Joseph Gabriel Mattia III, Quantus COO: ‘Five Locks Don’t Help If They All Share The Same Vulnerable Mechanism’ — Why Multisig Won’t Save You From Quantum Attacks
In Brief
Quantum computing could crack today’s crypto security by the late 2020s, making post-quantum migration, audits and resilient wallets urgent.
The cryptographic foundations of the internet were built for a world that no longer exists — or rather, for a world that is quietly running out of time. Q-Day, the point at which a quantum computer becomes powerful enough to crack modern public-key encryption, is no longer a theoretical horizon. According to many veterans in cryptography, it is a late-2020s problem. That puts it closer than most institutional roadmaps, and far closer than the average crypto user has been told to expect.
Joseph Gabriel Mattia III, COO of Quantus — the company integrating post-quantum cryptography into hardware wallet infrastructure — has been thinking through what that transition actually looks like at the protocol level, the custody level, and the level of the ordinary holder who learned everything they needed to know about security from a hardware wallet box. His answers are less reassuring than the industry’s current posture suggests they should be. A stablecoin’s administrative key worries him more than Satoshi’s wallet. Multisig, he argues, offers no meaningful resistance against a quantum attacker — just more locks of the same broken kind. And every major crypto asset tracked by migration.fail, a public readiness tracker, is currently listed as vulnerable at the signature level.
What follows is a conversation about the threat most of the industry is not yet taking seriously enough, why waiting for proof of concept may already be too late, and what quantum readiness actually has to look like — not as a marketing label, but as something verifiable, auditable, and built into the stack by default.
When do you estimate “Q-Day” will arrive — the threshold at which a quantum computer can break modern public-key cryptography? Which systems, data, assets, protocols, or infrastructure would adversaries target first? Why?
Most likely sometime in the late 2020s. There’s still debate over the exact year, but many cryptography veterans believe it will happen within the next four years.
As for the first targets, I don’t expect Satoshi’s Bitcoin to be one of them, even though that’s where people’s minds tend to go.
If an adversary had this capability, targeting something that is visible would announce it to the whole world and destroy an enormous strategic advantage. They’d probably focus on keys that give them the most control or value while attracting as little attention as possible.
In crypto, something like a major stablecoin’s administrative key would worry me more. One compromised key could affect the entire ecosystem, which makes it a much bigger target than any single wallet.
And outside crypto, I’d look at classified government communications, military networks, and intelligence systems, where breaking public-key cryptography could expose highly sensitive data.
Many projects today claim “quantum resistance,” yet without a unified, auditable checklist, such assertions are impossible to verify. In your view, what constitutes the minimum threshold of quantum readiness?
For me, the minimum threshold is that a project should be able to show exactly where quantum-vulnerable cryptography still exists in its stack. Using a post-quantum-secure authorization mechanism is a good start, but it doesn’t make the entire network quantum-ready.
Transaction authorization should rely on a recognized post-quantum-secure mechanism, and the project should publicly document what protects its P2P connections, consensus, zero-knowledge systems, privacy layer, bridges, and any other critical infrastructure.
There also needs to be a clear distinction between what is live today and what is only on a roadmap.
Most importantly, those claims need to be auditable. Anyone should be able to see which algorithms and parameter sets are being used, inspect the implementation, and verify that the security isn’t based on an opaque or unverifiable scheme or a marketing label.
If you can’t point to the exact cryptography protecting each critical part of the system, I don’t think “quantum-ready” means very much.
Who should be responsible for establishing unified, verifiable criteria for quantum readiness? What must be included in them?
I’d keep NIST as the reference point for the cryptography itself. Their post-quantum process brought in researchers from around the world and made it hard for any one government or company to steer the outcome.
For blockchains, the next layer must be built by protocol teams operating in the open, with room for researchers and auditors to rigorously challenge the design and its outcomes.
The criteria then need to reflect how the network operates today. That starts with the cryptography used to authorize transactions and with whether post-quantum protection is the default. Any remaining reliance on vulnerable signatures needs to be clearly disclosed.
Migration has to be part of that picture too, because a network can support post-quantum keys while most of its users are still sitting on old ones.
Hardware wallets protect keys against physical theft, but not against quantum attacks on public keys. How do you assess current user awareness of this distinction? Is there a secure storage model available to the average user today, or does the industry require a new wallet paradigm?
There’s still a big misconception around what a hardware wallet protects you from. It keeps your private key isolated from your laptop or phone, which is extremely useful. But a quantum attacker wouldn’t need to touch the device. Once a vulnerable public key is exposed, a quantum attacker can go after the cryptography directly without ever touching the hardware wallet.
That doesn’t make hardware wallets obsolete. We’ve already integrated post-quantum support into Keystone for Quantus, so the hardware model can evolve. The limitation is that a wallet can’t make Bitcoin or Ethereum post-quantum on its own – the underlying network has to support new signatures too.
A better model builds post-quantum protection into both the wallet and the network by default. Users shouldn’t have to know when the cryptography underneath them has become outdated.
Multisignature schemes increase attack complexity only linearly, not exponentially. Does this mean that institutional custody architectures built on multisig create a false sense of security?
