Ethereum faces multiple post-quantum migrations as hardware milestones shrink timeline

A talk at ETHCluj Meetup on quantum hardware milestones argued that the risk window for elliptic curve breaking begins in 2027-2028, far earlier than many expect. The speaker noted that quantum algorithms have improved 10-100x every one to two years since 2020, and that hardware qubit counts are doubling every nine months. 'I would say that is also when the risk window begins because this is when the com the companies that make the hardware say that they will have enough hardware to break elliptic curves,' the talk stated, citing companies like Quantum and their 2028 target. In contrast, a talk at ETH Sofia 2026 described a more measured view: 'We still have time. This is probably the most common sentence in discussions about quantum risks. And probably this is true. But, we also know that standardization, implementation, auditing, wallet integration, user migration will require years' 7.

A presentation at ETH Taipei 2026 by Alex Kuzmin focused on the 'other post-quantum migration' — upgrading Ethereum's zero-knowledge application layer. 'Even if the protocol has upgraded its cryptography and secured its transactions, it doesn't mean that u the payload of the transaction and let's say the cryptography of the applications on Ethereum is upgraded automatically,' he said. Kuzmin's team benchmarked hash-based SNARKs (STARKs) and found raw speed competitive, but proof sizes and on-chain verification costs are high — up to 4 million gas for the polynomial commitment part alone. Recursive aggregation can amortize costs, but requires an intermediate aggregator layer, an architectural trade-off 3.

A panel at Boston Blockchain Week 2026 emphasized that the quantum threat is real today through 'harvest now, decrypt later attacks.'If it is not quantum secure, an attacker could suck it all up, put it in a database, and in five, 10 years when quantum computers are powerful enough, decrypt it,' said Meera Blanki from Circle. The panel also highlighted that AI has already broken a candidate NIST post-quantum algorithm (HAWK). Meanwhile, a talk at CryptoCanal presented the 'cost math flipped' — Google's March 2026 paper cut required physical qubits from 2 billion to 500,000, and further work claims as few as 10,000. 'The expectation is somewhere around 2028 to 2030 that's when all these things come together5.

Views diverged on how Ethereum should prioritize. At ETH Belgrade Community, Marija Mikic argued Ethereum needs multiple migrations — accounts, consensus, data availability, and ZK — and that privacy is the most urgent because deanonymization can happen retroactively. A talk at Berlin Ethereum Day presented a concrete path: using smart contract accounts with hash-based signatures (Sphinx Minus) that are already verifiable on-chain today, costing 'as cheap as a few cents' 6. The talk also proposed EIPs to deactivate old ECDSA keys on EOAs, but warned that EC RECOVER is used beyond signatures, e.g., by Chainlink, requiring careful changes 6.

• A talk at ETHCluj urged immediate preparation: 'I I do not recommend holding a large amount of unprotected crypto' and noted that 65% of Ethereum addresses have exposed public keys, compared to 35% for Bitcoin 1.The Boston panel argued that 'you have to be the master of your own destiny' and map your full crypto supply chain 4.
• The Sofia panel stressed that post-quantum is 'an arms race' and that no algorithm is a permanent fix: 'The biggest misconception that I can see in people's eyes for post quantum security is that when you uh choose the best post quantum secure algorithm and implement it, you're done. Reality is just not like this' 2.
• The CryptoCanal talk concluded: 'The only expensive thing you can do now is wait' 5.