Quantum Computing on kenji.blog

An Ultra-Beginner Guide to Quantum Programming with Qiskit

Fri, 11 Sep 2026 20:00:00 +0900

1. Introduction

Modern computers (classical computers) have dramatically changed our lives, supporting every aspect of society with their advanced computational power. However, it is known that for certain specific problems (such as factoring extremely large numbers, simulating complex molecular structures, and optimization problems), even the most cutting-edge supercomputers of today would require a time longer than the age of the universe.

What holds the potential to break through these “limits of classical computers” is the Quantum Computer. By utilizing the mysterious properties of quantum mechanics (superposition and quantum entanglement) as computational resources, it is believed that specific problems can be dramatically accelerated.

In this article, we will take our first steps into the world of quantum programming using Qiskit, an open-source quantum computing framework provided by IBM. This is an extremely detailed introductory guide that carefully explains everything from the basics of physics and mathematics, to actually writing code in Python and running quantum circuits on a simulator.

2. Fundamentals of Physics and Mathematics Behind Quantum Computing

To understand quantum programming, you first need to grasp the basic concepts of quantum mechanics. Here, we will explain the three important pillars: qubits, superposition, and quantum entanglement.

2.1 Classical Bits and Qubits (Quantum Bits)

The unit of information in classical computers is the “Bit”. A bit always takes one of two states: 0 or 1.

On the other hand, the smallest unit of information in a quantum computer is called a Qubit (Quantum bit). A qubit can not only take the state of 0 and 1, but it can also hold both states simultaneously.

Mathematically, the state of a qubit $|\psi\rangle$ is represented as a linear combination (superposition) of the basis states $|0\rangle$ and $|1\rangle$.

$$ |\psi\rangle = \alpha|0\rangle + \beta|1\rangle $$

Here, $\alpha$ and $\beta$ are complex numbers, representing the probability amplitudes of observing the states $|0\rangle$ and $|1\rangle$, respectively. Based on the fundamental principles of quantum mechanics, the sum of probabilities must equal 1, thus satisfying the following normalization condition:

$$ |\alpha|^2 + |\beta|^2 = 1 $$

graph LR A["Classical Bit"] --> B["Determined state: 0 or 1"] C["Qubit"] --> D["Superposition: Both 0 and 1"] D --> E["State is determined probabilistically by measurement"]

2.2 Superposition

As mentioned earlier, the state where $|0\rangle$ and $|1\rangle$ are mixed together is called Superposition.

For example, when a single qubit is in a perfectly equal superposition state, $\alpha = \frac{1}{\sqrt{2}}$ and $\beta = \frac{1}{\sqrt{2}}$.

$$ |\psi\rangle = \frac{1}{\sqrt{2}}|0\rangle + \frac{1}{\sqrt{2}}|1\rangle $$

When this state is measured, $|0\rangle$ and $|1\rangle$ are observed with a 50% probability each. If you have 2 qubits, you can create a superposition of 4 states: $|00\rangle, |01\rangle, |10\rangle, |11\rangle$. With $n$ qubits, $2^n$ states can be represented simultaneously, which is one of the sources of the parallel processing power of quantum computers.

2.3 Quantum Entanglement

The most powerful and mysterious property in quantum computing is Quantum Entanglement. This phenomenon, which Einstein called “spooky action at a distance,” is a property where two or more qubits become strongly linked to each other. When the state of one qubit is determined, the state of the other qubit is instantaneously determined, no matter how far apart they are physically.

One of the most famous quantum entangled states, the “Bell State”, specifically the $\Phi^+$ state, is expressed as follows:

$$ |\Phi^+\rangle = \frac{|00\rangle + |11\rangle}{\sqrt{2}} $$

In this state, the states $|01\rangle$ and $|10\rangle$ do not exist. Therefore, if the first qubit is measured and is $|0\rangle$, the second qubit is guaranteed to be $|0\rangle$ without even needing to be measured. Conversely, if the first is $|1\rangle$, the second will also necessarily be $|1\rangle$.

3. Quantum Logic Gates

Just as classical computers perform calculations using logic gates like AND, OR, and NOT, quantum computers also manipulate the state of qubits using Quantum Gates. Since a quantum state is a vector, a quantum gate is represented as a “unitary matrix” acting on that vector.

3.1 Pauli Gates (Pauli-X, Y, Z)

Pauli gates are fundamental operations on a single qubit.

・Pauli-X Gate (NOT Gate) Equivalent to the classical NOT gate. It flips $|0\rangle$ to $|1\rangle$, and $|1\rangle$ to $|0\rangle$. (A 180-degree rotation around the X-axis on the Bloch sphere)

$$ X = \begin{pmatrix} 0 & 1 \\ 1 & 0 \end{pmatrix} $$

・Pauli-Y Gate Performs a 180-degree rotation around the Y-axis. It has the effect of flipping both the phase and the bit.

$$ Y = \begin{pmatrix} 0 & -i \\ i & 0 \end{pmatrix} $$

・Pauli-Z Gate (Phase Flip Gate) Leaves the state of $|0\rangle$ as is, but flips the phase of the $|1\rangle$ state (multiplies by $-1$). (A 180-degree rotation around the Z-axis)

$$ Z = \begin{pmatrix} 1 & 0 \\ 0 & -1 \end{pmatrix} $$

3.2 Hadamard Gate

The Hadamard gate (H gate) is an extremely important gate that transforms a determined state ($|0\rangle$ or $|1\rangle$) into a superposition state.

$$ H = \frac{1}{\sqrt{2}} \begin{pmatrix} 1 & 1 \\ 1 & -1 \end{pmatrix} $$

Applying the H gate to $|0\rangle$ results in $|+\rangle$, which is an equal superposition state.

$$ H|0\rangle = \frac{1}{\sqrt{2}}|0\rangle + \frac{1}{\sqrt{2}}|1\rangle = |+\rangle $$

3.3 Phase Gates

Phase gates are a generalization of the Z gate, rotating the phase of the $|1\rangle$ state by a specified angle $\theta$.

$$ P(\theta) = \begin{pmatrix} 1 & 0 \\ 0 & e^{i\theta} \end{pmatrix} $$

Typical examples include the S gate ($\theta = \pi/2$) and the T gate ($\theta = \pi/4$).

3.4 CNOT Gate (Controlled-NOT Gate)

The CNOT gate (CX gate) is a gate that performs an operation between two qubits and is essential for generating quantum entanglement. It consists of a “Control bit” and a “Target bit”.

Only when the control bit is $|1\rangle$, an X gate (NOT operation) is applied to the target bit; if the control bit is $|0\rangle$, nothing happens.

$$ CNOT = \begin{pmatrix} 1 & 0 & 0 & 0 \\ 0 & 1 & 0 & 0 \\ 0 & 0 & 0 & 1 \\ 0 & 0 & 1 & 0 \end{pmatrix} $$

4. Basics of Qiskit and Environment Setup

From here on, we will actually write quantum programs using Python and Qiskit.

