Every digitally signed contract, every encrypted financial record, every blockchain transaction your business has ever made rests on a mathematical assumption: that certain problems, factoring very large numbers, computing discrete logarithms, are practically impossible for any computer to solve within a useful timeframe. That assumption has held for roughly fifty years. It stops holding the day a sufficiently powerful quantum computer exists, and the uncomfortable part of this story is that the damage does not wait for that day to arrive.
Key Takeaway
Quantum computers powerful enough to break current public-key cryptography, RSA and elliptic-curve systems, do not yet exist. The risk is nonetheless active today, through a documented attack pattern called "harvest now, decrypt later," where encrypted data is captured and stored now for decryption once quantum capability arrives. NIST finalized the first three post-quantum cryptography standards in August 2024. Canada's Cyber Centre published a formal migration roadmap in June 2025, setting April 2026 for initial departmental migration plans, and 2031 and 2035 as hard deadlines for high-priority and remaining government systems respectively, a timeline increasingly treated as the de facto benchmark for regulated private-sector migration as well. For any business whose ledgers, contracts, or financial records need to remain confidential or verifiable for a decade or more, that timeline is not distant. It has already started.
The Threat, In Plain Terms
Modern public-key cryptography, the RSA and elliptic-curve (ECC) systems underlying essentially every secure web connection, digital signature, and blockchain transaction in use today, relies on mathematical problems that are extraordinarily difficult for classical computers but that a sufficiently powerful quantum computer could solve efficiently using Shor's algorithm, a quantum algorithm specifically capable of factoring large numbers and computing discrete logarithms in polynomial time[1]. No quantum computer capable of running Shor's algorithm against real-world key sizes exists today. Current estimates suggest breaking Bitcoin's cryptography alone would require millions to billions of stable, error-corrected qubits, far beyond any publicly known current capability[2]. The absence of a working machine today is not, however, the same thing as the absence of risk today, which is the entire point of the next section.
Harvest Now, Decrypt Later
The attack pattern that makes this an immediate rather than a future concern is well documented and has a specific name across the cybersecurity literature: harvest now, decrypt later (HNDL). An adversary intercepts and stores encrypted data today, with no ability to read it now, and simply waits, potentially for years, until quantum computing capability sufficient to break the encryption becomes available, at which point the previously unreadable archive becomes fully readable[3]. Canada's own Cyber Centre describes the mechanism in nearly identical terms in its public guidance: a threat actor intercepts encrypted information, stores it, and decrypts it in the future once sufficiently powerful quantum computers exist, meaning any information with a medium or long lifespan, ten years or more, is already at risk today, regardless of when a capable quantum computer actually arrives[4].
Palo Alto Networks' threat intelligence division has separately reported observing sophisticated threat actors already focused specifically on exfiltrating and archiving high-value encrypted data for exactly this purpose[5]. This is not a hypothetical concern awaiting future confirmation; it is an observed, ongoing collection pattern targeting data with long confidentiality requirements today.
The Timeline At A Glance
For quick reference: NIST finalized its first three PQC standards on August 13-14, 2024. A fifth algorithm, HQC, was selected in March 2025. Canada's Cyber Centre published its formal migration roadmap on June 23, 2025, setting April 2026 for initial departmental plans, and end of 2031 and end of 2035 as hard deadlines for high-priority and remaining government systems. The US NSA's own acquisition requirement for national security systems lands in 2027; the EU's target is 2030. Approximately 32.7% of circulating Bitcoin already sits in addresses with exposed public keys, already harvestable today regardless of when a capable quantum computer arrives.
The NIST Standards, Finalized
The global response to this threat reached a major milestone on August 13-14, 2024, when the U.S. National Institute of Standards and Technology finalized the first three post-quantum cryptography (PQC) standards, following an eight-year public evaluation and standardization process[6]. FIPS 203 (ML-KEM, derived from CRYSTALS-Kyber) provides a lattice-based key encapsulation mechanism replacing RSA and elliptic-curve key exchange. FIPS 204 (ML-DSA, derived from CRYSTALS-Dilithium) provides a lattice-based digital signature scheme replacing RSA and ECDSA signatures. FIPS 205 (SLH-DSA, derived from SPHINCS+) provides a conservative, hash-based signature scheme intended as a structurally independent fallback, since its security rests on different mathematical assumptions than the lattice-based schemes[6]. NIST subsequently selected a fifth algorithm, HQC, for standardization in March 2025, and continues evaluating additional signature scheme candidates[7].
