G7 Sounds the Alarm on Post-Quantum Security

The G7 urges states and companies to switch now to quantum-resistant cryptography. Its report of September 3, 2026, mentions neither bitcoin, nor exchanges, nor blockchain, but targets the component on which every wallet depends: the public key signature, which a sufficiently powerful quantum computer can break.

An eight-page report that never mentions crypto

The document is eight pages long and contains no occurrence of “cryptocurrency”, “bitcoin”, or “blockchain”. This silence does not mean the sector is on the sidelines. Nine players, including BlackRock, Coinbase, and Strategy, have already joined the Bitcoin Security Consortium to work on the subject.

“Although the exact timeline is uncertain, several recent advances suggest the development of quantum computers capable of breaking widely used public key cryptographic mechanisms and threatening the security of digital infrastructures,” write the authors, led by ANSSI for the French G7 presidency.

The G7 is especially interested in a well-known threat among specialists: “collect now, decrypt later”. Encrypted data may be stored today, then decrypted when computational power is sufficient.

In the case of cryptos, the problem is somewhat different. Public keys and transaction histories are exposed on the blockchain. A vulnerable signature therefore cannot simply be replaced afterward. The question is how long a key will remain secure.

Brussels and Washington have already set dates

The G7 imposes nothing, but existing timelines do. The European roadmap of June 2025, adopted by the NIS cooperation group, requires member states to have started their “first steps” by December 31, 2026, and migrated high-risk cases “no later than the end of 2030”.

On the American side, NIST IR 8547 proposes to ban algorithms of at least 128 bits after 2035, and those with 112 bits starting in 2030. The CISA, co-author of the call, pushes the same logic. Bitcoin’s secp256k1 curve offers about 128 bits and falls under the latter deadline, not the former.

The constraint will come from tenders and compliance: the G7 recommends integrating post-quantum cryptography into cybersecurity requirements and public procurement.

Bitcoin and Ethereum do not have the same timeline

On Bitcoin’s side, BIP-360, called Pay-to-Merkle-Root, creates a type of output that removes spending by Taproot key, the path exposed to quantum. The first assumed step: quick attacks on pending transactions would require post-quantum signatures, with no activation date set.

Ethereum aims broader. Published in February 2026, Vitalik Buterin’s roadmap identifies four components to replace, from validator signatures to KZG commitments, targeting infrastructure by 2029, as detailed by our follow-up on Ethereum’s cryptographic choices.

The cost explains these cautions. An ECDSA signature takes about 64 bytes, versus nearly 4,627 for ML-DSA-87, a profile standardized by NIST: a factor of 72 per transaction. Google Quantum AI reduced in March its estimates to break ECDLP-256, requiring under 500,000 physical qubits and a few minutes of computation.

The challenge for the coming months is not Q-Day but governance: adoption of BIP-360, national roadmaps expected before the end of 2026, first post-quantum clauses in public procurement. To evaluate these signals, understanding bitcoin and the protection of its keys remains useful.