4.1 What is Qiskit?

Qiskit is an open-source software development kit (SDK) for quantum computing developed by IBM Quantum. Using Python, you can intuitively build quantum circuits and run them on a local simulator or on actual IBM quantum computers via the cloud.

4.2 Installation Method

To use Qiskit, a Python environment is required. You can install Qiskit and related packages (simulator and drawing libraries) with the following command:

1

pip install qiskit qiskit-aer qiskit-ibm-runtime matplotlib pylatexenc

4.3 Basic Flow of Programming

Quantum programming using Qiskit mainly progresses through the following steps:

graph TD A["1. Build (Construct the circuit)"] --> B["2. Compile (Transpile/Optimize)"] B --> C["3. Execute (Run on backend)"] C --> D["4. Analyze (Results analysis and visualization)"]

Build: Create a QuantumCircuit object and add gates to it.
Compile: Optimize the circuit for the backend (actual hardware or simulator) to be executed on.
Execute: Send the job to the backend and retrieve the results.
Analyze: Plot histograms of the measurement results, etc.

5. Practice: Building a Circuit to Create a Bell State (Quantum Entanglement)

Let’s actually create the “Quantum Entanglement (Bell State)” we learned in theory using Qiskit. The target state is $|\Phi^+\rangle = \frac{|00\rangle + |11\rangle}{\sqrt{2}}$.

5.1 Circuit Design

To create a Bell state, we follow these steps:

Prepare two qubits (both initially in the $|0\rangle$ state).
Apply a Hadamard gate (H) to the first qubit to create a superposition state.
Apply a CNOT gate with the first qubit as the “Control bit” and the second qubit as the “Target bit”.
Perform a Measurement to read the result.

5.2 Python/Qiskit Code Implementation

Now, let’s look at the actual code.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


import numpy as np
from qiskit import QuantumCircuit, transpile
from qiskit_aer import Aer
from qiskit.visualization import plot_histogram
import matplotlib.pyplot as plt

# 1. Circuit Initialization
# Create a quantum circuit with 2 qubits and 2 classical bits
qc = QuantumCircuit(2, 2)

# 2. Applying the H Gate
# Apply a Hadamard gate to qubit 0 (q0)
qc.h(0)

# 3. Applying the CNOT Gate
# Apply CNOT using q0 as the control bit and q1 as the target bit
qc.cx(0, 1)

# 4. Measurement
# Measure qubits 0 and 1, and write the results to classical bits 0 and 1, respectively
qc.measure([0, 1], [0, 1])

# Draw the circuit diagram (using matplotlib)
# qc.draw('mpl')
print(qc.draw())

When you execute this code, the following quantum circuit diagram will be displayed as ASCII art on the console.

1
2
3
4
5
6
7


 ┌───┐ ┌─┐
q_0: ┤ H ├──■──┤M├───
 └───┘┌─┴─┐└╥┘┌─┐
q_1: ─────┤ X ├─╫─┤M├
 └───┘ ║ └╥┘
c: 2/═══════════╩══╩═
 0 1

H represents the Hadamard gate, the combination of ■ and X is the CNOT gate, and M represents measurement.

5.3 Execution on Simulator and Interpretation of Results

Next, we will run this circuit on IBM’s high-performance simulator Aer and check the results.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


# Get the Aer simulator backend
simulator = Aer.get_backend('qasm_simulator')

# Transpile (optimize) the circuit for the simulator
compiled_circuit = transpile(qc, simulator)

# Execute the circuit (here, running 1000 shots)
job = simulator.run(compiled_circuit, shots=1000)

# Retrieve the result
result = job.result()

# Get the observation counts for the states
counts = result.get_counts(compiled_circuit)
print("\nMeasurement results:", counts)

# Plotting the histogram
# plot_histogram(counts)
# plt.show()

Interpretation of Results

The console output should look something like this: Measurement results: {'00': 495, '11': 505} (*Note: Because probabilities are random, the numbers will fluctuate slightly with each execution.)

In an ideal simulation environment, the measurement results will show 00 and 11 observed roughly 50% of the time each, with 01 and 10 never being observed. This completely matches the theoretical prediction of the Bell state $|\Phi^+\rangle = \frac{|00\rangle + |11\rangle}{\sqrt{2}}$ that we created. It accurately simulates “quantum entanglement” where if the first qubit is 0, the second is always 0, and if the first is 1, the second is always 1.

Furthermore, when executed on an actual quantum computer (IBM Quantum Hardware), 01 and 10 might be observed slightly due to the influence of noise (quantum decoherence and gate errors). How to reduce this noise (quantum error correction) is one of the biggest challenges in current quantum computer development.

6. Scaling Up to More Advanced Algorithms

Creating a Bell state can be considered the “Hello World” of quantum programming. By expanding upon this, we can construct powerful algorithms that surpass classical computers.

6.1 Deutsch-Jozsa Algorithm

This is a problem to determine whether a given function $f(x)$ is a “constant function” (always outputs 0 or always outputs 1 regardless of input) or a “balanced function” (outputs 0 for half of the inputs and 1 for the other half). While a classical computer requires at worst $2^{n-1} + 1$ evaluations of the function, the Deutsch-Jozsa algorithm can determine it with just 1 evaluation by utilizing quantum parallelism. This demonstrates the basic pattern of quantum algorithms: inputting a superposition state, using interference to cancel out unnecessary states, and amplifying the desired answer.

6.2 Grover’s Algorithm

In the search problem of finding specific data from $N$ unsorted database elements, a classical algorithm requires an average of $N/2$ computations, whereas Grover’s algorithm can find the target data in $\sqrt{N}$ computations. This algorithm uses a black box called an “Oracle” to flip the phase of the target solution, and further applies “Amplitude Amplification” to dramatically increase the probability of observing the target solution.

graph TD A["Initialization (Superposition of all states)"] --> B["Oracle (Flip phase of the correct answer)"] B --> C["Diffusion Operator (Amplitude amplification by inversion about the mean)"] C --> D{"Reached sufficient probability?"} D -- "No" --> B D -- "Yes" --> E["Measurement"]

7. Conclusion and Future Learning

In this article, we started with fundamental concepts of quantum computing such as superposition and quantum entanglement, and explained in detail the manipulation of quantum logic gates using Qiskit, up to actually constructing and simulating a Bell state and interpreting the results.

Because Qiskit allows you to write in a familiar language like Python, it is a powerful tool that helps you focus on algorithm construction by overcoming mathematical and physical barriers. Although quantum computers are currently in the era of Noisy Intermediate-Scale Quantum (NISQ) devices, applied research is rapidly advancing worldwide in numerous fields such as Quantum Machine Learning, Quantum Chemistry simulations, and cryptography.

