G7 Sounds Alarm on Post-Quantum Security

The G7 urges states and businesses to transition now to quantum-resistant cryptography. Its report from September 3, 2026, does not mention bitcoin, exchanges, or blockchain, but targets the building block on which every wallet depends: the public key signature, which a sufficiently powerful quantum computer can break.

In Brief

• The G7 publishes "Preparing for the Post-Quantum Era" on September 3, 2026.
• The EU wants committed national transitions by the end of 2026, with high-risk systems migrated by the end of 2030.
• Bitcoin and Ethereum are on distinct trajectories, with no activation date for Bitcoin.

An Eight-Page Report That Never Mentions Crypto

The document is eight pages long and contains no occurrences of "cryptocurrency," "bitcoin," or "blockchain." This silence does not mean the sector is sidelined. Nine players, including BlackRock, Coinbase, and Strategy, have already joined the Bitcoin Security Consortium to work on the issue.

"Although the exact timeline is uncertain, several recent advances suggest the development of quantum computers capable of breaking widely used public key cryptography mechanisms and threatening the security of digital infrastructures," write the authors, led by ANSSI for the French G7 presidency.

The G7 is particularly concerned about a well-known threat to specialists: "collect now, decrypt later." Encrypted data can be stored today and then decrypted when computing capabilities allow.

In the case of cryptos, the problem is somewhat different. Public keys and transaction history are exposed on the blockchain. A vulnerable signature cannot simply be replaced afterward. The question is how long a key will remain secure.

Brussels and Washington Have Already Set Dates

The G7 imposes nothing, but existing timelines do. The European roadmap from June 2025, adopted by the NIS cooperation group, asks member states to have engaged their "first steps" by December 31, 2026, and to migrate high-risk cases "by the end of 2030 at the latest."

On the American side, the NIST IR 8547 project proposes banning algorithms of at least 128 bits after 2035, and those of 112 bits as early as 2030. CISA, a co-author of the call, pushes the same logic. However, Bitcoin's secp256k1 curve offers about 128 bits and falls under the second deadline, not the first.

The constraint will come from tenders and compliance: the G7 recommends integrating post-quantum cryptography into cybersecurity requirements and public procurement.

Bitcoin and Ethereum Do Not Share the Same Timeline

On the Bitcoin side, BIP-360, known as Pay-to-Merkle-Root, creates a type of output that removes the spending by Taproot key, the path exposed to quantum. The first step taken: rapid attacks on pending transactions would require post-quantum signatures, with no fixed activation date.

Ethereum aims broader. Published in February 2026, Vitalik Buterin's roadmap identifies four building blocks to replace, from validator signatures to KZG commitments, for an infrastructure targeted in 2029, as detailed in our follow-up on Ethereum's cryptographic choices.

The cost explains these precautions. An ECDSA signature occupies about 64 bytes, compared to nearly 4,627 for ML-DSA-87, a standard profile by NIST: a factor of 72 per transaction. Google Quantum AI reduced its estimates in March for breaking ECDLP-256, under 500,000 physical qubits and a few minutes of computation.

The challenge in the coming months is not Q-Day but governance: adoption of BIP-360, national roadmaps expected before the end of 2026, first post-quantum clauses in public markets. To judge these signals, understanding bitcoin and protecting its keys remains useful.