Citi confirms: Bitcoin faces far greater quantum risk than…

A Citi research note published May 18 concluded that Bitcoin faces significantly greater quantum risk than Ethereum, and that the gap is rooted not only in cryptography but in governance. The finding reinforces a landmark March 2026 paper by Google Quantum AI, Stanford, and the Ethereum Foundation, which estimated that a quantum computer with fewer than 500,000 physical qubits could derive a Bitcoin private key from its public key in roughly nine minutes — a threshold requiring 20 times fewer resources than previously thought.

Why it matters

Bitcoin's vulnerability stems from its reliance on elliptic curve digital signature algorithms: when a transaction is broadcast, the public key is briefly exposed on-chain, and Shor's algorithm could exploit that window. Coin Metrics co-founder Nic Carter has warned since October 2025 that a quantum computer could meaningfully break elliptic curve cryptography as early as 2028, with approximately 6.9 million BTC potentially exposed across legacy wallets and Taproot outputs. Bitcoin's governance compounds the risk: SegWit took 8.5 years from conception to adoption, Taproot took 7.5 years, and the current post-quantum proposals — BIP-360 and BIP-361 — remain at draft or early testnet stage as of 2026.

Market impact

Ethereum's position diverges sharply. The Pectra upgrade, shipped in May 2025, introduced EIP-7702 as a stepping stone toward account abstraction, allowing individual accounts to migrate to quantum-safe signatures voluntarily rather than requiring a single network-wide hard fork. The upcoming Hegotá hard fork, planned for late 2026, embeds post-quantum infrastructure further at the protocol level, with the Ethereum Foundation targeting completion by approximately 2029.