The emergence of onchain credit markets represents one of the most structurally significant shifts in crypto today. Historically, DeFi lending was constrained by rigid pool-based risk architectures and capital inefficiencies that made it inaccessible to institutional capital and fundamentally limited in its ability to replicate the sophistication of traditional credit markets. That is now changing. The convergence of efficiencies unlocked by onchain lending, institutional-grade custody infrastructure, and demand for institutional embedded finance has created the conditions for a fully programmable, permissionless credit layer to emerge at scale. We believe onchain credit will become the dominant form of collateralized lending over the next decade — not as an alternative to TradFi, but as its settlement infrastructure — as major asset managers and exchanges increasingly route credit exposure through decentralized protocols rather than bilateral OTC arrangements.

A Primer of Morpho’s History and Current Developments

Past

Morpho was founded in 2021 as a yield optimization layer on Compound and Aave lending platforms, introducing a P2P matching engine that enhances lending yields. Its Optimizer product quickly achieved massive product-market fit, growing to over $1 billion in deposits. However, the team recognized that building multibillion-dollar global infrastructure heavily reliant on legacy pools posed significant systemic risks. To eliminate these external dependencies, Morpho deprecated the Optimizer and built Morpho Blue, a base layer featuring immutable, security-hardened isolated lending markets. Blue externalizes the risk management and curation to independent vaults built on top of its protocol by vault curators.

Present

Today, Morpho has become the second largest lending protocol with close to $10B in deposits and $3.55B in active loans, more than doubling its market share in the lending market since the start of the year.

Future

Moving beyond Blue, Morpho also recently introduced its latest architectural whitepaper called Morpho Midnight. Midnight brings fixed-rate, fixed-maturity lending onchain. It operates without a utilization-based interest rate curve; instead, lenders and borrowers trade “zero-coupon” style market units at a discount, locking in a specific interest rate until a set maturity date. Midnight’s callback feature also allows lenders to keep their capital efficient by only deploying capital at the time of a matched loan. Fixed rate lending unlocks predictable funding costs for borrowers and returns predictable for lenders according to their risk return preferences. Furthermore, Midnight supports multi-market offers that share a single fill budget. This allows lenders to quote liquidity across several isolated markets simultaneously, dramatically reducing liquidity fragmentation while also retaining makers’ exposure bounded by their own defined budget.

Competitive Moats — Unique And Robust Architectural Design

To put it simply, Morpho is designed for capital efficiency and robust security which we are going to elaborate in the next few paragraphs.

Morpho’s true competitive edge lies in separating its base lending infrastructure from risk management. In Morpho Vaults V2, the protocol established a new standard of onchain lending through isolated vault curation and risk management. This allows independent builders to launch and curate scalable lending products on top of Morpho Blue, matching different risk, liquidity, and compliance profiles without compromising the minimal, isolated, highly secure base layer. This security design has paid off to date with the protocol seeing a bad debt of less than $20K in its entire years of operation while originating billions in loans, testament to the institutional-grade security framework embedded deeply in the protocol from its inception. Additionally, current Morpho’s Blue lending markets leverage an immutable AdaptiveCurveIRM interest rate model that adapts autonomously to market conditions. Supply of assets is also not used as collateral, and this clear segregation enables Morpho to achieve high utilization rates.

Morpho has built a deep moat around developer experience. The launch of the Morpho API and SDK in late 2025 allows builders to skip indexing and integrate directly into the protocol. This developer-centric approach ensures Morpho remains the easiest and most robust plumbing for any application wanting to offer yield or credit.

Beyond architectural competitiveness, Morpho has also strategically positioned itself as the de facto infrastructural layer for embedded finance, partnering up with crypto exchanges, fintechs, tokenized RWA providers, global institutional asset managers, and risk curators which help to quickly cement distribution needed to scale. What this means is that Morpho is moving beyond the DeFi interface and capturing user flows right at the point of custody which abstracts away the complexity of navigating onchain lending closing the UI gap with accessing traditional banking yield products.

Key Partners of Morpho:

• Coinbase — Routing $2.17B+ in USDC through Morpho; built a native yield product for retail users on Morpho (acting as a distributor funnelling users into Morpho-powered vaults curated by Steakhouse Financials)
• Apollo Global Management — 48-month agreement to acquire up to 90M MORPHO tokens (9% of total supply); strategic institutional credit validation
• Bitwise — Launched its first-ever non-custodial DeFi vault on Morpho
• Ethereum Foundation — Deposited 3,400 ETH into Morpho Vaults
• Société Générale Forge (SG-FORGE) — Eur/USD institutional lending on Morpho
• Kraken, Crypto.com & Gemini — Distribution partnerships
• Anchorage Digital, Taurus, Fireblocks — Partnered with Morpho to enable its institutional clients to access yield on idle balances

Future Outlook

With more than 25% of Morpho active loans (~$1B) originating from enterprise integrations using Morpho as backend infrastructure, the momentum is clear: leading asset managers, fintechs are moving beyond passive experimentation and structurally embedding themselves into DeFi infrastructure. At the epicenter of an ongoing structural shift in how credit is structured, Morpho has successfully evolved from a simple yield optimizer into the most resilient and scalable base layer. The TAM for onchain lending is vast with Mckinsey reporting a $2T private credit market in traditional markets. Beyond private credit, the rapid adoption of tokenized RWA also has ripple effects on lending, unlocking new forms of capital efficiencies previously inaccessible and costly prime brokerages. Morpho is uniquely positioned to capture the multi-trillion-dollar convergence of traditional finance and onchain credit and we are excited to be a part of Morpho’s journey in the latest funding round!

Stablecoins have moved from being a crypto-native use case into one of the most contested payment infrastructure markets in fintech. Stablecoin adoption has accelerated meaningfully, with total supply rising by more than 56% since the start of 2025 to reach $322 billion. At the same time, annualized adjusted stablecoin transaction volume in 2025 reached $ 10.79T, almost doubling 2024’s volume and rivalling traditional payment rails like Visa and Mastercard. While stablecoin utilities need no further validation in real world payments, it is premature to think the industry has reached its prime. Just looking at global B2B payments today, the number stands at roughly $1.6 quadrillion which is 149x larger than today’s stablecoin volume. Beyond stablecoins, CBDCs, tokenized deposits, interbank settlement networks, and institutional blockchain payment rails are all converging around the same objective: modernizing how money moves across borders, institutions, merchants, and consumers. Therefore, modernizing legacy financial infrastructure has been a key funding theme since 2025 with a significant amount of capital being deployed across various infrastructural stacks of blockchain payments such as: blockchain, fiat/crypto on/off ramp, wallet infrastructure, payment processing, and card infrastructure. Funding for blockchain payments has also reached close to $4B over the past year. However, the uneven distribution of capital highlights that the battleground of blockchain payments is gravitating toward those who control distribution, possess regulatory edge, and establish strategic market positioning that form durable competitive moats.

Capital Allocation Over The Past Year

The first major funding cluster is stablecoin settlement and payouts. This category attracted $1.29B in equity funding over the past year across 23 deals, the most within the payment industry accompanied by the fastest annual growth of 437.9%. This is important because settlement and payouts are where stablecoins become practical payment infrastructure. Companies in this category include Bridge, Ripple, Circle, ZeroHash and 1Money Network which help users and businesses move money across borders, pay suppliers, while managing fiat-to-stablecoin conversion in the backend. This is also an area that continues to rapidly scale led by meaningful acceleration in cross border B2B stablecoin flows. Volumes have surged from $100M per month in early 2023 to around $6B per month in 2025 and now takes up 60% of the global stablecoin payment volume although penetration rate of global B2B payment volumes remains in its infancy.

The second-largest funding category is blockchain interbank payment, which raised $703 million over the past year, up 116.9% year over year across 7 deals. This segment reflects growing interest from banks and financial institutions in settlement networks for tokenized assets. Companies in this category include Digital Asset, Fnality, R3, Partior. Unlike retail-facing networks, interbank payment infrastructure focuses on liquidity movement, and bank-to-bank transaction efficiency. Platforms such as Partior are being used by banks for 24/7 atomic settlement of tokenized commercial bank money, multi-currency liquidity management, and FX settlement. The deal count is smaller, but the funding per deal is high, suggesting large institutional investment into institutional-grade blockchain that does not overlap with retail-facing blockchain networks.

The third-largest category is fiat-backed stablecoins, which raised $670.65 million over the past year across 13 deals, although the segment declined 68.2% year over year. This does not mean fiat-backed stablecoins are becoming less important. Rather, it suggests that pure issuance is becoming more mature and concentrated. Issuers such as Tether, Circle, Paxos, and Ripple benefit from scale, trust, liquidity, regulatory positioning, and reserve economics. New entrants can still emerge, and the opportunity remains vast in non-USD stablecoins, but competing as a fiat-backed issuer requires addressing a multitude of factors such as licensing and regulatory costs, banking and custodian relationships, robust compliance program across jurisdictions, exchange listing, and distribution that can make barrier to entry high for smaller players.

Where The Next Funding Wave Is Headed To?

The Fastest Growing Funding Segments

The fastest-growing segment is stablecoin settlement and payouts, with 437.9% YoY funding growth. This is the clearest signal that investors are moving downstream from stablecoin issuance into real payment workflows. The reason is that settlement and payout platforms sit closest to revenue-generating use cases. Revenue source is diverse and can consist of transaction fees, FX spreads, withdrawal fees, treasury management fees, and account fees etc. Value accrual grows exponentially as more fintechs, marketplaces, corporations, SMB integrate stablecoin infrastructure into their backend, allowing these stablecoin infrastructure companies to ride on the volumes of their customers. These companies also gain a defensible distribution moat as switching costs post-integration compounds over time.

The second-fastest-growing segment is crypto payment processing, with 253.8% YoY funding growth. Companies in this market help merchants to accept, process and convert stablecoin payments. They provide APIs, plugins, point-of-sale systems, and card issuance infrastructure enabling legacy payment infrastructure to support digital payments. Within this segment, crypto card issuers and program managers have seen rapid adoption due to credit and debit cards being one of the most used payment methods at in-store point-of-sale (POS) globally. Their revenue is also diversified comprising of transaction fee, FX fee, network incentive (Visa or Mastercard), and interchange fees. Similar to stablecoin settlement and payout, revenue scales exponentially as volume grows and switching cost builds over time. Players like Reap and Rain are full stack card issuers, differentiating themselves from other players by having principal membership at Visa/Mastercard, enabling them to act as BIN sponsors and increase revenue.

The reason this segment is growing quickly is that payment processing is where stablecoins connect to merchant acceptance. Visa’s head of crypto, Cuy Sheffield, has noted that there is still no stablecoin “merchant acceptance at scale,” and that stablecoin companies still need to connect back into existing acceptance ecosystems if they want real customer usage. This explains why card networks, payment processors, and stablecoin infrastructure companies are increasingly converging. Therefore, the fastest growth is likely to accrue to companies that abstract away the underlying technical complexity and enable seamless integration into existing merchant systems.

The third-fastest-growing segment is CBDC development, with 134% YoY funding growth. While not considered stablecoin because CBDCs are sovereign-backed and issued only by central banks, funding of CBDCs still matters because CBDCs and stablecoins are part of the same broader competition over digital money infrastructure. CBDC-related funding comes as central banks race to preserve the value of central bank currency and optimize interbank settlement. CBDC efforts by central banks also serve to homogenize credit risk and guarantee 1:1 redemption without the volatility of fiat-backed stablecoins.

However, CBDC development is unlikely to replace private stablecoins in the near term. CBDCs are usually slower to deploy, more politically sensitive, and dependent on government timelines. Stablecoins, by contrast, are already circulating across public/private blockchains, exchanges, fintech apps, and payment platforms. The more likely future is coexistence: CBDCs may play a role in retail or wholesale settlement, while private stablecoins remain relevant for cross-border payments, offshore dollar access, crypto markets, and fintech distribution.

From a global lens, CBDCs have only officially launched in Jamaica, Bahamas, Nigeria, and Kazakhstan with many countries still actively in research, proof of concept or pilot phase, underscoring potential for accelerated growth in this area.

Originally published at https://medium.com on May 24, 2026.

Macro

April marked a month where risk-on capital re-entered the market despite headlines still being dominated by the Iran war as investors increasingly came to terms with a future defined by heightened geopolitical conflicts and repositioned their capital for the new normal. Equity markets surged with the S&P 500 rising 10.4%, Nasdaq up 15.3%, Dow Jones up 7.1%. Globally, the MSCI Asia Pacific Ex Japan index rose 15.1%, while the MSCI Emerging Market gained 14.7%, largely driven by a rebound in capital inflows led by the tech sector as investors recalibrated their attention to the fundamental demand for AI hardware and services that remains even as the Iran war rages on. Evidently, investors have looked beyond geopolitical tension to consider other fundamental factors such as corporate earnings which led to a repricing of the stock market.

In crypto, the total market capitalization also expanded with 8.08% to $2.54T as investors’ sentiment shifted from fear to neutral. Institutional capital redeployed into Bitcoin ETFs which drew in close to $2B, fuelling a price growth of 11.83%. ETH ETFs also ended its consecutive monthly outflows since the start of the year with a net monthly inflow of $356M in April, driving a price growth of 7.2% for Ethereum. Liquidity remains concentrated among BTC and ETH, as concerns over delay in CLARITY ACT and a slew of major DeFi exploits posed headwinds for the altcoin sector in April. As altcoins euphoria long faded into the background, the passage of the CLARITY ACT, regulation under a more accommodating SEC and CFTC could bring back altcoin optimism soon specifically for DeFi and blockchain infrastructure tokens.

Bitcoin

Key Theme: Institutional Accumulation and Productive Yields Unlock for Users

Strategy acquired 56,235 BTC in April, bringing its total holdings to 818,334 at an average BTC cost basis of $61,814.

Institutions’ appetite to unlock Bitcoin’s productive use case grew in April. Mezo launched Mezo Prime, a Bitcoin yield product aimed at institutional clients of Anchorage Digital with custodian-level security. As a start, Bullish deposited 250 BTC into the vault. On the retail side, Coinbase has also expanded its Bitcoin-backed loan service to the UK, enabling loans of up to $5M at a LTV of 86%. Its loan service has originated more than $2.17B in loans since its inception, underscoring the productive utility of Bitcoin as a collateral.

Why it matters: Holding BTC is becoming increasingly capital inefficient for investors as Bitcoin can be used as a collateral for lending and borrowing, staked, added as a liquidity pair providing additional yields (interests, swap fees, protocol revenue etc) beyond just capital appreciation.

Ethereum and L2s

Ethereum TVL declined in April dragged down by the KelpDAO exploit, the largest loss recorded in the industry this year. This briefly drove utilization of the WETH pool on Aave Ethereum to 100% with over $5.4B in panic-driven withdrawals within hours of the exploit. Impact was quickly contained as Aave led its recovery effort, DeFi United, which has now raised more than $325M, enabling full repayment of bad debt.

Why it matters: The speed of containment and recovery efforts shown in this incident highlighted the scale and fundamental role of Aave which has originated more than $1T in loans since inception and remains tightly integrated within the ecosystem.

Ethereum Performance:

Source: artemis.xyz, DeFi Llama

Notable L2 Developments:

MegaETH: The launch of Aave on MegaETH alongside an incentivized campaign has once again drove volumes of deposit on the network with TVL of MegaETH significantly increasing from $98.9M to $305.44M within 2 days. Correspondingly, native megaETH stablecoin, USDm, has also surged to more than $271M over the same period as lending yields for USDm stands at 5.12%.

What to watch: While USDm’s deposit base appears meaningful, Aave incentives have historically played a major role in attracting liquidity. The key question is whether this liquidity can be retained once the incentive campaign ends, and whether USDm can build traction on other chains with deeper and more active ecosystems. For context, the 10th-largest stablecoin currently (USDG) has a circulating supply of approximately $2.45B, and all top 10 stablecoins today are multichain in nature.

Base: TVL on Base expanded by 9.57% MoM fuelled by the growth of Morpho which saw minimal impact from the Kelpdao exploit. Partnership with Coinbase via Coinbase crypto loan service and its expansion into the UK has also attracted fresh liquidity from a new set of users. Base announced a 2026 roadmap focusing on tokenized RWA and payments. For context, adjusted stablecoin transaction volume on Base has surged 43.3% MoM, bucking the decline in transaction volume seen in its competitors. It also announced Azul Upgrade set to be completed on 13 May, introducing multi-proof security, higher transaction throughput and withdrawal timeline.

Key Theme: Privacy and Institutional Accumulation

Institutional Accumulation: Ethereum Foundation sold 20,000 ETH to Bitmine Immersion over a span of 2 consecutive weeks as it sought to fund its ecosystem development and core operations. Bitmine Immersion added more than 346,000 ETH in April, bringing its total ETH holdings above 5M.

Privacy: Aztec launched its alpha network as Ethereum’s first L2 for private smart contracts. Optimism’s privacy SDK sunnyside, using ZK and TEE technology also went live on mainnet, enabling confidential computing for enterprises on OP stack.

DeFi

After hitting a peak in cross-chain volumes in October 2025 recording $39.3B, monthly cross chain volume has declined ever since. The downtrend reversed in April as monthly volume rebounded for the first time with $16.4B in cross-chain volume processed. Solan<>Ethereum corridor remains the most liquid pathway for USDC CCTP flows. Meanwhile, USDT0 most liquid pathway is Ethereum<> Plasma.

April also marked the roughest month for DeFi as the sector experienced 2 major exploits (Drift, KelpDAO) that constituted more than 90% of the $630M lost in April, the highest loss since February 2025.

USDC Flows

Source: usdc.range.org

USDT Flows

Source: https://analytics.usdt0.to/pathways

Rapid Growth of Non-USD Stablecoins

Euro stablecoins

EURC expanded its circulating supply by 3.26% MoM while transaction volume grew to its highest level, processing ~$75B in April. The growth in topline volume is supported by an increase in holder count and transaction count which both recorded historical highs, underscoring the growing relevance and usage of euro stablecoin.

• Germany’s AllUnity expands MiCA-compliant EURAU euro stablecoin to Solana as euro stablecoin market doubles since early 2025.

Yen-pegged stablecoins

• JPYC, regulated yen-pegged stablecoin, has crossed $100M in volume on Polygon, establishing the chain as the dominant network for yen stablecoins.

