Author: Biteye
On October 8, Starknet officially stated that the team is actively considering transitioning from an Ethereum L2 to an independent L1, and has set becoming a "fully quantum-resistant network" by 2027 as one of its goals.
The reason given by Eli Ben-Sasson @EliBenSasson is that the quantum threat may arrive faster than the market expects, and if it continues to rely on Ethereum, the speed at which Starknet itself can advance cryptographic upgrades will be constrained.
Starknet is not an isolated case. Ethereum, NEAR, Algorand, Sui, and Solana have all begun preparing quantum-resistant solutions to varying degrees.
Outside developer circles, we may not even perceive the threat posed by quantum computers, but the term "quantum-resistant" is appearing more and more frequently, so let's break it down: why are public chains now all preparing for quantum resistance?
1️⃣ What exactly can quantum computing attack in Crypto?
People often say that "quantum computing can crack Bitcoin," but more precisely, quantum computing threatens the public-key cryptography used by public chains.
Bitcoin, Ethereum, and Solana currently make extensive use of elliptic curve signatures such as ECDSA, Schnorr, and Ed25519. Their security premise is that "deriving the private key from the public key" is almost infeasible on traditional computers.
But a sufficiently powerful quantum computer can greatly reduce this difficulty through Shor's algorithm. Once the public key has been made public, in theory a path may emerge: "public key → private key → forge signature → transfer assets away."
The industry originally expected the quantum threat to arrive in 2029, but recently Ethereum researcher Justin Drake, after seeing the rapid improvement in AI mathematical capabilities, called on the industry to begin entering "bunker mode."
On October 6, OpenAI publicly released 722 mathematical manuscripts at once, grouped into 372 sets of results, covering a large number of long-unsolved problems, and provided Lean formalized versions for many of the proofs.
AI may accelerate mathematical research and, before a true quantum computer matures, first find more efficient algorithms, weakening the security margin of existing cryptographic systems such as ECDSA.
2️⃣ If Q-Day arrived today, who would be most at risk?
If Q-Day really arrived, different public chains would face different risks. To judge who is more at risk, the key is to look at two things: whether the public key has already been exposed, and whether old assets can be smoothly migrated.
So, according to how public keys are exposed and the difficulty of migration, they can roughly be divided into the following three categories.
Tier 1: Chains where public keys are naturally exposed
Solana is the most typical example. An ordinary account address itself is an Ed25519 public key, so an attacker does not need to wait for the user to send a transaction before directly calculating the private key for an existing account.
If a quantum computer capable of quickly cracking Ed25519 really appears in the future, attackers would not need to wait for users to initiate transactions and could directly begin calculating from already public public keys.
Category 2: UTXO chains.
Bitcoin, Litecoin, Dogecoin, Bitcoin Cash, and others all belong to the UTXO model. On many common addresses on such chains, the full public key is not made public from the start; instead, the hash of the public key is stored first, so as long as the funds have not been spent, the public key usually will not be exposed.
But as long as a user has initiated a transfer from this address, the corresponding public key and signature will usually be made public on-chain. If the same address continues to be reused afterward, subsequent funds will remain in a state where the public key has already been exposed for a long time.
What is truly tricky is that Bitcoin has already been running for nearly 17 years, and a large amount of dormant assets and old addresses have accumulated on-chain. Even if quantum-resistant addresses are introduced in the future, these old funds will not automatically gain protection and will still require holders to actively migrate, so a network-wide upgrade will be very difficult.
Category 3: EVM-based public chains
Ethereum, BNB Chain, Avalanche C-Chain, as well as a large number of ordinary EOAs on Polygon, Base, Arbitrum, and Optimism, all use secp256k1 ECDSA.
An EOA address itself is not the full public key, but is generated by hashing the public key. Therefore, for an address that has only received assets and has never actively sent a transaction, the full public key usually will not yet be exposed.
But as long as an EOA has sent a transaction, an ECDSA signature will be left on-chain, and the corresponding public key can also be recovered. In other words, a large number of active addresses are in fact already in a state of public key exposure, while addresses that have never sent a transaction still have an extra layer of protection.
3️⃣ How have public chains already begun responding to the quantum threat?
For a long time in the past, quantum resistance remained mostly at the level of research and discussion, but starting this year, more and more public chains have truly pushed solutions to mainnet and the protocol layer.
On July 20, the NEAR 2.13 upgrade officially brought the NIST-standardized ML-DSA-65 to mainnet. Existing accounts can directly add a quantum-resistant Access Key and then gradually replace traditional keys, without needing to recreate accounts.
In August this year, Sui also announced its own roadmap, planning to support both ML-DSA-65 and SLH-DSA post-quantum signature schemes, and through Address Alias, allow users in the future to change authorization keys without changing addresses or migrating assets.
Ethereum's situation is more complex. In addition to user wallets, the BLS used by validators, KZG Commitment, and some ZK systems also need upgrades. In January this year, the Ethereum Foundation established a dedicated Post-Quantum Security Team and began testing new validator signatures, account abstraction, and alternative KZG solutions.
Starknet is more aggressive. It does not just want to add quantum-resistant signatures to accounts, but hopes to upgrade the entire network into a truly quantum-resistant public chain, with 2027 as its target time.
🌟Final thoughts: Quantum resistance is a required course, and also a new narrative
The threat of quantum computers is coming on strong. $STRK doubled in price due to the positive news, and measured from its lowest point, its one-month gain even reached 5x.
On the other side, the new public chain Quantus directly takes "quantum resistance" as its core positioning and calls itself the BTC for the quantum era. For a time, "quantum resistance" became the hottest thing.
But risk is risk, and narrative is narrative.
In the long run, quantum resistance is not the exclusive selling point of any single public chain. It is an infrastructure upgrade that all networks relying on existing public-key cryptography will eventually have to face.
So from a speculative perspective, I would rather treat "quantum resistance" as a new narrative. The most direct is the native quantum-resistant chain Quantus; next is $NEAR, which has already brought ML-DSA to mainnet and also helps Quantus connect to external liquidity through Intents; and further out is Starknet, which has directly written "fully quantum-resistant public chain" into its roadmap.
Ordinary users actually do not need to immediately migrate assets on a large scale because of the "quantum threat." Vitalik @VitalikButerin also reminded that what truly needs to be avoided is hastily moving funds, out of panic, into new solutions one is not familiar with and that may not even have been fully verified yet.
At this stage, a more practical approach is to reduce address reuse, keep large long-term assets in new addresses whose public keys have not yet been exposed as much as possible, and at the same time pay attention to whether the wallets and public chains you commonly use have clear quantum-resistant migration plans.