Multisig is still extremely useful, and I wouldn’t want institutions to abandon it. It protects against the threats custody systems deal with today, like one stolen key or one compromised signer.
Where it becomes dangerous is when people start treating more keys as protection against quantum attacks. A 3-of-5 setup built entirely on the same vulnerable signature scheme still has the same underlying weakness. A quantum attacker may need to recover several keys, but they’re solving the same kind of problem each time. Five locks don’t help much if they all share the same vulnerable mechanism.
So yes, multisig can create a false sense of security if institutions assume redundancy equals quantum resistance. The better path is to keep distributed custody, but replace the vulnerable authorization underneath it with something that can hold up against a quantum attacker.
Are major exchanges and custodians prepared for a scenario in which a quantum computer can derive a private key from a public key in minutes? What about ordinary users?
Most major exchanges are good at defending against the attacks we know today. I haven’t seen much evidence that they’re ready for an attack where a private key can be reconstructed without touching their infrastructure at all.
We track this via migration.fail, a public readiness tracker that assesses whether major blockchain networks still rely on quantum-vulnerable cryptography. Right now, all of the top 20 crypto assets it covers are listed as vulnerable at the signature level.
A serious response plan needs to account for which operational keys are exposed and how quickly funds could be moved once one becomes suspect. A malicious transaction may still look perfectly valid on-chain, which makes an early response harder.
Ordinary users are further behind. Most will only learn they need to migrate when a wallet or exchange tells them, so any realistic plan has to make that move simple enough to complete safely.
Why is the “harvest now, decrypt later” threat relevant today — long before the arrival of large-scale quantum computers?
Before anything, I’d like to separate this from the quantum threat to blockchain signatures, because they’re often lumped together. A Bitcoin transaction is already public. There’s nothing an attacker needs to record today and decrypt ten years from now.
But that can’t be said for banks, governments, and other institutions whose encrypted data may (and probably will) still be sensitive years from now. Someone can collect that traffic today and hold onto it until the technology catches up.
Signal, iMessage, and Cloudflare have already moved parts of their systems to post-quantum protection, and most users barely noticed. That’s probably how this transition should look.
Sensitive data shouldn’t stay on quantum-vulnerable encryption until someone proves a quantum computer can break it. By then, years of traffic may already be sitting in someone else’s archive.
Blockchain data is immutable and public. Is there anything that can be done about already recorded transactions, or is that data compromised forever?
Recorded blockchain data is permanent, but permanence doesn’t mean every old transaction suddenly becomes dangerous after Q-Day. Most of it was already public on a transparent chain anyway.
Public keys are the exception because Bitcoin already records exposed ones permanently. An attacker doesn’t need to build some private archive today or intercept anything in advance. Years from now, they can go back through the same public ledger and target any exposed key that still controls something valuable.
Moving funds to post-quantum keys can remove the value from that old exposure, but it can’t clean up the historical record.
For private transactions, the problem is a little different. The data is still sitting on-chain years later, so if the cryptography protecting it is eventually broken, information that was hidden at the time could become visible after the fact.
What measurable, enforceable standards of quantum readiness should the industry establish within the next 12 to 24 months?
One useful benchmark is what the U.S. government is doing now, with federal agencies required to map their cryptographic exposure and put specific people in charge of the migration. High-value systems have firm deadlines to migrate to post-quantum cryptography, and work is underway on a cryptographic bill of materials to make those dependencies easier to track.
Crypto needs its own version of that discipline over the next 12 to 24 months. Major protocols should publish where vulnerable cryptography is still in use and attach dates for completing the transition away from it. Exchanges and custodians should disclose how much value is held behind legacy keys.
Once those numbers are public, listing reviews and security audits can start using them too. That gives the industry something concrete to measure.
What is the single greatest obstacle to implementing those standards at scale? How should the industry address it in the immediate term?
The hardest part is getting millions of independent holders to move when there’s no central switch anyone can flip. A protocol can add post-quantum support, but coins held in cold storage for years still have to be moved by their owners.
Immediate work must focus on making the migration as simple as possible. Wallets need flows that guide users onto safer keys with minimal friction, while exchanges and custodians need procedures they have already tested under load. At the protocol level, we also have to avoid simply replacing one vulnerable system with something that creates unacceptable bandwidth, storage, or privacy costs. Waiting to design those systems until the threat feels urgent would leave little room for mistakes.
Dormant assets make the problem even harder. Some owners will never show up to migrate, so networks also need to decide how they handle vulnerable coins that remain behind.
Disclaimer
In line with the Trust Project guidelines, please note that the information provided on this page is not intended to be and should not be interpreted as legal, tax, investment, financial, or any other form of advice. It is important to only invest what you can afford to lose and to seek independent financial advice if you have any doubts. For further information, we suggest referring to the terms and conditions as well as the help and support pages provided by the issuer or advertiser. MetaversePost is committed to accurate, unbiased reporting, but market conditions are subject to change without notice.
About The Author
Alisa, a dedicated journalist at the MPost, specializes in crypto, AI, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
More articles
Alisa, a dedicated journalist at the MPost, specializes in crypto, AI, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