By all means, take this opportunity to create various quantum circuits using Qiskit and try running them on actual IBM Quantum processors. You should be able to experience the computing paradigm of the future firsthand.

References

Qiskit Official Documentation
Qiskit Textbook - An official textbook recommended for those who want to learn deeper mathematical backgrounds and algorithms
IBM Quantum Learning

Welcome to the quantum world!

What is Quantum Supremacy? Latest Trends from Google and IBM

Fri, 11 Sep 2026 18:00:00 +0900

1. Introduction: The Dawn of Quantum Computing and “Quantum Supremacy”

Quantum computing has the potential to solve complex problems that cannot be solved within a realistic timeframe by classical computers (the PCs and supercomputers we use daily) by applying quantum mechanics, the fundamental principle of physics, to information processing. For a long time, this field was primarily focused on theoretical research, but in recent years, rapid hardware advancements have intensified the race toward practical application.

One of the most attention-grabbing keywords in this context is “Quantum Supremacy.” This refers to the moment when a quantum computer demonstrates overwhelming computational power over classical computers in a specific computational task. In this article, starting from the strict definition of quantum supremacy, we will provide a detailed technical and mathematical deep dive into the 2019 experiment by Google’s “Sycamore” processor—which was announced as the first in the world to reach this milestone—as well as IBM’s rebuttal and unique approach, and the latest roadmap towards “Quantum Error Correction (QEC)” and “Fault-Tolerant Quantum Computing (FTQC),” which represent the biggest barriers to true practical application.

2. Theoretical Background: Fundamentals of Quantum Computing and Complexity Classes

To understand quantum supremacy, it is first necessary to understand the mathematical foundations of quantum computing and its position in computational complexity theory.

Qubits and Superposition

While the smallest unit of information in a classical computer is a bit (0 or 1), a quantum computer uses a qubit (Quantum bit). The state $|\psi\rangle$ of a single qubit is represented by a complex linear combination of the basis states $|0\rangle$ and $|1\rangle$.

$$ |\psi\rangle = \alpha|0\rangle + \beta|1\rangle $$

Here, $\alpha, \beta \in \mathbb{C}$, and they satisfy the normalization condition $|\alpha|^2 + |\beta|^2 = 1$. This property is called “Superposition.”

Entanglement and Tensor Product

When there are multiple qubits, the state of the entire system is represented by the tensor product of the state spaces of the individual qubits. A system of $n$ qubits becomes a vector on a $2^n$-dimensional Hilbert space $\mathcal{H}^{\otimes n}$.

$$ |\Psi\rangle = \sum_{x \in \{0, 1\}^n} c_x |x\rangle $$

Here, $\sum |c_x|^2 = 1$. A state where qubits are not independent, and the state of one depends on the other, is called “Quantum Entanglement.” This gives quantum computers the potential to simultaneously process an exponentially vast state space.

Computational Complexity Theory Definition of Quantum Supremacy

In computational complexity theory, the class of problems that classical computers can solve efficiently (in polynomial time) is called BPP (Bounded-error Probabilistic Polynomial time). On the other hand, the class of problems that quantum computers can solve efficiently is BQP (Bounded-error Quantum Polynomial time).

Demonstrating quantum supremacy means “executing a specific task on actual quantum hardware that is included in BQP but not in BPP (or is extremely likely not to be), and surpassing simulation by classical supercomputers in terms of time and resources.” It can be considered a historical attempt to falsify the extended Church-Turing thesis (“Any physically realizable computational model can be simulated by a probabilistic Turing machine in polynomial time”) through physical experiment.

3. 2019: Google’s Demonstration of Quantum Supremacy

In October 2019, the Google Quantum AI team announced in the scientific journal Nature that they had achieved quantum supremacy using a 53-qubit superconducting processor called “Sycamore.”

Architecture of the Sycamore Processor

The Sycamore processor consists of 54 transmon superconducting qubits arranged in a 2D grid (53 were used in the experiment as one was malfunctioning). Tunable couplers are placed between adjacent qubits, realizing fast and highly accurate two-qubit gates (a hybrid of iSWAP and controlled-Z gates).

graph TD A["Quantum Algorithm Input"] --> B["Sycamore Processor (53 Qubits)"] B --> C["Apply Random Quantum Gates"] C --> D["Measure Quantum States (Bitstrings)"] D --> E["Cross-Entropy Benchmarking (XEB)"] E --> F["Verify Quantum Supremacy"]

Random Circuit Sampling (RCS)

The task Google chose was “Random Circuit Sampling.” This involves applying randomly chosen single-qubit gates and two-qubit gates over multiple cycles (depth $m$), and sampling from the probability distribution of bitstrings obtained by measuring the final state.

The probability of a bitstring $x$ output from an ideal (noise-free) random quantum circuit is not a uniform distribution, but exhibits an interference fringe-like pattern called a Porter-Thomas distribution. To sample from this distribution on a classical computer requires simulating the entire state vector, and the computational complexity increases exponentially with respect to the number of qubits $n$ and the circuit depth $m$.

Evaluating Fidelity: Linear Cross-Entropy Benchmarking (XEB)

To prove that the experimental results were not just noise, but the results of actual quantum computation, Google used Linear Cross-Entropy Benchmarking (XEB). The ideal probability $P(x_i)$ of the circuit for the bitstring $x_i$ obtained in the experiment is calculated using a classical computer, and the fidelity $\mathcal{F}_{\text{XEB}}$ is obtained by the following formula:

$$ \mathcal{F}_{\text{XEB}} = 2^n \langle P(x_i) \rangle_{i} - 1 $$

If $\mathcal{F}_{\text{XEB}}$ is 0, it means complete noise, and if it is 1, it means an ideal quantum processor without noise. The Sycamore processor achieved $\mathcal{F}_{\text{XEB}} \approx 0.002$ (0.2%) for a circuit with depth 20. At first glance, this seems low, but it is a statistically significant value above zero, representing an astonishing achievement of controlling a state space of $2^{53} \approx 9 \times 10^{15}$.

The overall error rate was approximately modeled as the product of individual gate errors, measurement errors, etc.

$$ \mathcal{F} \approx (1 - e_1)^{N_1}(1 - e_2)^{N_2} \cdots \approx \prod_{g \in 1Q} (1 - e_g) \prod_{g \in 2Q} (1 - e_g) \prod_{q} (1 - e_{RO}) $$

(* $e_g$ is the gate error, $e_{RO}$ is the measurement error)

Google claimed that it would take a classical supercomputer (Summit) about 10,000 years to simulate this circuit. In contrast, Sycamore completed the sampling in just 200 seconds.

4. IBM’s Rebuttal: From “Supremacy” to “Utility”

Google’s announcement shocked the world, but IBM, which developed the world’s largest supercomputer “Summit” and is itself a leader in quantum computer development, immediately published a paper rebutting this claim.

