- The Ethereum Foundation’s team says it wants Ethereum’s layer 1 protected against quantum attack by the end of 2029, with a reassessment due in January 2027.
- Nothing quantum-resistant has shipped on Ethereum yet, and Hegotá, the next upgrade being planned, is explicitly not the one that does it. Vitalik Buterin is now pushing a first named candidate, EIP-8288, for the upgrade after that.
- No quantum computer that exists today can break Ethereum’s cryptography, and the Foundation’s own documentation says so plainly.
Quantum computing turns up in crypto coverage every few months, usually attached to a warning that bitcoin and ether will one day be broken. On 7 September the Ethereum Foundation’s protocol cluster published a date for its answer: it wants the network’s cryptography replaced by the end of 2029.
If you hold ether, there is nothing for you to do about this today, and anyone telling you otherwise is selling something. The reason it is worth ten minutes is that quantum will be attached to crypto headlines for years, and almost all of that coverage skips the one distinction that decides whether a story is real. What a large quantum computer threatens is the signature that proves your coins are yours. It does not threaten the record of who owns what, and it does not make coins disappear from a chain.
Knowing which half is at risk is the difference between reading a genuine engineering update and being frightened by one.
What you actually own
Start with the thing that makes a crypto wallet different from a bank account. Your ether does not sit inside your wallet the way cash sits in a purse. It sits on the , a public ledger anybody can inspect. What you hold is a : a very large secret number.
From that private key, the software derives a public key, and from the public key it derives your address, the string you give someone when you want to be paid. The maths runs in one direction only. Public key from private key is easy. Private key from public key is, with today’s computers, effectively impossible.
When you send a transaction, your wallet uses the private key to produce a digital signature: a short piece of data that anyone on the network can check against your public key to confirm the instruction came from the key’s owner. Nobody sees your private key. They see the proof that you have it. That mechanism is the whole security model, and it is the part quantum computing puts pressure on.
Two kinds of maths, two different risks
Ethereum leans on two very different pieces of cryptography, and they face very different threats. Confusing them is why so much of this coverage reads as apocalyptic.
The first is elliptic curve cryptography, which is what links your private key to your public key. Its security rests entirely on that one-way relationship. A sufficiently large quantum computer, running an algorithm published in the 1990s, would collapse that relationship and let someone work a private key out from a public key. In March 2026, research from Google Quantum AI estimated that breaking 256-bit elliptic curve cryptography could need roughly 1,200 logical qubits, a lower figure than earlier estimates.
The second is hashing, the one-way squashing function that turns a public key into a short address. Hashing holds up far better against quantum methods. The practical consequence is uneven exposure: an address that has never sent a transaction has never broadcast its public key, so there is less for an attacker to work from. An address that has spent from itself has published the public key permanently, on a ledger that never forgets.
What “quantum breaks crypto” would actually look like
Not coins vanishing overnight. The blockchain’s history is not rewritten by any of this, and the balances recorded in it stay exactly where they are. The failure mode is theft: forged signatures moving other people’s money, address by address, starting with the addresses that are cheapest to attack.
That is also why the fix is a migration rather than a patch. New signature schemes have to be added to the protocol, wallets and staking software have to support them, and holders eventually have to move funds from old-style addresses to new ones. If you are unsure where your keys actually live, our guide to self-custody covers that ground, and it is the only prep this story genuinely calls for.
What the Foundation has committed to, and what it hasn’t
The Foundation set up a dedicated post-quantum security team in January 2026, led by Thomas Coratger, with work tracked publicly at pq.ethereum.org. Its official documentation lays out a sequence of migration milestones and puts completion of the core post-quantum infrastructure at “approximately 2029”.
That page also says, in its own words: “These are planning milestones, not guaranteed commitments.” And in its FAQ: “No quantum computer today can break Ethereum’s cryptography.”
The September blog post is firmer. CoinDesk, The Block, The Defiant and others report it setting December 2029 as a “non-negotiable” target, holding until a January 2027 reassessment with outside experts. We could not read the full text of that post directly, so treat the specific wording as reported rather than confirmed. Either way, a deadline with a scheduled review built into it is a target the Foundation has reserved the right to move, which is a reasonable way to run engineering and a poor fit for the word non-negotiable.
