Ethereum and quantum computers: Has your ETH been affected?

No, your ETH is not in danger today, and you don't need to move anything.

On September 7, 2026, the Ethereum Foundation announced that Ethereum L1 should be quantum-resistant by December 2029. This is a deadline for developers, not a warning to holders. What's really important to you is another fact that's not mentioned in all the reports about the decision: Every Ethereum account that has ever sent a transaction disclosed its public key during the transaction. This is where the risks arise, and this is exactly the difference between Ethereum and Bitcoin.

This article aims to clarify the true meaning of the decision, which keys are at risk, the checks that holders, pledgers and Rollup users can take immediately, and why a recommendation widely circulated in the Bitcoin world does not apply to Ethereum.

The Ethereum Foundation's decision of September 7, 2026

The Ethereum Foundation's protocol cluster (i.e., the internal team responsible for the development of the network foundation layer) made a commitment under the goal titled "EF Protocol: Current and Emerging Priorities." The article points out that the goal is to enable Ethereum L1 to fully achieve quantum resistance at three levels: execution layer, consensus layer and data availability layer. The set completion date is December 2029.

There are three qualifications that should be noted immediately, but have been ignored in a large number of reports. First, this is the deadline set by the foundation itself. The foundation wrote in its text that "no negotiation is possible until at least January 2027," after which it will re-evaluate the current state of quantum research with external experts. Second, the foundation does not determine the direction of the agreement; upgrades are decided jointly by the client team and the open All Core Devs conference. Third, the foundation itself calls the idea that cryptographics-related quantum computers are expected to emerge in 2030 a "deliberately radical assumption," adding that most credible estimates are later, some even very late, and this may never come.

The decision did not address ETH prices. This is a development plan for an encryption solution, not a market event.

Can a quantum computer steal your ETH today?

No. The post-foundation quantum team described the current state of the hardware very calmly: to crack elliptic curve cryptography, the machine requires thousands of stable logic qubits and permanent error correction operations. A logical qubit is not a single component: it consists of many error-prone physical qubits that together form an element that is stable enough to perform calculations. Current machines are far from reaching this goal. Most technology roadmaps place cryptographic correlations in the early to mid-2030s.

The attack in question is called the Shor algorithm: a quantum method of deriving a matching private key from a known public key. The foundation bluntly pointed out the consequences: theft of balances and identity abuse. The history of the chain is not considered. Confirmed transactions and finalized blocks are still valid, and no one will rewrite the history of the chain in this way.

Why the public key on Ethereum is almost always exposed

This is the key point why most reports ignore your actual problem. Quantum risk is not attached to the coin itself, but to whether the public key of the address is known. As long as only the address exists, Shor algorithm has no way to start.

The Ethereum address is derived from the public key and does not reveal the public key itself. But once the account signs a transaction, the signature stays on the chain and the public key can be reconstructed from it. The foundation is blunt in its Frequently Asked Questions (FAQ): Every account where a transaction has been executed has a exposed public key. This applies to ordinary accounts (EOAs), whose keys are based on the ECDSA scheme on the secp 256k1 curve.

and Bitcoin address balances is that on Ethereum, the balance remains in the same account after sending. The key is exposed and the funds remain in place, which is the norm, not the exception, at Ethereum.

An account that has already sent a transaction is like the box on the left: the key is clearly exposed in broad daylight, and the balance is still behind it.

What it means compared to Bitcoin: 0.1% rather than 5%

For Bitcoin, we analyzed on September 5 which addresses disclosed public keys: basically old P2PK positions and reused addresses. For Ethereum, the foundation reverses this comparison in its FAQ. It said about 5% of the supply on Bitcoin is tied to earlier address formats widely considered obsolete, including about a million BTC attributed to Satoshi Nakamoto. The comparable share of permanently dormant positions in Ethereum (i.e. positions considered to be lost forever) is closer to 0.1%. This is the foundation's own estimate, not measurement data.

