Crypto Says It Is Getting Ready. The Rest of the Internet May Not Be.

There is an interesting argument gaining traction in the crypto community. Crypto may actually be better positioned for the quantum transition than traditional finance and the broader internet.

At first, that sounds backwards.

Bitcoin and other blockchains depend heavily on cryptography that a sufficiently capable quantum computer could eventually threaten. Public keys can become permanently visible. Assets cannot simply be recalled and replaced. Decentralized networks make coordinated upgrades difficult.

Yet the industry has spent more than a decade operating under relentless adversarial pressure where mistakes can result in irreversible financial loss.

That creates a different culture.

Projects are experimenting with post-quantum accounts. Wallet providers are studying migration strategies. Networks such as NEAR emphasize algorithm agility. Starknet is considering architectural independence partly because it wants greater control over its security timetable. Smaller projects are already testing ML-DSA, SLH-DSA, hash-based signatures, and hybrid approaches.

Some of those claims deserve skepticism. But the experimentation itself is real. Now compare that with ordinary mobile infrastructure.

NowSecure examined 136,711 iOS and Android applications and found that 96.9% showed no detectable post-quantum cryptography-related code or libraries in their binaries. More than 3,100 apps also triggered findings for legacy algorithms such as DES and RC4.

There are important caveats. Static analysis does not prove that an application lacks quantum-safe protection. Protection may be provided by the operating system, network stack, or server, and finding PQC-related code does not prove that it is actually used at runtime.

But the broader signal is hard to ignore.

The quantum-readiness problem may not be that cryptography is unavailable. It may be that organizations do not know where their cryptography actually lives.

The first signal is the growing amount of practical post-quantum experimentation inside the cryptocurrency ecosystem. The current discussion is increasingly about how to protect existing assets without forcing every user to move them, how to rotate account keys without hard forks, how to use hybrid signatures during transition periods, and how to preserve upgrade autonomy when underlying platforms move more slowly. Much of the social volume remains promotional, particularly around projects such as Quip Network, but the underlying engineering question is legitimate: how do you change cryptography without destroying usability?

Bitcoin continues to provide the clearest example of why this matters. Glassnode estimates that 6.04 million BTC, or 30.2% of issued supply, currently sits in outputs where the public key is already visible on-chain. Of that, 1.92 million BTC is structurally exposed by script design and another 4.12 million BTC through operational behavior such as address reuse or partial spending. Glassnode explicitly does not claim these coins can be attacked today. The analysis simply maps where public-key exposure already exists.

That distinction is critical. Quantum exposure is not the same thing as quantum compromise. But exposure creates a migration problem that already exists.

The second signal comes from mobile applications.

NowSecure’s findings suggest that mobile may be one of the least visible parts of many cryptographic inventories. Applications often inherit cryptography from third-party libraries and SDKs that security teams may not see in source repositories. NowSecure’s recommendation is therefore straightforward: inventory cryptography in first- and third-party applications, prioritize sensitive use cases, remediate, and retest.

The third signal comes from infrastructure providers that are already moving beyond laboratory demonstrations.

Cloudflare announced a post-quantum GeoKey Manager on October 23. The system uses a hybrid combination of ML-KEM-768 and X25519 to protect geographically restricted decryption keys, with general availability planned for Q1 2027. Cloudflare’s design is intended to preserve confidentiality even under harvest-now, decrypt-later assumptions while maintaining geographic data-sovereignty controls.

Cloudflare has also deployed hybrid X25519MLKEM768 key agreement and is working toward broader post-quantum authentication support, with full post-quantum security targeted for 2029.

That is what makes today’s contrast interesting.

Some parts of the technology ecosystem are experimenting aggressively.

Others may not even have sufficient visibility to know what needs to change.

The important question is not whether crypto is genuinely more quantum ready than traditional finance. We do not yet have enough standardized evidence to make that claim.

The more useful observation is this: Crypto is being forced to confront cryptographic migration as an architectural problem earlier than many traditional organizations are.

That may give it an advantage.

When money can disappear permanently because of a key failure, cryptographic assumptions receive unusually intense scrutiny.

Traditional organizations often have more buffers.

• Contracts.
• Insurance.
• Centralized account recovery.
• Fraud reversal.
• Administrative controls.

Legacy systems that can continue operating despite technical debt. Those buffers are valuable. But they can also allow cryptographic migration to remain invisible for longer.

The NowSecure findings illustrate the problem.

If an organization cannot identify which cryptographic libraries exist inside 100 mobile applications, how confidently can it claim to have a post-quantum migration plan?

If it cannot identify third-party SDK dependencies, how does it know which suppliers determine its migration timetable?

If authentication, certificates, machine identities, mobile APIs, embedded libraries, and backend services all change on different schedules, who actually owns the transition?

This brings us back to the recurring QCI-QS1 question:

Can the organization change its cryptography deliberately when the assumptions change?

Not just on a server.

Across applications.

Across identities.

Across vendors.

Across mobile devices.

Across infrastructure.

Across the entire trust chain.

That is crypto-agility.

And today’s market signals suggest something uncomfortable.

The organizations most exposed to the quantum transition may not be the ones using the weakest cryptography. They may be the ones with the weakest visibility.

So the boardroom question for today is: “If 97% of mobile applications show no detectable PQC code, do we actually know what cryptography our own applications depend on?”

If the answer requires someone to go find out, that is the beginning of the inventory. And perhaps the beginning of quantum readiness.

Think Earlier. Trust Must Survive.