G7 warns quantum threat to encryption puts crypto wallets on notice

The Group of Seven has issued a coordinated warning that organizations must begin moving to post-quantum cryptography before large-scale quantum computers can compromise today's encryption and digital signatures, a message that puts cryptocurrency exchanges, custodians and wallet developers directly in the regulatory spotlight. The group's framing treats the shift as a matter of national economic security rather than a niche research topic, citing the trillions of dollars in digital assets that rely on the same elliptic curve and RSA math that a future quantum machine could theoretically break.

Why is the G7 raising the quantum alarm now?

The G7 is raising the alarm now because the gap between the current state of quantum hardware and the cryptographic assumptions underpinning global finance has narrowed enough to demand coordinated policy action. Public statements from major quantum labs in 2024 and 2025 reported qubit counts in the triple digits, with error correction milestones that suggest the technology is moving from laboratory curiosity toward engineering scale. For policymakers, the lesson from past cryptographic transitions such as the SHA-1 to SHA-2 migration is that standardizing algorithms takes years, and replacing deployed keys takes even longer, which is why the G7 is calling for preparation rather than waiting for a single trigger event. The group also noted that a harvest-now, decrypt-later strategy, in which adversaries record encrypted traffic today and decrypt it once a quantum computer is ready, makes the threat immediate for any data with a long secrecy shelf life, including blockchain transactions whose addresses can be monitored indefinitely.

Which crypto signature schemes are actually at risk?

The crypto signature schemes at risk are the elliptic curve variants that secure nearly every major blockchain, including ECDSA used by Bitcoin and Ethereum, Schnorr signatures adopted by Bitcoin through the Taproot upgrade, and EdDSA used across several altcoin networks. All three schemes derive their security from the difficulty of the elliptic curve discrete logarithm problem, a math problem that Peter Shor's algorithm, when run on a sufficiently large fault-tolerant quantum machine, is widely expected to solve in polynomial time. Public key exposure is the trigger: in Bitcoin's current pay-to-public-key-hash model, the public key only becomes visible on chain after the first spend from an address, meaning coins sitting in legacy addresses that have never moved are partially shielded, but any reused address or modern Taproot output already broadcasts the public key in the open. Once the public key is on chain, an attacker with a quantum computer could derive the private key and forge a transaction, redirecting funds before the network confirms any defense.

How serious is the threat to bitcoin and ether holders today?

The threat to bitcoin and ether holders today is real in theory but low in probability on any specific timeline, which is exactly why policymakers want action before that probability changes. On-chain data shows that a meaningful share of circulating bitcoin sits in addresses that have already exposed their public keys, including all Taproot outputs and any address that has been spent from at least once, with the remainder shielded until first use. Ethereum faces a related but distinct exposure because its accounts expose the public key as part of the standard transaction format, which means a quantum attacker with sufficient power could theoretically target any active address, not just reused ones. Industry estimates for the cost of breaking a single 256-bit elliptic curve key have historically been quoted in the hundreds of millions of dollars of classical compute, a figure that a scaled quantum machine could compress dramatically, though no peer-reviewed estimate of the exact qubit count required to attack secp256k1 has been confirmed by experimental demonstration.

What are the post-quantum fixes the industry is weighing?

The post-quantum fixes the industry is weighing fall into three buckets: hash-based signatures, lattice-based signatures and protocol-level migration paths. Hash-based schemes such as XMSS and SPHINCS+ have been studied for years and are well understood, with the trade-off being larger signature sizes and stateful key requirements that complicate wallet design. Lattice-based schemes such as CRYSTALS-Dilithium, standardized by the U.S. National Institute of Standards and Technology as ML-DSA in FIPS 204, offer smaller signatures and stateless keys, which is why most blockchain researchers are focused on lattice-based replacements rather than hash-based ones. Migration is the harder problem, because changing a signature scheme on a live network worth hundreds of billions of dollars requires a hard fork, replay protection, new address types and a multi-year transition window in which both old and new signatures must be accepted, and none of the top five chains by market cap have published such a roadmap publicly as of late 2025.

How does this fit the bigger regulatory trend?

The G7 statement fits a broader regulatory trend in which standards bodies and governments have spent three years translating the abstract quantum threat into concrete compliance deadlines. NIST published its first three finalized post-quantum standards, FIPS 203 for ML-KEM key encapsulation, FIPS 204 for ML-DSA signatures and FIPS 205 for SLH-DSA stateless hash-based signatures, in August 2024, and U.S. Federal agencies have been told to begin inventorying cryptographic systems under guidance issued through 2025. For crypto, the parallel pressure comes from traditional finance integration: spot bitcoin and ether exchange-traded funds hold custody with regulated qualified custodians, and those custodians are themselves subject to the same post-quantum migration timelines as banks, meaning exchanges will inherit deadlines whether or not the underlying blockchains are ready. The G7's communication is notable because it extends that pressure to the cryptocurrency industry explicitly rather than leaving it as an implicit downstream effect.

What should traders and developers watch next?

Traders and developers should watch next for any G7 working group report with implementation timelines, any NIST or equivalent European standards body draft that addresses blockchain-specific signature migration, and any core developer call from Bitcoin, Ethereum or major smart contract platforms that begins discussing post-quantum address types. The likeliest near-term catalysts are quantum hardware announcements from large-scale labs, since each qubit-count milestone tends to reignite policy urgency, and any successful demonstration of a cryptographically relevant algorithm on a real device rather than a simulator. The likeliest near-term risks are regulatory: if custodians and exchanges are required to migrate to post-quantum key management before chains do, users may see new wallet formats, address rotation campaigns and custody migrations that briefly complicate deposits and withdrawals. For long-term holders, the practical implication is that address hygiene matters more than ever, since addresses that have never spent a transaction continue to hide their public key, and simple practices like avoiding address reuse reduce the future attack surface regardless of which signature scheme wins the standardization race.