Loading story…
The cryptocurrency industry is facing a significant security risk due to its failure to adopt post-quantum cryptography (PQC) standards, leaving user data and transactions vulnerable to future quantum computing threats. A recent ImmuniWeb report revealed that none of the 2,138 web applications and 146 mobile apps tested in the sector currently support the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM), the new post-quantum encryption standard published by NIST. This lack of adoption means that encrypted transactions and sensitive user data could be exposed once quantum computers become capable of breaking current cryptographic algorithms. The report also highlighted that over 7.8 million user records from cryptocurrency platforms are already circulating on the dark web, underscoring the urgency of the threat. Despite the overall poor sector performance, exchanges like Coinbase, UPbit, and Crypto.com were identified as the most secure, with the fewest security findings, demonstrating that robust security is achievable. However, the absence of ML-KEM support across all tested exchanges indicates a sector-wide lag in migrating to quantum-resistant encryption. Compounding the issue, nearly one-third of exchanges still support outdated protocols such as TLS 1.0 and 1.1, further exposing encrypted traffic to interception. The research also found that 45% of exchanges lacked a web application firewall, making them susceptible to AI-driven threats like automated scraping, impersonation, and infrastructure mapping. The increasing use of generative AI in development, without adequate security oversight, is introducing new vulnerabilities and expanding attack surfaces. Persistent issues such as 74% of web applications using outdated software or libraries and 67% failing GDPR compliance continue to plague the industry. Internationally, the NIST PQC standards, including ML-KEM, ML-DSA, and SLH-DSA, have set the baseline for quantum-resistant encryption, with most countries aiming for full quantum resistance by 2035. While there is broad agreement on the need for PQC, there are differences among countries regarding recommended algorithms and the use of hybrid post-quantum/traditional encryption schemes. Most governments, including the U.S. and U.K., advise against quantum key distribution in favor of PQC. The slow adoption of these standards in the cryptocurrency sector stands in stark contrast to the urgency expressed by global standards bodies and governments. The current state of security in the sector, combined with the looming threat of quantum computing, presents a critical challenge that requires immediate attention and coordinated action. Without rapid migration to PQC, the confidentiality and integrity of cryptocurrency transactions and user data remain at significant risk. The industry must prioritize the implementation of NIST-approved PQC standards to safeguard against both present and future threats. Failure to do so could result in catastrophic breaches once quantum computers become operationally viable for cryptanalysis. The situation is further complicated by the global nature of cryptocurrency, necessitating harmonized international standards and compliance efforts. As adversaries continue to harvest encrypted data for future decryption, the window for proactive defense is rapidly closing. The sector's response in the coming years will determine its resilience against the quantum threat.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
Help Net Security reported on an ImmuniWeb report warning that outdated encryption leaves the cryptocurrency sector vulnerable to quantum-related threats.
Use of hybrid post-quantum and traditional cryptography, especially X25519MLKEM768 for TLS, became widespread in industry even though NIST had not yet standardized hybrid algorithms.
Akamai started deploying post-quantum cryptography in three phases covering Akamai-to-origin, client-to-Akamai, and Akamai-to-Akamai connections, with a goal of full quantum-safe connectivity by Q1 2026.
South Korea advanced its national post-quantum cryptography efforts by selecting specific algorithms as part of its own standards development, while other countries continued pursuing separate approaches.