Korean won-backed stablecoin

• South Korea’s Shinhan Card partners with Solana Foundation to pilot real-world stablecoin payments and explore DeFi-based services.
• MoonPay Korea partnered with Woori Bank to launch won-backed stablecoin.

Why it matters: KRW accounted for nearly 30% of all spot volumes in 2026, behind only USD. Given the high popularity of crypto trading among retail traders in Korea, a won-backed stablecoin supported by banking institutions and distribution partners could quickly gain traction and rival that of USD-denominated stablecoins.

Hong Kong stablecoins

• On 10 April, the HKMA granted stablecoin licenses to HSBC and a joint venture by Standard Chartered, marking the country’s first approvals since the stablecoin regime came into effect in August 2025. The launch is expected in 2H 2026, with the HKD-pegged stablecoin being used for cross-border transactions and local use cases.RWA

RWA

Onchain venue continues to gain appeal as a popular destination for price discovery. HIP-3 and Lighter volumes of RWA perpetual open interest reflected the shifting market sentiment as growing optimism over a temporary truce in Iran war led to a decline in commodities open interest with open interest in equities overtaking it by the end of April as the largest share of RWA OI.

Key Theme: Institutional Entry into Tokenized Stocks

Key Developments:

• Ondo lists tokenized stocks on 360X, Deutsche Börse-backed platform with Clearstream custody, marking major European institutional integration.
• Ondo partners with Broadridge to enable governance, voting, and investor communications for tokenized stockholders.
• Computershare taps Securitize to tokenize thousands of US company stocks on Wall Street with Issuer-Sponsored Tokens.

Why it matters: Integration of tokenized stocks into institutional platforms is the clearest sign of adoption. Ondo’s partnership with 360X allows professional and institutional investors to gain access to tokenized stocks. Its integration with Broadridge closes the gap between traditional equity and tokenized equity which often surrounds the issue of shareholder rights since holders of tokenized stocks are now able to participate in onchain voting with verifiable onchain records through Broadridge’s ProxyVote platform. Computershare partnership with Securitize marks a major signal that adoption is going to be institutionally driven because Computershare is the largest transfer agent for 58% of S&P 500 companies and by partnering with Securitize, the institutional entry barriers to tokenized stocks just got signficantly lowered.

Stablecoins and Payments

Stablecoin market supply continues to expand recording 1.35% in MoM growth. However, adjusted stablecoin transaction volume declined by 14.38% MoM due to DeFi exploits and cautious market sentiments.

Key Theme: Agentic Payments Led by Institutional Adoption and Distribution

Notable Developments:

• Circle launched nanopayments on mainnet.
• OKX launched Agent Payment Protocol.
• MoonPay launches stablecoin debit Mastercard for AI agents, enabling autonomous spending from onchain wallets without human approval loops.
• Tether-backed Oobit rolls out virtual Visa cards for AI agents to spend USDT without human approval on every transaction.
• Lighter enables AI agents to trade on platform with paper trading engine compatible with Claude Code and Codex.
• Binance Wallet launches Agentic Wallet allowing AI agents to trade, set limit orders, and manage assets with zero service fees.
• Gemini rolls out agentic trading, allowing users to connect their LLMs to trading account using MCP.
• Stripe launches Link wallet for agents enabling secure autonomous spending with user approval requirements.

Why it matters: Institutional adoption brings the retail adoption needed for agentic payments to scale. Protocols like MPP and x402 need to first be supported by sellers, wallets, exchanges and payment providers before the end users can indirectly access it under the hood. Agentic payment is still nascent but as distribution expands, usage and adoption will scale exponentially as AI products have been proven to have high adoption and retention rates.

Upcoming Events and Unlocks in May

Earnings Calendar

May 5: Strategy Q1 2026 earnings report

May 7: Coinbase Q1 2026 earnings report

May 11: Circle Q1 2026 earnings report

Week of May 11: CLARITY Act is expected to enter the markup stage; Circle releases its Q1 earnings report

Notable Token Unlocks

Ethena: 2.12% unlock on May 5, approximately $18.36 million
Space and Time: 23.20% unlock on May 8, approximately $6.10 million
Babylon: 7.86% unlock on May 10, approximately $2.81 million
Linea: 5.05% unlock on May 10, approximately $4.97 million
Peaq: 4.04% unlock on May 12, approximately $1.51 million
Pyth: 36.96% unlock on May 19, approximately $105.96 million
Huma Finance: 20.04% unlock on May 26, approximately $10.03 million

Originally published at https://medium.com on May 13, 2026.

Quarterly Research 2026.04

Authors: Chaltan Wang, Zeqing Guo
Contact: chaltan.wang@hashkey.com, guo.zeqing@hashkey.com

In Q1 2026, the crypto market entered a recovery phase after deleveraging, with ETF inflows stabilizing prices, but it remains in early re-accumulation rather than a new bull market.

BTC pricing is increasingly driven by ETF flows and global risk appetite, behaving like a high-beta tech asset, with the recent rebound led by spot buying and short covering.

This structural shift is extending to the primary market, where capital is moving from narratives to cash flow and compliance, concentrating in infrastructure sectors like payments and RWA.

Key Takeaways

The crypto market spent Q1 2026 recovering from a difficult start.

BTC went through the familiar cycle of macro scare, forced deleveraging, then a gradual recovery. From January through February, risk appetite collapsed across tech and crypto alike, and derivatives liquidations made things worse. By March, ETF inflows resumed, prices stabilized, and BTC bounced into a trading range around $76,000. This is not the start of a new bull market. Rather, it is closer to an early post-deleveraging recovery phase, where the worst of the selling pressure has likely passed, but meaningful new conviction capital has not yet returned at scale.

A key development this quarter is that the pricing logic of the crypto market has shifted.

ETF flows now matter more than any on-chain metric for short-term price action. BTC increasingly trades like a leveraged tech stock. Its correlation with the Nasdaq has been climbing all quarter. That means BTC is less about crypto-native cycles now and more about where global risk appetite sits. Recovery from here depends on structural improvement, not a liquidity flood.

At a structural level, two developments took place in parallel.

First, ETF money came back and became the single most important source of marginal buying. The market shifted from trade-driven to allocation-driven. Second, derivatives markets rebuilt in a healthier way. Open interest recovered while funding rates stayed low or negative, and perpetual CVD turned positive. That combination suggests the rally has been led by spot buying and short covering, not overleveraged longs piling in. On-chain data tells a similar story: outflows slowed, short-term speculators got flushed, and loss conditions improved, though long-term capital has not returned at scale. Taken together, these factors suggest that the market has a foundation for a gradual upward recovery, although a rapid breakout remains unlikely in the near term.

This shift in the secondary market is filtering directly into the primary market, which is going through its own reckoning.

Fewer projects are getting funded, but total capital has held steady or grown slightly, meaning average deal sizes have nearly doubled. Capital is shifting away from broadly dispersed early-stage experimentation toward more concentrated mid-to-late-stage investments. The investment thesis has flipped from narrative-first to cash-flow-first: compliance pathways, real revenue, actual business models. This lines up with what is happening on the secondary side, where institutional capital now demands certainty over hype.

At the sector level, capital is increasingly concentrating in infrastructure segments with financial characteristics.

Stablecoin payments and RWA (real world assets) are the two standout themes, covering on-chain money movement and on-chain asset hosting respectively. Prediction markets emerged as one of the most notable growth segments, expanding from almost no primary-market presence to $157 million in funding. Meanwhile, AI+Crypto, Gaming, and L2 sectors have cooled sharply. The market has lost patience with projects that have narratives but no users or revenue. Traditional financial players are accelerating their entry through strategic investments and M&A, further reinforcing a valuation framework built around compliance and cash flows.

To sum up where we are: the crypto market is in a transition from volatility-driven narrative cycles to something more institutional and capital-allocation-driven.

The secondary market has cleared most of its risk through deleveraging, creating conditions for long-term capital to re-enter. The primary market is converging on a value system that rewards business fundamentals and compliance. Over the next quarter or two, if ETF inflows broaden, on-chain flows turn positive, and holding structures improve, the secondary market could shift from recovery into a proper uptrend. On the primary side, payments and RWA infrastructure should keep attracting capital and maturing. Those two dynamics together are likely to define the next phase.

Contents

Crypto Secondary Market

• Market Review: Decline, Deleveraging, Then Recovery
• Market Sentiment: Bullish and Bearish Sentiments Coexist
• Trend Characteristics: Institutionalization and Risk-Asset Convergence
• Market Outlook: Gradual Recovery with Range-Bound Uptrend
• Investment Strategy: Early Positioning with Risk Constraints

Crypto Primary Market

• Market Overview: Fewer Projects, Concentrated Capital
• Sector Stories: Abandoning Narratives, Embracing Cash Flows
• Investor Landscape: Ecosystem Building Replaces Narrative Betting
• Top Ten Financings This Quarter
• Investment Judgment: Market Self-Purification, Accelerated Bubble Clearing

Crypto Secondary Market

(1) Market Review: Decline, Deleveraging, Then Recovery

In the first quarter of 2026, global capital markets were characterized by pressure on risk assets, strength in commodities, and the weakening effectiveness of traditional diversification. Specifically, after deleveraging and risk release, Bitcoin (BTC) fell by approximately 25% in the quarter; the stock market also performed weakly, with the S&P 500 index recording approximately -5%; bond assets were also suppressed by rising interest rates, resulting in a lackluster performance, with the US composite bond index falling by about 2%. In contrast, commodities became the biggest highlight of the quarter, with crude oil surging by 70% driven by geopolitical conflicts and supply shocks, while gold, as a safe-haven asset, rose by approximately 8%.

From a broader perspective, asset performance this quarter was driven primarily by the macro environment rather than by asset-specific fundamentals, and this was reflected in three key features: First, uncertainty surrounding interest rates and inflation suppressed valuations, putting pressure on both stocks and bonds, undermining the traditional diversification framework based on the negative correlation between equities and bonds; Second, supply shocks driven by geopolitical conflicts pushed up energy prices, making commodities the only asset with significant positive returns; Third, BTC’s attributes as a high-beta risk asset were further strengthened, exhibiting higher volatility and larger drawdowns than stocks during periods of declining risk appetite and deleveraging, but recovering in March as funds returned.

BTC prices in Q1 2026 followed a textbook path: drop, deleveraging, then recovery.

January and February were rough. Uncertainty around the Fed’s rate path combined with a selloff in AI and tech stocks pressured all risk assets. BTC moved in lockstep with tech, behaving like a high-beta equity. Derivatives liquidations amplified the decline, and by February, BTC was in a forced-selling phase.

By March, the deleveraging had mostly run its course. Spot ETF inflows resumed, and BTC bounced to around $76,000. The rebound was modest and did not reclaim previous highs, but the market had clearly shifted from one-way selling into a trading range.

(2) Market Sentiment: Bullish and Bearish Sentiments Coexist

Jane Street Faces Market Manipulation Allegations. In February 2026, the Wall Street Journal revealed that Jane Street, a well-known quantitative fund on Wall Street, was facing a major lawsuit. It was accused of using insider information to preemptively trade and seek discounted bottom-fishing, thereby accelerating the collapse of the Terra ecosystem, which was worth up to $40 billion, and contributing to the “winter” in the global cryptocurrency market in 2022. Jane Street subsequently denied all allegations. Following the lawsuit against Jane Street, the cryptocurrency community pointed out that after the lawsuit, the daily 10 AM drop in the secondary Bitcoin market over the past few months suddenly stopped and was followed by a period of significant price increases. As a result, parts of the crypto community further speculated that there may have been a connection between the “10 AM drop” pattern and Jane Street, and that the firm may have exerted downward pressure on crypto prices. Although the current allegations lack substantial evidence, considering that Jane Street was previously sued by regulators for manipulating the Indian derivatives market, the subsequent developments are worth watching.

MicroStrategy Continues to Buy Bitcoin. In July 2025, MicroStrategy launched a new financing instrument, STRC, whose core feature is a floating dividend yield that is adjusted monthly, helping keep its market price close to its $100 par value. MicroStrategy hopes to attract conservative funds seeking fixed income through this product.

Starting in 2026, MicroStrategy’s fundraising through STRC began to grow rapidly. Based on SEC 8-K filings and ATM limits, STRC fundraising in the first quarter of 2026 could ultimately reach $2.5 billion to $3 billion, exceeding the total cumulative fundraising amount of STRC from its launch in July 2025 to the end of 2025. Simultaneously, MicroStrategy began large-scale Bitcoin purchases. Since Bitcoin fell below $90,000 in February, MicroStrategy has purchased $3.3 billion worth of Bitcoin, and on March 9th and March 19th, it disclosed two purchases totaling $2.8 billion in Bitcoin — a move the cryptocurrency community considers a major driver of Bitcoin’s rebound.

Max Pain at the $75,000 Strike. Max Pain is a concept in the options market, referring to the price at which the most option buyers (whether bullish or bearish) suffer the greatest loss at expiration, and in other words, the price at which option sellers (usually market makers) suffer the least loss. In BTC options contracts on exchanges like Deribit (especially those expiring on March 27th), the 75,000 strike price has attracted a massive amount of open interest (OI) — more than 5% of total OI, with a notional value exceeding $1 billion. The market is currently watching this strike level closely. Whether the market moves higher or lower, volatility around this level may be amplified; once the price breaks meaningfully above or below it, market makers’ hedging activity could trigger a significant one-sided move.

(3) Trend Characteristics: Institutionalization and Risk-Asset Convergence

ETF capital as the dominant market force. The biggest change this quarter is that ETF capital now sets the tone. Unlike past cycles driven by retail and trading flows, price action today depends heavily on institutional allocation decisions. ETF flows traced a V-shape in Q1: inflows slowed or reversed during January-February as BTC dropped, then turned positive again in March, supporting the recovery. ETFs are no longer just a capital channel. They are effectively the anchor for market sentiment and pricing.

BTC-tech stock correlation strengthens

BTC is increasingly behaving like a leveraged tech stock.

Under the ETF-dominated regime, institutional investors treat it as a high-beta tech play. In January, tech stocks started showing valuation strain and BTC followed. In February, AI earnings scares and rate uncertainty pulled tech stocks down hard, and BTC dropped with them, triggering the deleveraging. In March, once software sector valuations bottomed and AI panic faded, tech stabilized and BTC recovered alongside it. Throughout the quarter, BTC’s price movements tracked the broader risk-asset cycle closely.

(4) Market Outlook: Gradual Recovery with Range-Bound Uptrend

Based on macro conditions, ETF flows, derivatives positioning, and on-chain data, BTC appears to be in the early-to-middle stages of a post-washout recovery and re-accumulation.

In the near term, conditions support a range-bound bias to the upside. The macro backdrop is not getting worse, ETF money keeps trickling back, and derivatives have restructured. On-chain loss pressure has eased and selling has slowed, which also supports prices holding current levels or drifting higher.

Over the medium term, whether this turns into a real bull market depends on a few things: whether ETF inflows broaden and sustain, whether on-chain capital flows flip positive, and whether holding structures get healthier. If those line up, the market can move from recovery into trend appreciation. If not, we are looking at range-bound drift rather than a major uptrend.

Near-term indicator: macro liquidity (not easing, but no longer tightening)

The macro backdrop affects BTC through three channels: rates, the dollar, and risk appetite. In Q1, inflation and jobs data did not support fast rate cuts, keeping the Fed at restrictive levels. Middle East tensions and higher oil prices pushed the dollar index up, weighing on risk assets broadly. And the AI earnings scare compressed tech valuations, dragging BTC along.

Looking ahead, macro headwinds are easing at the margin. If Middle East tensions persist and oil stays elevated, the dollar will probably stay firm on safe-haven demand and inflation fears, though slowing U.S. growth could bring rate-cut bets back into play. On risk appetite, the most likely path is a gradual, selective recovery. Markets will add risk exposure incrementally, not go all-in like 2025.

Near-term indicator: ETF net flows (the main support for recovery)

ETF capital drove this recovery.

But it is recovery money, not new-trend money. Starting in March, ETFs logged consecutive days of net inflows, meaning institutional demand has picked up meaningfully and deleveraging pressure has eased. That said, the pace is still well below typical bull-market levels, and flows are concentrated in a few products (mainly IBIT) rather than spreading broadly.

Going forward, ETF flows will most likely stay net positive, but shift from steady recovery to more uneven, choppy inflows. There will be bouts of profit-taking and macro disruptions, but as long as prices hold and the macro does not deteriorate sharply, the foundation for continued inflows remains intact. ETF flow direction is the most important signal for whether the market can sustain a medium-term uptrend.

Near-term indicator: derivatives structure (from deleveraging to healthy rebuild)

Derivatives went through a full cycle in Q1. January: open interest stayed high, but funding rates kept falling, a sign that long momentum was fading. February: risk appetite collapsed, open interest contracted fast, perpetual CVD went deeply negative. Classic deleveraging. March: spot ETF buying resumed, open interest recovered, perpetual CVD flipped positive, but funding rates stayed negative, meaning shorts are still crowded.

The current derivatives structure looks like a healthy post-washout rebuild. Open interest is rising again, so leverage is coming back. Funding rates are negative, so shorts remain crowded. And perpetual CVD has strengthened, meaning active buying is picking up. This adds up to a rally driven by spot buying and short covering rather than overheated longs. Compared to a long-crowded structure, this is healthier and more likely to produce sustained price appreciation.

Medium-to-long term indicator: on-chain capital flows and holding structure

On-chain indicators traced a clear path in Q1: recovery attempt, pressure release, early re-accumulation. January showed a partial bounce from Q4 2025’s drawdown, but on-chain capital remained weak. February brought genuine capital outflows and holder stress as macro sentiment soured. Since March, short-term hot money has been largely flushed out, and the market is transitioning from deleveraging into re-accumulation.

The on-chain structure supports a range-bound recovery thesis. Over the next two to four weeks, we are broadly bullish: the data is improving at the margin, downside looks limited, and pullbacks are more likely to be bought. Over one to two months, we are cautiously optimistic, watching a few indicators. If Realized Cap Change turns positive, it signals real capital returning. If the STH/LTH ratio drops, long-term holders are becoming dominant. If Percent Supply in Profit and NUPL exit deep-negative territory, the market is returning to profitability. If these improve together, we are heading toward a bull market.

