Exchanges

USDC quantum migration spans 37 chains beyond Circle

by
written by

Circle issued a warning that the quantum circuits needed to attack widely used blockchain signatures are becoming leaner, citing a low-width record of 813 logical qubits.

For the USDC quantum migration, the immediate consequence is a dependency problem across every host chain, wallet, custodian, bridge and user account that must eventually accept a safer way to authorize transactions.

Circle’s current contract documentation contains 37 mainnet USDC rows. The company can protect infrastructure it controls and exercise token-contract powers on supported networks, but it cannot rotate a customer’s private key, rewrite a custodian’s signing stack or unilaterally change the signature rules of Ethereum, Solana, XRPL or any other host.

In its Aug. 31 disclosure, Circle told developers to inventory their cryptography, identify vendor dependencies and prepare key rotation. USDC was worth about $73.6 billion on Sept. 2, giving that coordination problem financial scale. A migration that secures Circle’s own keys while leaving an old wallet, bridge or base-layer path exposed would not secure the whole footprint.

The 813-qubit figure is one coordinate, not a countdown

Circle describes 813 logical qubits as the August 2026 low-width record on ECDSA.fail. That is evidence that quantum circuit designs are becoming more resource-efficient, but the number is easy to misread.

The public challenge specification optimizes a reversible point-addition circuit for secp256k1, the curve used by Bitcoin and Ethereum. It scores submissions by multiplying peak logical-qubit width by average Toffoli-gate count. A design can reduce width by spending more gates, or reduce gates by using more width. The 813 figure therefore does not describe, by itself, a complete Shor attack, its circuit depth, its error-correction overhead or how long it would run on physical hardware.

A March 2026 paper makes the tradeoff explicit. The researchers estimated that a 256-bit elliptic-curve discrete-log attack could use fewer than 1,200 logical qubits and fewer than 90 million Toffoli gates, or fewer than 1,450 logical qubits and fewer than 70 million Toffoli gates. Their minutes-scale scenario also assumed a fast-clock superconducting architecture, physical error rates of 10^-3, planar connectivity and fewer than 500,000 physical qubits.

Those estimates are a stronger resource model than a width figure alone, but they still do not provide a delivery date for such a machine.

Circle’s hardware comparison also needs correction. Its post says Google achieved 105 logical qubits with Willow. Google describes Willow as a 105-qubit processor, while the associated Nature paper describes 105 physical qubits used in a distance-7 surface-code logical-memory experiment involving 101 qubits. That is not the same as 105 attack-ready logical qubits.

The migration case does not need an invented deadline. NIST standardized SLH-DSA in FIPS 205 and says organizations should begin replacing quantum-vulnerable cryptography now. Its 2035 horizon concerns deprecation and removal from standards, not a prediction of Q-day.

The practical trigger is readiness. Networks need enough time to add verification rules, wallets and custodians need tested key-rotation paths, and users need a period in which classical and post-quantum authorization can coexist without splitting liquidity or trapping balances.

Related Reading

Bitcoin now has a quantum computing escape route, but 7 million BTC may still be exposed

Arc is one controllable layer inside a 37-network system

Arc gives Circle a place to design post-quantum support more directly, but its present documentation separates several layers that Circle’s disclosure compresses into the phrase “supports SLH-DSA.”

Arc’s execution-layer documentation describes a precompile that can verify SLH-DSA-SHA2-128s signatures. A verification precompile lets contracts check that signature type. It does not automatically replace the signature that authorizes an ordinary network transaction.

Arc’s custody guide still specifies standard secp256k1 ECDSA transaction signing. Its post-quantum roadmap places opt-in beta post-quantum wallet signatures at mainnet launch and post-quantum validator signatures later. Circle also says Arc has not chosen its final post-quantum transaction-signature scheme and expects hybrid ECDSA support during migration.

Arc can become a proving ground for a hybrid design. It cannot make USDC quantum-safe on Ethereum, Solana or 35 other mainnet rows simply by adopting that design.

Related Reading

Circle gives legacy USDC apps 95 days before old cross-chain transfer routes stop working

USDC quantum migration spans 37 different network paths

Circle’s public count is itself moving. Its USDC page says 35 networks as of June 29, 2026 while enumerating 37 names. The current contract-address table is the mainnet anchor used here and contains 37 rows. A separate Circle Mint table reaches 38 only when Arc testnet is included, so Arc testnet is not counted in the inventory below.

The table distinguishes verified signing classes from hosts that need their own cryptographic audit. “EVM path” means an Ethereum-style externally owned account normally uses secp256k1 ECDSA, with its public key recoverable after signing, while a smart-contract account may use contract-defined verification. “Chain-specific” avoids assigning an exact scheme where the cited primary chain documentation does not establish one. The status column records whether the cited material establishes a host-wide post-quantum switch; it does not rule out exploratory work elsewhere.