The U.S. National Institute of Standards and Technology approved several standard algorithms for post-quantum cryptography, establishing a baseline for quantum-resistant encryption and authentication.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Quantum computing is rapidly emerging as a transformative technology with the potential to revolutionize various industries, but it also poses significant risks to current cryptographic systems. Bitcoin, which relies on strong cryptographic algorithms such as SHA-256 and the Elliptic Curve Digital Signature Algorithm (ECDSA), faces a unique threat from quantum computers. The security of Bitcoin transactions and wallets is fundamentally based on the computational difficulty of breaking these algorithms, a challenge that quantum computers could potentially overcome. Algorithms like Shor’s algorithm threaten to break ECDSA in a fraction of the time required by classical computers, undermining the security of digital signatures and potentially allowing unauthorized transfers. Similarly, Grover’s algorithm could reduce the difficulty of attacking hash functions, impacting both mining and protocol-level security. The risk is not limited to Bitcoin; quantum computing threatens to break many types of traditional encryption, including both asymmetric and, eventually, symmetric cryptography. Attackers are already harvesting encrypted data today with the intention of decrypting it once quantum capabilities become available, a practice known as 'harvest now, decrypt later.' A common misconception is that the quantum threat is still years away, but recent research and expert opinions suggest that quantum computing could become mainstream within five years or less. This short timeline means that organizations must begin replacing legacy encryption with quantum-resistant solutions now, as the transition is complex and time-consuming. The urgency is heightened by the fact that most businesses are unaware of the full scope of the threat, particularly to symmetric encryption. Security leaders are being urged to prepare for the post-quantum era by assessing their cryptographic assets and developing migration strategies. The ongoing debate and research into quantum resistance are shaping the future of digital security, with the Bitcoin community and broader cybersecurity industry recognizing the need for proactive measures. The continued popularity and financial significance of Bitcoin add to the urgency, as any compromise in its cryptographic integrity could have far-reaching consequences. The challenge is not merely theoretical; it is an immediate concern that requires coordinated action from developers, researchers, and business leaders. The transition to quantum-resistant cryptography is expected to be a major technological undertaking, involving updates to protocols, software, and hardware across the digital ecosystem. As quantum computing advances, the window for effective preparation is closing, making it imperative for organizations to act now to safeguard their data and systems. The future of secure digital transactions, including those on the Bitcoin network, depends on the timely adoption of post-quantum cryptographic standards.
Jun 29, 2026
Cybersecurity leaders are raising alarms about the accelerating timeline for quantum computing to break current public encryption methods, a milestone known as Q-Day. Experts warn that Q-Day could arrive as soon as 2030, threatening to undermine the core trust mechanisms of the internet, including HTTPS, digital certificates, and public-key infrastructure. In response, governments and industries are developing plans to transition to post-quantum cryptography (PQC), but concerns remain that critical sectors such as banking, healthcare, and government may not be fully prepared in time. One of the earliest operational changes in anticipation of quantum threats is the reduction of SSL/TLS certificate lifespans to 47 days. This move, aligned with evolving browser requirements and NIST guidance, is designed to improve crypto agility and security hygiene, helping organizations adapt to a future where static cryptography is no longer viable. Security executives emphasize the need for urgent action, drawing parallels to the unpreparedness seen during the rapid adoption of AI, and stress that building operational readiness for PQC is now a strategic imperative for digital trust and business continuity.
Jun 29, 2026
The looming threat posed by quantum computers to current cryptographic systems has prompted significant discussion and action within the cybersecurity industry. Experts warn that once quantum computers become powerful enough, they will be able to break widely used encryption algorithms, jeopardizing the security of communications, financial transactions, and sensitive data. Zulfikar Ramzan, CTO of Point Wild, emphasizes that despite substantial investments in traditional cybersecurity tools, organizations remain vulnerable, highlighting the need for robust cryptographic strategies as a core component of cyber resilience. He points out that the transition to quantum-resistant cryptography is complex, involving not only technical challenges but also compliance with emerging standards such as those from NIST. Organizations are being driven toward quantum migration by both the evolving threat landscape and regulatory requirements, but the process is far from straightforward. Many enterprises are still in the early stages of preparing for this shift, with less than half of TLS connections in major networks like Cloudflare supporting quantum-resistant algorithms, and even fewer organizations implementing quantum-ready encryption in less prominent protocols. The uncertainty around the timeline for quantum computing's impact has led to hesitation in investing the necessary resources for a full migration. However, some entities are taking proactive steps. The engineering team behind the Signal Protocol, which powers secure messaging apps like Signal Messenger, has recently completed a major update to make their protocol fully quantum-resistant. This achievement required overcoming significant engineering challenges, given the intricate nature of the existing protocol. The Signal team's work stands out as a rare example of industry leadership in quantum-safe cryptography, contrasting with the broader industry's slow adoption. The update was detailed in a comprehensive technical write-up, underscoring the complexity and importance of the transition. Compliance with new standards, such as those being developed by NIST, is expected to further drive organizations toward adopting quantum-resistant solutions. The shift to post-quantum cryptography is not just a technical upgrade but a fundamental change in how organizations approach data protection. Security leaders are urged to prioritize cryptographic agility and resilience in their long-term strategies. The industry is at a crossroads, balancing immediate threats like ransomware with the existential risk posed by quantum computing. As the timeline for quantum breakthroughs remains uncertain, early adopters like Signal set a precedent for others to follow. The conversation around post-quantum cryptography is intensifying, with experts advocating for a proactive rather than reactive approach. Ultimately, the transition will require coordinated efforts across technology, compliance, and operational domains to ensure the continued security of digital communications and assets.
Jul 12, 2026