Realized Cap Change will probably keep recovering toward neutral but may not flip positive quickly. ETF and spot demand help slow capital outflows, but the macro is not accommodative enough to pull in large-scale fresh capital yet. If it does flip positive, that would confirm BTC transitioning from recovery to trend expansion.

Hot Capital Share (a proxy for short-term speculative participation) will likely stay low or drift lower. Since March, it has dropped noticeably as speculative capital retreated. That makes a sharp near-term rally unlikely, but it is actually good for the medium term: when new demand eventually shows up, there is less floating supply for sale.

NUPL and Percent Supply in Profit will probably keep improving, but slowly. NUPL measures whether the overall market sits in unrealized profit or loss; Percent Supply in Profit tracks how much BTC across the network is above water. Both improved in March, recovering from extreme pressure, which is typically an early cycle-recovery signal. But moving from deep pessimism to full optimism takes time.

The STH/LTH (short-term holder to long-term holder) ratio may edge lower or stay elevated and choppy before declining. It started dropping from its February peak but is still relatively high, meaning there are still a lot of short-term participants. That keeps prices sensitive and prone to swings. If prices stabilize at these levels, some short-term holdings will age into long-term holdings, improving the supply structure. But if volatility spikes again, the ratio will stay elevated.

(5) Investment Strategy: Early Positioning with Risk Constraints

BTC is most likely in a post-deleveraging recovery and re-accumulation phase. Near term: bullish bias. Medium term: cautiously optimistic. But this is not a full bull market yet. Near-term signals are supportive: macro is no longer deteriorating, ETFs keep seeing inflows, derivatives are restructuring healthily. Longer-term signals are mixed: on-chain outflows are easing and hot money has been flushed, but a new wave of long-term capital has not been confirmed.

The right approach here is not a directional bet. Think of it as layered participation, yield enhancement, and risk management working together.

Layered participation:
on the time axis, spread entry-point risk by using instruments with different maturities (short-term option selling for premium, longer-term directional exposure). On the structural axis, combine spot, options, and structured products to balance upside exposure with income generation.

Yield enhancement:
implied volatility has come down but still sits above realized vol, so selling out-of-the-money puts or building dual-currency / FCN structures can generate meaningful premium income in a rangebound market. On existing holdings, selling moderately OTM covered calls improves total return without giving up too much upside.

Risk management:
the macro is improving but uncertainties have not disappeared. Maintaining some tail-risk hedging makes sense. Far OTM protective puts or limited-loss hedge structures can handle a macro shock or liquidity reversal. The goal in this phase is to participate in the recovery through a combination of directional exposure, short volatility, and tail protection, keeping enough risk budget and return flexibility for when the trend is confirmed, while keeping drawdowns contained.

Our actively managed fund has been incrementally adding to BTC and core asset positions within the range, participating in the recovery while managing drawdowns. We track ETF flows and on-chain capital changes as the main triggers for adding more exposure. In an environment where macro conditions are not yet fully accommodative but market structure has clearly improved, this early-positioning-with-risk-constraints approach lets us stay steady through uncertainty while being able to scale up quickly when the trend gets confirmed.

Crypto Primary Market

(1) Market Overview: Fewer Projects, Concentrated Capital

Project count declined, while capital continued to concentrate in a smaller number of transactions. As of March 31, 2026, we tracked 114 crypto primary fundraising rounds (excluding M&A), down about 31% from 166 in the same period last year. But total funding stayed at $2.37 billion, up slightly by 3.4% year-over-year. Average deal size jumped from $13.9 million to $27.2 million, nearly doubling. Fewer bets, bigger checks. Capital is moving from scattered early-stage experiments toward higher-conviction mid-to-late-stage projects.

The shift shows up in round composition. Early-stage deals (Pre-Seed and Seed) fell from 34.3% of the mix last year to 23.7%. Mid-to-late-stage rounds (Series A through C+) climbed from 11.4% to 16.7%. This lines up with the broader trend of capital concentrating rather than spreading.

Investor bars for getting funded are higher, but when something clears that bar, money moves fast. Both new funds and established firms are more cautious with early-stage projects. But for a handful of validated companies, conviction has never been stronger. Rain raised $250 million in a Series C, Alpaca closed a $150 million Series D, and Tether led 7 consecutive deals totaling over $300 million. All textbook examples of capital concentrating around winners.

The boundary between traditional capital and the crypto industry is fading rapidly. On March 5, OKX announced a strategic investment from Intercontinental Exchange (ICE), the parent company of the NYSE, at a $25 billion valuation. At the same time, Nasdaq announced a partnership with Kraken to build a tokenized stock issuance and trading system. Both moves came from traditional financial infrastructure operators, not the usual asset managers or hedge funds. Something deeper is happening between TradFi and crypto.

Stablecoins and licensing have become the M&A battleground this quarter. Mastercard announced a $1.8 billion acquisition of BVNK to grab its stablecoin payment compliance licenses across multiple regions. Ripple is planning to acquire BC Payments Australia for its local financial services licenses. The message for investors: in stablecoins, the combination of compliance licenses and infrastructure is being repriced upward, attracting far more interest than other primary market segments.

(2) Sector Stories: Abandoning Narratives, Embracing Cash Flows

Stablecoin payments: from talking about it to actually doing it.

Payments was the standout sector this quarter, with funding growing nearly 3x year over year. Deal count doubled from 7 to 14 (excluding M&A), and total funding surged from $106 million to $416 million. Payments went from a side topic to one of the biggest capital magnets in the primary market.

Rain’s $250 million Series C is a milestone. Led by Iconiq Capital, it represents traditional capital formally validating that stablecoin payments can be a real business, not just a proof of concept. Valuation benchmarks are shifting from TVL to actual settlement volumes and compliant assets.

The mid-tier payment deals share a common profile: regional focus and specific use cases. Kast ($80 million Series A, led by QED Investors) targets crypto payment cards in Latin America, North America, and the Middle East. Mesh ($75 million Series C, led by Dragonfly Capital) is building a multi-chain payment aggregation protocol. None of these projects are pitching grand visions of blockchain transforming payments. They have real users in specific markets.

Mastercard and Ripple’s M&A activity has made the stablecoin licensing race visible. On March 17, Mastercard announced a $1.8 billion deal for BVNK, an enterprise stablecoin payment platform processing $30 billion in transactions annually across 130+ countries. Mastercard wants BVNKs multi-regional licenses to enter stablecoin markets worldwide. Ripples plan to buy BC Payments Australia has the same logic: acquiring local payment capabilities. Worth noting: Reap, a HashKey Capital portfolio company, also has enterprise stablecoin payment infrastructure with compliance qualifications in Singapore, Hong Kong, Mexico, and elsewhere.

RWA: institutional capital moves from watching to betting

RWA deal count doubled and funding grew 507% year over year, making it one of the fastest-growing sectors this quarter. Project count went from 6 to 12, with funding jumping from $22.1 million to $134 million. Notably, the new capital came more from cross-sector institutions teaming up with leading crypto VCs, a more robust funding mix than the prior quarter.

Superstate’s $82.5 million Series B is a signal. Co-led by Bain Capital Crypto and Distributed Global, the company (founded by former Compound Finance founder Robert Leshner) is bringing traditional financial products like U.S. Treasuries on-chain. Bain Capital manages roughly $215 billion. When capital of that scale bets on RWA, it suggests institutional perception has shifted from ‘interesting experiment’ to ‘investable trend.’

Nasdaq and Kraken’s partnership adds a new compliance angle to equity tokenization. Nasdaq said it will work with Kraken on a tokenized issuance and trading system for stocks and exchange-traded products. Beyond expanding what counts as RWA, this gives a replicable compliance template for future on-chain equity products.

The investor base in RWA is shifting. Many of the active institutions were known for DeFi and infrastructure in the last cycle but have now turned their attention to on-chain assets. This migration of capital reinforces the mid-to-late-stage shift visible in the funding data.

Prediction Markets: One of the Fastest-Growing Segments This Quarter

Prediction markets went from basically zero primary market presence to $157 million in Q1 funding. That is the most dramatic sector emergence of the quarter. Polymarket’s breakout during the 2024 U.S. presidential election proved on-chain prediction markets have genuine value for information discovery, and that catalyzed this round of funding.

Top VCs are placing collective bets here, which clarifies the competitive landscape. Novig raised $75 million in a Series B (led by Pantera Capital), Bluff closed a $21 million strategic round, and Opinion completed a $20 million Series A. Coinbase Ventures invested in 2 deals, and a16z crypto and Jump Crypto also participated. When that many top-tier firms move into a sector simultaneously, it is consensus, not coincidence.

The product is evolving fast. In Q1, several prediction markets launched ultra-short-term crypto price bets (5 to 15 minutes), attracting retail traders and high-frequency arbitrageurs. These formats stress-test on-chain matching and clearing, and they are starting to reshape how prediction market revenue models work.

Sectors cooling off: AI+Crypto, Gaming, and L2 enter correction

AI+Crypto, Gaming, and L2 are in deep adjustment. The market has become far less tolerant of narrative-driven projects without real users or revenue. AI+Crypto project count dropped from 22 to 8 (down 64%), with funding falling from $134 million to $23 million (down 83%). Gaming went from 11 deals to just 1. L2 contracted from 10 to 1. Valuation anchors for broadly-defined AI and gaming in crypto are shifting downward.

There are still pockets of activity where real demand exists. VeryAI raised $10 million (led by Polychain Capital) for digital identity and content authenticity in the AI era. Kled AI got $5.5 million (led by Aglae Ventures) for AI data markets. The market is narrowing from ‘everything can be AI’ to ‘what actually needs on-chain AI.’

(3) Investor Landscape: Ecosystem Building Replaces Narrative Betting

Tether: the quarter’s largest investor, operating like an industrial conglomerate

Tether topped the most active investor list with $300 million deployed, and the pattern looks more like industrial empire-building than venture investing. Seven deals in a single quarter, versus one deal for roughly $3 million in the same period last year. That pace is beyond what any VC typically does. It looks like systematic ecosystem construction.

The deals tell a story. A $200 million strategic investment in Whop (a digital commerce platform for creators), $100 million in Anchorage Digital (a digital asset bank with a federal banking charter), plus 3 more payment-sector deals. Tether is assembling the pieces of a complete business loop around USDT: payment channels, custodial banking, commercial use cases. Given that USDT daily trading volume already exceeds $10 billion, these are not just financial bets. They are part of a broader effort to strengthen Tether’s competitive moat.

Crypto VCs: collective migration from DeFi to Payments and RWA

The leading crypto VCs have clearly shifted their sector preferences, and they are converging in the same direction.

Coinbase Ventures co-invested in 9 deals this quarter, moving from last year’s DeFi and wallet focus into prediction markets. a16z crypto made a similar move. Animoca Brands shifted from gaming and meme sectors toward DeFi and RWA. When multiple major firms pivot in the same direction at the same time, that is a consensus shift, not a series of independent decisions.

The new consensus is that cryptos next growth engine is real revenue, not new narratives.

Payments, prediction markets, RWA, and trading infrastructure all share common traits: actual revenue, identifiable compliance pathways, and demand for integration with traditional finance. More institutions are evaluating projects through discounted-cash-flow logic.

(4) Top Ten Financings This Quarter

This quarter’s top ten deals collectively illustrate three themes: payments, industrial capital, and late-stage maturation.

Below are the most representative equity financing deals (excluding debt and M&A). They show stablecoin payment infrastructure scaling, industrial capital deploying systematically through strategic rounds, and late-stage rounds (Series C and above) accelerating.

(5) Investment Judgment: Market Self-Purification, Accelerated Bubble Clearing

Looking back at Q1, the crypto primary market appears to be undergoing a process of market cleansing. Bubble projects are getting cleared out faster, while companies with actual products, revenue, and compliance pathways are raising more capital than ever. For investors, this is the transition from narrative-driven pricing to fundamentals-driven pricing. Here are four views on the next two to three quarters.

First, Payments and RWA will be the dominant themes for the next 12 months. Stablecoin compliance is advancing (Europe’s MiCA framework, U.S. stablecoin legislation), traditional asset tokenization is accelerating, and institutional participation is deepening. We expect both sectors to maintain high growth through Q2.

Second, prediction markets deserve close attention, but regulatory risk is real. From zero funding last year to $157 million this quarter, backed by top-tier VCs and inherently consumer-facing, prediction markets could become one of the defining sectors of this cycle. But the regulatory picture is still unclear, and how different jurisdictions classify and regulate them matters a lot.

Third, industrial capital and traditional finance entering the market will reshape competitive dynamics. When Tether deploys $300 million in a quarter and Goldman Sachs starts participating in crypto equity rounds, pure-financial VCs lose their edge. Capital alone is no longer enough. Whether an investor can bring channels, users, and technology integration is becoming the deciding factor for portfolio companies choosing their backers.

Fourth, maturing exit channels will push the crypto VC model toward traditional equity exit structures. BitGos IPO and the notable increase in Series C and D rounds signal that the crypto VC model is shifting from exit via token listing to traditional equity exits. This structural change carries important implications for LP return expectations and investment horizon planning.

Disclaimer

This document has been prepared by HashKey Capital for general information and discussion purposes only. It does not constitute, and should not be construed as, any form of investment advice, legal advice, tax advice, accounting advice or other professional advice, nor does it constitute an offer, solicitation, invitation, recommendation or commitment to purchase or invest in any securities, tokens, fund interests, financial products or investment strategies.

The views, opinions, estimates and projections contained in this document reflect the judgment of the author(s) as of the date of this document only and are subject to change without notice. Any forecasts, targets, outlooks or forward-looking statements are for illustrative purposes only and should not be relied upon as guarantees of future performance or results.

The information contained in this document has been obtained from sources believed to be reliable, including public and third-party sources, but no representation or warranty, express or implied, is made as to its accuracy, completeness, timeliness or suitability. Certain information may be based on assumptions, estimates or market data that have not been independently verified.

Digital assets and related products involve significant risks, including but not limited to extreme price volatility, illiquidity, market manipulation, technological vulnerabilities, custody risks, cyber incidents, legal and regulatory uncertainty, and the potential loss of all principal invested. Past performance is not indicative of future results.

This document is not intended for retail investors and is directed only to persons to whom it may lawfully be communicated. Any investment decision should be made solely on the basis of the relevant formal offering documents, subscription documents and other definitive legal documentation, and only after obtaining independent legal, tax, financial and other professional advice.

Any references in this document to any fund, product, service or strategy managed by or affiliated with HashKey Capital are provided for informational purposes only and should not be regarded as a standalone marketing communication or product recommendation. In the event of any inconsistency between this document and any formal offering document, the formal offering document shall prevail.

HashKey Capital, its affiliates and/or their respective directors, officers, employees or clients may from time to time hold, trade, manage, advise on, invest in, or provide services to any digital assets, securities, funds, issuers or transactions referred to in this document, and therefore may have interests or conflicts of interest in relation to such matters.

This document may not be reproduced, copied, distributed, published, disclosed or transmitted, in whole or in part, without the prior written consent of HashKey Capital.

Contact us

hashkey.capital
@HashKey_Capital
ir@hashkey.com

Chapter 1 | Prologue: A White Paper That Awakened the Industry

1.1 Background: An Unusual Proactive Disclosure

On March 30, 2026, Google Quantum AI published an academic whitepaper titled “Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations.” The paper’s co-authors include Google Quantum AI core researchers Ryan Babbush and Craig Gidney, as well as Ethereum Foundation researcher Justin Drake and Stanford cryptography professor Dan Boneh. Google Research’s blog simultaneously published a public-facing article titled “Safeguarding Cryptocurrency by Disclosing Quantum Vulnerabilities Responsibly,” explaining the motivations and methods behind this disclosure to general readers.

Several aspects of this publication were unusual:

1. First, the release was coordinated with the US government. Google explicitly stated in its blog post: “To share this research responsibly, we coordinated with the US government and developed a novel method of describing the quantum threat through zero-knowledge proofs so that it can be verified without exposing attack vectors for attackers.” This approach was jointly developed by Google and the US government and has been proposed as an industry model for handling sensitive disclosures in the quantum research community.
2. Second, specific attack circuits were deliberately withheld. The research team used zero-knowledge proofs to cryptographically verify their computational results — anyone can independently verify whether the resource estimates are accurate, but the attack path cannot be extracted from them. This indicates that the research team believes quantum computing progress has reached a stage where it is no longer appropriate to publicly publish improved quantum cryptoanalysis details — continued publication would only provide a roadmap for potential attackers rather than advancing defensive action. The signal it conveys is: quantum computing advancement is accelerating and selective disclosure is needed.
3. Third, the time window was internally set before publication. Google had previously announced 2029 as the target milestone for completing post-quantum cryptography migration, and recommended the entire industry adopt this timeline. The white paper’s publication was the public signal of this internal deadline being transmitted externally.

1.2 Core Findings: A Dramatic Reduction in the Resource Threshold

The white paper’s core technical contribution is a new, lower estimate for a critical parameter: how large a quantum computer is needed to break the elliptic curve cryptography protecting mainstream cryptocurrencies?

The paper presents two optimized quantum circuit schemes: one using no more than 1,200 logical qubits and 90 million Toffoli gates, and another using no more than 1,450 logical qubits and 70 million Toffoli gates. At the physical qubit level, both can run on superconducting architectures below 500,000 physical qubits, with the entire computation complete within a matter of minutes. This figure is approximately 20 times lower than the mainstream estimates previously found in academic literature.

Over the past few years, the industry has generally used “requiring millions or even tens of millions of qubits” to maintain psychological distance from quantum threats. This was one of the main reasons many institutions classified quantum risk as a “long-tail” concern. The Google white paper systematically debunked the idealogy.

1.3 Why Investors Need to Redefine This Risk

Quantum threats have long been classified as “long-term tail risks,” a characterization that has led the vast majority of institutions to adopt a “wait and see” approach.

The advancement of quantum computing now requires a repositioning in approach and mental framework:

First, the probability distribution has been updated. White paper co-author and Ethereum Foundation researcher Justin Drake estimates the probability of a successful quantum attack before 2032 is at least 10%.

Second, risk exposure is highly uneven and can be quantified and located. Public key exposure patterns, address reuse history, protocol upgrade capability — these factors determine whether specific positions are in the high-risk range. Google estimates that the top 1,000 Ethereum wallets hold approximately 20.5 million ETH, plus at least 70 administrator-controlled smart contracts (including contracts supporting some stablecoins) have quantum exposure, with total exposed assets exceeding $100 billion. This means quantum risk is already a structural variable that can be quantified and located, rather than an unaddressable systemic black box.

