Quantum will break most chains. Starknet has been waiting for it.
Governments, Big Tech, and researchers are increasingly converging on the same timeline for when quantum breaks today's cryptography. When it arrives, nearly every onchain wallet is exposed. For most of crypto, this is a threat. For Starknet, it highlights the strength of its architecture.
The industry's converging deadline
919
Days
10
Hours
45
Minutes
38
Seconds
TODAY2029
Microsoft, Google, and IBM have converged, independently, within days of each other, on 2029. The "when" is arriving faster than crypto has priced in, and it could arrive even sooner than that.
01
Nation-states became quantum investors.
The catalyst
States started taking equity.
For decades, government support for quantum computing meant research grants and patient science. In the span of a few weeks in spring 2026, that posture changed in nature.
On June 22, 2026, the White House signed two quantum executive orders the same day. One launches a national effort to build a government-scale machine. The other orders an accelerated, government-wide migration to post-quantum cryptography.
When governments take equity in quantum companies, race to build the machine, and order their own defenses against it, the risk profile has changed. Meanwhile, the three biggest quantum players converged, days apart, on the same year: 2029. That year is now a deadline.
02
Q-day, and the fault line it draws.
The threat
One key. Two machines.
Every wallet in crypto is protected by the same lock: elliptic-curve cryptography, the math that links your private key to your public address. Breaking it with today's computers is impossible on any human timescale. The picture changes completely with a quantum computer.
Picture a giant maze; the exit is your private key. A classical computer walks the corridors one by one. There are more paths than atoms in the universe, so it never escapes. A quantum computer doesn't walk the maze: it notices the maze was built by repeating one pattern, and computes the exit directly. That is Shor's algorithm against elliptic-curve cryptography, the math that links your private key to your public address and secures nearly every wallet in crypto today.
Classical
Walks the corridors one by one, and keeps walking.
time 0.0scorridors walked 0
Quantum
Does not walk. It reads the maze and computes the exit.
time 0.00sidle
So what happens the day a quantum computer finally reaches the exit? It holds your private key, and your funds are already gone. That is the exact risk sitting under most blockchains today.
Safe every single day, right up until one day in 2029.
A turkey grows more confident every day, fed and cared for, right up to Thanksgiving, the day it gets eaten. Every safe day made the turkey more certain the next one would be safe too. Most blockchains sit on the same curve: a lengthening track record of safety that proves nothing about the day the machine arrives.
status secureconfidence 0%
Unlike the turkey, we can see the knife. And it is moving faster every year: the cost and the hardware needed to break these keys have been collapsing for over a decade, and every new paper brings the drop closer.
The cost of the attack is collapsing.
10,000×
The estimated cost of a quantum attack on crypto's cryptography has collapsed roughly 10,000x since 2012, paper after paper, all from the organizations that actually build the hardware.
The exposure is concrete. On Bitcoin, 6.9M BTC is vulnerable. On Ethereum, 20.5M ETH sits in exposed top accounts, with $200B in stablecoins behind admin keys.
The paper draws a sharp line between what a quantum computer breaks and what it cannot touch:
Quantum-vulnerable
ECDSA signatures (Bitcoin, Ethereum)
BLS consensus signatures
KZG commitments
Pairing-based SNARKs (Groth16, Plonk)
Optimistic rollups, sidechains
Quantum-safe
zk-STARK proofs
Hash-based commitments (BLAKE2)
Post-quantum signatures (Falcon, ML-DSA)
In the paper's own risk chart, zk-STARK is the only proving category in production today not flagged as quantum-vulnerable by Google. Starknet's proving system is named explicitly as resistant.
03
Starknet will be ready before Q-day.
The head start
Every other major chain starts its quantum migration from zero: vulnerable proofs, vulnerable wallets, and a hard fork between them and safety. Starknet starts from three facts that are already true on mainnet today.
The proofs were born post-quantum.
By design
STARKs rely on hash functions, not elliptic curves, which is why Shor's algorithm has nothing to attack. It comes from the original STARK paper co-authored by StarkWare's founders in 2018. The entire proving layer, the foundation every other layer rests on and the most expensive part to change, never needs to migrate.
Migration is one transaction, not a hard fork.
Native account abstraction
On Starknet, signature logic lives in the account contract, not in the protocol. Upgrading a wallet to post-quantum signatures is a single transaction by the user: no protocol change, no new address format, no network-wide coordination.
