Circle Warning: Even if the issuer completes the upgrade, the quantum cracking risk remains as long as the old signatures are not eliminated across the entire chain.

Written by: Liam 'Akiba' Wright

Translated by: Saoirse, Foresight News

Circle issues a warning: The resources required for quantum circuits to break mainstream blockchain signature algorithms are continuously decreasing, citing a low resource consumption record of 813 logical quantum bits.

The implementation of USDC's quantum migration directly exposes dependency issues across the entire ecosystem: every host public chain, wallet, custodian, cross-chain bridge, and user account ultimately needs to adopt a more secure transaction authorization method.

The current contract documents of Circle record the deployment information of USDC on 37 main networks. The company can protect its controlled infrastructure and exercise token contract rights across supported networks, but it cannot rotate user private keys, rewrite the signing system of custodians, nor unilaterally modify the signature rules of Ethereum, Solana, XRPL, and other public chains.

In a disclosure document on August 31, Circle urged developers to review their cryptographic systems, investigate third-party dependencies, and prepare for key rotation. As of September 2, the market cap of USDC was approximately $73.6 billion, which makes ecosystem coordination issues correspond to massive assets. If the migration only hardens Circle's own keys while allowing old wallets, cross-chain bridges, or underlying chain paths to remain exposed to risk, the entire USDC ecosystem cannot achieve security.

813 Quantum Bits are a Reference Indicator, Not a Countdown

Circle states that 813 logical quantum bits is a low resource consumption record updated on the ECDSA.fail website in August 2026. This data demonstrates that the resource utilization efficiency of quantum circuit design is improving, but this figure can easily be misinterpreted by the public.

This public challenge specification is aimed at the secp256k1 elliptic curve used by Bitcoin and Ethereum, optimizing reversible point addition circuits; the scoring method is the peak width of logical quantum bits multiplied by the average number of Toffoli gates. Developers can reduce bit width by increasing the number of logical gates, or increase bit width to reduce the consumption of logical gates. Therefore, the single number 813 cannot fully describe a Shor's algorithm attack, circuit depth, or error correction overhead, nor can it reflect the actual running time of such an attack on physical hardware.

(Note: Toffoli gates are a key computational instruction in quantum computers; quantum programs to crack encryption algorithms extensively use this instruction. When assessing quantum cracking capabilities, both the number of quantum bits and the quantity of such instructions must be considered.)

A paper from March 2026 clearly showcases this trade-off. Researchers estimate that an attack against a 256-bit elliptic curve discrete logarithm requires one approach with less than 1200 logical quantum bits and no more than 90 million Toffoli gates; another approach requires no more than 1450 logical quantum bits and 70 million Toffoli gates. The prerequisites for this minute-level attack scenario include: high-speed clock superconducting architecture, 10⁻³ physical error rate, planar interconnection architecture, and fewer than 500,000 physical quantum bits.

This estimate presents a more complete resource model compared to a simple bit width metric, yet it still cannot determine when such hardware will be available.

Circle's external hardware comparison description also contains discrepancies. Its article states that Google achieved 105 logical quantum bits with Willow. However, Google's positioning of Willow is a 105 quantum bit processor; the corresponding Nature paper documents an experiment that uses 105 physical quantum bits to complete a distance-7 surface code logical storage experiment, actually utilizing 101 quantum bits. This is not the same concept as the 105 logical quantum bits available for implementing an attack.

Advancing the migration does not require a set deadline. The National Institute of Standards and Technology (NIST) has incorporated SLH-DSSA into FIPS 205 standards and has mandated various institutions to immediately replace encryption schemes that are vulnerable to quantum attacks. The 2035 timeline proposed by NIST only signifies that the relevant algorithms will be deprecated and removed from the standard, not a prediction for a "quantum attack day."

The real criterion for initiating migration is ecosystem readiness: public chains need sufficient time to introduce new signature verification rules; wallets and custodians must undergo tested key rotation processes; users require a transition period during which traditional cryptographic authorization and post-quantum authorization can run in parallel, avoiding liquidity fragmentation or user assets being locked.

Arc is Only One Layer of the 37 Public Chain Ecosystem That Circle Can Control

Arc allows Circle to build post-quantum cryptography support capabilities more directly, but the official documentation splits it into multiple layers of logic, while Circle simplifies its external disclosure as "supporting SLH-DSA."

The execution layer documentation of Arc introduces a precompiled program that can verify SLH-DSA-SHA2-128s signatures. This precompiled component can be used by smart contracts to verify the corresponding signature type, but it does not automatically replace the signature mechanism used in ordinary network transactions.

The Arc custody guide still uses the standard secp256k1 ECDSA to complete transaction signatures. Its post-quantum roadmap plans to launch an optional beta post-quantum wallet signature upon mainnet launch, with post-quantum validator signing functions to follow later. Circle also clarifies that Arc's final post-quantum transaction signing scheme has not been finalized, and the migration phase will be compatible with a mixed-mode ECDSA signature.