Third, migration involves enormous governance friction and cannot be time-compressed. Migration to post-quantum cryptography is technically feasible but is a complex and slow process, particularly for decentralized networks requiring broad coordination. For protocols with more decentralized governance structures, the social coordination costs required for migration are higher and the cycle is longer — and this means precisely that the chains hardest to upgrade are often those with the most concentrated exposure. Google’s suggested migration completion target is 2029, less than three years away.

1.4 Sieving Through the Noise

Following the white paper’s publication, two starkly different misconceptions emerged in the market, worth addressing here as they represent two typical cognitive traps.

The first is technical panic: spreading “a quantum computer can break a Bitcoin private key in 9 minutes” as a headline, while omitting the prerequisite conditions for this estimate to hold — no machine currently exists with hundreds of thousands of high-quality error-correcting physical quantum qubits. This estimate describes the capability ceiling of some future machine, not today’s reality.

The second is defensive dismissal: citing the argument that “quantum threats would also destroy the entire traditional financial system,” using this to argue Bitcoin would not be uniquely impacted. The white paper directly responds to this logic: centralized systems like banks and military networks can push cryptographic upgrades through software updates, while Bitcoin requires consensus among a decentralized community. The two types of systems face structurally different response speeds to the same technological threat.

The Google research team anticipated both tendencies. The white paper explicitly states: both overstating and understating quantum risk cause harm — overstating undermines public confidence in digital systems, while understating delays necessary security upgrades. Their choice of responsible disclosure methodology was itself an attempt to find a path that accurately transmits information between these two extremes.

The correct way to read this white paper is as a forced upgrade to a probability: the probability of Q-Day occurring, the distributional structure of asset exposure, and the differences in protocol migration capability — these variables have changed from background assumptions that could be temporarily set aside to analytical dimensions that need to be actively incorporated into asset evaluation frameworks.

The following chapters will systematically unpack: what quantum computing can actually break (Chapter 2), why breaking still takes time (Chapter 3), reasonable estimates of the time window (Chapter 4), and the current response progress of major public blockchains (Chapter 5) — with the goal of helping readers understand quantum risk through an analytical framework.

Chapter 2 | Threat Analysis: What Can Quantum Computing Actually Break?

2.1 The Cryptographic Foundation of the Crypto Industry

The security of Bitcoin, Ethereum, and the vast majority of other blockchain projects is built on Elliptic Curve Cryptography (ECC). The core of this system consists of three elements: public keys, private keys, and signatures.

Users hold private keys, from which public keys are derived. Public keys are used to receive funds; private keys are used to send funds. When initiating a transaction (e.g., transferring 1 BTC), the user signs the transaction content with their private key. Any node in the network can verify that the signature comes from the corresponding private key holder, but cannot reverse-engineer the private key from the public key or signature.

This is the foundation of blockchain security: deriving the private key from the public key is computationally infeasible on classical computers. The secp256k1 elliptic curve used by Bitcoin and Ethereum derives its security from the computational difficulty of the 256-bit Elliptic Curve Discrete Logarithm Problem (ECDLP-256).

Quantum computing challenges precisely this critical assumption. Shor’s algorithm can theoretically solve the ECDLP efficiently, making it possible to reverse-engineer private keys from public keys. Once this assumption is broken, all assets with public keys already exposed on-chain will face the risk of theft.

This risk is not a distant future. Currently, approximately 6.9 million BTC worth of public keys have been exposed on-chain — roughly one-third of total supply. Of these, approximately 1.7 million come from Bitcoin’s earliest days (including the Satoshi era), using the Pay-to-Public-Key (P2PK) script format, with public keys directly embedded in transaction outputs, completely exposed. Additionally, address reuse and the 2021 Taproot upgrade (P2TR addresses expose public keys by default) have further expanded the exposure surface. On the Ethereum side, once an account initiates a transaction, its public key becomes permanently visible. Google estimates that just the top 1,000 Ethereum wallets by balance hold approximately 20.5 million ETH, all in an exposed state.

2.2 New Resource Estimates for Quantum Computing

In March 2026, Google Quantum AI, in collaboration with the Ethereum Foundation and Stanford University, published a white paper systematically evaluating the resources required for a quantum computer to break ECDLP-256. This paper attracted widespread attention because barriers to break blockchain security have become far lower than previous academic estimates.

The research team compiled two optimized quantum circuit schemes, both based on Shor’s algorithm to solve ECDLP-256 on the secp256k1 curve. Both circuits can complete their computations on a superconducting quantum computer with fewer than 500,000 physical qubits, within a matter of minutes.

Previous mainstream estimates suggested breaking ECDLP-256 required millions of physical qubits. Google’s results reduce this figure by approximately 20 times. This is the paper’s most core contribution. It means the timeline for the quantum threat will be brought forward.

To prevent attack circuits from being exploited by hackers, Google adopted a special approach to disclosure: the research team did not publish the actual attack circuits but instead released a Zero-Knowledge Proof, allowing external researchers to verify the accuracy of resource estimates without exposing reproducible attack details. Google also coordinated with the US government before publishing the paper.

Google has set its deadline for migrating its own authentication and digital signature services to post-quantum computing as 2029. This means Google expects that after 2029, the current cryptographic foundation will no longer be secure.

2.3 Three Attack Modes

Google’s white paper identifies three attack modes for quantum computing against blockchains.

On-Spend Attack (In-Transit Transaction Attack).

This attack mode has the tightest time window. When a user broadcasts a Bitcoin transaction, the public key is exposed in the mempool. The attacker uses a quantum computer to derive the private key from the public key, signs a competing transaction (with a higher fee), and attempts to complete the substitution before the original transaction is confirmed.

Google’s paper estimates that on a fast-clock superconducting quantum architecture, deriving a private key from a public key takes approximately 9 minutes. Bitcoin’s average block time is approximately 10 minutes. Under ideal conditions, the probability of a quantum computer successfully completing an attack in time is approximately 41%. Although this window is narrow, it is sufficient to constitute a threat.

At-Rest Attack (Static Asset Attack).

This attack targets addresses whose public keys are permanently exposed on-chain, especially dormant wallets. The attacker does not need to wait for new transactions, there is no time window constraint, and computations can be done offline. The aforementioned 6.9 million BTC with exposed public keys (including approximately 1.7 million P2PK Bitcoin from the Satoshi era) and the large number of Ethereum accounts with exposed public keys both fall into this category. If address holders have lost their private keys or cannot operate (e.g., Satoshi’s wallets), assets cannot be migrated to quantum-safe addresses, and the risk becomes unavoidable.

On-Setup Attack (Protocol Parameter Attack).

This is the most far-reaching but least intuitive attack, targeting Ethereum’s cryptographic infrastructure. Ethereum’s Data Availability Sampling relies on the KZG polynomial commitment scheme, which is built upon the Trusted Setup Ceremony completed in 2023. The ceremony generated a secret scalar (known in the industry as “toxic waste”), which was destroyed at the end of the ceremony.

A quantum computer can recover the secret scalar from the publicly released parameters of this ceremony. Once successfully recovered, the attacker obtains a permanent, reusable classical computing vulnerability. Thereafter, without needing to use a quantum computer again, they can continuously forge data availability proofs.

2.4 Which Assets Are Already at Risk

Quantum threats are not uniformly distributed; risk levels vary greatly across on-chain assets on different chains.

Bitcoin:

Approximately 6.9 million BTC (about 33% of total supply) have public keys exposed on-chain. Of these, approximately 1.7 million come from early P2PK scripts (including an estimated 1.1 million from Satoshi’s wallets, distributed across approximately 22,000 addresses); approximately 5.2 million come from address reuse and P2TR (Taproot) addresses. The 2021 Taproot upgrade, while improving privacy and flexibility, exposed public keys by default — quantum threat urgency was not anticipated at design time. Currently, Taproot key-path spending accounts for 60%–80% of P2TR transactions and is the main source of new exposure. The Bitcoin community is already discussing mitigation measures; in February 2026, a new output type proposal called Pay-to-Merkle-Root (BIP-0360) was merged into the official BIP repository, but at the cost of higher fees and privacy degradation.

Ethereum:

Ethereum’s exposure surface is deeper than Bitcoin’s across multiple dimensions. Once an account initiates a transaction, its public key is permanently exposed — Google estimates the top 1,000 high-net-worth wallets alone hold approximately 20.5 million ETH. At least 70 administrator-controlled critical smart contracts (including those supporting stablecoins like USDT and USDC) rely on exposed administrator keys, involving approximately $200 billion in assets. At least 15 million ETH are distributed across major L2 networks and cross-chain bridges; these infrastructure components rely on Ethereum’s built-in cryptographic tools and are equally not quantum-resistant. Adding the aforementioned KZG trusted setup vulnerability, Google’s paper identifies at least 5 quantum attack vectors against Ethereum, with total risk exposure exceeding $100 billion. The Ethereum Foundation has initiated a post-quantum migration roadmap, planning to complete core protocol upgrades before 2029 through 4 sequential hard forks. But upgrading the base layer does not automatically fix the thousands of already-deployed smart contracts — every protocol, bridge, and L2 needs to independently upgrade code and rotate keys.

Beyond this, Bitcoin’s Proof-of-Work (PoW) mining mechanism is not affected by the above quantum attacks. SHA-256 is a symmetric hash function; quantum computers can only halve its effective security via Grover’s algorithm (from 256 bits to 128 bits), which is insufficient to constitute a threat. More critically, 2026 research points out that achieving quantum mining under Bitcoin’s current mainnet difficulty would require an astronomical number of qubits and energy consumption (approximately 1⁰²³ qubits, with power consumption approaching the threshold of a Kardashev Type II civilization). The Bitcoin network can also respond to any change in computing power through difficulty adjustment. Therefore, the core quantum threat to blockchains lies not in the consensus mechanism, but in the signature algorithm — i.e., the elliptic curve cryptography discussed above.

Both the Bitcoin and Ethereum communities are closely monitoring quantum computing developments and actively discussing various solutions. Therefore, the threat of quantum computing to cryptography is manageable, and we believe that quantum-resistant Bitcoin and Ethereum will arrive before quantum computing succeeds. The quantum-resistant upgrade roadmap is presented in Chapter 5 of this paper and is not elaborated here.

Chapter 3 | Technical Foundations: From Physical Qubits to Logical Qubits — Why Breaking Still Takes Time

3.1 The Physical Principles of Quantum Bits

The basic unit of classical information is the bit, which can only exist in one of two definite states: 0 or 1.

• 1 bit：0 or 1
• 2 bits：00,01,10,11

The basic unit of quantum computing is the quantum bit (Qubit), which can exist in a superposition of 0 and 1.

• 1-qubit state: |ψ⟩ = α|0⟩ + β|1⟩
• 2-qubit state: |ψ⟩ = α|00⟩ + β|01⟩ + γ|10⟩ + δ|11⟩

Where α, β, γ, δ are complex probability amplitudes; the square of their moduli represents the probability of measuring the corresponding state, satisfying the normalization condition:

|α|² + |β|² + |γ|² + |δ|² = 1

All particles in the microscopic world can be described in quantum states; therefore different particles can be used to implement logical operations on quantum bits. Common implementations include neutral atoms, photons, charged atoms (ions), and others.

Entanglement is a unique feature of quantum computing that distinguishes it from classical bits and is also the advantage of quantum computing. When 2 qubits are in a specific entangled state, it can be expressed as:

|ψ⟩ = (1/√2)(|00⟩ + |11⟩)

3.2 Quantum Logic Gates and Logical Qubits

Quantum computer logic gate operations apply to all superposition states simultaneously. For example, passing |ψ⟩ = α|00⟩ + β|01⟩ + γ|10⟩ + δ|11⟩ through a NOT gate yields |ψ’⟩ = α|11⟩ + β|10⟩ + γ|01⟩ + δ|00⟩, changing the complex probability amplitudes and phases of the superposition state and thereby indirectly affecting the observed probabilities.

Because quantum states can be represented as superpositions, the number of states representable by multiple quantum bits grows exponentially: 4 qubits can represent 16 states, n qubits can represent 2ⁿ states. In theory, a quantum computer operating with n qubits can simultaneously evolve 2ⁿ states, while a classical computer would need to compute these states 2ⁿ times — achieving a terrifying exponential speedup for specific algorithms and outputs.

In quantum computing, we need to use a series of quantum logic gates to let the system evolve continuously from its initial state. In this process, all possible answers exist simultaneously in superposition, but we cannot directly read out these results because the system continuously exists in superposition. The key is that we can carefully design these logic gates to continuously amplify the “probability amplitude” of the correct answer while gradually canceling out incorrect answers. By operating quantum gates to evolve the superposition state, controlling the probability amplitudes and phases of each state, the probability of the target answer is progressively amplified, enabling the correct result to be obtained with high probability upon measurement.

Quantum states are extremely fragile; any small environmental perturbation will cause decoherence, leading to quantum information loss. To reliably implement quantum computation, information must be encoded using a set of physical bits, which are continuously monitored and errors corrected. Quantum bits record a single signal and are prone to phase errors, state flips, and even data loss, whereas logical qubits are stable communication signals with added error-correction coding.

A simple example: we can use 3 quantum bits bound together, defining logical states 0 and 1 as:

|0L⟩ = |000⟩; |1L⟩ = |111⟩

This way, when one quantum bit undergoes a state flip (e.g., from |000⟩ flipping to |010⟩), we can correct the state. This is the simplest example of repetition code correction; actual logical qubits require more complex entangled states to simultaneously correct both bit-flip and phase-flip errors.

One current mainstream approach is to use surface codes for error correction, requiring d² + (d-1)² quantum bits, where d is the code distance; the larger the number, the higher the reliability. Under this approach, the number of qubits required to implement one logical qubit ranges from tens to thousands.

3.3 The Race Between Four Technical Approaches

The quantum computing field has not yet selected an optimal approach. The main current technical pathways include: Superconducting Qubits; Photonic Qubits; Trapped-Ion Qubits; and Neutral Atom Qubits.

• Superconducting quantum computing’s core idea is to use superconducting circuits to construct quantum systems with discrete energy level structures at macroscopic scales — so-called “artificial atoms” — to implement qubits. The most mature current implementation is the Transmon and its improved charge qubit variants, already engineered and deployed by companies such as Google and IBM.
• The neutral atom approach has recently achieved rapid scaling; optical array scale has grown from tens of thousands to hundreds of thousands within a short period, while stably controlling approximately 6,100 highly coherent physical quantum qubits, approaching the important milestone of the 10,000-qubit scale. Overall, the neutral atom system’s basic physical feasibility has been fully verified; current challenges are concentrated at the engineering and system integration layer, and related solutions continue to advance.
• The trapped-ion approach uses electromagnetic fields to “trap” charged atoms, uses lasers to precisely control their quantum states, and uses common vibrational modes to implement quantum gates. Currently, trapped-ion schemes have also realized approximately hundred-qubit-scale systems, with significant advantages in high-fidelity quantum gates (>99%) and fully-connected structures.
• Photonic quantum computing uses photons as information carriers, implementing quantum operations through photon interference and measurement. It is the only solution that can operate at room temperature and atmospheric pressure. This approach has natural scalability and networking advantages, but two-qubit gates are typically probabilistic processes, and large-scale fault-tolerant logical qubit computation has not yet been achieved.

Among the four main quantum computing technical approaches, superconducting quantum and neutral atom approaches are overall in the leading positions. Superconducting quantum computing, leveraging mature semiconductor manufacturing processes, has significant advantages in device fabrication, system integration, and scaled engineering capabilities — it is currently the most engineered technical approach closest to practical application. Neutral atoms demonstrate superior scalability and system purity at the physical level, with potential to achieve large-scale qubit arrays, and have made substantive progress on programmable multi-qubit systems. In comparison, the other two technical approaches, while having differentiated advantages on specific performance metrics, still have certain gaps in system scale, engineering maturity, and application transfer capability.

3.4 Frontier Investment and Progress

Over the past three years, the world’s leading quantum hardware companies have completed an intensive round of financing — valuations ranging from hundreds of millions to tens of billions of dollars, backed by institutions including BlackRock, Temasek, and NVIDIA. The entry of these sovereign funds and strategic investors signals that uncertainty in this track has been reduced to a level institutions can accept.

In 2024–2025, the technical frontiers of quantum hardware were densely breached — Google Willow first experimentally demonstrated that error correction falls below the threshold, Caltech achieved 6,100 highly coherent qubits, Harvard/MIT advanced neutral atoms to the level of programmable logical qubit processors. These milestones are not isolated academic results; they are the technical basis for capital bets and the foundation for the next round of valuation repricing.

3.5 Existing Challenges

Decoherence & Noise

Quantum bits are extremely fragile; any small environmental perturbation (such as temperature changes, electromagnetic waves, or even cosmic rays) will cause the quantum state to collapse, a phenomenon called decoherence.

• Extreme low-temperature requirements: Superconducting qubits typically need to operate at 10mK (near absolute zero).
• Fidelity bottleneck: Although current qubit gate operation fidelity can reach 99.9%, for complex long-path computations, errors accumulate rapidly, causing computation results to become random noise.

The High Overhead of Error Correction

Because quantum bits are unreliable, we need many quantum bits to “protect” one logical qubit.

• Bit redundancy: According to current Surface Code theory, achieving one high-performance logical qubit may require tens to thousands of quantum bits.
• Computational overhead: Real-time detection and repair of errors requires extremely high computing power and extremely low latency, posing tremendous challenges for control circuits. The “break-even point” (logical qubit quality exceeding physical bit quality) is the industry’s top challenge.

Scalability & Connectivity

Even if we can create 1 perfect logical qubit, solving practical problems (such as breaking encryption or simulating drug molecules) may require thousands or tens of thousands of logical qubits.

• Wiring challenges: In superconducting systems, tens of thousands of cryogenic cables cause refrigerator volume to explode.
• Full-connectivity challenge: Although trapped-ion and neutral atom approaches have high fidelity, enabling entanglement (interaction) between qubits separated by greater distances is a tremendous physical challenge.

Control Hardware Precision and Speed

Quantum computing is not just a quantum chip problem; it also requires an extremely complex set of classical electronic equipment to control.

