Shor's Algorithm & Quantum Threats to Crypto & Seed Phrase Security
Understanding the long-term quantum risk to blockchain cryptography — and practical steps you can take today.
Shor's Algorithm
Shor's Algorithm (developed in 1994 by Peter Shor) is a quantum algorithm that efficiently solves two hard mathematical problems:
- Integer factorization (breaks RSA)
- Elliptic Curve Discrete Logarithm Problem (ECDLP) — breaks elliptic curve cryptography (ECC) used in Bitcoin (secp256k1), Ethereum, PulseChain, and most blockchains for digital signatures (ECDSA/Schnorr).
A sufficiently powerful quantum computer running Shor's algorithm could derive a private key from a public key (or transaction signature). This would allow an attacker to spend funds from exposed addresses.
2026 Research Update
In March 2026, Google Quantum AI published new resource estimates showing optimized Shor's circuits for 256-bit ECDLP (secp256k1) could run with roughly 1,200 logical qubits and 70–90 million Toffoli gates. On superconducting hardware this could execute in minutes with under 500,000 physical qubits — a 10–20× improvement over prior estimates. Other research (neutral-atom architectures) suggests even lower physical qubit counts are theoretically possible, though with longer runtimes.
A Cryptographically Relevant Quantum Computer (CRQC) capable of practical attacks is still estimated to be years away (late 2020s to mid-2030s). Grover's algorithm (the other major quantum algorithm) only provides a quadratic speedup and poses a much milder threat to hashing and mining.
How Shor's Algorithm Affects Seed Phrases
A BIP-39 seed phrase itself is not directly broken by Shor's algorithm. The vulnerability is indirect:
- Your seed phrase generates a master private key and all derived child keys/addresses.
- When you spend from an address, the public key is revealed on the blockchain.
- Shor's algorithm can then solve ECDLP to recover the private key.
Practical Impact:
- Addresses you have ever spent from carry higher long-term risk.
- Pure receive-only addresses (public key never revealed) are significantly safer until spent.
- The seed phrase remains a strong secret as long as it is properly protected and public keys are not exposed.
SLIP-39 vs BIP-39 Clarification
SLIP-39 does not reduce your security to 64 bits or make it weaker.
| Aspect | BIP-39 (Standard) | SLIP-39 (Shamir's) | Notes |
|---|---|---|---|
| Entropy / Security | 128-bit (12 words) or 256-bit (24 words) | Same underlying entropy (128–256 bits) | Equal base security |
| Single Point of Failure | Yes | No (multi-share) | SLIP-39 stronger |
| Words per Backup | 12 or 24 | Usually 20 per share | BIP-39 shorter |
| Flexibility | Fixed (1-of-1) | Custom (2-of-3, 3-of-5, etc.) | SLIP-39 more flexible |
| Compatibility | Universal | Limited (Trezor, Keystone, etc.) | BIP-39 wins here |
Conclusion: When configured with multiple shares, SLIP-39 is generally more secure than standard BIP-39 because it removes the single point of failure.
Mitigation Strategies (Tiered Approach)
Tier 1: Strongest Current Protections (Implement These)
| Strategy | Effectiveness | Why It Helps | Difficulty |
|---|---|---|---|
| Hardware wallet + Secure Element | Very High | Keys never leave the device | Medium |
| Strong passphrase ("25th word") | Very High | Creates hidden wallets; never stored on device | Easy |
| SLIP-39 multi-share backups | Very High | Eliminates single point of failure | Medium |
| Never reuse addresses | High | Minimizes public key exposure | Easy |
| Metal backups + geographic split | High | Protects against physical loss/theft/fire | Medium |
| Air-gapped / dedicated device | High | Reduces malware/keylogger risk | Medium |
Tier 2: Additional Best Practices
- Use decoy wallets with small amounts + hidden passphrase wallets for main funds.
- Periodically move funds to fresh addresses derived from the same seed.
- Only enter seed phrases on trusted, offline, or hardware-secured devices.
- Monitor wallet software for emerging post-quantum features.
Tier 3: Future / Ecosystem-Level Solutions
- Post-quantum signature schemes (lattice-based like Dilithium/Falcon, hash-based like XMSS/SPHINCS+).
- Hybrid classical + quantum-resistant signatures during transition.
- Wallet migration tools using zero-knowledge proofs to move funds securely.
- Blockchain upgrades with new quantum-resistant address types and scripts.
Bottom Line & Recommendations
Quantum threats from Shor's algorithm are a long-term concern, not an immediate one. The best actions you can take right now are the same practices that protect against today's threats: hardware wallets, strong passphrases, SLIP-39, and careful address hygiene.
For most users: Hardware wallet + strong passphrase is excellent.
For larger holdings: Add SLIP-39 multi-share backups stored in separate secure locations.
Stay informed as wallets and blockchains roll out post-quantum upgrades in the coming years.
Frequently Asked Questions
What is Shor's algorithm?
Shor's algorithm is a quantum algorithm developed by Peter Shor in 1994 that can efficiently solve the Elliptic Curve Discrete Logarithm Problem (ECDLP). This means a sufficiently powerful quantum computer could derive private keys from public keys, breaking the cryptography used by Bitcoin, Ethereum, PulseChain, and most blockchains.
Can quantum computers break seed phrases today?
No. Cryptographically relevant quantum computers are estimated to be years away (late 2020s to mid-2030s). A seed phrase itself is not directly broken by Shor's algorithm — the risk is that public keys revealed during transactions could be used to derive private keys in the future.
Is SLIP-39 weaker than BIP-39 because of quantum computers?
No. SLIP-39 does not reduce your security. Both BIP-39 and SLIP-39 use the same underlying entropy (128–256 bits). SLIP-39 is actually more secure in practice because it eliminates the single point of failure through multi-share backups.
What is "Harvest Now, Decrypt Later"?
HNDL is an attack where adversaries collect encrypted data or public keys today, storing them until powerful quantum computers become available to break the encryption. For public blockchains, this means your revealed public keys could be targeted in the future.
How can I protect my crypto from quantum threats?
Use a hardware wallet with a Secure Element, enable a strong passphrase, use SLIP-39 multi-share backups, avoid reusing addresses, and store metal backups in multiple locations. These are the same best practices that protect against today's threats.