Vitalik Buterin's Insights on Quantum Computing and Ethereum's Cryptography

In a noteworthy discussion, Ethereum co-founder Vitalik Buterin has highlighted the potential impact of quantum computing on current cryptography. He estimates a significant 20% chance that quantum computers capable of breaking existing cryptographic systems could emerge before the end of this decade. This article explores Buterin's insights, including the risks associated with elliptic curve cryptography and the strategies Ethereum should adopt to mitigate potential threats.

Key Takeaways

Buterin points out a notable 20% probability that quantum computers could compromise existing cryptography before 2030, urging Ethereum to start preparations.
One key concern is ECDSA (Elliptic Curve Digital Signature Algorithm). Exposing a public key on the blockchain could allow a future quantum computer to recover its corresponding private key.
Buterin suggests an emergency plan for quantum threats, involving block rollbacks, freezing external owned accounts (EOAs), and transitioning funds to quantum-resistant smart contract wallets.
Effective mitigation strategies include using smart contract wallets, implementing NIST-approved post-quantum signatures, and developing a flexible crypto infrastructure that enables seamless changes in signature schemes.

In late 2025, Vitalik Buterin, the co-founder of Ethereum, took an unusual step by quantifying a risk often portrayed in science fiction. He referenced the forecasting platform Metaculus, stating there is “about a 20% chance” that quantum computers capable of breaking current cryptographic methods could be developed before 2030, with a median estimate closer to 2040. During a subsequent event in Buenos Aires, he expressed concern that elliptic curve cryptography, a cornerstone for both Ethereum and Bitcoin, “might fail before the next U.S. presidential election in 2028.” He urged the Ethereum community to transition to quantum-resistant structures in the next four years.

Ethereum's Growth and Key Risks

According to Buterin, a cryptographically significant quantum computer could emerge within the next decade, making it crucial for Ethereum’s research roadmap to address this risk rather than dismissing it as a far-off concern.

Did you know? As of 2025, data from Etherscan shows over 350 million unique Ethereum addresses, reflecting the network's growth, although only a small fraction holds substantial balances or remains active.

Vitalik Buterin's Insights on Quantum Computing and Ethereum's Cryptography

The Quantum Computing Challenge for Ethereum

The majority of Ethereum’s security relies on the elliptic curve discrete logarithm problem (ECDLP), the foundation of the elliptic curve digital signature algorithm (ECDSA). Ethereum employs the secp256k1 elliptic curve for signatures. In simpler terms:

Your private key is a large, random number.
Your public key derives from that private key as a point on the curve.
Your address is a hash of the public key.

While it is straightforward to derive the public key from the private key on conventional hardware, reversing this process is believed to be practically impossible. This asymmetry allows a 256-bit key to be considered effectively unbreakable.

Understanding Cryptography’s Vulnerability

Quantum computing poses a significant threat to that asymmetry. Shor’s algorithm, introduced in 1994, indicates that a sufficiently powerful quantum computer could solve the discrete logarithm problem and related equations quickly, thereby affecting various public key systems, including RSA, Diffie-Hellman, and ECDSA.

Both the Internet Engineering Task Force and the National Institute of Standards and Technology (NIST) acknowledge that classical elliptic curve systems would be at risk if confronted by a cryptographically relevant quantum computer (CRQC). Buterin’s call to action emphasizes a crucial aspect for Ethereum: when an address has never transacted, only the hash of its public key is visible on-chain, which is still considered quantum-safe. However, once a transaction occurs, the public key becomes exposed, giving potential quantum attackers the necessary information to derive the private key and compromise the account.

Thus, the core risk isn’t that quantum computers will break Keccak or Ethereum’s data structures; rather, it lies in targeting any address that has exposed its public key, which includes most user wallets and numerous smart contract treasuries.

Buterin's Perspective on Quantum Risk

Buterin’s recent commentary contains two primary components. The first is his probability assessment. Instead of making an arbitrary guess, he turned to Metaculus forecasts indicating a 20% chance of quantum computers capable of breaking public key cryptography appearing before 2030, with a median estimate of around 2040. He argues that this level of potential risk is significant enough for Ethereum to proactively prepare.

The second point involves a 2028 context. At Devconnect, he mentioned, “elliptic curves are going to die,” referencing studies suggesting quantum attacks on 256-bit elliptic curves may be feasible before the 2028 U.S. presidential election. Some media reports condensed his message into a headline like “Ethereum has four years,” but his communication is more nuanced:

Present quantum computers do not pose a threat to Ethereum or Bitcoin at this time.
When CRQCs become available, ECDSA and similar systems will be structurally vulnerable.
Transitioning a global network to post-quantum systems requires years of preparation, making it unwise to wait for an imminent danger before taking action.

In essence, he adopts the mindset of a safety engineer. While there may be a 20% chance of a devastating earthquake in the next decade, one does not evacuate a city but reinforces infrastructure in anticipation of future risks.

Did you know? As of 2024, IBM’s strategy combines new quantum chips, Nighthawk and Loon, with aspirations to demonstrate fault-tolerant quantum computing by 2029, having also displayed a key quantum error correction algorithm functioning efficiently on standard AMD hardware.

Understanding the Quantum Emergency Plan

Long before recent public alerts, Buterin discussed a “How to hard-fork to save most users’ funds in a quantum emergency” in a 2024 Ethereum Research post. This outlined potential responses if a significant breakthrough in quantum computing occurs unexpectedly.