• Microwave/laser precision: Nanosecond-level precise pulses are needed to control bits. As the qubit count increases, how to synchronously control thousands of laser beams (e.g., optical tweezer arrays) or microwave channels without interference is an enormous engineering challenge.
• Readout speed: The speed of reading quantum states must be faster than the decoherence speed, making extremely high demands on high-sensitivity detectors.

These four challenges compound each other, constituting a composite engineering barrier. Decoherence forces the system to introduce error correction; the high overhead of error correction raises the required physical qubit count; scale expansion triggers bottlenecks in connectivity and control systems — every hurdle must be cleared simultaneously. This is precisely why Google’s white paper reducing the physical qubit count required for an attack from millions to 500,000 is an important milestone, but 500,000 high-quality, error-correctable, stably operating physical qubits remain an engineering barrier that has not yet been crossed in today’s reality. Understanding the structure of this barrier is a prerequisite for understanding why the timeline in Chapter 4 remains debated — yet is also continuously narrowing.

Chapter 4 | Timeline Assessment: How Much Time Do We Have?

4.1 Current Quantum Capability vs. Threat Threshold: A Gap That Is Rapidly Narrowing

Understanding the timeline requires understanding two curves: the resource threshold required for an attack, and the resource scale that hardware can actually provide. The distance between these two curves is the time left for the industry to prepare.

Note: The table’s second row notes that the ~25x “logical qubit gap” is misleading because both sides define “logical qubit” differently. This is a critical analytical point: the paper correctly flags this definitional inconsistency. The first row (physical qubits, ~250–500x gap) is the more rigorous comparison. Readers should rely on the physical qubit comparison for investment analysis.

Threat Threshold — The resource threshold required for an attack:

According to Google’s white paper, breaking secp256k1 elliptic curve cryptography requires approximately 1,200 to 1,450 logical qubits and tens of millions of Toffoli gate operations, translating to approximately 500,000 physical bits. This is currently the most authoritative estimate, approximately 20 times lower than the mainstream figures from three years ago.

White paper co-author and Ethereum Foundation researcher Justin Drake points out that current optimized quantum circuits “require only approximately 100 million Toffoli gates, a surprisingly shallow depth,” and adds that the logical qubit count “may soon drop below 1,000.” In other words, this threshold itself continues to be pushed downward by ongoing algorithmic optimization, and the speed of reduction is unpredictable. Drake explicitly states “AI has not yet been used to find optimization space” — meaning human researchers are still using relatively traditional methods to continuously lower this threshold.

Current Quantum Capability — The resource scale hardware can actually provide:

This needs to be viewed from two dimensions separately, because physical qubits and logical qubits are two different measurement standards that cannot be mixed.

At the physical qubit level: current mainstream systems — including Google’s Willow chip (105 physical qubits), IBM Nighthawk (120 physical qubits), and others — scale between hundreds and thousands of physical qubits. Compared to the 500,000 physical qubits required to break ECC, the gap is approximately 250–500 times.

At the logical qubit level: the current global highest measured value is Quantinuum Helios 2025’s 48 logical qubits (full error-correction mode, using concatenated error-correction codes), approximately 25 times short of the 1,200–1,450 required to break ECC. But this 25x figure is misleading — the quality requirements for “logical qubits” on both sides differ by 7–8 orders of magnitude (see table above). IBM’s 2029 roadmap targets 200 logical qubits; even if achieved, it would still be 6–7 times short of the breaking threshold, and the error correction quality gap would equally persist.

Combining both dimensions:

Measured in physical qubit terms, the gap between current capability and the threat threshold is approximately 250–500 times — this is currently the most rigorous comparison method, using the same technical assumptions on both sides. This gap sounds large, but two points make it less reassuring: first, the threat threshold continues to be pushed downward by algorithmic optimization, and the speed of reduction is unpredictable; second, the hardware progress curve is not linear — history has repeatedly seen resource estimates compressed by 20 times in a single paper, creating acceleration inflection points.

4.2 Comparison of Various Timeline Projections

No one can precisely predict when Q-Day will arrive. But over the past two years, the judgments of major institutions and researchers have shown a clear directional shift: the range is shifting forward overall, and uncertainty is tilting in the pessimistic direction.

The following table’s various predictors have very different identities — there are Google researchers who personally build attack algorithms, Ethereum Foundation researchers who participated in writing the white paper, government agencies that set regulatory standards, and independent judgments from the investment community. They use different methodologies, different information sources, and different thresholds for “acceptable risk.”

Synthesizing seven projections, two structural features are worth calling out separately:

First, the lower bound of the range is moving forward while the upper bound remains roughly stable. The most conservative regulatory timeline (NIST, 2035) has barely changed over the past five years; but the judgments of technical institutions and frontline researchers — Google’s 2029 action deadline, Drake and Gidney’s “≥10% probability before 2030–2032” — have continued to compress forward over the past two years. This means the risk distribution is right-skewed: the probability of arriving ahead of expectations is systematically higher than the probability of being significantly delayed.

Second, no party in the table believes the threat will not materialize; the only disagreement is timing. From the most aggressive Vitalik (before 2028) to the most conservative NIST (before 2035), all projections point in the same direction, with the only difference being speed assumptions. This consistency is itself a signal.

For investors, this distribution has a direct decision-making implication: using NIST’s 2035 as the reference framework for risk planning is equivalent to systematically adopting the most optimistic assumptions; using Google’s 2029 as the reference framework is closer to the consensus median of the current technological frontier. Which reference framework to choose will directly affect the pace of handling high-risk exposure in one’s portfolio.

4.3 The “Remaining Time” Paradox: The Scissors Gap Between Technical and Governance Windows

Google’s white paper offers a superficially reassuring judgment: the time required to migrate blockchains to post-quantum cryptography currently still exceeds the time required for CRQC to arrive — but this margin of error is becoming increasingly narrow.

The core of the current problem is: “technically still achievable on time” and “actually completable” are two entirely different things.

Technical Level: Migration Pathway Is Already Clear

From a purely technical perspective, PQC migration tools are ready. NIST formally published three PQC standards in 2024 (FIPS 203, FIPS 204, FIPS 205); the algorithms have undergone years of review, and implementation paths are clear. The Ethereum Foundation has planned a detailed four-fork roadmap, including a phased implementation plan from post-quantum key registration to full PQC consensus. Currently, more than 10 client teams are running development testnets weekly, with specific milestones spanning four hard forks.

Technically, this is an engineering problem, not a physics problem. The path exists, the tools exist; the question is whether this path can be completed before the time window closes.

Governance Level and Hidden Costs: This Is the Real Bottleneck

Blockchain cryptographic migration is fundamentally not an engineering problem but a social coordination problem.

The reason blockchains are an extremely difficult domain for cryptographic migration is rooted in their decentralized architecture and long-term security requirements. Human factors based on economic rationality — investors pursuing short-term profits, miners focused on mining revenue — have become key obstacles to migration. Bitcoin is a particularly acute example. Bitcoin’s governance model makes this kind of coordinated response structurally more difficult — there is no equivalent institution to the Ethereum Foundation that can fund and lead multi-year engineering work; protocol changes require broad consensus from the decentralized developer community, and this community has historically acted slowly and cautiously.

More critically, the incentive structure of PQC migration is fundamentally different from previous upgrades. PQC migration poses an unprecedented consensus challenge for governance: it imposes immediate, enormous costs with no visible short-term benefits. Even the technical hidden costs are devastating.

Data sources: Signature scheme technical parameters from NIST FIPS 204 (Module-Lattice-Based Digital Signature Standard, ML-DSA-65 security level); block capacity estimates based on Bitcoin’s 1MB native block consensus limit; derivation logic references the CEUR Workshop Proceedings publication “Impact of post-quantum signatures on blockchain and DLT systems” and Bitcoin developer mailing list (Bitcoin-dev) discussions. The above estimates do not account for SegWit extended blocks or Taproot optimizations and represent conservative baseline estimates.

In the post-quantum era, the volume of PQC (Post-Quantum Cryptography) signatures is far larger than existing elliptic curve signatures. Taking the NIST standard algorithm ML-DSA-65 as an example, its signature and public key size expands by tens of times. This means that, without Bitcoin undergoing a major capacity-expanding hard fork, what was originally 2,000–3,000 transactions per block would plummet to approximately 200 transactions, and network throughput faces a cliff-like drop of more than 90%.

Dormant Assets: An Unsolvable Governance Dilemma

There is a special structural dilemma within PQC migration that makes Bitcoin’s governance problem even more intractable: unclaimed dormant assets cannot be automatically upgraded.

The chain can accept new rules, but it cannot notify every holder who wrote their mnemonic phrase on paper and locked it in a safe, or stored it on a forgotten hardware wallet. The approximately 1.7 million Satoshi-era dormant Bitcoin, and the large number of Ethereum addresses with exposed public keys, cannot actively participate in migration at the technical level — they can only wait to be attacked, or be disposed of through collective decisions at the protocol layer.

This creates an extremely thorny governance problem: if the protocol encodes special cases for specific addresses or holder categories, politics will be introduced into the base layer — and once consensus rules involve the fate of specific assets, they may immediately undermine the aligned incentives of all previously aligned parties. Burn unmigrated dormant assets? This amounts to property confiscation. Freeze these addresses? This requires defining what is “genuinely lost” versus “hasn’t come back yet” — the two are indistinguishable on-chain. Do nothing? These assets will become the first targets of quantum attacks; once stolen, the resulting market panic may be far more destructive than the technical problem itself.

Google’s white paper dedicates an entire chapter to public policy frameworks such as “Digital Salvage,” attempting to find a way out of this problem, but this problem has no clean technical solution.

In summary, the technical window can be compressed — algorithmic standards are ready, engineering paths are known, implementation time can be accelerated through resource investment. The governance window is almost impossible to compress by external force — it depends on community political will, interest competition, realignment of economic incentives, and the inherently slow decision-making of decentralized networks. Even if the “remaining time” is technically positive, governance-level friction may still lead to migration failing to be completed before the threat arrives.

Chapter 5 | Industry Response: Quantum-Resistant Roadmaps of Major Blockchains

5.1 Post-Quantum Cryptography (PQC) Standardization Progress

Cryptographic standards preparation work is complete. In August 2024, NIST formally published three PQC standards: FIPS 203 (ML-KEM/Kyber, for key encapsulation), FIPS 204 (ML-DSA/Dilithium, for digital signatures), and FIPS 205 (SLH-DSA/SPHINCS+, hash-based signatures). In March 2025, NIST further selected HQC as a code-based backup option to guard against unexpected vulnerabilities in lattice cryptography. These algorithms have undergone years of global cryptographic community review and are the standard solution for blockchain migration — the tools are ready; the question is only whether they can be utilized.

At the same time, policy-level pressure is escalating in parallel. US federal agencies must submit PQC migration plans before April 2026 (pursuant to NSM-10); the EU requires critical infrastructure to complete quantum-resistant upgrades by 2030; NIST’s overall goal is industry-wide migration completion before 2035.

However, there is a significant execution gap between actual progress and policy timelines. According to analysis by the Cambridge Centre for Alternative Finance under Cambridge Judge Business School of 1,725 open-source blockchain code repositories involving cryptographic applications, traditional cryptographic algorithms still account for 98.7%, while post-quantum algorithms appear in only 0.35% of repositories. This indicates that the vast majority of blockchain projects remain at the theoretical discussion stage, and genuine code-level defensive construction has not yet begun.

5.2 Readiness Status of Major Public Blockchains

Not all public blockchains face the same quantum risk, nor do all public blockchains have the same response capability. From the degree of cryptographic exposure and the completeness of migration roadmaps, to the execution capability of governance structures and funding assurance — the combination of these four dimensions determines each chain’s true situation when the quantum threat arrives.

The following table provides a cross-sectional comparison of the readiness status of five mainstream or representative public blockchains, covering current progress, roadmap credibility, governance and funding support, and the risks and opportunities most directly relevant to investors. It should be noted that this table presents a snapshot as of March 2026; the response progress of each chain continues to evolve and is not a static rating.

Overall, a differentiated landscape has formed and continues to expand:

• Ethereum: Currently the only mainstream public blockchain simultaneously possessing high roadmap credibility, strong governance execution, and clear funding commitments. The Foundation’s internal quantum security work began as early as 2019; in January 2026 it formally listed post-quantum security as a core strategic priority, established a dedicated PQ team, and invested $2 million in directed funding for post-quantum cryptography research.
• Bitcoin: A proposal exists — BIP-360 (Pay-to-Merkle-Root, P2MR) is currently the most specific quantum-resistant upgrade proposal. As of March 2026, BIP-360 remains in draft status in the official Bitcoin BIP process — not activated, not scheduled, still requiring complete peer review, security audits, and community consensus-building before mainnet activation. The core challenge it faces is not technical but the coordination cost under decentralized governance.
• Solana: On December 16, 2025, the Solana Foundation partnered with security firm Project Eleven to deploy a post-quantum digital signature prototype on testnet, completing a comprehensive quantum threat assessment of validator identity, user wallets, and network signature assumptions. According to Unchained reporting, the specific post-quantum signing algorithm used was not publicly disclosed, but external observers estimate it references NIST’s published PQC digital signature standards (such as FIPS 204/205). This is an experimental testnet deployment; mainnet roadmap and timeline have not yet been published; overall readiness remains in early stages.

5.3 Short-Term Transition Measures (Google WhitePaper Recommendations)

While calling for complete PQC migration, Google’s white paper also provides short-term defensive measures that can be immediately implemented:

Stop public key reuse: Change address after each transaction, avoiding long-term exposure of public keys on-chain — this is the lowest-cost, immediately executable risk mitigation measure, particularly important for Bitcoin users.

Additional caution with Taproot addresses: The 2021 Taproot upgrade exposes public keys by default; Taproot address holders face higher at-rest attack risk. It is recommended to maintain address hygiene before solutions like BIP-360 mature.

Public key management for institutional cold wallets: For large positions, exchanges and institutional custodians should immediately inventory their cryptographic asset exposure, identify which cold wallet addresses fall into high-risk categories, and develop migration contingency plans.

“Private mempools” and “commit-reveal” schemes: Google’s white paper specifically mentions these two technical solutions as effectively resisting on-spend attacks — by delaying the timing of public key exposure, narrowing the attack window before transaction confirmation.

These measures are all transitional and cannot substitute for fundamental migration at the protocol layer.

Conclusion | Incorporating Quantum Risk into the Decision Framework

The preceding five chapters attempt to accomplish one thing: transform the quantum threat from a vague technical narrative into an actionable investment analysis framework.

Risk-Stratified Assessment Matrix At the project dimension, investors should focus on the following questions:

• Does the project already have a public PQC migration roadmap?
• Is the core signing scheme upgradeable (cryptographic agility)?
• Does the governance structure have the capability to execute large-scale upgrades (the more decentralized, the harder to coordinate)?

Which Asset Classes Are Highest Risk:

• Exchange cold wallets that heavily rely on address reuse
• Long-inactive institutional large-holder addresses
• Primitive chains with extreme governance rigidity incapable of rapid upgrades (e.g., early BTC addresses in P2PK format)

Which Tracks May Encounter Opportunities:

• Native post-quantum public blockchains (QRL, etc.)
• Privacy chains with already-deployed ZK quantum-resistant solutions
• Infrastructure projects providing cryptographic auditing and PQC migration services

Closing Remarks

Quantum computing attacks on cryptocurrency have not yet occurred. Google’s white paper did not announce that a crisis has arrived; it announced that the technical assumptions previously supporting the judgment that “the threat is still far away” have been systematically revised.

The implications of this revision are concrete: the resource threshold is moving down, hardware capability is moving up, the governance time required for migration cannot be compressed, and the preparedness gap between different protocols has formed and continues to widen. These variables together point toward the same conclusion: the market needs to reprice quantum risk.

For investors, the correct way to handle quantum risk is not to predict the precise time of Q-Day, but to treat it as a structural variable whose probability distribution is continuously shifting forward and incorporate it into everyday due diligence frameworks. Evaluate roadmap credibility, identify high-risk exposure, and pay attention to the differentiation of migration capability.

