the vulnerable coins unspendable, and that lever will be argued over for years by people who are correct on both sides. Set against that, 2029 stops looking like a distant date and starts looking like a governance timeline, which is a much shorter unit of time than it sounds. The useful takeaway is small and unglamorous: the G7's first instruction was to take an inventory. Very few teams in this industry can currently produce one. That, not the qubit count, is the number that should be bothering people.