Circle has warned that the technology needed to break widely used blockchain signatures is becoming more efficient, raising questions over whether USDC can be made quantum-safe across all of the networks, wallets, custodians, bridges and user accounts that support it.
The company said quantum circuits capable of attacking blockchain signatures are becoming “leaner”, pointing to a record design requiring 813 logical qubits. But that figure does not represent a complete attack machine, and Circle’s proposed migration would depend on many organisations outside its direct control.
USDC was worth about $73.6bn on 2 September, giving the issue significant financial weight. Circle’s current contract documentation lists 37 mainnet USDC entries. While the company can protect its own infrastructure and use powers built into token contracts, it cannot replace a customer’s private key, rewrite a custodian’s signing systems or independently alter the signature rules of Ethereum, Solana, XRPL or any other host blockchain.
In an 31 August disclosure, Circle advised developers to audit their cryptography, identify dependencies on suppliers and prepare for key rotation. Securing Circle’s own keys would not protect the wider USDC system if an old wallet, bridge or base-layer transaction route remained vulnerable.
The 813 logical-qubit figure comes from ECDSA.fail, which Circle described as the low-width record for August 2026. It indicates that quantum circuit designs are becoming more resource-efficient, but it is not a direct estimate of the resources required to complete a real-world attack.
The public challenge behind the figure focuses on a reversible point-addition circuit for secp256k1, the elliptic curve used by Bitcoin and Ethereum. Entries are assessed by multiplying peak logical-qubit width by the average number of Toffoli gates.
That creates a trade-off: a design can use fewer qubits by requiring more gates, or reduce gate numbers by using greater width. The 813 figure therefore does not state the circuit depth, error-correction requirements, running time on physical hardware or the total resources needed for Shor’s algorithm to recover a private key.
A March 2026 paper gave a broader estimate. It suggested that an attack on a 256-bit elliptic-curve discrete-log problem could require fewer than 1,200 logical qubits and fewer than 90 million Toffoli gates. An alternative design could use fewer than 1,450 logical qubits and fewer than 70 million Toffoli gates.
The paper’s minutes-scale scenario also assumed a fast-clock superconducting system, physical error rates of 10^-3, planar connectivity and fewer than 500,000 physical qubits. Those estimates offer a more complete resource model than a width-only record, but they do not predict when such a machine will be available.
Circle’s comparison with Google’s Willow processor also requires qualification. Its post says Google achieved 105 logical qubits with Willow. Google describes Willow as a 105-qubit processor, while the associated Nature paper documents an experiment involving 105 physical qubits, 101 of which were used in a distance-seven surface-code logical-memory test. That is not equivalent to having 105 logical qubits capable of attacking blockchain signatures.
There is no need to set an invented deadline for the migration. NIST has standardised SLH-DSA in FIPS 205 and says organisations should start replacing cryptography that is vulnerable to quantum attacks. Its 2035 date concerns the deprecation and removal of vulnerable methods from standards, rather than a forecast of the arrival of “Q-day”.
The real trigger is operational readiness. Networks require time to introduce new verification rules. Wallet providers and custodians need tested methods for rotating keys. Users need a period during which classical and post-quantum authorisation can work together without fragmenting liquidity or leaving balances inaccessible.
Arc provides Circle with an environment in which some of that work can be developed, although its documentation distinguishes between several different layers that Circle’s disclosure groups together under the phrase “supports SLH-DSA”.
Arc’s execution-layer documentation describes a precompile capable of verifying SLH-DSA-SHA2-128s signatures. Such a precompile allows contracts to check that type of signature; it does not automatically replace the signature used to authorise a standard network transaction.
Arc’s custody guide continues to specify ordinary secp256k1 ECDSA signing for transactions. Its post-quantum roadmap refers to opt-in beta post-quantum wallet signatures at mainnet launch, with post-quantum validator signatures planned for a later stage. Circle also says Arc has not selected its final post-quantum transaction-signature scheme and expects hybrid ECDSA support during the transition.
Arc could therefore serve as a testing ground for a hybrid model. However, adopting that model would not make USDC quantum-safe on Ethereum, Solana or the other 35 mainnet entries listed by Circle.
Circle’s network count is also changing. Its USDC page listed 35 networks as of 29 June 2026, while naming 37 networks. The current contract-address table, used as the mainnet reference here, contains 37 rows. A separate Circle Mint table reaches 38 only when Arc testnet is included, so Arc testnet is not part of the mainnet count.
The relevant cryptographic arrangements vary considerably. An “EVM path” generally means that an Ethereum-style externally owned account uses secp256k1 ECDSA, with the public key recoverable from a signed transaction. A smart-contract account can instead use verification rules defined by the contract. “Chain-specific” is used where the available primary documentation does not establish one precise signing scheme.
Solana transactions use Ed25519. Polkadot supports sr25519, Ed25519 and ECDSA accounts. The migration choices for Ethereum-style accounts and smart-contract wallets differ even before they are compared with non-EVM networks.
Control over upgrades is similarly distributed. An XRPL amendment requires more than 80% support from trusted validators for two weeks. Algorand protocol changes require an on-chain supermajority, while Stellar network upgrades depend on validator consensus. Circle does not control any of those decisions.
The company does have important powers at the token-contract level. Its EVM FiatToken design includes roles that can mint, burn, pause, blacklist and upgrade the contract. Its USDC terms also reserve powers to block activity and suspend services in defined circumstances.
Those tools could help contain a known incident on a supported contract. Circle might freeze an address where the implementation permits it, stop minting or transfers, and arrange redemption or reissuance under its legal and operational procedures. But freezing funds does not make a compromised private key safe, nor can Circle change the signature verifier used by a host blockchain.
The vulnerable party will depend on where the exposed key sits. It may be a custodian unable to rotate thousands of accounts quickly, a bridge whose emergency controls still rely on a compromised key, or a group of users who fail to move funds before an old signature route is withdrawn.
A workable migration would require more than announcing a blockchain activation height. Operators would need an inventory of exposed and secure keys, a tested destination account type, hardware and software capable of supporting the new signature and a recovery policy for balances that are not transferred.
Hybrid acceptance would also need a clearly defined end point. Otherwise, classical authorisation could remain indefinitely as an escape route. Circle could coordinate those stages for its own contracts and services, but each host ecosystem would still determine how and when its classical signing path is closed.
Circle’s disclosure is useful because it treats post-quantum preparation as an immediate operational task rather than a distant theoretical concern. The 813-qubit record shows that attack circuits can improve while researchers and hardware manufacturers continue working on error correction. NIST’s standards provide concrete alternatives for developers to test.
However, comparing 813 logical attack qubits with Willow’s 105 physical device qubits places two different measurements on the same apparent scale. There is also a substantial practical difference between verifying an SLH-DSA signature inside Arc and authorising, settling and recovering USDC across dozens of independent production networks.
USDC was up 0.02% over the previous 24 hours and ranked sixth by market capitalisation on 2 September. Its quantum-security challenge is not solved by a single technical upgrade: Circle can make its own part of the system more adaptable, but USDC will not be quantum-safe across its full footprint until host chains, wallets, custodians, bridges and users can all migrate and every remaining classical route is retired or deliberately contained.