Improving Classical Simulation via Tensor Network Contraction

The core of IBM’s rebuttal was that “the optimization of algorithms and resources on the classical computer side was insufficient.” Google assumed a state vector simulator that directly calculates the time evolution of the Schrödinger equation and came up with the 10,000-year estimate. However, IBM pointed out that the simulation time could be dramatically reduced by using a method called a “Tensor Network.”

In a tensor network, the gate operations of a quantum circuit are represented as operations on multi-dimensional arrays (tensors), and the order of network “contraction” is optimized. Furthermore, they claimed that by fully utilizing Summit’s massive 250 PB of storage (hierarchical disk and memory), a higher-precision simulation would be possible in just “2.5 days” while maintaining the entire state vector.

Quantum Advantage and Quantum Utility

Triggered by this debate, the trend in the entire industry shifted from merely adhering to “executing artificial tasks impossible for classical computers (Supremacy)” to a phase of “demonstrating a practical advantage over classical approaches in useful real-world problems (Quantum Advantage),” and further to “quantum computers functioning as new tools for scientific discovery (Quantum Utility).”

IBM itself avoided the word “Supremacy” and advocated “Quantum Volume” and “CLOPS (Circuit Layer Operations Per Second)” as comprehensive performance metrics for quantum processors, promoting development that emphasizes a balance between hardware scale and quality.

timeline title "The Evolution of Quantum Milestones" 2019 : "Google Sycamore (53Q)" : "Quantum Supremacy announcement" 2019 : "IBM Rebuttal" : "Summit supercomputer simulation in 2.5 days" 2021 : "IBM Eagle (127Q)" : "Breaking the 100-qubit barrier" 2022 : "IBM Osprey (433Q)" : "Advancing processor scale" 2023 : "Google Surface Code" : "Scaling error correction (d=3 to d=5)" 2023 : "IBM Quantum Utility" : "Complex spin model simulation on 127Q" 2024 : "Beyond" : "Logical Qubits and Error Mitigation era"

5. The Next Frontier: Error Mitigation and Quantum Error Correction (QEC)

Current quantum computers are called “NISQ (Noisy Intermediate-Scale Quantum),” and they are susceptible to noise (errors due to interactions with the external environment or imperfect control). When performing long computations, the results get buried in noise. There are broadly two approaches to overcoming this problem: “Error Mitigation” and “Quantum Error Correction.”

Error Mitigation

Error mitigation is a method to remove the effects of noise from the expected values of calculation results through classical post-processing without changing the quantum hardware. In 2023, IBM achieved a precision that surpassed state-of-the-art approximate tensor network methods in a time evolution simulation of a complex Ising model by combining its 127-qubit “Eagle” processor with error mitigation techniques such as “Zero-Noise Extrapolation (ZNE),” thereby demonstrating “Quantum Utility.”

Quantum Error Correction (QEC) and Logical Qubits

However, to ultimately run any arbitrary complex algorithm (e.g., Shor’s factoring algorithm or complex quantum chemistry calculations), error mitigation alone is insufficient, and “Quantum Error Correction (QEC),” which dynamically detects and corrects errors, is essential.

The mainstream approach for QEC is the “Surface Code.” This is a method where multiple physical qubits (data qubits) are arranged in a 2D grid, and measurement qubits (ancilla qubits) are placed between them to continuously perform parity checks called “Stabilizers.”

graph LR Q1["Data Qubit (Data)"] --- M1["Measure X Stabilizer (Ancilla)"] Q2["Data Qubit (Data)"] --- M1 Q3["Data Qubit (Data)"] --- M2["Measure Z Stabilizer (Ancilla)"] Q4["Data Qubit (Data)"] --- M2 M1 --> EC["Error Syndrome Decoding (Classical)"] M2 --> EC EC --> LQ["Logical Qubit State Update"]

The Threshold Theorem and Distance $d$

A “Threshold Theorem” exists in quantum error correction. When the error rate $p$ of physical qubits is below a certain threshold $p_{th}$ (around 1% for the surface code), increasing the code distance $d$ (allocating more physical qubits to a single logical qubit) can exponentially reduce the logical error rate $p_L$.

The approximate formula for the logical error rate is expressed as follows:

$$ p_L \approx \Lambda \left( \frac{p}{p_{th}} \right)^{\frac{d+1}{2}} $$

Here, $\Lambda$ is a constant. If $p < p_{th}$, increasing $d$ makes $p_L$ smaller. However, if $p > p_{th}$, increasing physical qubits conversely accumulates noise, worsening the logical error rate.

Google’s 2023 Milestone: Demonstrating Error Reduction by Scaling Distance

In February 2023, Google published a monumental paper in Nature. They became the first in the world to demonstrate that when expanding the distance of the surface code from $d=3$ (using 17 physical qubits) to $d=5$ (using 49 physical qubits) using their 3rd generation Sycamore processor, the logical error rate slightly decreased from 3.028% to 2.914%.

This means they have stepped into the region where $p < p_{th}$, showing that the most important Proof of Concept towards FTQC—where performance improves as more physical qubits are added—has been completed.

6. Roadmap and Prospects for FTQC (Fault-Tolerant Quantum Computing)

While adopting different architectures and approaches, Google and IBM are engaged in fierce development competition towards the ultimate goal of FTQC (Fault-Tolerant Quantum Computing).

IBM’s Approach: Modularization and Heavy-Hex Lattices

IBM is focusing on scaling up processors in parallel with drastically reducing error rates. While challenging the limits of single chips with “Eagle (127Q),” “Osprey (433Q),” and “Condor (1121Q),” they announced a modular architecture called “Quantum System Two.” In addition, for the qubit coupling topology, they have adopted a “Heavy-Hex lattice” that reduces unnecessary crosstalk and increases stability. IBM’s strategy is a hybrid approach that gradually introduces QEC while pursuing utility through advanced error mitigation in the short term.

Google’s Approach: Improving Logical Qubit Quality

Google’s strategy places greater emphasis on extremely lowering the error rate of a single logical qubit (e.g., down to $10^{-6}$) rather than rapidly increasing the number of physical qubits. Upon achieving this, they aim for a large-scale system that runs thousands to tens of thousands of physical qubits in parallel by establishing technologies for transferring quantum states between modules (Quantum Interconnects).

Implementing protocols to fault-tolerantly execute non-Clifford gates, such as Magic State Distillation, will also be a major technical hurdle in the future. To run a practical Shor’s algorithm and crack a 2048-bit RSA cipher, it is said that thousands of logical qubits with an error rate of $10^{-8}$ or less are required, equating to millions to tens of millions of physical qubits, meaning the journey is still long.