This results in an inversion that is visible only when viewed by the second eye. On Ethereum, the proportion of lost positions is small, so the foundation believes the option of doing nothing in the end is more feasible than on Bitcoin. At the same time, a much larger proportion of accounts on Ethereum have exposure keys. As a result, risk is more evenly distributed and migration is correspondingly wider: it involves many active accounts rather than limited legacy inventory. Opinions within the community are widely divided on what will happen to balances that have never been migrated, which is clearly a network governance issue rather than a technical issue.

Which keys are really at risk: Ranking of post-quantum groups

Post-quantum teams rank attack surfaces by priority in the FAQ, an order that is more useful than any general threat assessment.

• Ordinary User Accounts (EOAs):The largest store of value, the public key is exposed after the first transaction.
• High-value operating keys: Bridging between exchanges, blockchain networks, and managed hot wallets concentrate large amounts of value behind a few keys.
• Governance and upgrade keys: Multi-signature accounts that boot the entire protocol.
• Verifier keys: involve consensus participation, but they do not hold balances themselves.

The common pattern pointed out by the foundation is to concentrate value or control behind exposed, long-standing keys. Important background information: This does not mean that every ETH is at equal risk. The severity of the scenario depends on how far the migration progresses when the hardware is ready.

As a holder, this means that if your ETH is stored on an exchange, your risk depends on the second point, which is someone else's operating key, not your own key. This is another reason for self-trusteeship independent of quantum problems.

What can pledgers now check: Withdrawal vouchers

Verifiers are signed with a BLS key, a different scheme than ordinary accounts. The solution is also based on elliptic curves and is therefore equally fragile. It becomes specific with withdrawal certificates, which are entries that specify where the verifier can pay its balance. Old deposits still carry 0x00 format there and are directly bound to the BLS key. Newer formats point to ordinary execution addresses.

During the Hegotá fork, EIP-8365 is awaiting a decision, a proposal to eliminate these legacy certificates. The foundation wrote that this work could begin before waiting for quantum design after the consensus layer is complete. Therefore, anyone pledging should immediately check which format their verifier carries. How we step-by-step described in the guide how to check verifier credentials. If you entrust your ETH through the provider, the operator will bear this check for you; however, these details are still what you should ask when selecting a service.

Roadmap to December 2029: Glamestead, Hegotá and the Five Hard Forks

A Hard Fork is a network upgrade where all client teams switch to new rules simultaneously. The foundation did its own calculations in its text: If Glamstam arrives in December 2026, and full quantum-resistant capabilities are intended to stand in December 2029 after the five subsequent hard forks, then the average time interval for each fork is 7.2 months. It itself acknowledges that the timetable is "quite radical" and that if the fork is longer than assumed a year ago, there is little room for it.

For urgent situations, there is a fallback flag called MV-PQ, the lowest feasible level of quantum-resistant capabilities, designed to keep the network through difficulties with low guarantees. The intermediate stage lies on the post-quantum group roadmap: the quantum-secure public key registry in the I* fork, the quantum-secure signature building block in the execution layer in the J* fork, and then the quantum-secure attestations. Regarding Hegotá, the next fork after GlamAmsterdam, the foundation wrote a sentence that summarizes the whole situation: Hegotá itself is not a quantum fork; it is a fork that determines whether to reach the quantum fork on time.

By the way, the deadline is not fabricated: December 2029 is at the same level as the 2029 migration goals set independently by Google, Cloudflare and Microsoft for their respective systems. Those here accusing Ethereum of lagging behind other technology industries are using the wrong yardstick.

Why the consensus layer is more difficult to convert than the execution layer

These two layers are treated differently, which explains why you can take action quickly on one side and not on the other.

At the execution level (where your accounts and exchanges are), the foundation is betting on cryptographic agility: the ability to swap signature schemes without having to have a separate hard fork for each new scheme. What makes this possible is the native account abstraction, where accounts come with rules for verifying signatures. The proposal EIP-8141 specified for this purpose aims to provide accounts with a protocol-native path to escape vulnerable secp256k1 keys. This is why switching is intended to run gradually and voluntarily for users, rather than as a deadline for everything to flip over at the same time.