Primary Sources

Core White Papers and Official Documents

[1] Babbush, R., Zalcman, A., Gidney, C., Broughton, M., Khattar, T., Neven, H., Bergamaschi, T., Drake, J., & Boneh, D. (2026). Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations. Google Quantum AI. arXiv:2603.28846. https://quantumai.google/static/site-assets/downloads/cryptocurrency-whitepaper.pdf

[2] Google Research Blog. (2026, March 30). Safeguarding Cryptocurrency by Disclosing Quantum Vulnerabilities Responsibly. https://research.google/blog/safeguarding-cryptocurrency-by-disclosing-quantum-vulnerabilities-responsibly/

[3] Google Security Blog. (2026, March). Setting a 2029 Timeline for Post-Quantum Cryptography Migration. https://blog.google/innovation-and-ai/technology/safety-security/cryptography-migration-timeline/

[4] NIST. (2024). FIPS 204: Module-Lattice-Based Digital Signature Standard (ML-DSA/Dilithium). https://doi.org/10.6028/NIST.FIPS.204

[5] NIST. (2024). FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM/Kyber). https://doi.org/10.6028/NIST.FIPS.203

[6] NIST. (2024). FIPS 205: Stateless Hash-Based Digital Signature Standard (SLH-DSA/SPHINCS+). https://doi.org/10.6028/NIST.FIPS.205

[7] Ethereum Foundation. (2026, March 25). Post-Quantum Ethereum Roadmap. https://pq.ethereum.org/

Quantum Hardware Milestones

[8] Google Quantum AI and Collaborators. (2025). Quantum error correction below the surface code threshold. Nature, 638, 920–926. https://doi.org/10.1038/s41586-024-08449-y

[9] Ransford, A. et al. (2025). Helios: A 98-qubit trapped-ion quantum computer. arXiv preprint arXiv:2511.05465. (Quantinuum Helios，本文4.1节48个逻辑量子比特数据来源)

[10] Bluvstein, D. et al. (2024). Logical quantum processor based on reconfigurable atom arrays. Nature. (中性原子路线里程碑)

[11] Bravyi, S. et al. (2024). High-threshold and low-overhead fault-tolerant quantum memory. Nature, 627, 778–782. https://doi.org/10.1038/s41586-024-07107-7. (QLDPC纠错码，IBM Heron处理器相关)

[12] Bartolucci, S. et al. (2025). Scaling and networking a modular photonic quantum computer. Nature, 638, 57–63. https://doi.org/10.1038/s41586-024-08406-9. (光子路线)

[13] Manetsch, H. J. et al. (2025). A tweezer array with 6100 highly coherent atomic qubits. Nature. (中性原子6100量子比特)

[14] Zhao, X. et al. (2025). High-fidelity two-qubit quantum logic gates in a trapped-ion chain using axial motional modes. Chinese Physics Letters, 42, 110601. (离子阱路线)

[15] Koch, J. et al. (2007). Charge-insensitive qubit design derived from the Cooper pair box. Physical Review A, 76, 042319. (超导transmon量子比特奠基论文)

Algorithm Optimization History

[16] Gidney, C., & Ekerå, M. (2021). How to factor 2048-bit RSA integers in 8 hours using 20 million noisy qubits. Quantum, 5, 433. (2019年资源估算，攻击门槛历史数据)

[17] Gidney, C. (2025). Factoring 2048-bit RSA integers in under a week with only 1 million noisy qubits. arXiv preprint. (2025年RSA资源估算)

[18] Litinski, D. (2023). How to compute a 256-bit elliptic curve private key with only 50 million Toffoli gates. arXiv:2306.08585. (2023年ECC资源估算，本文攻击门槛数据来源之一)

Blockchain PQC Migration

[19] Fukuda, K., Matsuo, S., Suga, Y., & Ito, T. (2025). The Grand Challenge of PQC Migration: Analysis of Modern Blockchain and Intertwined Human Egoisms. Cryptology ePrint Archive, 2025/1626. https://eprint.iacr.org/2025/1626

[20] BTQ Technologies. (2026, March 20). BTQ Technologies Announces First Deployment of BIP 360 on Bitcoin Quantum Testnet v0.3.0. Press Release. https://www.prnewswire.com/news-releases/btq-technologies-announces-first-deployment-of-bip-360-on-bitcoin-quantum-testnet-v0-3-0--302718592.html

[21] Campbell, R. et al. (2026). Hybrid Post-Quantum Signatures for Bitcoin and Ethereum: A Protocol-Level Integration Strategy. The Journal of the British Blockchain Association, 9(1). (PQC迁移对比特币吞吐量影响数据来源)

[22] Carchidi, A. (2026, March 11). Bitcoin’s Migration Problem Is Self-Organization. Quantum Canary. https://www.quantumcanary.org/insights/bitcoins-migration-problem-is-self-organization

Timeline and Industry Projections

[23] The Quantum Insider. (2026, March 31). Q-Day Just Got Closer: Three Papers in Three Months Are Rewriting the Quantum Threat Timeline. https://thequantuminsider.com/2026/03/31/q-day-just-got-closer-three-papers-in-three-months-are-rewriting-the-quantum-threat-timeline/

[24] CoinDesk. (2026, March 28). Watch Out Bitcoin Devs. Google Says Post-Quantum Migration Needs to Happen by 2029. https://www.coindesk.com/tech/2026/03/28/watch-out-bitcoin-devs-google-says-post-quantum-migration-needs-to-happen-by-2029

[25] Federal Reserve Board. (2025). Quantum Computing and Cryptocurrency: Policy Considerations. Finance and Economics Discussion Series. https://www.federalreserve.gov/econres/feds/files/2025093pap.pdf

第一章｜引子：一份让行业警醒的白皮书

1.1 事件背景：一次不平常的主动披露

2026年3月30日，Google Quantum AI发布了一篇学术白皮书，题为《针对量子漏洞保护椭圆曲线加密货币：资源估算与缓解方案》论文共同作者包括Google Quantum AI核心研究员Ryan Babbush、Craig Gidney等人，以及以太坊基金会研究员Justin Drake和Stanford密码学教授Dan Boneh。Google Research博客同日刊发了一篇面向大众的传播文章，标题为《负责任地披露量子漏洞以保护加密货币》，向普通读者解释了这次披露的动机与方式。

这次发布有几处不寻常之处，第一，发布前与美国政府进行了协调。 Google在博客文章中明确写道：”为了负责任地分享这项研究，我们与美国政府进行了沟通，并开发了一种通过零知识证明描述量子威胁的新方法，以便可以在不为攻击者提供路线图的情况下对其进行验证。” 这套方法由Google与美国政府协同开发，并被提议作为量子研究界处理敏感披露的行业模型。

第二，刻意不公开具体的攻击电路。 研究团队使用零知识证明对计算结果进行了密码学验证 — — 任何人可以独立核验资源估算是否属实，但无法从中提取攻击路径。这表明研究团队认为，量子计算进展已经到了应当停止公开发表改进版量子密码分析细节的阶段 — — 继续发表只会为潜在攻击者提供路线图，而不再有助于推动防御端的行动。这是一个在量子研究界极为罕见的自我约束声明，它传递的信号是：进展已经足够接近，需要开始管控信息扩散。

第三，时间窗口在发布前已经被内部设定。 Google此前已经宣布将2029年设为完成后量子密码学迁移的目标节点，并建议整个行业采用这一时间表。白皮书的发布，是这个内部deadline向外部传递的公开信号。

1.2 核心结论：资源门槛的大幅下移

白皮书的核心技术贡献，是对一个关键参数给出了新的、更低的估算：破解保护主流加密货币的椭圆曲线密码学，究竟需要多大规模的量子计算机？

论文给出了两条优化后的量子电路方案：一条使用不超过1200个逻辑量子比特与9000万个Toffoli门，另一条使用不超过1450个逻辑量子比特与7000万个Toffoli门。在物理量子比特层面，两者均可在低于50万个物理量子比特的超导架构上运行，且整个计算可在数分钟内完成。

这一数字比此前学术文献中的主流估算减少了约20倍。

悉知过去几年行业普遍用”需要数百万乃至数千万量子比特”来维持对量子威胁的心理距离。这个距离，是很多机构将量子风险归类为”远期尾部”的主要依据之一。Google这篇白皮书系统性地压缩了这个距离。

1.3 为什么投资人需要重新定义这个风险

量子威胁长期被归类为”远期尾部风险”，这种定性使得绝大多数机构对其采取了”观察但不纳入框架”的态度。

但这种定性需要修正，理由有三：

1. 第一，概率分布已经更新。 白皮书联合作者、以太坊基金会研究员Justin Drake估计，2032年前量子攻击成功的概率至少达到10%。
2. 第二，风险敞口高度不均匀，且可以被量化、定位。 公钥暴露模式、地址复用历史、协议升级能力 — — 这些因素决定了特定头寸是否处于高风险区间。Google估计，以太坊头部1000个钱包持有约2050万枚ETH，加之至少70个主要管理员控制的智能合约（包括支撑部分稳定币的合约）存在量子敞口，合计暴露资产超过1000亿美元。 这意味着量子风险已经是可以被量化、被定位的结构性变量，而非无从下手的系统性黑箱。
3. 第三，迁移存在巨大的治理摩擦，且时间无法压缩。 向后量子密码学的迁移在技术上是可行的，但过程复杂而缓慢，对需要广泛协调的去中心化网络尤为如此。对于治理结构越去中心化的协议，迁移所需的社会协调成本越高、周期越长。 — — 而这恰恰意味着那些最难升级的链，往往也是敞口最集中的那些。Google建议的迁移完成目标节点是2029年，距今不足三年。

1.4 信号与噪声：正确的阅读姿态

白皮书发布后，市场上出现了两种截然不同的误读，值得在这里点明，因为它们代表了两种典型的认知陷阱。

第一种是技术性恐慌：将”量子计算机可在9分钟内破解比特币私钥”作为标题传播，却省略了这一估算成立所需的前提 — — 目前不存在拥有数十万高质量纠错物理量子比特的机器。这个估算描述的是未来某台机器的能力上限，不是今天的现实。

第二种是防御性驳斥：援引”量子威胁也会破坏整个传统金融体系”的论点，以此论证比特币不会单独受到冲击。白皮书直接回应了这种逻辑：银行、军事网络等中心化系统可以通过软件更新推送密码学升级，而比特币需要在去中心化社区中达成共识。 两类系统面对同一技术威胁的应对速度，有结构性差异。

Google研究团队对这两种倾向都有预判。白皮书明确指出：对量子风险的夸大或低估都会造成伤害 — — 夸大会动摇公众对数字系统的信心，低估则会推迟必要的安全升级。 他们选择负责任披露的方式本身，正是试图在两个极端之间找到一条准确传递信息的路径。

正确的阅读方式是将这篇白皮书理解为一次概率分布的强制更新：Q-Day的发生概率、资产敞口的分布结构、协议迁移能力的差异 — — 这三个变量，已经从可以暂时搁置的背景假设，变成了需要主动纳入资产评估框架的分析维度。

本文接下来的章节将依次拆解：量子计算究竟能破什么（第二章）、为什么破解仍然需要时间（第三章）、时间窗口的合理估算（第四章）、以及各主要公链当前的应对进展（第五章） — — 目标是帮助读者将量子风险从情绪化的市场叙事，转化为可以落地操作的分析框架。

第二章｜威胁解构：量子计算究竟能破什么

2.1 加密行业的密码学根基

比特币、以太坊等绝大多数区块链项目的安全性都建立在椭圆曲线密码学（Elliptic Curve Cryptography, ECC）上。这套体系的核心是三个要素：公钥、私钥和签名。

用户持有私钥，由此派生出公钥，公钥用于收款，私钥用于汇款。发起交易时（如转账1个BTC），用户用私钥对交易内容签名。网络中的任何节点都可验证签名来自对应的私钥持有者，但无法从公钥或签名倒推出私钥。

这是区块链安全的根基：从公钥推导私钥在经典计算机上是不可行的。 比特币和以太坊使用的secp256k1椭圆曲线，其安全性依赖于256位椭圆曲线离散对数问题（ECDLP-256）的计算困难性。

量子计算挑战的正是这一关键假设。Shor算法在理论上能够高效求解ECDLP，使得从公钥倒推私钥成为可能。一旦这一假设被打破，所有已经在链上暴露公钥的资产都将面临被盗的风险。

这一风险并非遥远的假设。目前，比特币网络中约有690万枚BTC的公钥已经暴露在链上 — — 约占总供应量的三分之一。其中约170万枚来自比特币最早期（包括中本聪时代），使用的是Pay-to-Public-Key（P2PK）脚本格式，公钥直接嵌入在交易输出中，完全暴露。此外，地址复用和2021年Taproot升级（P2TR地址默认暴露公钥）进一步扩大了暴露面。在以太坊一侧，只要账户发起过一笔交易，其公钥就永久可见。Google估算，仅以太坊余额排名前1000的钱包就持有约2050万枚ETH，全部处于暴露状态。

2.2 量子计算的新资源估算

2026年3月，Google Quantum AI联合以太坊基金会和斯坦福大学发表了一篇白皮书，系统评估了量子计算机破解ECDLP-256所需的资源。这篇论文引起广泛关注的原因是它给出的数字远低于此前的学术估算。

研究团队编译了两条优化的量子电路方案，均基于Shor算法实现对secp256k1曲线上ECDLP-256的求解。两条电路均可在不到50万个物理量子比特的超导量子计算机上、在数分钟内完成运算。

此前的主流估算认为破解ECDLP-256需要数百万物理量子比特。Google的结果将这一数字缩减了约20倍。 这是论文最核心的贡献。它意味着量子威胁到来的时间将会前移。

为了防止攻击电路被黑客利用，Google在披露方式上采取了特殊做法：研究团队没有公开实际的攻击电路，而是发布了一个零知识证明（Zero-Knowledge Proof），允许外部研究者验证资源估算的正确性，同时不暴露可被复现的攻击细节。论文发布前，Google还与美国政府进行了沟通协调。

Google已将自身认证和数字签名服务的后量子计算迁移截止日期设定为2029年。这意味着Google预计在2029年后当前的密码学根基将不再安全。

2.3 三种攻击模式

Google的白皮书梳理了量子计算对区块链的三种攻击模式。

On-Spend攻击（交易在途攻击）。 这类攻击的时间窗口最紧。用户广播比特币交易时，公钥在内存池（mempool）中暴露。攻击者用量子计算机从公钥推算出私钥，签署竞争交易（手续费更高），试图在原始交易被确认前完成替换。

Google的论文估算，在快时钟超导量子架构上，从公钥推导私钥约需9分钟。比特币的平均出块时间约为10分钟。在理想条件下，量子计算机成功抢先完成攻击的概率约为41%。这个窗口虽然狭窄，但足以构成威胁。

At-Rest攻击（静态资产攻击）。 这类攻击针对公钥已永久暴露在链上的地址，尤其是休眠钱包。攻击者不需要等待新交易，不存在时间窗口限制，可以离线计算。前述的690万枚公钥已暴露的BTC（包括170万枚中本聪时代的P2PK比特币）以及以太坊上大量已暴露公钥的账户，都属于此类攻击的目标。如果地址持有者已丢失私钥或无法操作（如中本聪的钱包），资产无法迁移至量子安全地址，风险不可逆。

On-Setup攻击（协议参数攻击）。 这是影响最深远但最不直观的攻击，针对以太坊的密码学基础设施。以太坊的数据可用性采样（Data Availability Sampling）依赖KZG多项式承诺方案，该方案建立在2023年完成的可信设置仪式（Trusted Setup Ceremony）之上。仪式生成了一个秘密标量（业内称为”toxic waste”），已在仪式结束后被销毁。

量子计算机能从该仪式公开发布的参数中恢复秘密标量。恢复成功后，攻击者获得一个永久性、可复用的经典计算漏洞。此后无需再使用量子计算机，就能持续伪造数据可用性证明。

2.4 哪些资产已处于风险敞口

量子威胁不是均匀分布的，不同链上资产的风险等级差异很大。

比特币方面： 约690万枚BTC（占总供应量约33%）的公钥已暴露在链上。其中约170万枚来自早期P2PK脚本（含中本聪钱包估计的110万枚，分布在约22,000个地址）；约520万枚来自地址复用和P2TR（Taproot）地址。2021年的Taproot升级在提升隐私性和灵活性的同时，默认暴露了公钥。设计时未预见量子威胁的紧迫性。目前Taproot key-path花费占P2TR交易的60%–80%，是新增暴露面的主要来源。Bitcoin社区已在讨论缓解方案，2026年2月一项名为Pay-to-Merkle-Root（BIP-0360）的新输出类型提案已合并至官方BIP仓库，但代价是更高的手续费和隐私降级。

以太坊方面： 以太坊的暴露面在多个层面上比比特币更深。账户一旦发起交易，公钥就永久暴露 — — Google估算前1000个高净值钱包就持有约2050万枚ETH。至少70个管理员控制的关键智能合约（包括支撑USDT、USDC等稳定币）依赖暴露的管理员密钥，涉及约2000亿美元资产。至少1500万枚ETH分布在主要L2网络和跨链桥中，这些基础设施依赖以太坊内置的密码学工具，同样不具备量子抗性。加上前述的KZG可信设置漏洞，Google的论文认为以太坊面临至少5条量子攻击路径，总风险敞口超过1000亿美元。以太坊基金会已启动后量子迁移路线图，计划通过4次连续硬分叉在2029年前完成核心协议升级。但升级基础层不能自动修复已部署的数千个智能合约 — — 每个协议、桥和L2都需要独立升级代码并轮换密钥。

除此之外，比特币的工作量证明（PoW）挖矿机制不受上述量子攻击影响。SHA-256是对称哈希函数，量子计算机通过Grover算法仅能将其有效安全性减半（从256位降至128位），不足以构成威胁。更关键的是，2026年的研究指出，在比特币当前主网难度下实现量子挖矿所需的量子比特数和能耗达到天文数字级别（约1⁰²³个量子比特，功耗接近卡尔达肖夫II型文明的门槛）。比特币网络还可通过难度调整应对任何算力变化。因此，量子计算对区块链的核心威胁不在于共识机制，而在于签名算法 — — 即上文讨论的椭圆曲线密码学。

当前比特币社区和以太坊社区都在密切监控量子计算的发展，并且积极讨论各类解决方案。因此量子计算对于密码学的威胁是可控的，我们相信在抗量子计算的比特币和以太坊一定会先于量子计算实现。抗量子计算升级路线图位于本文第五章，这里不做赘述。

第三章｜技术底层：从量子比特到逻辑比特 — — 为什么破解还需要时间

3.1 量子比特的物理原理

经典信息的基本单位是比特(bit)，只能处于$$0$$或$$1$$两种确定状态之一。

1个比特：0或1

2个比特：00,01,10,11

量子计算的基本单位是量子比特(Qubit)，可以处于 0 和 1 的叠加态。

其中 α,β,γ,δ 是复数概率幅，其模的平方表示测量得到对应状态的概率，并满足归一化条件：

微观粒子世界中的粒子均可以用量子态表示，因此可以使用不同的粒子来实现量子比特的逻辑运算，常用的有中性原子、光子、带电原子(离子）等。

量子计算特有的纠缠态，这是有别于经典比特的地方，也是量子计算的优势。当2量子处于某种特定的纠缠态时，可以表示为：

3.2 量子逻辑门和逻辑比特（Logical Qubit）

量子计算机的逻辑门操作是对所有叠加态实施操作，如

通过NOT门得到

改变的是叠加态的复数概率幅和相位，从而间接影响观测到的概率。

因为量子可以表示为叠加态，多个量子比特表示的状态以指数提升，如4个量子比特可以表示16个状态，n 个量子比特可以表示2^n个状态。理论上1台n 个量子比特运算的量子计算机，可以同时进行2^n个状态的演化，而经典计算机则需要对这些状态进行2^n次运算，在特定算法和结果输出时，有着恐怖的指数加速效果。

量子计算中，我们需要通过一系列量子逻辑门，让系统从初始状态不断演化。这个过程中，所有可能的答案会以叠加态的形式同时存在，但我们不能直接读出这些结果，因为系统一直以叠加态存在。关键在于，我们可以通过精心设计这些逻辑门，让正确答案的“概率幅”不断被放大，而错误答案逐渐被抵消。通过量子门操作对叠加态进行演化，调控各个状态的概率幅和相位，使目标答案的概率逐步放大，从而在测量时以高概率获得正确结果。

量子态非常脆弱，任何微小环境波动就会导致退相干，从而导致量子信息丢失。而想要可靠的实现量子计算，需要用一组物理比特编码信息，进行持续检测并纠正错误。量子比特记录的是单一的信号，容易出现相位错误、状态翻转，甚至数据丢失等问题，而逻辑比特是加了纠错编码的稳定通信信号。