Most chains
Protocol-level hard fork
New address formats
Forced user migration
Starknet
Deploy a new account contract
Same network, same wallet interface, self-custody intact
The head start does not cover everything. Here is every remaining cryptographic surface on Starknet: what it runs on today, what it moves to, who owns the change, and which phase delivers it. Filter by phase, and click any row for the details.
All8Complete2Committed · Phase 13In development · Phase 21External dependency2
Surface
Current
Desired
Roadmap status
Owner
▸STARK prover
Hash-based (no ECC)
n/a
Complete
Starknet
The core proof system relies on collision-resistant hash functions, not elliptic curves, so it carries no quantum exposure. This is the layer that is normally the most expensive to change, and on Starknet it was never the problem.
Status Shipped. No migration required.
▸State trie hashing
Pedersen
BLAKE2
Phase 1
Starknet
The contracts and storage tries commit state with Pedersen today. They migrate to BLAKE2, which removes the ability to forge balance proofs and is also cheaper to prove than Pedersen, so it is a security and a performance win at once.
Estimated time Phase 1, around 2 months from start.
▸Address derivation
Pedersen
BLAKE2
Phase 1
Starknet
Account and contract addresses are derived with Pedersen. Moving derivation to BLAKE2 closes a narrow window where an attacker could find a collision and slip a malicious contract into an address before it is funded.
Estimated time Phase 1, around 2 months from start.
▸OS config hash
Pedersen
BLAKE2
Complete
Starknet
The chain's environment anchor (chain ID, version, fee token) is hashed with Pedersen. It moves to BLAKE2 in a one-line change with no historical data to recompute.
Estimated time Complete. Live on mainnet.
▸Consensus signing
ECDSA
Falcon-512
Phase 1
Starknet
Sequencer signatures use ECDSA. They migrate to a post-quantum scheme such as Falcon-512 in two steps: the signing layer becomes scheme-agnostic first, then sequencers rotate their keys, with no disruption to consensus at either step.
Estimated time Phase 1, around 2 months from start.
▸Legacy storage
Pedersen (slot keys)
BLAKE2
Phase 2
Starknet
Contracts already deployed under Pedersen-derived storage keys keep working after Phase 1, but their internal key derivation no longer aligns. A migration toolkit brings them into BLAKE2 alignment with no manual data migration and no breaking changes to their interfaces.
Estimated time Phase 2, around 1 month after Phase 1 (dapp side TBD).
▸secp syscalls
secp256k1/r1 (ECDSA)
TBD
External
Ethereum
The Cairo VM's secp256k1/r1 syscalls support L1 to L2 messaging and the Ethereum bridge. They are quantum-vulnerable, but removing them depends on Ethereum migrating first, otherwise the bridge breaks.
Estimated time Gated on Ethereum's own migration.Fallback If Ethereum is late, Starknet can become its own L1, removing the dependency.
▸Blob data availability
KZG commitment
TBD
External
Ethereum
State-diff data posted to Ethereum as blobs is anchored by a KZG commitment, which is quantum-vulnerable. A KZG compromise would affect data availability transparency, not state-transition soundness, which the STARK proof still protects. This surface is Ethereum's to migrate.
Estimated time Gated on Ethereum's own migration.Fallback If Ethereum is late, Starknet can become its own L1, removing the dependency.
No surfaces in this category.
And to get this roadmap right, StarkWare brought in one of the world's leading quantum minds.
In February 2026, Prof. Scott Aaronson joined StarkWare's Scientific Advisory Board with a clear mandate: pressure-test this roadmap. Every assumption about what quantum computers can and cannot do, every cryptographic choice on the path to end-to-end resistance, now gets challenged by one of the foremost authorities in the field.
Scott Aaronson · Schlumberger Chair of Computer Science, UT Austin · Founding Director, Quantum Information Center
Eli Ben-Sasson on the quantum era.
From the source
StarkWare's co-founder and CEO on why STARKs were built for this moment.
No video set
Starknet's strength against the quantum threat, and what are the missing pieces
Local preview only. To publish, add the file to the project and set its path above.
No video set
Starknet's seamless migration to post-quantum security
Local preview only. To publish, add the file to the project and set its path above.
No video set
Post-quantum by design: the ZK-STARK white paper called it eight years ago
Local preview only. To publish, add the file to the project and set its path above.
No video set
How little Starknet needs to change to go post-quantum
Local preview only. To publish, add the file to the project and set its path above.
On the day the line is drawn for everyone, most chains will discover which side they were born on. Starknet already knows.
The thesis needs only two recognitions: that the quantum-security premium is not yet priced in, and that Starknet holds the structural moat to capture it.