Canada's Own Deadlines
Canada's Communications Security Establishment, through its Canadian Centre for Cyber Security, published ITSM.40.001, its formal roadmap for post-quantum cryptography migration across Government of Canada systems, on June 23, 2025[8]. The roadmap sets four concrete milestones: departmental PQC migration plans due by April 2026, annual progress reporting beginning that same month, migration of high-priority systems complete by the end of 2031, and migration of remaining systems complete by the end of 2035[8]. The roadmap defines completion strictly: quantum-vulnerable algorithms must be disabled, isolated, or tunnelled, not merely supplemented alongside a newer algorithm[9]. Systems specifically at risk of harvest-now-decrypt-later exposure, those protecting confidentiality of information in transit over public networks, are explicitly flagged as high priority for earlier migration[8].
It is worth an honest comparative note: Canada's 2031 deadline for high-priority systems trails the European Union's 2030 target and the United States NSA's 2027 acquisition requirement for national security systems by a meaningful margin[9]. This does not mean Canadian organizations have more runway in practice than their EU or US counterparts; it means the Canadian federal timeline specifically, which increasingly functions as a de facto benchmark private-sector regulators and counterparties reference, is somewhat more conservative than peer jurisdictions, and Canadian businesses transacting internationally may find themselves needing to meet the earlier deadlines of counterparties or markets they operate in regardless of their own domestic timeline.
OSFI And Federally Regulated Financial Institutions
This is the detail most relevant to this publication's core audience, and it deserves to be stated plainly rather than buried in a general cybersecurity discussion. The Office of the Superintendent of Financial Institutions (OSFI), which regulates Canada's federally chartered banks, insurers, and trust companies, has issued technology and cyber risk guidance, notably Guideline B-13, alongside specific quantum readiness communications, that create supervisory expectations for regulated financial institutions independent of and generally ahead of the broader government migration timeline[9]. OSFI's Guideline B-10 on third-party risk management further extends this pressure down the vendor supply chain, meaning a federally regulated financial institution's quantum risk expectations increasingly flow through to the technology vendors, payment processors, and service providers it relies on, whether or not those vendors are themselves directly regulated[9]. A Canadian business that supplies technology, data processing, or financial infrastructure services to a bank or insurer should expect quantum-readiness questions to appear in vendor risk assessments well before either the 2031 government deadline or any formal statutory requirement specific to their own business arrives.
Why "Ledgers" Specifically Are Exposed
The term "ledger" in this article's title deserves precision, because the exposure differs meaningfully depending on what kind of ledger is meant. A conventional corporate general ledger, held in a private accounting system, is primarily exposed through the encryption protecting it in transit and at rest, TLS connections, database encryption, backup encryption, all of which rely on the same RSA and ECC primitives the NIST standards are designed to replace. A distributed, blockchain-based ledger carries a structurally different and, in some respects, more acute exposure, because the ledger's core integrity guarantee, that transaction history cannot be altered, depends entirely on the same public-key cryptography that HNDL and Shor's algorithm specifically threaten, and because blockchain ledgers are, by design, permanent, public, and immutable, meaning historical transaction data that HNDL captures does not need to be separately harvested at all; it is already sitting in plain sight on the chain itself, waiting only for the cryptography protecting it to be broken.
The Bitcoin Numbers, As A Case Study
Bitcoin's own exposure illustrates the scale of the problem concretely, and the numbers are worth citing precisely because they are frequently understated in casual discussion of this topic. Research cited by Chainalysis, drawing on analysis from Project Eleven, estimates approximately $718 billion worth of bitcoin is currently held in addresses vulnerable to quantum attack, including early Pay-to-Public-Key (P2PK) addresses where the public key itself is already permanently exposed on the blockchain rather than merely hashed[2]. Separate research cited in 2026 coverage found approximately 6.51 million BTC, roughly 32.7% of the entire circulating supply, sits in addresses with exposed public keys, all of it already harvestable data today, regardless of when a capable quantum computer actually materializes[10]. The technical mechanism is specific: Bitcoin's earlier P2PK address scheme exposes the public key directly on-chain, while its more modern P2PKH scheme exposes only a hash of the public key, meaning the public key itself is not revealed, and therefore not harvestable, until the coins in that address are actually spent[11]. This distinction, between an address type that has already leaked its exposure and one that has not yet done so, is precisely the kind of granular exposure assessment any business holding or processing blockchain-based assets needs to perform, rather than treating "blockchain security" as a single, undifferentiated question.