简单的例子，如我们可以使用3个量子比特绑定，将逻辑态 0 和 1 定义为：

这样当其中一个量子比特发生状态翻转时(如从∣000⟩ 翻转为∣010⟩) ，我们可以对状态进行修正。这是最简单的重复码纠正示例，实际逻辑比特需要更复杂的纠缠态来同时纠正比特翻转和相位翻转错误。

目前主流的方案之一是使用表面码进行数据纠错，需要用到的量子比特数量是 d²+(d−1)² ，d 为码距，数字越大则可靠度越高。这种情况下，实现一个逻辑比特所需要的量子比特数量为几十到上千个。

3.3 四条技术路线的竞赛

量子计算领域尚未选定最优方案，目前主要路线包括：超导量子比特（Superconducting qubits）；光量子比特（Photonic qubits）；离子阱（Trapped-ion qubits）；以及中性原子（Neutral atom qubits）。

• 超导量子计算的核心思想是利用超导电路，在宏观尺度上构造具有离散能级结构的量子系统，即“人造原子”，以此实现量子比特。目前最成熟的实现形式是 Transmon 及其改进型电荷比特，已被 Google、IBM 等公司实现工程化落地。
• 中性原子路线在近期实现了快速规模扩展，光学阵列规模在短时间内从数万提升至数十万级别，同时已能够稳定操控约 6,100 个高相干物理量子比特，接近万比特量级这一重要里程碑。整体来看，中性原子体系在基础物理可行性方面已得到充分验证，当前主要挑战集中在工程化与系统集成层面，相关解决方案仍在持续推进中。
• 离子阱路线是用电磁场把带电原子“困住”，用激光精确操控其量子态，并利用共同的振动模式实现量子门。目前离子阱方案也实现了约百比特级系统，并在高保真量子门（>99%）和全连接结构方面具有显著优势。
• 光量子计算路线使用光子作为信息载体，通过光子干涉与测量实现量子操作，是唯一可在室温常压下运行的解决方案。该路线具有天然的可扩展性和网络化优势，但两比特门通常为概率性过程，目前尚未实现大规模容错逻辑比特计算。

在当前主流的四条量子计算技术路径中，超导量子与中性原子路线整体处于领先地位。超导量子依托成熟的半导体制造工艺体系，在器件制备、系统集成及规模化工程能力方面具备显著优势，是目前工程化程度最高、最接近实际应用落地的技术路线。中性原子则在物理层面展现出更优的可扩展性与体系纯净性，具备实现大规模量子比特阵列的潜力，并已在可编程多比特系统上取得实质性进展。相比之下，其余两条技术路径虽在特定性能指标上具有差异化优势，但在系统规模、工程成熟度以及应用转化能力等方面仍存在一定差距。

3.4 前沿投入和进展

过去三年，全球头部量子硬件公司完成了一轮密集融资 — — 估值从数亿到百亿美元不等，背后站着BlackRock、淡马锡、NVIDIA等机构。这些主权基金和战略投资人的入场意味着这条赛道的不确定性已经降低到机构可以接受的程度。

2024–2025年，量子硬件的技术边界被密集突破 — — Google Willow首次在实验上证明纠错低于阈值，Caltech实现6100个高相干量子比特，Harvard/MIT把中性原子推进到可编程逻辑比特处理器层面。这些里程碑不是孤立的学术成果，它们是资本押注的技术依据，也是下一轮估值重定价的基础。

3.5 现存的难点

退相干效应与噪声控制 (Decoherence & Noise)

量子比特极其脆弱，任何微小的环境波动（如温度变化、电磁波、甚至是宇宙射线）都会导致量子态坍缩，这种现象称为退相干。

• 极低温度需求：超导量子比特通常需要在 10mK（接近绝对零度）的环境下运行。
• 保真度瓶颈：目前的量子比特门操作保真度虽能达到 99.9%，但对于复杂的长路径运算，误差会迅速累积，导致计算结果变成随机噪声。

量子纠错的“高昂成本” (The Overhead of Error Correction)

由于量子比特不可靠，我们需要用很多个量子比特去“保护”一个逻辑比特。

• 比特冗余：根据目前的表面码（Surface Code）理论，要实现一个高性能的逻辑比特，可能需要 几十到上千个量子比特。
• 计算开销：实时检测和修复错误需要极高的算力和极低的延迟，这对控制电路提出了巨大挑战。“盈亏平衡点”（逻辑比特质量超过物理比特）是目前全行业的头号难题。

可扩展性与连通性 (Scalability & Connectivity)

即便我们能做出 1 个完美的逻辑比特，要解决实际问题（如破解加密、模拟药物分子）可能需要成千上万个逻辑比特。

• 布线难题：在超导系统中，成千上万根极低温线缆会导致制冷机体积爆炸。
• 全连接挑战：离子阱和中性原子路线虽然保真度高，但如何让相距较远的比特发生纠缠（交互）是一个巨大的物理难题。

控制系统的精度与速度 (Control Hardware)

量子计算不只是量子芯片的问题，它还需要一套极其复杂的经典电子设备来控制。

• 微波/激光精度：需要用纳秒级别的精准脉冲去操控比特。随着比特数增加，如何同步控制成千上万个激光束（如光镊阵列）或微波通道而不产生干扰，是极大的工程挑战。
• 读出速度：量子态的读取速度必须快于退相干速度，这对高灵敏度检测器要求极高。

这四个难点相互叠加，构成了一道工程意义上的复合屏障。退相干迫使系统引入纠错，纠错的高昂开销推高了所需的物理量子比特数量，规模扩展又触发了连通性和控制系统的瓶颈 — — 每一关都必须同时过，缺一不可。这正是为什么Google白皮书将攻击所需的物理量子比特从数百万压缩至50万是一个重要里程碑，但50万个高质量、可纠错、稳定运行的物理量子比特，在今天的工程现实中依然是一道尚未跨越的门槛。理解这道门槛的结构，是理解第四章时间轴为何仍有争议、但又在持续收窄的前提。

第四章｜时间轴评估：我们还有多少时间

4.1 当前量子能力 vs 威胁门槛：一个正在快速收窄的差距

理解时间轴，首先需要理解两条曲线：攻击所需的资源门槛，以及硬件实际能够提供的资源规模。这两条曲线之间的距离，就是留给行业准备的时间。

注： “逻辑量子比特”这个词在不同论文里定义并不统一 — — 两者都叫逻辑量子比特，但要求的稳定程度差了一亿倍。因此第二行”约25倍”的差距严重低估了实际距离。第一行（物理量子比特，约250–500倍）使用相同技术假设，是目前最严谨、可以直接引用的差距描述。

威胁门槛 — — 攻击所需的资源门槛：

根据Google白皮书，破解secp256k1椭圆曲线密码学，需要约1200至1450个逻辑量子比特和数千万个Toffoli门操作，折算为物理比特约50万个。这是目前最权威的估算，比三年前的主流数字低了约20倍。

白皮书共同作者、以太坊基金会研究员Justin Drake指出，目前优化后的量子电路”仅需约1亿个Toffoli门，这个深度出人意料地浅”，并补充说逻辑量子比特数”有可能很快降到1000以下”。 换言之，这个门槛本身仍在被算法层面的持续优化向下压缩，且Drake明确表示”AI尚未被用于寻找优化空间” — — 意味着人类研究者还在用比较传统的方式持续降低这个门槛。

当前量子能力 — — 硬件实际能够提供的资源规模：

需要从两个维度分开来看，因为物理量子比特和逻辑量子比特是两个不同的度量标准，不能混用。

物理量子比特层面：当前主流系统 — — 包括Google的Willow芯片（105个物理量子比特）、IBM Nighthawk（120个物理量子比特）等 — — 规模在数百至数千个物理量子比特之间。与破解ECC所需的50万物理量子比特相比，差距约250–500倍。

逻辑量子比特层面：当前全球最高实测值是Quantinuum Helios 2025的48个逻辑量子比特（完全纠错模式，采用串联纠错码），距离破解ECC所需的1200–1450个差约25倍。但这个25倍的数字会产生误导 — — 两侧对”逻辑量子比特”的质量要求差了7–8个数量级（详见上方表格）。IBM的2029年路线图目标是实现200个逻辑量子比特，即便届时实现，距离破解门槛仍差6–7倍，且纠错质量的差距同样存在。

两个维度合并来看：

用物理量子比特口径衡量，当前能力与威胁门槛的差距约250–500倍 — — 这是目前最严谨、两侧使用相同技术假设的比较方式。这个差距听起来很大，但有两点让它变得不那么令人安心：第一，威胁门槛在算法优化的驱动下持续下移，且下移速度不可预测；第二，硬件进步的曲线并非线性，历史上多次出现资源估算被单篇论文压缩20倍的加速拐点。

4.2 各方时间线预判对比

没有人能精确预测Q-Day的到来时间。但过去两年里，主要机构和研究者的判断出现了一个明显的方向性变化：区间在整体前移，且不确定性正在向悲观方向倾斜。

下表中对 Q-Day 时间线的公开预判的各方预判者身份迥异 — — 有亲手构建攻击算法的Google研究员，有参与白皮书写作的以太坊基金会研究员，有制定监管标准的政府机构，也有来自投资界的独立判断。他们使用的方法论不同，信息来源不同，对”风险可接受”的阈值也不同。

综合七方预判，有两个结构性特征值得单独点出。

第一，区间的下限在前移，而上限基本稳定。最保守的监管时间表（NIST，2035年）过去五年几乎没有变化；但技术机构和一线研究者的判断 — — Google的2029年行动截止日、Drake和Gidney的”2030–2032年前≥10%概率” — — 在过去两年持续向前压缩。这意味着风险分布是右偏的：超预期提前的概率，系统性高于大幅推迟的概率。

第二，表中没有任何一方认为威胁不会发生，分歧只在于时间。从最激进的Vitalik（2028年前）到最保守的NIST（2035年前），所有预判都指向同一个方向，区别仅在于速度假设。这种一致性本身就是一个信号。

对投资人而言，这个分布有一个直接的决策含义：以NIST的2035年为参照系做风险规划，相当于系统性采用了最乐观的假设；而以Google的2029年为参照系，则更接近当前技术前沿的共识中位数。两个参照系选哪个，将直接影响对持仓中高风险敞口的处置节奏。

4.3 “留存时间”悖论：技术窗口与治理窗口的剪刀差

Google白皮书给出了一个表面上令人安慰的判断：迁移区块链至后量子密码学所需的时间，目前仍少于CRQC到来所需的时间 — — 但这个容错空间正越来越窄。

当前问题的核心在于：”技术上还来得及”和”实际上能完成”是两件完全不同的事。

技术层面：迁移路径已经清晰

从纯技术角度看，PQC迁移的工具已经就绪。NIST于2024年正式发布了三项PQC标准（FIPS 203、FIPS 204、FIPS 205），算法经过多年评审，实现路径清晰。以太坊基金会已经规划了详细的四叉路线图，包含从后量子密钥注册到完整PQC共识的分阶段实施计划，目前已有超过10个客户端团队在每周运行开发测试网，路线图包含跨越四次硬分叉的具体里程碑。

技术上，这是一个工程问题，不是一个物理学问题。路径存在，工具存在，问题是能否在时间窗口关闭之前走完这条路。

治理层面及隐形代价：这才是真正的瓶颈

区块链的密码学迁移，本质上不是一个工程问题，而是一个社会协调问题。

区块链之所以是密码学迁移中极为困难的领域，根本原因在于它的去中心化架构和长期安全要求。投资者追求短期利润、矿工关注挖矿收益等基于经济理性的人为因素，已经成为迁移的关键障碍。以比特币为例，问题尤为突出。比特币的治理模式使这种协调响应在结构上更加困难 — — 没有以太坊基金会那样可以资助和主导多年工程工作的等效机构，协议变更需要去中心化开发者社区的广泛共识，而这个社区历来行动缓慢且审慎。

更关键的是，PQC迁移在经济上的激励结构与以往升级根本不同。PQC迁移对治理构成了前所未有的共识挑战：它强加了即时的巨大成本，却没有任何短期内可见的收益。甚至技术上的隐性代价是毁灭性的。

数据来源： 签名方案技术参数来自 NIST FIPS 204（Module-Lattice-Based Digital Signature Standard，ML-DSA-65 安全级别）；区块容量推算基于比特币 1MB 原生区块共识限制，推导逻辑参考 CEUR Workshop Proceedings 刊载的《Impact of post-quantum signatures on blockchain and DLT systems》及比特币开发者邮件组（Bitcoin-dev mailing list）相关讨论。上述推算未考虑 SegWit 扩展区块或 Taproot 优化，为保守基准估算。

在后量子时代，PQC（后量子密码学）签名的体积远大于现有的椭圆曲线签名。以NIST标准算法 ML-DSA-65 为例，其签名和公钥体积膨胀了数十倍。这意味着，在比特币不进行大幅度硬分叉扩容的前提下，其原本每区块可容纳的两三千笔交易将骤降至区区两百笔左右，网络吞吐量面临高达 90% 以上的断崖式下跌。

休眠资产：一个无解的治理难题

PQC迁移中存在一个特殊的结构性困境，使比特币的治理问题更加棘手：无人认领的休眠资产无法自动升级。

链可以接受新规则，但它无法通知每一个把助记词写在纸上锁进保险箱、或者存在被遗忘的硬件钱包里的持有者。约170万枚中本聪时代的休眠比特币，以及大量暴露公钥的以太坊地址，在技术层面无法主动参与迁移 — — 它们只能等待被攻击，或者被协议层面的集体决策处置。

这带来了一个在治理上极为棘手的问题：如果协议对特定地址或持有者类别编码了特殊情况，就会将政治引入基础层 — — 而一旦共识规则涉及具体资产的命运，就可能立即破坏此前对齐的各方激励。烧毁未迁移的休眠资产？这相当于没收财产。冻结这些地址？需要界定什么是”真正丢失”、什么是”还没回来” — — 在链上这两者无法区分。放任不管？这些资产将成为第一批量子攻击的目标，一旦被盗，引发的市场恐慌可能远比技术问题本身更具破坏性。

Google白皮书专门用一整章讨论了”数字打捞”（Digital Salvage）等公共政策框架，试图为这一问题提供出路，但这个问题在技术层面没有干净的解决方案。

总而言之，技术窗口是可以被压缩的 — — 算法标准已就绪，工程路径已知，实施时间可以通过资源投入加速。治理窗口几乎无法被外力压缩 — — 它取决于社区政治意愿、利益博弈、经济激励的重新对齐，以及去中心化网络天然的决策迟缓。即使技术上”留存时间”为正，治理层面的摩擦仍然可能导致迁移未能在威胁到来前完成。

第五章｜行业应对：主流链的抗量子路线图

5.1 后量子密码学（PQC）标准化进展

密码学标准的准备工作已经完成，2024年8月，NIST正式发布了三项PQC标准：FIPS 203（ML-KEM/Kyber，用于密钥封装）、FIPS 204（ML-DSA/Dilithium，用于数字签名）、FIPS 205（SLH-DSA/SPHINCS+，基于哈希的签名）。2025年3月，NIST进一步选定HQC作为基于编码的备选方案，以防格密码学出现意外漏洞。这些算法经过多年全球密码学界评审，是区块链迁移的标准方案 — — 工具已经准备好，问题只在于能否用上。

与此同时，政策层面的压力也在同步升级。美国联邦机构须于2026年4月前提交PQC迁移计划（依据NSM-10），欧盟要求关键基础设施于2030年前完成量子抗性升级，NIST的整体目标是2035年前完成全行业迁移。

然而，实际进展与政策时间表之间存在着巨大的执行缺口。根据剑桥大学贾吉商学院（Cambridge Judge Business School）下属替代金融中心对 1725 个涉及密码学应用的开源区块链代码库的分析显示，传统密码算法依然占比高达 98.7%，而后量子算法仅出现在 0.35% 的代码库中。这表明绝大多数区块链项目仍停留在理论探讨阶段，真正的代码级防御建设尚未展开。

5.2 主要公链的应对状态

并非所有公链面临相同的量子风险，也并非所有公链拥有相同的应对能力。从密码学暴露程度、迁移路线图的完整性，到治理结构的执行力和资金保障 — — 这四个维度的组合，决定了每条链在量子威胁到来时的真实处境。

以下表格对五条主流或代表性公链的准备状态做了横向对比，覆盖当前进展、路线图可信度、治理与资金支持，以及对投资人最直接相关的风险与机遇。需要说明的是，这张表呈现的是截至2026年3月的快照，各链的响应进展都在持续演进，而非静态评级。

整体来看，分化格局已经形成且仍在扩大：

• 以太坊：是目前唯一同时具备高路线图可信度、强治理执行力和明确资金承诺的主流公链，基金会内部的量子安全工作从2019年就已开始，2026年1月正式将后量子安全列为核心战略优先级，成立专职PQ团队，并投入200万美元定向资助后量子密码学研究；
• 比特币：提案存在：BIP-360（Pay-to-Merkle-Root，P2MR）是目前最具体的量子抗性升级方案；截至2026年3月，BIP-360在比特币官方BIP流程中仍处于草案状态 — — 未被激活，未被排入任何计划表，距离主网激活还需要经历完整的同行评审、安全审计和社区共识建立过程。其面临的核心挑战不是技术，而是去中心化治理下的协调成本技术。
• Solana：2025年12月16日，Solana基金会与安全机构Project Eleven合作，在测试网上部署了后量子数字签名原型，完成了对验证者身份、用户钱包和网络签名假设的完整量子威胁评估。 据 Unchained 报道，具体采用的后量子签名算法官方未予公开，但外界推测其参考了NIST已发布的PQC数字签名标准（如FIPS 204/205）。这是实验性测试网部署，主网路线图和时间表尚未发布，整体准备状态仍处于早期阶段。

5.3 短期过渡措施（Google白皮书建议）

Google白皮书在呼吁PQC完整迁移的同时，也给出了可以立即执行的短期防御措施：

停止公钥复用：每次交易后更换地址，避免公钥长期暴露在链上 — — 这是成本最低、可立即执行的风险缓释手段，对比特币用户尤为重要。

Taproot地址的额外注意：2021年Taproot升级默认暴露公钥，使用Taproot地址的持有者面临更高的at-rest攻击风险，建议在BIP-360等方案成熟前保持地址卫生。

