SoK: Stablecoins in the Quantum Era

In three numbers

Why this is not a drop-in swap

Every figure below is quoted from the paper, which in turn cites standards, draft EIPs and published measurements.

The problem

A stablecoin is not a single contract

Shor's algorithm breaks ECDSA, Schnorr, EdDSA and BLS. For an ordinary wallet that means one theft. For a stablecoin, one extracted mint, bridge or oracle key can change supply, redemption or liquidity for every holder. The paper models a stablecoin as three coupled layers:

The authority–liability gap. The party able to migrate a component is often not the party that bears the loss when it fails. A migration that is technically available can still stall because the actor who could deploy it lacks the incentive, legal authority or coordination channel to protect the loss bearer.

Timing follows Mosca's inequality: a system is insecure if $X + Y > Z$, where $X$ is how long the data must stay protected, $Y$ is migration time and $Z$ is time until a CRQC. For stablecoins, $X$ is years to decades and $Y$ is large because every layer migrates through its own governance process. The paper does not estimate $Z$.

Interactive 1 · Table 1

Who can fix it, and who pays

Choose a control surface. The left box names the actor able to migrate it and the right box names the principal loss bearer. Where they differ, a working post-quantum primitive is not enough.

Interactive 2 · §3.3 and Table 3

Upgrade one layer; watch what stays exposed

Mark components as post-quantum secure. The outcomes on the right follow the paper's cross-layer rules. Securing the issuer's keys does not protect users on a vulnerable host chain, and a PQ bridge committee does not protect wrapped supply if source-chain finality can still be rewritten.

Component-to-attack mapping from Table 3 and §3.3; control surfaces from §4, Dimension 1, and Table 1. Store-now-decrypt-later: upgrading the KEM protects future traffic only, because traffic already archived stays exposed.

Interactive 3 · Remark in §3.1

Quantum compromise is not all-or-nothing

The paper separates three regimes of quantum attack. Stablecoins are exposed in the first: issuer, bridge and oracle keys sit at static on-chain addresses with public keys already revealed.

Interactive 4 · Tables 7 and 9

Gas figures only mean something with their execution model

Every cost figure in the paper on one log axis, coloured by what kind of evidence it is. Calldata figures only price moving the signature bytes. Draft EIPs are proposed prices. poqeth figures are measured full-EVM verification. The spread covers six orders of magnitude, and the paper warns these values are not directly comparable.

Calldata uses 16 gas per non-zero byte and excludes verification, public-key storage, aggregation and transaction overhead. Values are shown as the paper prints them; "≈" marks figures the paper gives as "about". SLH-DSA is not plotted: the paper gives only a bound ("an 8-KB signature alone costs over 100k calldata gas"). poqeth values use NIST-level-1 parameters. EIP-8051 assumes a 20,512-byte expanded verifier key.

Interactive 5 · Table 5

Each proposal fixes one part of the stack

The taxonomy classifies migrations by control surface (who can authorize the change: issuer, host chain or ecosystem), layer (infrastructure, application overlay, bridge/rollup, base layer) and strategy (hybrid, PQ-native or encapsulation). Choose a proposal to see what it addresses and what it leaves open for a stablecoin. Most are drafts or roadmaps, not deployed guarantees.

Properties & evidence

What breaks, what each operation needs, what it costs

Quantum-enabled attack patterns (Table 3)

Requirements differ by operation (Table 8)

Verification and data costs (Table 9, Appendix B)

The paper collects these from the cited sources; they are not the authors' own measurements.

Table 7 also lists ML-DSA-65 (pk 1,952 B; sig 3,309 B; about 52.9k calldata gas) and Falcon-512 (pk 897 B; sig about 666 B; about 10.7k calldata gas).

Cite

BibTeX

@inproceedings{chatzigiannis2026sokstablecoins,
  title     = {SoK: Stablecoins in the Quantum Era},
  author    = {Chatzigiannis, Panagiotis and Alamati, Navid and
               Chakraborty, Suvradip and Le, Duc V.},
  booktitle = {ACM Conference on Post-Quantum and Quantum-based
               Security (PQQS)},
  year      = {2026}
}

Code and data. This is a systematization paper and ships no code or dataset. Every number on this page is quoted from the paper, which cites standards, draft EIPs and BIPs, and published measurements.