The Stablecoin Wrinkle
This exposure connects directly to the machine-to-machine payment infrastructure discussed elsewhere in this publication. The x402 protocol and comparable agentic payment systems settle predominantly in stablecoins, a market processing hundreds of billions of dollars in monthly settlement volume[10]. A business building meaningful transaction volume on this infrastructure, whether receiving M2M revenue or funding an agentic wallet, is accumulating exposure through the underlying blockchain rails' own cryptographic vulnerabilities, layered on top of whatever quantum exposure exists in the business's own conventional systems. This is a genuinely new category of exposure for a Canadian business to have on its radar at all, since blockchain-settled payment infrastructure at meaningful volume is itself a very recent development for most businesses outside the crypto-native sector, and quantum readiness has not historically been part of standard vendor or infrastructure risk assessment for a typical SMB.
Crypto-Agility, Explained
Every piece of official guidance reviewed for this article converges on the same underlying architectural instinct, regardless of which specific standard or jurisdiction it addresses: build for change, because the current standard is very unlikely to be the last one.
The single most important architectural concept in this entire migration, repeated across essentially every piece of NIST and Cyber Centre guidance reviewed for this article, is crypto-agility: designing systems so that the specific cryptographic algorithm in use can be changed without requiring a substantial infrastructure overhaul[4]. This matters for a reason specific to the current moment: PQC algorithms themselves are still maturing, NIST added a fifth algorithm in March 2025 and continues evaluating others, which means an organization migrating today needs an architecture capable of adopting today's standard without that architecture itself becoming the next legacy system requiring a second painful migration when a stronger or more efficient algorithm is later standardized. The recommended near-term deployment pattern reflects this directly: a hybrid approach combining a classical algorithm with a post-quantum algorithm in the same handshake or transaction, ensuring the connection remains secure as long as at least one of the two algorithms remains unbroken, is the practical bridge most guidance currently recommends rather than a single wholesale cutover[12].
Fifty Years Is Not An Exaggeration
Canada's own quantum-readiness guidance is explicit about a detail easy to underweight: the shelf life of critical data such as trade secrets can exceed 50 years[9]. This reframes the entire urgency question for any business holding genuinely long-lived confidential material, proprietary formulations, long-term client agreements, intellectual property with decades of remaining commercial value. For that category of data, the relevant question is not "when will a capable quantum computer exist," a genuinely uncertain timeline among experts, but "is there any credible probability it exists within the next 50 years," a considerably easier question to answer affirmatively, and one that most credible expert assessments do answer affirmatively. Data with a shorter, more conventional business lifespan, a quarterly financial report, an ordinary customer transaction record, carries meaningfully lower HNDL exposure simply because its value to an adversary decays well before quantum capability is likely to arrive, which is precisely why the Cyber Centre's own prioritization guidance ties migration urgency to data lifespan rather than treating all encrypted information as equally urgent.
A Worked Case: The Contract Signed Today, Read In 2040
A Canadian professional services firm digitally signs and encrypts a set of client engagement contracts and financial records with a contractual confidentiality obligation extending 15 years. Under current, entirely standard encryption practice, using RSA or ECC-based systems, that data is genuinely secure against any classical computing attack for the foreseeable future. Under the HNDL threat model, however, an adversary intercepting and archiving that encrypted data today needs only to wait until a capable quantum computer exists, plausibly, per most credible expert timelines, sometime within that same 15-year confidentiality window, at which point the archived data becomes fully readable, and the firm's confidentiality obligation is retroactively breached without any new attack occurring at the time of breach at all. The firm's actual, tangible risk today is not that its current encryption is broken; it is that its current encryption choice determines whether data captured today remains protected for as long as its confidentiality obligation actually requires, a question that has to be answered now, at the moment of encryption, because it cannot be retroactively fixed once the data has already been harvested.
A Practical Migration Sequence
Drawing directly from Cyber Centre and NIST guidance, a proportionate sequence for a business without a dedicated large-scale IT security function follows. Build a cryptographic inventory first, identifying where and how RSA, ECC, and other quantum-vulnerable algorithms are actually used across your systems, since the Cyber Centre's own guidance identifies this discovery step as a prerequisite most organizations skip, to their later cost[4]. Prioritize by data lifespan and HNDL exposure, focusing first on systems protecting data with genuinely long confidentiality requirements or transmitted over public networks, rather than attempting a uniform migration across every system simultaneously. Ask vendors directly about their PQC roadmap and require FIPS-validated cryptography where available, since most businesses will migrate primarily through vendor and platform updates rather than building cryptographic implementations themselves. Design for crypto-agility explicitly in any new system procurement or architecture decision made from this point forward, so today's migration does not become tomorrow's second legacy problem. Treat any blockchain or stablecoin-settled infrastructure exposure as a distinct line item in this assessment, given its structurally different, and in some address-type cases already-realized, exposure profile relative to conventional encrypted systems.