7. Conclusion

“Quantum Supremacy” was an important milestone in the history of quantum computers that physically proved the theoretical potential of computing machines. Google’s 2019 demonstration and IBM’s constructive rebuttal pushed the entire industry from mere theoretical proof into an era of genuine engineering towards the pursuit of actual Utility and, ultimately, Fault-Tolerant Quantum Computing (FTQC).

Currently, we are witnessing a transitional phase from noisy NISQ devices to logical qubit devices equipped with error correction. In the next five to ten years, new discoveries in materials science, revolutions in the drug discovery process, and breakthroughs in optimization problems will likely become a reality alongside the evolution of this quantum hardware.

We must keep a close eye on the movements of Google, IBM, and researchers worldwide who are shaping the future of computer science.

How Will Blockchain and Cryptocurrencies Change in the Post-Quantum Era?

Fri, 11 Sep 2026 17:00:00 +0900

1. Introduction: The Footsteps of the Post-Quantum Era and the Crisis of Blockchain

Since the birth of Bitcoin by Satoshi Nakamoto in 2009, blockchain technology has grown to become the foundation of financial systems and applications worldwide as a “decentralized and tamper-proof ledger.” This robust security is supported by modern cryptographic technologies: Public Key Cryptography and Cryptographic Hash Functions.

These cryptographic technologies guarantee security based on the mathematical “computational difficulty” that classical computers (the PCs and supercomputers we currently use) cannot decipher even if they took time equivalent to the lifespan of the universe.

However, this premise is about to be fundamentally overturned by the rapid development and practical application of Quantum Computers, the frontier of physics and information science. Quantum computers, which utilize quantum mechanics specifics such as “Superposition” and “Entanglement,” demonstrate computational power that overwhelms conventional classical computers in specific mathematical problems, a phenomenon known as “Quantum Supremacy.”

In this article, we will thoroughly and deeply delve into what specific threats blockchain technology faces from quantum computers, the latest trends in Post-Quantum Cryptography (PQC) that serve as a solution, and the transition scenarios for crypto asset networks from a technical and mathematical perspective.

2. Basics of Quantum Computers and Two Major Threats to Blockchain

Current blockchain systems are primarily composed of the following two cryptographic elements, each of which is exposed to different threats from quantum algorithms.

graph TD A["Astonishing computational power of quantum computers"] --> B["Shor's Algorithm"] A --> C["Grover's Algorithm"] B --> D["Collapse of Public Key Cryptography (ECDSA/RSA/DSA)"] C --> E["Impact on Cryptographic Hash Functions (SHA-256)"] D --> F["Identification of others' private keys and transaction forgery"] E --> G["PoW mining dominance and attacks on certain addresses"] F --> H["Fatal and direct threat to blockchain"] G --> I["Threat manageable by algorithm adjustments (e.g., key length extension)"] style H fill:#ff9999,stroke:#cc0000,stroke-width:2px; style I fill:#ffff99,stroke:#cccc00,stroke-width:2px;

2.1. Basics of Elliptic Curve Cryptography (ECDSA) and Computational Difficulty

Many blockchains, including Bitcoin and Ethereum, employ the Elliptic Curve Digital Signature Algorithm (ECDSA) as their digital signature algorithm. Specifically, Bitcoin uses an elliptic curve with the parameter secp256k1.

The security of elliptic curve cryptography relies on the computational difficulty of the Elliptic Curve Discrete Logarithm Problem (ECDLP). An elliptic curve is defined by the following equation in the Weierstrass normal form:

$$ y^2 \equiv x^3 + ax + b \pmod{p} $$

In Bitcoin’s secp256k1, $a = 0, b = 7$, and $p$ is a very large prime number. Let $G$ be the base point (reference point) on this curve, and $k$ be the private key, which is a randomly chosen massive 256-bit integer. The public key $K$ is then obtained by adding the base point $k$ times (scalar multiplication).

$$ K = k \times G = \underbrace{G + G + \dots + G}_{k \text{ times}} $$

Calculating the private key $k$ (finding the discrete logarithm) from the exposed public key $K$ and base point $G$ using classical computers requires an exponential computational time of $\mathcal{O}(\sqrt{p})$, even when using the best classical algorithms like Pollard’s rho algorithm. For a 256-bit key, it takes about $2^{128}$ operations, a level that cannot be solved even if current supercomputers are run for billions of years.

2.2. Collapse by Shor’s Algorithm

However, Shor’s Algorithm, published by Peter Shor in 1994, completely destroyed this premise. Shor’s algorithm was originally proposed to solve the prime factorization problem (the foundation of RSA cryptography) in polynomial time, but it can also be applied to the discrete logarithm problem and the elliptic curve discrete logarithm problem.

The core of Shor’s algorithm lies in rapidly finding the “Period” of a function using the Quantum Fourier Transform (QFT).

$$ \text{Classical computational complexity} = \mathcal{O}(2^{n/2}) \quad (\text{where } n \text{ is the bit length}) $$ $$ \text{Quantum algorithm computational complexity} = \mathcal{O}(n^3) $$

In this way, Shor’s algorithm dramatically reduces exponential time to Polynomial Time. If a quantum computer with sufficient logical qubits is completed, it will be possible to determine the private key $k$ from the public key $K$ exposed on the network in minutes or seconds. This allows attackers to easily obtain the private keys of others’ wallets and take full control of their funds.

2.2.1 Step-by-Step Explanation of ECDLP Decryption by Shor’s Algorithm

Let’s look at the internal process of how a quantum computer solves the Elliptic Curve Discrete Logarithm Problem (ECDLP) step by step.

Problem setting: In $K = k \times G$, $G$ and $K$ are known, and we want to find the unknown integer $k$ (private key). Let the order of the elliptic curve be $N$.

Step 1: Creation of a superposition state First, prepare two quantum registers and apply a Hadamard Gate to each to create a superposition state of all possible integer combinations.

$$ |\psi_1\rangle = \frac{1}{N} \sum_{x=0}^{N-1} \sum_{y=0}^{N-1} |x\rangle |y\rangle |0\rangle $$

Step 2: Application of the quantum oracle (evaluation of the function) Next, using a quantum circuit (oracle) that performs point addition on the elliptic curve, compute the function $f(x, y) = x \times G + y \times K$ in the third register.

$$ |\psi_2\rangle = \frac{1}{N} \sum_{x=0}^{N-1} \sum_{y=0}^{N-1} |x\rangle |y\rangle |x \times G + y \times K\rangle $$

The important point here is that since $K = k \times G$, we can rewrite it as $f(x, y) = (x + y \cdot k) \times G$.