This does not work at the consensus level. Its cryptography can only be changed through hard forks, and the functionality provided by BLS today to aggregate many signatures into one signature has no completed counterpart in the post-quantum world. The foundation studies hash-based signatures under the name leanXMSS, on Rust implementations, and on minimal zero-knowledge machines. According to the foundation, an executable specification called leanSpec has been used by about ten client teams for its quantum security consensus client. The cost of these solutions is larger signatures and more expensive verifications, which increases bandwidth, storage burdens and ultimately affects the efficiency of the entire network. This is why the consensus layer will be hardened first and then rolled out, rather than emerging block by block.

All machines targeted by the deadline: To attack today's signatures, it requires thousands of stable logic qubits.

What "Harvest now, decrypt later" means to your coin

The term describes a strategy for collecting encrypted data today so that it can be decrypted with better hardware in the future. In the cryptocurrency space, it is often misused, and the foundation clarified this: blockchain relies mainly on the integrity system of signatures, not confidentiality. Recording today's transactions will not allow anyone to later cancel past payments or clear old balances.

Where collection does work is all the encrypted content around the entire ecosystem: private communications, confidential transaction systems, custody infrastructure and off-chain sensitive data. For your ETH, the rules are as follows: Risks exist in the future, there were no risks in the past. It only occurs when a sufficiently powerful machine exists, and then hits accounts that have not yet migrated keys at that time.

What happens to tokens, NFTs, DeFi positions, and Rollup

Positions in tokens, NFTs, and apps exist as contract entries pointing to your account rather than as separate keys. Therefore, these entries are completely hung on the same key in your ETH. Migrate your account and the rest follows; if you don't, everything is at the same risk. It does not need to be processed separately.

For Rollups (i.e. chains that bundle their transactions and hand them over to Ethereum for security), their own vulnerabilities have been added. The foundation lists four: sorters and managed operation keys, bridging and cross-chain messaging, the user account itself, and the attestation system in zero-knowledge Rollup. The model is the same as above. Wherever few keys control a lot of value it gets dangerous. If you have a large balance on Rollup, that's when you should pay attention to carrier announcements in years to come.

Actions you can take today and things you should avoid

First of all: There is currently no technical reason to move balances, sell coins , or switch to another network. The foundation clearly warns in its FAQ against rushing into immature solutions, which may create more risk than eliminate it.

What really helps is the unobtrusive. The key is that you can take action when official migration paths exist. This requires you to control your key and not lose it. Balances of mnemonic words that can no longer be found cannot be moved, and this type of position can eventually become mired in a debate about freezing funds. If your key is sitting today on a computer that is also used for browsing, moving to a signing-only device is a step worth taking regardless of quantum issues. Which devices manage this, and how they differ, are explained in our Hardware Wallet Comparison.

Although one of the advice from the Bitcoin world does not apply to Ethereum: the advice there is to use each address only once so that the public key remains hidden. On Ethereum, once the account has been sent, this is useless because by then the key has been exposed and the balance remains in the same account. Pushing your ETH to a new address will reveal the old key when sent anyway and only incur a cost.

How to identify scams that use quantum arguments

Every major headline on this topic brings a wave of news urging immediate "quantum safe migration." Three characteristics can reliably identify them. First, they create time pressure, and the real roadmap spans years and will be reassessed in January 2027 anyway. Second, they ask you to enter or upload mnemonic words, which is not required for any legal upgrade. Third, they arrive through channels that no one uses for protocol upgrades, such as direct messaging or promoting search results.

Reliable reverse inspection takes only two minutes: the foundation's post-quantum work is open and public, with specifications, code, and meeting minutes. What is not recorded there is not an upgrade.

Examining the quantum risks of Ethereum: Summary of the key points

Keep calm and don't sell anything.

The decision is a development goal for December 2029, not an alarm. Instead, use this time to put your hosting on a clean foundation; the differences between software solutions and device solutions are illustrated in the Software Wallet Comparison.

Make sure you can take action.

Check if you store the mnemonic safely and can find it again, and if you sign the transaction on a device that is not online at the same time. Appropriate devices are compared in a hardware wallet comparison.

As a pledger, establish the format of your withdrawal voucher.

The old 0x00 certificate is a specific part of the quantum problem that you can already change today. Anyone pledging through a service provider should check the details of that provider and include the provider in the pledging platform comparison.