Shor's Algorithm & Quantum Threats to Crypto & Seed Phrase Security
Understanding the long-term quantum risk to blockchain cryptography — and practical steps you can take today.
Shor's Algorithm
Shor's Algorithm (developed in 1994 by Peter Shor) is a quantum algorithm that efficiently solves two hard mathematical problems:
- Integer factorization (breaks RSA)
- Elliptic Curve Discrete Logarithm Problem (ECDLP) — breaks elliptic curve cryptography (ECC) used in Bitcoin (secp256k1), Ethereum, PulseChain, and most blockchains for digital signatures (ECDSA/Schnorr).
A sufficiently powerful quantum computer running Shor's algorithm could derive a private key from a public key (or transaction signature). This would allow an attacker to spend funds from exposed addresses.
2026 Research Update
In March 2026, Google Quantum AI published new resource estimates for Shor's algorithm against 256-bit ECDLP (secp256k1): one circuit with under 1,200 logical qubits and 90 million Toffoli gates, another with under 1,450 logical qubits and 70 million. On superconducting hardware either could execute in minutes with under 500,000 physical qubits — about a 20-fold reduction in physical qubits over prior estimates. Other research (neutral-atom architectures) suggests even lower physical qubit counts are theoretically possible, though with longer runtimes.
A Cryptographically Relevant Quantum Computer (CRQC) capable of practical attacks is still estimated to be years away (late 2020s to mid-2030s). Grover's algorithm (the other major quantum algorithm) only provides a quadratic speedup and poses a much milder threat to hashing and mining.
How Shor's Algorithm Affects Seed Phrases
A BIP-39 seed phrase itself is not directly broken by Shor's algorithm. The vulnerability is indirect:
- Your seed phrase generates a master private key and all derived child keys/addresses.
- When an address signs any transaction — a send, a swap, an approval, a HEX stake start or end — its public key is revealed on the blockchain.
- Shor's algorithm can then solve ECDLP to recover the private key.
Practical Impact:
- Addresses that have ever signed a transaction carry higher long-term risk.
- Pure receive-only addresses (public key never revealed) are significantly safer until spent.
- The seed phrase remains a strong secret as long as it is properly protected and public keys are not exposed.
SLIP-39 vs BIP-39 Clarification
SLIP-39 does not reduce your security to 64 bits or make it weaker.
| Aspect | BIP-39 (Standard) | SLIP-39 (Shamir's) | Notes |
|---|---|---|---|
| Entropy / Security | 128-bit (12 words) or 256-bit (24 words) | Same underlying entropy (128–256 bits) | Equal base security |
| Single Point of Failure | Yes | No (multi-share) | SLIP-39 stronger |
| Words per Backup | 12 or 24 | Usually 20 per share | BIP-39 shorter |
| Flexibility | Fixed (1-of-1) | Custom (2-of-3, 3-of-5, etc.) | SLIP-39 more flexible |
| Compatibility | Universal | Limited (Trezor, Keystone, etc.) | BIP-39 wins here |
Conclusion: When configured with multiple shares, SLIP-39 is generally more secure than standard BIP-39 because it removes the single point of failure.
Mitigation Strategies (Tiered Approach)
Tier 1: Strongest Current Protections (Implement These)
| Strategy | Effectiveness | Why It Helps | Difficulty |
|---|---|---|---|
| Hardware wallet + Secure Element | Very High | Keys never leave the device | Medium |
| Passphrase ("25th word") | None Against Shor | Opens a separate wallet from the same seed; a different passphrase opens a different, empty wallet with no error, and a lost passphrase cannot be recovered | — |
| SLIP-39 multi-share backups | Very High | Eliminates single point of failure | Medium |
| Holding long-term on an address that has never signed; sweeping the whole balance to a fresh address when one must sign | High | An address reveals its public key the first time it signs | Passive holdings only; a native HEX stake ends at the address that started it |
| Metal backups + geographic split | High | Protects against physical loss/theft/fire | Medium |
| Air-gapped / dedicated device | High | Reduces malware/keylogger risk | Medium |
Tier 2: Additional Best Practices
- A passphrase opens a separate set of addresses; Shor treats each of them like any other address, exposed once it has signed.
- Moving funds to a fresh address signs from the old one and reveals its public key for good; sweeping every token off it at that time, one transaction per token, leaves nothing behind on the exposed address. A native HEX stake cannot move: it ends at the address that started it.
- A hardware wallet's own screen keeps a seed phrase off any internet-connected machine; a phrase typed into a computer or phone that has been online lives on a machine the owner does not control.
- Monitor wallet software for emerging post-quantum features.
Tier 3: Future / Ecosystem-Level Solutions
- Post-quantum signature schemes (lattice-based like Dilithium/Falcon, hash-based like XMSS/SPHINCS+).
- Hybrid classical + quantum-resistant signatures during transition.
- Wallet migration tools using zero-knowledge proofs to move funds securely.
- Blockchain upgrades with new quantum-resistant address types and scripts.
Quantum Resistance in Wallets (Quick Reference)
| Wallet / Device | Quantum Resistance |
|---|---|
| Trezor Safe series | Good (SLIP-39 + Passphrase) |
| Ledger | Moderate |
| Internet Money | Moderate |
| ZKX / MetaMask / Rabby | Moderate |
Legend: Good = strong current practices (hardware + SLIP-39 + passphrase). Moderate = standard BIP-39 only.
Bottom Line & Recommendations
Quantum threats from Shor's algorithm are a long-term concern, not an immediate one. The quantum hedge is a behavior, not a product: an address that has never signed has shown Shor nothing, and an address emptied of every token when it first signs leaves nothing behind to attack. Hardware wallets, passphrases and SLIP-39 defend against today's thieves; they do nothing against Shor.
Against Shor: An address that has never signed has revealed no public key; a hardware wallet and a passphrase guard against theft today, not against quantum attack.
For larger holdings: Add SLIP-39 multi-share backups stored in separate secure locations.
Stay informed as wallets and blockchains roll out post-quantum upgrades in the coming years.
Frequently Asked Questions
What is Shor's algorithm?
Shor's algorithm is a quantum algorithm developed by Peter Shor in 1994 that can efficiently solve the Elliptic Curve Discrete Logarithm Problem (ECDLP). This means a sufficiently powerful quantum computer could derive private keys from public keys, breaking the cryptography used by Bitcoin, Ethereum, PulseChain, and most blockchains.
Can quantum computers break seed phrases today?
No. Cryptographically relevant quantum computers are estimated to be years away (late 2020s to mid-2030s). A seed phrase itself is not directly broken by Shor's algorithm — the risk is that public keys revealed during transactions could be used to derive private keys in the future.
Is SLIP-39 weaker than BIP-39 because of quantum computers?
No. SLIP-39 does not reduce your security. Both BIP-39 and SLIP-39 use the same underlying entropy (128–256 bits). SLIP-39 is actually more secure in practice because it eliminates the single point of failure through multi-share backups.
What is "Harvest Now, Decrypt Later"?
HNDL is an attack where adversaries collect encrypted data or public keys today, storing them until powerful quantum computers become available to break the encryption. For public blockchains, this means your revealed public keys could be targeted in the future.
How can I protect my crypto from quantum threats?
Quantum computers that can break today's wallet cryptography don't exist yet. We expect it to become a real problem in 2 to 5 years, and there will be a way to handle it as that gets closer. Stay aware of the situation. One habit helps today: an address that has never sent a transaction has not revealed its public key, so there is nothing on the chain for a quantum computer to attack.