Step 3: Measurement of the third register When the third register is measured, it collapses to a point $R$ on the elliptic curve. As a result, the first and second registers collapse to a superposition state of pairs $(x, y)$ that satisfy $x + y \cdot k \equiv c \pmod{N}$ (where $c$ is a constant).

$$ |\psi_3\rangle = \frac{1}{\sqrt{N}} \sum_{y=0}^{N-1} |c - y \cdot k \pmod{N}\rangle |y\rangle $$

Step 4: Application of the Quantum Fourier Transform (QFT) This state has a periodicity related to the period $k$. By applying the Inverse QFT here, phase interference is induced, converting the period information into amplitudes.

Step 5: Measurement and classical post-processing When the first and second registers are measured, a value containing information about $k$ is obtained with high probability. By applying classical number theory algorithms such as Continued Fractions to the measured value, the unknown private key $k$ can be completely determined.

The number of quantum gates required for this entire process is $\mathcal{O}(\log^3 N)$, uncovering the private key at ultra-high speeds completely incomparable to the $\mathcal{O}(\sqrt{N})$ search by classical computers.

2.3. Grover’s Algorithm and its Impact on Hash Functions

Another threat is Grover’s Algorithm, proposed by Lov Grover in 1996. This significantly impacts hash functions (e.g., SHA-256).

In blockchain, hash functions are used to ensure data integrity, generate addresses, and serve as the foundation for PoW (Proof of Work) mining in Bitcoin. Reversing a hash function (preimage computation) can be seen as an “unstructured database search problem” to find the input value $x$ such that $H(x) = y$ for a specific output value $y$.

For classical computers, finding the correct answer out of $N$ possibilities requires an average of $\frac{N}{2}$ trials and a worst-case of $N$ trials. That is, the computational complexity is $\mathcal{O}(N)$. However, Grover’s algorithm uses a quantum technique called “Amplitude Amplification.” By iteratively amplifying the probability amplitude of the correct state from among all possibilities in a superposition state, it reduces the search time to its square root.

$$ \text{Computational complexity of Grover's Algorithm} = \mathcal{O}(\sqrt{N}) $$

For SHA-256, since $N = 2^{256}$, a classical brute-force search requires about $2^{256}$ trials. But using Grover’s algorithm, it only takes $\sqrt{2^{256}} = 2^{128}$ trials. This means that a 256-bit hash function’s security strength is effectively halved to 128 bits against quantum computers.

2.3.1. Will SHA-256 Survive? (Quantum Supremacy in Hashing)

Even if the security is halved, “128-bit security” remains extremely robust. The $2^{128}$ operations is an astronomical number even from the current technological level, requiring a timescale of the lifespan of the universe. Therefore, it is widely believed that “SHA-256 maintains practical security against quantum computers.” If it becomes necessary to increase the security margin in the future, simply doubling the hash output length (e.g., migrating from SHA-256 to SHA-512) will preserve classical 256-bit security in the quantum world.

In conclusion, the quantum threat to hash functions is “minor and manageable,” whereas the threat to public key cryptography (ECDSA) is “fatal.”

3. Specific Impact Analysis on Current Crypto Assets (Bitcoin, Ethereum)

In a world where ECDSA decryption by quantum computers is possible, what specific vulnerabilities will crypto asset networks face? Here, we provide a detailed analysis using Bitcoin’s mechanism as an example, from the perspective of “the timing of public key exposure.”

3.1. Address Generation and the “Privacy” of Public Keys

Bitcoin addresses (P2PKH: Pay-to-Public-Key-Hash or P2WPKH: Pay-to-Witness-Public-Key-Hash) use a public key hashed multiple times rather than the public key itself.

$$ \text{Bitcoin Address} = \text{Base58Check}(\text{RIPEMD160}(\text{SHA256}(\text{Public Key}))) $$

As mentioned earlier, since hash functions are resistant to quantum attacks (Grover’s algorithm), reversing the original “public key” from the “address” (which is a hash value) is impossible even for a quantum computer. In other words, for “unused addresses (those that have never sent funds),” the public key is not exposed on the blockchain at all, and only the hash value is recorded. Therefore, as long as the public key is unknown, there is no target to execute Shor’s algorithm, and the private key cannot be identified. Wallets in this state can be said to be Quantum-safe.

3.2. Fatal Vulnerability During Transaction Transmission (Front-running Attack)

The problem arises when users send funds. When broadcasting (sending) a transaction to the network, the user must include their public key in the transaction data along with the digital signature and expose it to the entire network for verification.

sequenceDiagram participant User as "User (Alice)" participant Mempool as "Mempool (Unconfirmed Transaction Pool)" participant QuantumAttacker as "Quantum Attacker" participant Miner as "Miner (Block Generation)" User->>Mempool: Send transaction (including public key + signature) Mempool-->>QuantumAttacker: Intercept public key on the network note right of QuantumAttacker: Execute Shor's algorithm in minutes
(Calculate private key from public key) QuantumAttacker->>QuantumAttacker: Generate a new signature using Alice's private key QuantumAttacker->>Mempool: Broadcast fraudulent transfer with a higher miner fee Miner->>Miner: Prioritize fraudulent transaction with higher fee (Gas) into a block Miner-->>User: Recorded on blockchain (Alice loses funds)

Once the public key is sent to the Mempool (the waiting area for unconfirmed transactions), that data is shared with nodes worldwide. If an attacker possesses an ultra-fast quantum computer, they can steal funds through the following process:

Intercept a legitimate user’s (Alice’s) transaction from the Mempool and extract the public key.
Execute Shor’s algorithm and calculate the private key from the public key within minutes (before the block is confirmed).
Using the obtained private key, create a fake transaction sending Alice’s funds to the attacker’s address.
Set a much higher miner fee for this fake transaction than Alice’s original transaction and send it to the network.

Miners prioritize transactions with higher fees into blocks according to economic incentives. As a result, the attacker’s fraudulent transfer is confirmed first, and Alice’s legitimate transfer is discarded as a “Double Spend” due to insufficient balance. This series of events is called a Front-running Attack, and in a world where quantum computers are commercialized, it will cause a terrifying situation where funds are stolen by hackers the moment someone presses the send button.

3.3. The Crisis of Reused Addresses and Old Addresses (P2PK)

An even more serious problem is that addresses that have sent funds at least once in the past (such as when reused as change addresses) already have their public keys permanently recorded on the blockchain. These are in danger of having their private keys calculated and balances stolen at any time, without even waiting to send a transaction.

Additionally, in the P2PK (Pay-to-Public-Key) format, which was mainstream around 2009-2010 and includes Satoshi Nakamoto’s early mining rewards (over 1 million BTC), the public key itself was recorded directly on the blockchain as the address instead of a hash. These massive amounts of dormant Bitcoins would be the easiest targets for quantum computers, and if stolen all at once and dumped on the market, could cause a massive price crash.

4. Transition Scenarios to Post-Quantum Cryptography (PQC)

To avoid such a “Q-Day (the day quantum computers break cryptography)” catastrophe, the cryptography and blockchain communities are planning a transition to Post-Quantum Cryptography (PQC), which is difficult even for quantum algorithms to decrypt. The National Institute of Standards and Technology (NIST) has been progressing with the standardization process of PQC for many years, and after several rounds of rigorous evaluation, some promising cryptographic schemes have been selected as final standards.