Arc can serve as a testing ground for mixed signing schemes. However, relying solely on the Arc upgrade cannot make USDC on Ethereum, Solana, and the other 35 main networks quantum secure.

USDC Quantum Migration Involves 37 Independently Operating Network Paths

The number of networks publicly announced by Circle is itself in flux. On June 29, 2026, the text on its USDC page marked 35 networks but actually listed 37 names. The contract address summary referenced in this article records a total of 37 mainnet entries. If the Arc testnet is included, the Circle Mint list would reach 38, so the Arc testnet is not counted in the statistics.

The table below distinguishes verifiable signature types and the host chains that require independent cryptographic audits. The "EVM path" represents Ethereum-style external accounts, which by default use secp256k1 ECDSA, and can recover the public key after signing; smart contract accounts can use custom verification logic defined by the contract. The "chain-specific solution" indicates that the public chain's official documentation does not specify a unified signature algorithm and does not force specific solutions. The status column records whether the public chain has implemented a full network post-quantum upgrade, but does not imply that there is no exploratory research and development work ongoing on-chain.

The quantum security upgrade of USDC cannot rely solely on Circle's unilateral action. All 37 public chains, wallets, custodians, cross-chain bridges, and users must synchronize their upgrades and completely discontinue the old signature mechanisms for the overall security to be realized.

Instances illustrate that no single unified deadline can cover the entire ecosystem. Solana transactions use Ed25519 signatures; Polkadot simultaneously supports sr25519, Ed25519, and ECDSA accounts. Even when comparing internally within Ethereum, the migration plans for external accounts and smart contract wallets differ, not to mention non-EVM public chains.

Each public chain's upgrade decision-making mechanisms are also entirely different. An XRPL proposal amendment requires over 80% of trustworthy validating nodes to support it for two consecutive weeks; Algorand protocol modifications require an absolute majority vote on-chain; Stellar network upgrades depend on consensus among validating nodes. In all these decision-making processes, Circle has no authority to intervene.

Freezing and Reissuing Permissions Cannot Complete User Key Rotation

Circle holds several key control capabilities at the token level. Its EVM fiat token design includes permissions that can execute minting, burning, pausing transfers, blacklisting, and contract upgrades. The USDC service terms also specify that in certain scenarios, it holds the power to freeze addresses and pause services.

These capabilities can control risks in the event of security incidents with contracts. When conditions permit, Circle can freeze addresses, stop minting or transferring, and execute redemptions or reissuances of tokens in accordance with legal and business rules. However, freezing addresses does not eliminate the risks posed by stolen private keys, nor can it modify the signature verification logic of the underlying public blockchain.

The responsibilities corresponding to key risks differ:

• Circle: Must rotate issuance party and contract management credentials that it controls.
• Users/Custodians: Must use wallets and public chains compatible with the new signatures to transfer assets out of risk accounts.
• Cross-chain bridge operators: Must protect their own signatures and contract permissions while coordinating liquidity across both sides.
• Underlying chain communities: Must approve and implement protocol layer changes.
• Wallet manufacturers, hardware wallets, exchanges: Must simultaneously accommodate both new and old signature algorithms during the transition period.

Thus, the weakest link may not necessarily be the public chain with the slowest technical iteration. Custodians cannot quickly complete key rotations for thousands of accounts; cross-chain bridges' emergency control logic still relies on risk keys; a large number of users do not migrate assets before the old signature scheme is retired—these can all become attack vectors.

A feasible implementation plan cannot merely set a block height as a switch. Each operational party needs to outline risk/security key inventories, verified target account types, software and hardware compatible with new signatures, and formulate disposal strategies for balances that remain untransferred. Mixed signing modes must have clear endpoints and cannot allow traditional signatures to remain indefinitely as a workaround. Circle can set milestones for its contracts and services, but each public chain ecosystem must decide independently when and how to close traditional signature paths.

Even Without an Exact "Quantum Attack Day", the Urgency of Migration is Real

The value of this disclosure from Circle is to turn post-quantum cryptography preparation into an operational plan that must be implemented now. The record of 813 bits proves that as hardware teams tackle error correction technologies, the quantum circuits for attacks will continue to optimize. The NIST public standards also provide developers with testable implementation solutions.

However, this disclosure also has exaggeration issues: comparing 813 logical quantum bits used for attacks directly with Willow's 105 physical quantum bits puts both on the same scale. At the same time, the article underestimates the real gap: verifying SLH-DSA signatures inside Arc, and fully implementing the USDC authorization, settlement, and asset recovery across dozens of production public chains present vastly different levels of difficulty.

Circle can optimize the systems under its jurisdiction. However, only after host public chains, wallets, custodians, cross-chain bridges, and all users complete the migration, and all traditional signature paths are either eliminated or strictly restricted, can Circle claim that USDC as a whole achieves quantum security. This is a large-scale migration project involving multiple parties' veto powers, far from a simple switch in cryptographic protocols.