For instance, if there were an announcement about the launch of large-scale quantum computers, leading to attackers draining wallets secured by ECDSA, what actions would Ethereum take? Ethereum would roll back to the last block prior to the major quantum theft event. Traditional EOAs utilizing ECDSA would be rendered inactive and unable to transfer further funds, thereby reducing additional thefts from exposed public keys.

A new transaction method would permit users to verify through zero-knowledge STARKs that they control the original seed or derivation path, such as a Bitcoin Improvement Proposal (BIP) 32 HD wallet preimage for a vulnerable address. The verification process would also involve specifying new validation code for a quantum-resistant smart contract wallet. Once confirmed, the control of the funds would transfer to this contract, which could implement post-quantum signatures from that point.

Because STARK proofs can be large, the design plans for batching, where aggregators submit bundles of proofs, allowing multiple users to transfer simultaneously while keeping each user’s preimage private.

Significantly, this approach serves as a last-resort recovery solution, not an immediate fix. Buterin asserts that the essential infrastructure for such a hard fork—including account abstraction, robust ZK-proof systems, and standardized quantum-safe signature schemes—should be developed. This transforms quantum emergency preparedness into a necessary design aspect of Ethereum’s infrastructure rather than merely a speculative exercise.

Expert Opinions on Timelines

If Buterin is relying on public forecasts, what are the conclusions from hardware and cryptography specialists? On the hardware front, Google's Willow chip, launched in late 2024, stands out as one of the most advanced public quantum processors available, featuring 105 physical qubits and error-corrected logical qubits that outpace classical supercomputers in certain benchmarks. However, Google’s quantum AI director has clearly indicated that "the Willow chip is not capable of breaking modern cryptography." He estimates that breaking RSA would necessitate millions of physical qubits, which is at least a decade away.

Similar perspectives emerge from academic sources. A frequently cited analysis indicates that compromising 256-bit elliptic curve cryptography in under an hour using surface code-protected qubits would require tens to hundreds of millions of physical qubits, far exceeding current capabilities.

On the cryptography side, NIST and academic institutions like the Massachusetts Institute of Technology have long warned that the existence of cryptographically relevant quantum computers would disrupt nearly all widely employed public key systems, including RSA, Diffie-Hellman, Elliptic Curve Diffie-Hellman, and ECDSA, due to Shor’s algorithm. This threat applies both retrospectively—decrypting previously collected data—and prospectively—forging signatures.

That’s why NIST has spent nearly a decade organizing its Post-Quantum Cryptography competition, culminating in 2024 with the establishment of three initial PQC standards: ML-KEM for key encapsulation and ML-DSA and SLH-DSA for signatures.

There is no expert consensus on an exact “Q-Day.” Most predictions lie within a 10- to 20-year frame, while some recent work contemplates more optimistic scenarios, suggesting that fault-tolerant attacks on elliptic curves might become possible in the late 2020s under aggressive assumptions.

Important policy bodies, including the U.S. White House and NIST, take the issue seriously enough to transition federal systems to PQC by the mid-2030s, suggesting a notable risk that cryptographically relevant quantum computers could arise within this timeframe. Viewed in this context, Buterin's "20% by 2030" and "possibly before 2028" statements reflect a broader spectrum of risk assessments, where the crucial takeaway is not the belief that a code-breaking machine currently exists, but rather that preparation is essential given the uncertainty and lengthy migration periods involved.

Did you know? A 2024 report from the National Institute of Standards and Technology and the White House estimates that it will cost approximately $7.1 billion for U.S. federal agencies to transition their systems to post-quantum cryptography between 2025 and 2035—an investment representing just one country’s governmental IT infrastructure.

Adjustments for Ethereum Amidst Quantum Advancements

On both protocol and wallet fronts, various elements are converging already. Transitioning users from basic EOAs to upgradable smart contract wallets, facilitated by ERC-4337-style account abstraction, becomes simpler for future signature scheme updates without needing emergency hard forks. Some existing projects are already demonstrating quantum-resistant wallets using Lamport-style or eXtended Merkle Signature Scheme (XMSS)-style designs on Ethereum.

Ethereum will need to select (and comprehensively test) one or more PQC signature families, likely from those offered by NIST (ML-DSA/SLH-DSA or hash-based constructions), considering factors such as key size, signature size, verification costs, and integration with smart contracts. Moreover, elliptic curves are employed not only for user keys; BLS signatures, KZG commitments, and some rollup proof systems equally depend on the hardness of discrete logarithms, indicating that a thorough quantum-resilient roadmap needs viable alternatives for each foundational element.

On the social and governance fronts, Buterin's proposed quantum emergency fork illustrates the extensive coordination required for any authentic response. Even with perfect cryptography, actions like rolling back blocks, freezing old accounts, or enforcing mass key transitions would be contentious politically and operationally. This is why he and other researchers advocate for:

Developing “kill switch” or “quantum canary” mechanisms to automatically trigger migration policies upon verification of a smaller, intentionally vulnerable test asset being compromised.
Considering post-quantum transitions as an incremental opt-in process that users can adopt long before facing an imminent attack, rather than as a last-minute rush.

For individuals and institutions, the immediate checklist is more straightforward:

Opt for wallets and custody options that enable cryptographic upgrades without necessitating a switch to entirely new addresses.
Avoid unnecessary reuse of addresses to minimize the exposure of public keys on-chain.
Monitor Ethereum's eventual post-quantum signature selections and be prepared to transition once reliable tools become accessible.

Quantum risks should be approached similarly to how engineers consider floods or earthquakes. While it may not likely result in the destruction of your property this year, its likelihood over an extended period warrants designing a resilient foundation in anticipation of future challenges.