We will explain in detail the major PQC algorithms that are drawing attention as digital signature alternatives for blockchains, along with their mathematical mechanisms.

4.1. Hash-Based Signatures

Hash-based signatures are a cryptographic scheme whose security relies solely on a very simple and robust foundation: the “collision resistance of hash functions.” Since the safety of hash functions against quantum computers has already been proven (as mentioned above, a 128-bit security margin is sufficient), this is a highly reliable approach. Representative examples include Lamport Signatures, WOTS (Winternitz One-Time Signature) which extended it, and the NIST standardization candidate SPHINCS+ (now called SLH-DSA under FIPS 205).

4.1.1. Mathematical Details of Lamport Signatures (One-Time Signature)

Let’s look at the mechanism of Lamport signatures in more mathematical detail. Let the hash function be $H: \{0, 1\}^* \to \{0, 1\}^{256}$.

[Key Generation] Alice (sender) generates 256 pairs of private keys using a True Random Number Generator (TRNG).

$$ \text{sk}_{i,0} \in \{0, 1\}^{256}, \quad \text{sk}_{i,1} \in \{0, 1\}^{256} \quad (1 \le i \le 256) $$

Thus, the private key $\text{sk}$ consists of a total of 512 256-bit strings (Size: $512 \times 32 = 16,384$ bytes).

Next, she computes the public key $\text{pk}$. Each private key component is individually hashed.

$$ \text{pk}_{i,0} = H(\text{sk}_{i,0}), \quad \text{pk}_{i,1} = H(\text{sk}_{i,1}) $$

The public key is also $16,384$ bytes. This is published to the blockchain network.

[Signature Generation] To sign a transaction data $M$, Alice first calculates its hash value.

$$ h = H(M) \in \{0, 1\}^{256} $$

Let the $i$-th bit of the hash value $h$ be $h_i \in \{0, 1\}$. Alice’s signature $\sigma$ is a set of private key components corresponding to each bit $h_i$.

$$ \sigma = (\text{sk}_{1, h_1}, \text{sk}_{2, h_2}, \dots, \text{sk}_{256, h_{256}}) $$

In other words, if the message hash bit is 0, $\text{sk}_{i,0}$ is revealed, and if 1, $\text{sk}_{i,1}$ is revealed. The signature size is $256 \times 32 = 8,192$ bytes.

[Signature Verification] The miner (verifier) verifies using the received transaction $M$, signature $\sigma = (s_1, s_2, \dots, s_{256})$, and the public key $\text{pk}$. They recalculate the hash of the transaction $h = H(M)$, and check whether hashing each $s_i$ matches the corresponding element $\text{pk}_{i, h_i}$ of the public key.

$$ H(s_i) \overset{?}{=} \text{pk}_{i, h_i} \quad (\text{for all } 1 \le i \le 256) $$

This process is mathematically extremely simple, and it is impossible to forge a signature unless a quantum computer can reverse $H$. However, once signed, half of the private key is exposed to the network, so if another message is signed with the same key pair, the exposed private keys combine to give the attacker room for forgery, creating a strong restriction that it can only be used “One-Time.” To make this practical, technologies like XMSS, which bundles many one-time keys into a single root public key using a Merkle tree, and the stateless SPHINCS+ have been developed, but they have the drawback of signature sizes reaching tens of kilobytes.

4.2. Lattice-Based Cryptography

Currently, the most anticipated mainstream of PQC, adopted as NIST’s main standard specification (FIPS 204: ML-DSA / formerly CRYSTALS-Dilithium, and Falcon, etc.), is Lattice-Based Cryptography.

The security of lattice cryptography depends on mathematically proven hard problems such as the “Shortest Vector Problem (SVP) in multi-dimensional lattices” or the “Learning With Errors (LWE) problem.” No algorithm has been found to solve lattice problems efficiently even using quantum computers.

Mathematical Model of LWE (Learning With Errors): The basic idea of the LWE problem is to dramatically increase the difficulty of a problem by intentionally adding “small noise (errors)” to a system of linear equations. Let the secret vector be $\mathbf{s} \in \mathbb{Z}_q^n$. There is a massive randomly chosen public matrix $\mathbf{A} \in \mathbb{Z}_q^{m \times n}$ and an intentionally added small noise vector $\mathbf{e} \in \mathbb{Z}_q^m$. The public key $\mathbf{b}$ is calculated as follows:

$$ \mathbf{b} = \mathbf{A}\mathbf{s} + \mathbf{e} \pmod{q} $$

Even if matrix $\mathbf{A}$ and vector $\mathbf{b}$ (public key) are public, reversing them to find the private key $\mathbf{s}$ becomes extremely difficult due to the presence of the noise $\mathbf{e}$. Without the noise, it could be solved by simple Gaussian elimination, but with the noise, the search space in all dimensions explodes, providing robust security against both classical and quantum computers. In actual algorithms used in blockchain and elsewhere (like Dilithium), Ring-LWE (or Module-LWE), which expands this over polynomial rings, is used to reduce key sizes and speed up computations.

Pros: Compared to hash-based signatures, public key and signature sizes are relatively small (a few kilobytes), and signature generation/verification computation speeds are extremely fast (equivalent to or better than ECDSA).
Cons: The mathematical structure is complex, and because the historical verification period is short, the risk of a new decryption algorithm being discovered in the future is not zero.

5. Technical Challenges in Migrating Blockchains to PQC

Just because PQC algorithms (like Dilithium and SPHINCS+) exist doesn’t mean they can be introduced to Bitcoin or Ethereum tomorrow. There are several heavy challenges unique to decentralized systems.

5.1. Signature Size Bloat and the Collapse of Scalability

The biggest barrier to introducing PQC is the significant bloat in data size. While the current ECDSA signature size is about 70 bytes, the lattice-based Dilithium (ML-DSA) has a signature size of about 2,420 to 4,595 bytes (depending on the security level), and a public key size exceeding 1,300 bytes. For the hash-based SPHINCS+, the signature alone reaches tens of thousands of bytes.

