The emergence of quantum computing has sparked intense debate, particularly after Google's assertion that a sufficiently powerful quantum machine could potentially exploit traditional blockchains with less computational power than initially thought. For XRP holders, the answer to the question of vulnerability is nuanced.
Experts suggest that XRP's architecture may be better positioned to withstand quantum threats than Bitcoin's. XRP operates on the XRP Ledger, an open-source and decentralized blockchain, which is utilized by Ripple, a fintech company, to facilitate cross-border transactions. Let's break down the details step by step. The primary concern with quantum computing is its potential to reverse-engineer private keys from exposed public keys, thereby allowing unauthorized access to funds.
Typically, when a transaction is sent, the public key is exposed to the network, while receiving funds only exposes the wallet address. This means that account activity, such as sending transactions, increases quantum vulnerability, whereas the balance or the duration of holding an address does not.
Recently, a quantum vulnerability audit of the XRP Ledger revealed that approximately 300,000 accounts holding 2.4 billion XRP have never sent any funds, only receiving them, and thus their public keys have never been exposed to the network. These accounts are inherently quantum-safe. However, there are dormant whale accounts that have transacted in the past, exposing their public keys, but have been inactive for at least five years.
If a quantum computer were to emerge, these accounts would be at risk. The audit found two such accounts on the XRP Ledger, collectively holding 21 million XRP, which is only 0.03% of the circulating supply. The vulnerability of these accounts is based on the assumption that they are dormant and have not undergone key rotation, a feature available on the XRP Ledger that allows users to swap their signing key without moving funds. This feature is available to all users but is ineffective for long-dormant accounts that may have lost their keys or are no longer active.
Mayukha Vadari, a staff software engineer at Ripple, highlighted the escrow feature as another defense against quantum risk. According to Vadari, funds locked in escrow with a time lock are safe due to logical rather than cryptographic reasons, as the time lock prevents withdrawal until a specified time has passed. While the time lock protects the funds, the account that locked them can still carry quantum risks, and an attacker could potentially take control of the account and cancel or modify the escrow.
In comparison, the quantum threat to Bitcoin appears more significant. A substantial portion of early bitcoin was mined using the P2PK format, which directly exposed public keys in transaction outputs. This includes Satoshi Nakamoto's 1 million BTC, which has never been moved.
Google estimates that around 6.9 million BTC are vulnerable, accounting for nearly 35% of Bitcoin's circulating supply, a significantly larger figure than XRP's 0.03%. Bitcoin holders who recognize the threat face a structural issue that XRP holders do not, as Bitcoin's blockchain lacks a key rotation feature, leaving holders with only one option: moving funds to a new address whose public key has never been seen. However, when funds are moved from an old to a new address, the transaction is exposed in the memory pool for about 10 minutes, during which time a sufficiently strong quantum machine could exploit the public key.
Although this risk is still largely theoretical, it highlights the relative structural vulnerability of Bitcoin holders. It is worth noting that Bitcoin developers have already initiated proposals to develop quantum resistance.