I spent three weeks last month auditing the cryptographic foundations of a Layer 2 project that had just raised $47 million in a Series A. The pitch deck was immaculate—zk-STARKs, recursive proofs, a roadmap that promised sub-second finality. But buried in their technical documentation, on page 34 of a 40-page appendix, I found a single sentence that stopped me cold: "Post-quantum resistance will be addressed in a future upgrade."
No timeline. No technical specification. No acknowledgment of what that sentence actually meant.
I closed my laptop and sat in silence for a moment. Here was a project valued at nearly half a billion dollars, built on cryptographic primitives that a sufficiently powerful quantum computer could theoretically shatter—and they were treating the solution as an afterthought. The marketing emphasized speed. The investors emphasized returns. Nobody emphasized the fact that the entire edifice rested on mathematical assumptions that may not hold in twenty years.
This is the paradox of the current bull market. We are building faster than ever, deploying capital with unprecedented enthusiasm, and yet the foundational layer—the cryptography that makes any of this possible—remains vulnerable to threats we have already identified but refuse to seriously address.
The conversation about AI challenging cryptography is not wrong, but it is dangerously imprecise. The real threat is quantum computing. AI is an accelerant, not the fire itself. And conflating the two leads to exactly the kind of muddled thinking that produces either panic-driven migration or complacent inaction—both of which are catastrophic.
The Foundations We Never Question
To understand why this matters, we need to revisit what we actually mean when we say "blockchain security."
Every transaction you have ever signed on Ethereum, every Bitcoin you have ever moved, every NFT you have ever minted—all of it relies on a single class of cryptographic primitives: public-key cryptography, specifically the Elliptic Curve Digital Signature Algorithm (ECDSA) for Bitcoin and Ethereum, and Schnorr signatures for newer protocols.
These algorithms derive their security from a mathematical problem called the discrete logarithm problem. The idea is elegantly simple: given a public key, it is computationally infeasible to derive the corresponding private key. This infeasibility is not a matter of engineering—it is a mathematical guarantee, rooted in the difficulty of solving certain equations on elliptic curves.
For decades, this guarantee has held. The best classical algorithms for solving discrete logarithms—the general number field sieve, the Pollard rho algorithm—would require more computational power than exists in the entire world to break a single 256-bit key.
But quantum computing changes the equation entirely.
In 1994, a mathematician named Peter Shor published an algorithm that could solve both integer factorization and discrete logarithms in polynomial time on a sufficiently powerful quantum computer. This was not a marginal improvement—it was a categorical shift. A problem that would take classical computers billions of years could, in theory, be solved by a quantum computer in hours.
The implications for blockchain are existential. Every public key that has ever been exposed on-chain—every address that has sent a transaction, every smart contract that has verified a signature—becomes a potential target. Satoshi's estimated 1 million BTC, dormant for over fifteen years, would be vulnerable the moment a quantum computer capable of running Shor's algorithm at scale is built.
This is not speculation. This is mathematics.
The AI Confusion
So why does the current discourse frame this as an "AI challenge" rather than a quantum one?
I believe there are three reasons, and none of them are technically sound.
First, AI is the dominant narrative of our time. Every industry, every sector, every conference panel must somehow connect to artificial intelligence. The crypto industry is no exception. Framing cryptographic vulnerability as an "AI problem" makes it feel more immediate, more connected to the zeitgeist. It sells papers. It drives engagement. It generates the kind of breathless commentary that passes for analysis in too many corners of Crypto Twitter.
Second, there is a genuine—but limited—role for AI in cryptographic attacks. AI can accelerate vulnerability discovery in implementation code. It can assist in side-channel analysis, identifying patterns in power consumption or timing that leak information about private keys. It can help researchers explore the vast space of potential weaknesses more efficiently than manual analysis.
But here is the critical distinction: AI cannot break the mathematical foundations of public-key cryptography. It can only exploit implementation flaws or accelerate research that might eventually lead to quantum breakthroughs. These are fundamentally different threat models, and conflating them leads to fundamentally different—and often wrong—responses.