If Bitcoin introduces PQC with the current block size limit (about 4MB weight including SegWit), the number of transactions that can be stored in one block will drastically decrease. Network throughput (TPS: Transactions Per Second) would fall devastatingly, and transaction congestion would become normal. To solve this, a massive increase in block size is necessary, but this would increase the storage and network bandwidth requirements for full nodes, making it difficult for individuals to operate nodes, resulting in the dilemma of causing centralization of the network.

pie title "Comparison of Signature Data Sizes in Blockchain (Conceptual Diagram)" "ECDSA (approx. 70 Bytes)" : 2 "Dilithium ML-DSA (approx. 2,500 Bytes)" : 58 "SPHINCS+ (approx. 17,000 Bytes)" : 40

(Note: Transaction data bloat due to PQC introduction is a fatal bottleneck for scalability)

5.2. Impact on the Ethereum Virtual Machine (EVM) and Precompiled Contracts

In a Turing-complete smart contract platform like Ethereum, the introduction of PQC demands a fundamental upgrade to the EVM (Ethereum Virtual Machine). In the current EVM, a precompiled contract ecrecover (address: 0x01) is provided for ECDSA signature verification, optimized to perform signature verification at a very low gas cost (3000 Gas).

However, the verification process of new lattice-based cryptographic algorithms like Dilithium and Falcon involves complex polynomial and matrix operations. Implementing this using only existing EVM Opcodes could consume millions to tens of millions of gas for just one signature verification. This is a level that would deplete the current block gas limit (about 30 million Gas) with a single transaction.

To avoid this, it is necessary to incorporate a new Precompiled Contract for PQC verification (e.g., assigning DilithiumVerify to 0x10) into the EVM itself through a network hard fork. This requires a long-term process where core developers of each Ethereum client (Geth, Nethermind, Erigon, etc.) collaborate to optimally implement lattice cryptography verification logic at the language level (C++, Go, Rust, etc.) and conduct security audits.

5.3. Difficulties in Consensus Building Through Hard Forks

Changing the underlying signature algorithm inherently requires a Hard Fork that updates the entire network protocol. However, in communities like Bitcoin that emphasize “not changing rules, being decentralized,” the consensus-building process is politically very difficult. From the time a BIP (Bitcoin Improvement Proposal) for migrating to PQC is proposed until it is implemented, years of discussion and testing will be required.

6. When Will “Q-Day” Arrive? A Roadmap for Transition

When will “Q-Day (the day a quantum computer completely decrypts 256-bit elliptic curve cryptography)” arrive? Although opinions are divided even among researchers, many experts predict that large-scale quantum computers with at least thousands to tens of thousands of stable logical qubits (error-corrected qubits with noise tolerance) will emerge “from the mid-2030s to the 2040s.” However, depending on breakthroughs in hardware architecture or the discovery of more efficient quantum algorithms, the possibility of this arriving sooner (around 2030) cannot be ruled out.

The roadmap the crypto asset ecosystem must take before it’s too late is as follows:

Phase 1: Hybrid Signatures and Account Abstraction (Present to around 2028)

The current blockchain scene, particularly Ethereum developers (like Vitalik Buterin), is considering “Hybrid Signatures” that combine ECDSA and PQC (hash-based signatures or lattice cryptography). This approach attaches both the existing secure ECDSA signature and a PQC signature to a transaction, maintaining security even if one of them is broken. Additionally, by utilizing Account Abstraction (ERC-4337), efforts are underway to implement and support PQC signatures on an opt-in basis (only for users who want it) on smart contract wallets without waiting for a protocol-level hard fork.

Phase 2: Utilizing Zero-Knowledge Proofs (ZK-Rollups) (2025 onwards)

The trump card expected to solve PQC’s biggest weakness, “signature data bloat,” is the utilization of ZK-Rollups (Zero-Knowledge Proofs), a Layer 2 technology. Instead of writing massive PQC signature data directly to Layer 1 (the main chain), numerous PQC transactions are verified and aggregated on Layer 2. Then, using ZK-SNARKs or ZK-STARKs, they are compressed into a single extraordinarily small “Proof” and recorded on Layer 1. Note that since some SNARKs configurations (like Groth16) are themselves vulnerable to quantum attacks, adopting ZK-STARKs, which rely solely on quantum-resistant hash functions, is key.

Phase 3: Protocol-Level Hard Forks (Around 2030)

Once NIST’s PQC standardization is fully established, and industry-standard libraries are available and well-tested, it is expected that a hard fork completely transitioning the default signature scheme to PQC will be implemented on major chains like Bitcoin and Ethereum. During this transition period, a massive announcement urging users to “move funds from old wallets to new PQC-compatible wallets” will take place.

Pioneering Project Examples

Some blockchain projects have anticipated this quantum threat and have been developed with quantum resistance from their initial stages.

QRL (Quantum Resistant Ledger): An early blockchain that natively implemented a hash-based PQC called XMSS (eXtended Merkle Signature Scheme) at the protocol level.
Algorand / Cellframe: A group of projects actively exploring the integration of lattice cryptography, possessing a flexible cryptographic layer modular architecture anticipating future PQC updates.

7. Conclusion: The Future of Crypto Assets and Protecting Our Wealth

The arrival of the “Post-Quantum Era” goes beyond mere science fiction fantasy; it is already looming before us as a concrete technical challenge to real-world cryptographic systems.

The two swords of quantum computers, Shor’s algorithm and Grover’s algorithm, threaten public key cryptography and hash functions, respectively, which are the foundations of current blockchains. In particular, the vulnerability of ECDSA is fatal, and to avoid the risk of fund theft through front-running attacks, transitioning to Post-Quantum Cryptography (PQC) is an absolutely unavoidable path.

However, the technology sector and blockchain community are not just twiddling their thumbs waiting for destruction. The selection and standardization of PQC algorithms like lattice cryptography and hash-based signatures are steadily progressing, and a path to overcoming PQC’s biggest hurdle, “data size bloat,” is beginning to emerge by utilizing Zero-Knowledge Proofs (ZK-STARKs) and Layer 2 scaling technologies.

There is no need for everyday crypto asset users and investors to panic right now and sell all their funds. However, it is important to have the following basic literacy and sense of self-defense:

Avoid address reuse: Thoroughly avoid keeping funds long-term in “used addresses (addresses that have sent funds even once, exposing their public key on the blockchain)” from a security perspective, not just a privacy one.
Pay attention to technology trends: Keep an antenna up for discussions on major networks’ PQC transitions and hard fork news (like Bitcoin’s BIPs and Ethereum’s EIPs), so that you can appropriately transition your wallet when necessary.

The history of blockchain is also a history of continuous upgrades and resilience against new technological threats. Just as it has overcome scalability issues and environmental problems (like the transition from PoW to PoS), the entire ecosystem will surely seek solutions and adapt to this unprecedented quantum threat. We look forward to a future where the new human wisdom of quantum computers and the trusted technology of decentralized ledgers do not collapse through collision, but rather sublimate into a higher-dimension, robustly fused system.

References & Related Links:

National Institute of Standards and Technology (NIST) - Post-Quantum Cryptography Standardization Project
Shor, P. W. (1994). Algorithms for quantum computation: discrete logarithms and factoring.
Grover, L. K. (1996). A fast quantum mechanical algorithm for database search.
Buterin, V. (2024). How to hard-fork to save most users’ funds in a quantum emergency.