Hegotá is not the quantum upgrade
This is where the announcement is more honest than most of the headlines about it. Hegotá is the being planned after Glamsterdam, and the Foundation’s post says of it: “Hegotá is not the PQ fork. It is the fork that decides whether the PQ forks happen on time.”
That is the Foundation writing about the Foundation’s own roadmap, so read it as framing rather than as an independent finding. What it means in practice is that Hegotá’s job is scope discipline: shipping a small enough set of changes, fast enough, to leave room for the real migration behind it. Secondary reporting says the team graded 62 proposed changes into a public tier list and marked only two, FOCIL and Frame Transactions, as must-ship. We have not read that tier list first-hand.
The roadmap has since acquired its first named candidate. Vitalik Buterin is pushing EIP-8288 for I-star, the upgrade pencilled in after Hegotá. Decrypt reports the proposal as aimed at cutting the cost of quantum-safe privacy, and says adopting it would also make RISC-V, an open instruction set used in ordinary chip design, Ethereum’s canonical instruction set: the low-level language the network’s execution is defined in. That second part is a substantial change to how Ethereum runs code, well beyond anything to do with quantum.
Two things to keep straight about it. A co-founder arguing for a proposal is not a scheduled change, and Ethereum improvement proposals get debated, rewritten and abandoned all the time; I-star also sits behind the upgrade whose entire stated purpose is deciding whether the quantum forks land on time. And cheaper quantum-safe privacy is a narrower thing than quantum-resistant signatures. It lowers the cost of the cryptography behind private transactions once that cryptography has to be post-quantum. It does not by itself replace the elliptic curve signatures described earlier, which are what actually protects your coins.
What it does change is the character of the story. A month ago the 2029 target was a date with nothing named under it. There is now a specific proposal, with a specific upgrade attached, that people can argue about in public.
There is also a date muddle worth noting. Most outlets place Hegotá in 2027. The Foundation’s own quantum-resistance page describes one relevant proposal as being considered for Hegotá in the second half of 2026. One of those is out of date, and nobody has reconciled them.
Elsewhere the post reaches for outside credibility, aligning its timeline with the post-quantum migration targets set by Google, Cloudflare and Microsoft, and calling a 2030 assumption for so-called Q-day “a deliberately aggressive assumption” that front-runs most credible forecasts. Big Tech is indeed migrating, helped by the three post-quantum standards NIST finalised in August 2024, so the building blocks are real. Borrowing their urgency is a rhetorical move all the same.
Bitcoin has no dated plan at all
The comparison neither write-up makes is with bitcoin, which uses the same family of elliptic curve signatures and faces the same eventual problem. Quantum-resistant proposals have been discussed by bitcoin developers for years, but there is no scheduled migration, no target year, and no body with the standing to impose one. Ethereum’s foundation-led development is regularly criticised as too centralised. On this particular question it is the reason a timetable exists to argue about.
The question left open
A protocol upgrade can add new signature types. It cannot make people use them. Coins in addresses whose owners have died, lost their keys or simply stopped paying attention will sit in the old scheme indefinitely, and those are disproportionately the reused, long-dormant addresses whose public keys are already exposed.
One secondary aggregator, CryptoBriefing, put roughly 65% of all ETH in addresses that would be vulnerable to a quantum attack, and about 42.4 million staked ETH as relying on BLS signatures. We could not trace either figure to the Foundation’s own material, so treat them as unverified. The shape of the problem stands whatever the exact numbers turn out to be: a migration this large is decided by how many holders act, not by when the code merges.
What to watch
The January 2027 reassessment is the real test. If the December 2029 date survives contact with outside cryptographers, it starts to look like a plan. If it slides, it was always a milestone.
Nearer term, follow EIP-8288 through the proposal process. Whether it gathers client-team support, and whether I-star’s scope stays as disciplined as Hegotá’s is supposed to be, will say more about the Foundation’s ability to hold a timetable than any restatement of the 2029 date.
Watch, too, for the first post-quantum signature scheme running on a public Ethereum testnet, because that is the point at which any of this stops being a roadmap. And watch the cadence. The timeline implies hard forks arriving every seven months or so for years, against a project whose Merge upgrade shipped years behind its original schedule. Ambition is not delivery, and the Foundation’s own documentation is careful to say so even where its blog post is not.