Third, and most troublingly, the AI framing serves a marketing purpose. A project that claims to be "AI-resistant" or "quantum-ready" sounds cutting-edge. A project that honestly says "we are aware of the quantum threat and are monitoring developments" sounds boring. In a bull market, boring does not raise capital.
I have seen this pattern before. In 2017, every project claimed to be "decentralized" without understanding what that meant. In 2021, every project claimed to be "carbon neutral" without auditing their actual energy consumption. Today, every project claims to be "quantum-resistant" without having a migration plan.
The words change. The substance does not.
The Migration Dilemma
The real question is not whether we need to migrate to post-quantum cryptography. We do. The question is when and how.
The National Institute of Standards and Technology (NIST) finalized its first post-quantum cryptographic standards in 2024—FIPS 203 (ML-KEM, based on the CRYSTALS-Kyber algorithm), FIPS 204 (ML-DSA, based on CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, based on SPHINCS+). These are genuine achievements, the culmination of years of research and international collaboration.
But here is what the marketing materials do not tell you: these algorithms are young. They have not been subjected to the same decades of adversarial scrutiny as ECDSA and RSA. Their security assumptions are different—lattice-based problems, hash-based constructions—and while these problems are believed to be hard, the belief is not as deeply tested.
More importantly, the performance characteristics are radically different.
A Dilithium signature is approximately 2.4 kilobytes. An ECDSA signature is approximately 64 bytes. That is a 37x increase in size. Every transaction, every block, every wallet storage requirement would be affected. Gas costs would skyrocket. Throughput would plummet. The entire economic model of blockchains, built on the assumption of cheap signature verification, would need to be rethought.
This is not a simple upgrade. This is a fundamental rearchitecture.
The Coordination Problem
Let us imagine, for a moment, that the technical challenges are solved. We have efficient post-quantum signatures. We have migration paths that preserve backward compatibility. We have wallet software that supports the new schemes.
The harder problem remains: coordination.
Cryptographic migration is not a decision that any single protocol can make unilaterally. Bitcoin cannot migrate without overwhelming community consensus—a process that has historically taken years for far simpler changes. Ethereum cannot migrate without the Ethereum Improvement Proposal (EIP) process, which requires extensive discussion, testing, and eventual hard fork coordination.
And even if the major L1s migrate, what about the bridges?
Cross-chain bridges are already the most vulnerable component of the Web3 ecosystem. They aggregate massive amounts of value, rely on complex verification logic, and have been repeatedly exploited for billions of dollars. Now imagine asking them to support both classical and post-quantum signatures simultaneously, during a transition period that could last years.
The attack surface would be enormous. Every bridge would become a potential point of failure. Every compatibility layer would be a potential vulnerability.
This is the hidden danger of hasty migration: the transition period itself may be more dangerous than the threat we are trying to mitigate.
A Framework for Principled Patience
So what should we actually do?
I propose a framework that I have been developing in my own work, one that balances urgency with prudence:
First, acknowledge the threat honestly. Not with marketing language, not with vague promises of future upgrades, but with clear technical documentation that explains what the quantum threat is, what the current status of post-quantum cryptography is, and what the migration path looks like. Projects that cannot provide this documentation should be viewed with skepticism.
Second, invest in research and testing now. The algorithms are young, but they are not unknown. Every major protocol should have a research team actively testing post-quantum signatures in testnet environments, measuring performance impacts, and identifying edge cases. This is not about deploying tomorrow—it is about being ready when deployment becomes necessary.
Third, design for gradual transition. EIP-4337, Ethereum's account abstraction proposal, offers a potential path forward. By allowing accounts to define custom signature verification logic, it creates the possibility of introducing post-quantum signatures incrementally, without requiring a hard fork that affects all users simultaneously. Similar approaches should be explored for other protocols.
Fourth, coordinate across the ecosystem. This is not a problem any single project can solve alone. We need cross-protocol working groups, shared standards, and coordinated timelines. The alternative is a fragmented migration that leaves gaps for attackers to exploit.