Why This Is A Once-In-Fifty-Years Event
For anyone studying cryptography, security engineering, or technology policy, it is worth situating this migration in its actual historical scale rather than treating it as a routine security update cycle. Current technical commentary describes the shift to post-quantum standards as the largest cryptographic change since the adoption of RSA itself, roughly four decades ago[12]. RSA's adoption did not require replacing an existing widely deployed public-key infrastructure, because none existed yet at meaningful scale; this migration does, across every system, protocol, and piece of infrastructure built on the assumption that RSA and ECC would remain secure indefinitely. That combination, comparable historical significance to RSA's original adoption, but with the added complexity of migrating away from decades of embedded legacy infrastructure rather than building fresh, is precisely why crypto-agility has become the central architectural principle in every serious piece of guidance on this topic, and why organizations that treat this as a routine patch cycle rather than a genuinely multi-year infrastructure program consistently underestimate what it actually requires.
The Limits Of This Analysis
Several caveats matter. The timeline for a cryptographically relevant quantum computer capable of running Shor's algorithm at the scale needed to break real-world encryption remains genuinely uncertain among experts, and this article does not take a position on when that will occur, only on the fact that the HNDL threat model makes today's data exposure independent of that timing question. The specific dollar figures and address-vulnerability percentages cited for Bitcoin come from third-party research and analytics firms rather than a single authoritative source, and should be treated as credible estimates rather than precise, universally agreed figures. Canadian regulatory guidance in this area, particularly OSFI's specific expectations, is evolving, and this article's characterization reflects publicly available guidance as of mid-2026; a business with a live compliance question should confirm current, specific requirements directly with OSFI guidance or qualified counsel rather than relying on this general framework article. Finally, cryptographic migration is a genuinely technical, specialized undertaking, and this article's practical sequence is a starting framework for engaging the right expertise, not a substitute for it.
Frequently Asked Questions
Does a quantum computer capable of breaking encryption exist today?
What are the NIST post-quantum cryptography standards?
What deadlines has Canada actually set?
Is my business's blockchain or cryptocurrency exposure really at risk today?
What should a small or mid-sized Canadian business actually do first?
References
- Shor, P. W. (1997). Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer. SIAM Journal on Computing, 26(5), 1484-1509.
- Chainalysis. (2026, April 8). Quantum Computing and Cryptocurrency. chainalysis.com/blog/quantum-computing-crypto-security
- Palo Alto Networks. What Are NIST PQC Standards? paloaltonetworks.com/cyberpedia/pqc-standards
- Canadian Centre for Cyber Security. Addressing the Quantum Computing Threat to Cryptography (ITSE.00.017). cyber.gc.ca/en/guidance/addressing-quantum-computing-threat-cryptography-itse00017
- Palo Alto Networks Unit 42, cited in Palo Alto Networks (2026). What Are NIST PQC Standards? paloaltonetworks.com/cyberpedia/pqc-standards
- NIST National Cybersecurity Center of Excellence. Frequently Asked Questions About Post-Quantum Cryptography. pages.nist.gov/nccoe-migration-post-quantum-cryptography
- Encryption Consulting. (2026, January 27). Decoding NIST PQC Standards: What They Are, What's Final, and What's Next. encryptionconsulting.com/decoding-nist-pqc-standards
- Canadian Centre for Cyber Security. (2025, June 23). Roadmap for the Migration to Post-Quantum Cryptography for the Government of Canada (ITSM.40.001). cyber.gc.ca/en/guidance/roadmap-migration-post-quantum-cryptography-itsm40001
- PostQuantum.com. (2026, June 5). No Single Law, No Single Excuse: How Canada Regulates PQC Without Saying "Quantum". postquantum.com/quantum-policies/canada-pqc-regulatory-framework
- BlockEden.xyz. (2026, April 19). Canada's Post-Quantum Cryptography Deadline Is Here — What It Means for Bitcoin, Ethereum, and Solana. blockeden.xyz/.../canada-post-quantum-cryptography-mandate
- Quantum Disruption: An SoK of How Post-Quantum Attackers Reshape Blockchain Security and Performance. (2026). arXiv preprint, arXiv:2512.13333.
- Jacar. (2026, May 3). NIST PQC: The Post-Quantum Cryptography Standards. jacar.es/en/nist-pqc-finalistas
This article discusses NIST and Canadian government cybersecurity guidance and current technical literature and is provided for general informational purposes. It is not security or legal advice. Post-quantum cryptography migration is a specialized, evolving technical discipline; confirm your specific migration requirements and timeline with a qualified security professional and, where applicable, current OSFI guidance.