The emergence of quantum computing has sparked intense discussion, particularly after Google suggested that a sufficiently powerful quantum machine could compromise legacy blockchains with less effort than previously thought. For XRP holders, the answer to the question of vulnerability is nuanced.
Experts point out that XRP's architecture may offer better protection against quantum threats than Bitcoin's. XRP operates on the XRP Ledger, an open-source, decentralized blockchain used by Ripple for cross-border transactions. To understand the threat, it's essential to delve into the basics of blockchain cryptography.
Each user has a private key, a secret password used to sign transactions, and a public key derived from it, which is used to generate a wallet address for receiving funds. The quantum vulnerability stems from the possibility that a powerful machine using Shor's algorithm could reverse-engineer a private key from an exposed public key, thereby draining a user's funds. Typically, a public key is exposed when a transaction is sent, making the account activity a factor in quantum vulnerability, rather than the balance or the duration of holding an address.
Recently, a quantum vulnerability audit of the XRP Ledger found that approximately 300,000 accounts holding 2.4 billion XRP have never sent funds, only receiving them, which means their public keys have never been exposed to the network, making these accounts quantum-safe by default. However, dormant whale accounts that have transacted in the past and exposed their public keys, but have been inactive for at least five years, are vulnerable. The audit found two such accounts holding 21 million XRP, which, although significant, accounts for only 0.03% of the circulating supply. The XRP Ledger's account-based system and the feature of signing key rotation, which allows users to change their signing key without moving funds, offer additional protection.
This feature, available to all users, enables the rotation of keys that sign on behalf of an account without switching the account itself, thus keeping funds safe without the need for a send transaction. Mayukha Vadari, a staff software engineer at Ripple, highlighted the 'escrow feature' as another defense mechanism.
Funds locked in escrow with a time lock are safe due to logical constraints rather than cryptography, as the time lock prevents withdrawal until a specified time has passed. While the time lock protects the funds, the account that locked them can still carry quantum risks.
In comparison, the quantum threat to Bitcoin appears more significant due to its scale and the lack of a key rotation feature. A substantial portion of early Bitcoin was mined using a format that exposed public keys directly, including Satoshi Nakamoto's 1 million BTC, which has never been moved. Google estimates that about 6.9 million BTC are vulnerable, accounting for nearly 35% of Bitcoin's circulating supply. These funds are at risk of being exploited by a quantum attacker.
Bitcoin holders face a structural problem, as moving funds to a new address to protect against quantum threats exposes the public key of the old address during the transaction process, making them vulnerable to exploitation. Although the risk is still theoretical, it underscores the relative structural vulnerability of Bitcoin holders. It's worth noting that Bitcoin developers have already proposed several initiatives to develop quantum resistance.