Fifth, and most importantly, resist the urge to rush. The quantum threat is real, but it is not imminent. Current estimates suggest that a quantum computer capable of breaking 256-bit elliptic curve cryptography is at least a decade away—possibly two. We have time to do this right. We do not have time to do it wrong.
The Contrarian View: Why the AI Narrative Hurts Us
I want to push back against the dominant narrative in a way that may be uncomfortable.
The emphasis on AI as the primary threat to cryptography is not just technically imprecise—it is actively harmful.
Here is why: AI is a tool that can be used to attack cryptographic implementations, but it is not a threat to cryptographic foundations. By conflating these two, we misallocate resources and attention.
Projects that are genuinely concerned about AI-assisted attacks should focus on formal verification, code auditing, and secure development practices. These are important, but they are fundamentally different from preparing for quantum migration.
Projects that are genuinely concerned about quantum threats should focus on post-quantum cryptography research, migration planning, and ecosystem coordination. These are also important, but they require different expertise, different timelines, and different investments.
When we blur the distinction, we end up doing neither well.
I have seen this play out already. A project I consulted with last year spent six figures on an "AI security audit" that consisted of running a machine learning model against their smart contracts. The model found some minor issues—inefficient gas usage, potential reentrancy patterns—but nothing that a human auditor would not have caught. Meanwhile, their cryptographic migration roadmap remained empty.
This is the opportunity cost of narrative confusion. We are spending resources on the wrong problems because we are not thinking clearly about what the actual problems are.
The Human Dimension
Let me step back from the technical analysis for a moment and consider what is really at stake.
When I translated MakerDAO governance proposals from English to Chinese in 2020, I was struck by how abstract the discussions often were. We talked about "decentralization" and "trustless systems" as if these were purely technical properties, divorced from human experience.
But they are not. Every cryptographic primitive we deploy is ultimately a promise to users—a promise that their assets are safe, that their identity is secure, that the system will work as described.
When we fail to prepare for cryptographic migration, we break that promise. Not immediately, not today or tomorrow, but eventually. And when that day comes, the people who will suffer most are not the developers who understood the risks and chose to ignore them. They are the ordinary users who trusted the system.
The 2022 collapse of FTX taught us that centralization of power leads to moral hazard. But it also taught us something else: technical sophistication is not the same as ethical responsibility. FTX had excellent technology. It had a functioning exchange, sophisticated trading systems, and a user base that trusted it. What it lacked was a commitment to the values that make technology worthy of trust.
The same principle applies to cryptographic migration. It is not enough to have the technical capability to migrate. We must have the ethical commitment to do it right—to prioritize long-term security over short-term convenience, to coordinate rather than compete, to prepare rather than react.
The Path Forward
So where does this leave us?
The quantum threat is real. The AI narrative is confused. The migration is necessary but must not be rushed. The coordination problem is daunting but not insurmountable.
What we need is a new kind of conversation—one that treats cryptographic migration not as a technical problem to be solved, but as a collective challenge to be navigated. This conversation must involve developers and users, researchers and regulators, protocols and bridges. It must be grounded in technical reality, not marketing narratives.
I am not optimistic that this conversation will happen naturally. The incentives in a bull market push toward hype, toward speed, toward the appearance of innovation rather than its substance. Projects that take the time to do things right are often punished by markets that reward those who move fast and break things.
But I am hopeful that enough of us understand what is at stake. The values that brought us to this space—decentralization, transparency, trustlessness—are not just slogans. They are commitments. And commitments require action, not just words.
The quantum shadow is real, but it is still in the distance. The AI mirage is closer, but it is an illusion. What matters now is that we see clearly, think carefully, and act deliberately.
The cryptography that secures our digital lives is not eternal. It is a human construction, with human limitations, requiring human stewardship. The question is not whether we will need to migrate. The question is whether we will do it with wisdom or with recklessness.
I know which one I am betting on. I hope you will join me.