机构冷钱包的公钥管理：对于大额持仓，交易所和机构托管方应立即盘点其密码学资产敞口，识别哪些冷钱包地址属于高风险类别，并制定迁移预案。

“私有内存池”与”提交-揭示”方案：Google白皮书特别提到这两种技术方案可以有效抵御on-spend攻击 — — 通过延迟公钥暴露的时机，在交易确认前缩小攻击窗口。

这些措施都是过渡性的，无法替代协议层的根本迁移。

总结｜将量子风险纳入决策框架

本文前五章试图完成一件事：将量子威胁从一个模糊的技术叙事，转化为一个可以操作的投资分析框架。

风险分层评估矩阵 按项目维度，投资人关注以下问题：

• 项目是否已有公开的PQC迁移路线图？
• 核心签名方案是否可升级（密码学敏捷性）？
• 治理结构是否具备执行大规模升级的能力（去中心化程度越高，越难协调）？

哪类资产风险最高

• 大量依赖地址复用的交易所冷钱包
• 长期不活跃的机构大户地址
• 治理刚性极强、无法快速升级的原始链（如P2PK格式的早期BTC地址）

哪类赛道或迎来机会

• 原生后量子公链（QRL等）
• 隐私链中已采用ZK抗量子方案的项目
• 提供密码学审计和PQC迁移服务的基础设施项目

结语：

量子计算对加密货币的攻击，目前尚未发生。Google白皮书没有宣告危机已经到来，它宣告的是：此前支撑”威胁还很遥远”这一判断的技术假设，已经被系统性地修正。

这个修正的含义是具体的：资源门槛在下移，硬件能力在上升，迁移所需的治理时间无法被压缩，而不同协议之间的准备差距已经形成且还在扩大。这些变量叠加在一起，指向同一个结论：市场需对量子风险重新定价。

对投资人而言，量子风险的正确处理方式不是预测Q-Day的精确时间，而是将其作为一个概率分布持续前移的结构性变量，纳入日常尽调框架。评估路线图的可信度、识别高风险敞口、关注迁移能力的分化。

主要来源

核心白皮书与官方文件

[1] Babbush, R., Zalcman, A., Gidney, C., Broughton, M., Khattar, T., Neven, H., Bergamaschi, T., Drake, J., & Boneh, D. (2026). Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations. Google Quantum AI. arXiv:2603.28846. https://quantumai.google/static/site-assets/downloads/cryptocurrency-whitepaper.pdf

[2] Google Research Blog. (2026, March 30). Safeguarding Cryptocurrency by Disclosing Quantum Vulnerabilities Responsibly. https://research.google/blog/safeguarding-cryptocurrency-by-disclosing-quantum-vulnerabilities-responsibly/

[3] Google Security Blog. (2026, March). Setting a 2029 Timeline for Post-Quantum Cryptography Migration. https://blog.google/innovation-and-ai/technology/safety-security/cryptography-migration-timeline/

[4] NIST. (2024). FIPS 204: Module-Lattice-Based Digital Signature Standard (ML-DSA/Dilithium). https://doi.org/10.6028/NIST.FIPS.204

[5] NIST. (2024). FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM/Kyber). https://doi.org/10.6028/NIST.FIPS.203

[6] NIST. (2024). FIPS 205: Stateless Hash-Based Digital Signature Standard (SLH-DSA/SPHINCS+). https://doi.org/10.6028/NIST.FIPS.205

[7] Ethereum Foundation. (2026, March 25). Post-Quantum Ethereum Roadmap. https://pq.ethereum.org/

量子硬件里程碑

[8] Google Quantum AI and Collaborators. (2025). Quantum error correction below the surface code threshold. Nature, 638, 920–926. https://doi.org/10.1038/s41586-024-08449-y

[9] Ransford, A. et al. (2025). Helios: A 98-qubit trapped-ion quantum computer. arXiv preprint arXiv:2511.05465. (Quantinuum Helios，本文4.1节48个逻辑量子比特数据来源)

[10] Bluvstein, D. et al. (2024). Logical quantum processor based on reconfigurable atom arrays. Nature. (中性原子路线里程碑)

[11] Bravyi, S. et al. (2024). High-threshold and low-overhead fault-tolerant quantum memory. Nature, 627, 778–782. https://doi.org/10.1038/s41586-024-07107-7. (QLDPC纠错码，IBM Heron处理器相关)

[12] Bartolucci, S. et al. (2025). Scaling and networking a modular photonic quantum computer. Nature, 638, 57–63. https://doi.org/10.1038/s41586-024-08406-9. (光子路线)

[13] Manetsch, H. J. et al. (2025). A tweezer array with 6100 highly coherent atomic qubits. Nature. (中性原子6100量子比特)

[14] Zhao, X. et al. (2025). High-fidelity two-qubit quantum logic gates in a trapped-ion chain using axial motional modes. Chinese Physics Letters, 42, 110601. (离子阱路线)

[15] Koch, J. et al. (2007). Charge-insensitive qubit design derived from the Cooper pair box. Physical Review A, 76, 042319. (超导transmon量子比特奠基论文)

算法优化历史

[16] Gidney, C., & Ekerå, M. (2021). How to factor 2048-bit RSA integers in 8 hours using 20 million noisy qubits. Quantum, 5, 433. (2019年资源估算，攻击门槛历史数据)

[17] Gidney, C. (2025). Factoring 2048-bit RSA integers in under a week with only 1 million noisy qubits. arXiv preprint. (2025年RSA资源估算)

[18] Litinski, D. (2023). How to compute a 256-bit elliptic curve private key with only 50 million Toffoli gates. arXiv:2306.08585. (2023年ECC资源估算，本文攻击门槛数据来源之一)

区块链PQC迁移

[19] Fukuda, K., Matsuo, S., Suga, Y., & Ito, T. (2025). The Grand Challenge of PQC Migration: Analysis of Modern Blockchain and Intertwined Human Egoisms. Cryptology ePrint Archive, 2025/1626. https://eprint.iacr.org/2025/1626

[20] BTQ Technologies. (2026, March 20). BTQ Technologies Announces First Deployment of BIP 360 on Bitcoin Quantum Testnet v0.3.0. Press Release. https://www.prnewswire.com/news-releases/btq-technologies-announces-first-deployment-of-bip-360-on-bitcoin-quantum-testnet-v0-3-0--302718592.html

[21] Campbell, R. et al. (2026). Hybrid Post-Quantum Signatures for Bitcoin and Ethereum: A Protocol-Level Integration Strategy. The Journal of the British Blockchain Association, 9(1). (PQC迁移对比特币吞吐量影响数据来源)

[22] Carchidi, A. (2026, March 11). Bitcoin’s Migration Problem Is Self-Organization. Quantum Canary. https://www.quantumcanary.org/insights/bitcoins-migration-problem-is-self-organization

时间线与行业预判

[23] The Quantum Insider. (2026, March 31). Q-Day Just Got Closer: Three Papers in Three Months Are Rewriting the Quantum Threat Timeline. https://thequantuminsider.com/2026/03/31/q-day-just-got-closer-three-papers-in-three-months-are-rewriting-the-quantum-threat-timeline/

[24] CoinDesk. (2026, March 28). Watch Out Bitcoin Devs. Google Says Post-Quantum Migration Needs to Happen by 2029. https://www.coindesk.com/tech/2026/03/28/watch-out-bitcoin-devs-google-says-post-quantum-migration-needs-to-happen-by-2029

[25] Federal Reserve Board. (2025). Quantum Computing and Cryptocurrency: Policy Considerations. Finance and Economics Discussion Series. https://www.federalreserve.gov/econres/feds/files/2025093pap.pdf

量子计算的最新进展对加密行业的冲击与应对 was originally published in HashKey Capital Insights on Medium, where people are continuing the conversation by highlighting and responding to this story.

A Digital Asset Treasury (DAT) is a type of publicly listed company whose core strategy is to hold digital assets. In Part 1 of this series, we introduced DAT’s basic concept, operating model, and defining features. This second installment addresses two questions:

1. From an operator’s perspective, how do you build a DAT?
2. From an investor’s perspective, how do you select high-quality DAT companies?

1. How to Build a DAT

From the operator’s standpoint, there are two main paths to establishing a DAT:

1. An existing company proactively purchases digital assets to pursue a strategic transformation similar to what firms like Microstrategy and Tesla are doing. The process generally includes board approval, treasury-management policy updates, engagement of qualified custodians, and public disclosure to investors.
2. A new listed digital asset company can be established through capital market transactions such as reverse takeovers (RTOs) or SPAC/backdoor listings.

Whichever path is taken, the company must plan sensibly around asset allocation and market strategy/listing venue selection.

1.1 Proactive Purchases / Strategic Transformation

Some companies transition into a DAT due to strategic, business, or financial considerations. Early DAT examples — such as MicroStrategy (later renamed Strategy) — largely fall into this bucket. In 2020, under the CEO’s leadership, Strategy launched a Bitcoin reserve strategy that drove its market capitalization from USD 1.436 billion to USD 112 billion by 2025. Similarly, Japan’s Metaplanet, originally in the hotel business, announced in April 2024 that it would adopt Bitcoin as its primary reserve asset.

Successful transitions of this nature are often driven by a controlling management shareholder and subsequently endorsed by the board and shareholders. Accordingly, any listed company considering a shift toward a DAT-style model should carefully evaluate how its core business aligns with a digital asset–holding strategy for additional synergies, while also assessing shareholder backing and the associated accounting and tax implications.

1.2 Using a Shell Company

Today, many DAT projects/companies are established via approaches such as reverse takeovers (RTOs), de-SPAC mergers, and PIPE capital injections. Several aspects in this process merit attention from DAT teams.

1.2.1 Choosing the Target

An ideal shell should be listed in a suitable market, be cost-effective to acquire, have no significant legacy liabilities, and have a shareholding structure that allows control without breaching listing float rules. Preferably, its share price has been depressed yet stable — especially without recent spikes — and a smaller share count eases future issuance subject to minimum public float. Concentrated ownership reduces friction with the original team and board. Prior disclosures related to crypto are a plus, as they link the business to a future DAT narrative and can smooth regulatory review.

Different markets have unique traits and regulatory barriers. In the U.S., there are small-cap shells on Nasdaq and the OTC markets, but one must screen for hidden debt or legal issues. Reverse-merger shells exist but carry elevated liability and disclosure risks. Hong Kong Main Board listed companies tend to be pricier, have a sustainable business model and operate under stringent regulation; GEM (Growth Enterprise Market) listed companies often have lower liquidity. Currently, the Hong Kong market is gradually rolling out new investment opportunities, such as the launch of a Solana spot ETF, but DAT companies still face severe regulatory resistance in Hong Kong. Japan has fewer shell opportunities, and where available, they are subjected to Tokyo Stock Exchange rules regarding number of shareholders, tradable shares, and market capitalization.

1.2.2 Choosing the Mechanism

Financing can take multiple forms, including RTO, de-SPAC, and PIPE.

RTO

RTO (Reverse Takeover) is one of the most common shell routes. It refers to a private company being acquired by a listed “shell company,” thereby achieving an indirect listing. The key is to find a listed entity that is compliant and either no longer operates its core business or whose core business can be wound down. For teams aiming to build a DAT, RTO offers several advantages:

• Rapid access to listed status, skipping the lengthy IPO review
• Often lower valuations, making it cheaper to obtain control

But there are also risks and drawbacks:

• The shell may carry historical baggage, financial issues, or a complex cap table
• Limited initial financing capacity, requiring follow‑on PIPE placements
• Compliance risks, as both U.S. and Hong Kong markets have recently tightened scrutiny on RTOs. In addition, if the exchange deems the new share issuance in an RTO to constitute a reverse acquisition, the deal must be reviewed under new‑listing standards.

de‑SPAC

de‑SPAC refers to merging with an already listed Special Purpose Acquisition Company (SPAC) to achieve the target company’s listing. Because the SPAC passes listing approval at the IPO stage, the de‑SPAC process focuses more on disclosure and shareholder voting, with review emphasis on transaction fairness and sufficiency of disclosure rather than rerunning the full IPO gauntlet. Advantages include:

• Review is relatively simpler versus IPO
• SPAC cash/commitments provide valuation anchors

Risks include:

• A SPAC must complete its de‑SPAC within its effective period, typically 18–24 months, or return funds to IPO investors, creating a time‑window constraint

For an RTO or de-SPAC, you need a reasonable valuation anchor. A credible valuation anchor is essential to support negotiations and regulatory review. In practice, valuation is based on the fair market value of the combined business or injected digital assets, verified by independent experts where required. A reasonable premium may be applied to reflect the combined group’s future capital-raising potential and growth prospects, thereby aligning incentives between new and existing shareholders. Lock-ups for legacy shareholders help prevent immediate selling post-reorganization that could pressure the stock.

PIPE

Beyond RTO and de‑SPAC, financing can also be done via a shell company’s PIPE (Private Investment in Public Equity). PIPE places new shares with a limited set of qualified investors. Its advantages include:

• A process similar to RTO but more streamlined, with directed issuance approved by shareholder vote, while taking care not to issue to a controlling level
• Greater flexibility and generally lower frictional costs

The main risks and drawbacks lie in careful design of PIPE structures and discounts to avoid excessive dilution pressure on the share price.

A PIPE (Private Investment in Public Equity) introduces strategic investors through a board-approved private placement of shares or convertible instruments to specific investors. Unlike a Reverse Takeover (RTO), a PIPE is primarily a financing mechanism rather than a change-of-control event, and it is generally more streamlined procedurally — provided the issuance does not necessarily result in change in effective control unless that outcome is intended.

1.2.3 Choosing Partners

Standing up a DAT typically involves multiple counterparties:

Investment Banks

Key partners that source shells (and conduct due diligence), locate PIPE investors, and advise on execution. Prior experience and familiarity with shell resources are important selection criteria.

Placement Agencies

Focus on private placement transactions, especially central in PIPE deals. Typical responsibilities include introducing qualified investors, helping set financing terms such as lockups, redemption, and discounts, and coordinating legal disclosures and regulatory filings.

PIPE Investors

Lead investors often seek control rights and a say in operations. The first PIPE greatly shapes a DAT’s initial trajectory, so it’s crucial to bring in strategic institutions aligned with the DAT’s thesis.

Asset Managers

Responsible for executing the DAT’s digital asset portfolio, including purchases, on‑chain staking, and yield strategies. Projects can build in‑house teams or outsource to managers with on‑chain execution and custody capabilities.

Custodians

Safekeep the DAT’s crypto assets, enforce signing‑authority segregation, and provide on‑chain address attestation. They must also meet audit requirements and compliance standards such as SOC 2.

Legal Counsel

Core advisors for structuring the DAT strategy. They help interpret securities‑law boundaries, draft financing documents for PIPE and other tools, and complete exchange disclosure documentation.

Auditors

Play the audit role in the DAT model, covering fair‑value measurement of assets, NAV/mNAV and related financial disclosures in annual and quarterly reports. They are critical to ensuring digital assets are accounted for compliantly on the balance sheet and that corresponding audit opinions are provided.

1.3 Asset Allocation

A DAT’s asset allocation strategy determines its risk–return profile, market narrative, and ongoing fundraising capacity.

Core assets: BTC/ETH/SOL

• Bitcoin is “digital gold” with inflation-hedging and store-of-value attributes — often the base allocation for DATs.
• Ethereum offers growth potential plus staking yield, providing a more predictable return stream.
• SOL, BNB, and others have drawn some DAT allocations in 2025 due to performant base chains, vibrant ecosystem, and efficient operating teams.

Most DATs concentrate in one major asset to craft and reinforce a clear brand and core narrative for investors (e.g., Strategy ↔ Bitcoin, BitMine ↔ Ethereum). Multi-asset DATs — with more flexible rebalancing — can mitigate single asset risk and may gradually emerge and capture share.

Pros of major-cap allocations: mature playbooks and lower risk vs. smaller tokens.

Cons: more competitors, tighter fundraising conditions as the theme gets crowded.

1.4 Venue and Market Comparison

The DAT model has spread from the U.S. to Asia and Europe, but market environments vary widely. Companies should choose a listing venue based on financing tools, regulatory framework, investor base, and liquidity. Below we compare the U.S., Hong Kong, and Japan across these four dimensions.

1.4.1 United States

The U.S. is DAT’s core market — characterized by diverse financing tools, mature capital market infrastructure, strict disclosure regime, and high volatility and valuation elasticity.

Listing & Issuance Tools

U.S.-listed DATs have broad financing flexibility. They use at-the-market (ATM) equity programs, larger follow-on equity offerings, large convertible note issuances, and — more recently — perpetual preferred stock structures to raise billions of dollars and purchase additional crypto assets. For example, Strategy issued four series of preferred stocks and multiple convertibles notes within a short span, raising billions of dollars. In bull markets, these tools let U.S. DATs quickly “reload” and scale holdings.

Regulatory Framework

The U.S. has robust disclosure rules. Listed firms must promptly disclose significant crypto purchases, financing, and risk factors around crypto concentration, liquidity and custody of assets. Custody and AML standards are high; DATs generally use regulated custodians and adhere to OFAC/FinCEN requirements when conducting capital raises. The Financial Accounting Standards Board (FASB) issued ASU 2023–08, which requires in-scope crypto assets to be reported at fair value, with unrealized gains and losses flowing through earnings and enhanced footnote disclosure. The standard becomes mandatory for fiscal years beginning after December 15, 2024 (effectively 2025 reporting), with early adoption permitted in 2024. Economically, these vehicles give investors indirect crypto exposure through a U.S.-reporting, exchange-traded equity wrapper, which many institutions and family offices can hold more easily than spot tokens.

Investor Base

A mix of institutions and retail. Hedge funds and family offices view DATs as new vehicles for crypto exposure; retail investors are driven by momentum and narrative The U.S. risk appetite is high with established leverage and shorting mechanisms — as such, DAT stocks often show greater volatility than the cryptocurrencies themselves.

Liquidity

Deep market leaders like MSTR trade heavily; options and broad market coverage add further liquidity. This aids continuous capital raising via ATMs and follow-on offerings but also makes prices highly news sensitive. Market makers and quantitative funds provide liquidity that helps dampen short-term volatility and facilitate smoother capital raising through ATMs and follow-on offerings.

Overall, the U.S. offers the highest valuation ceiling and financing convenience, alongside higher volatility and regulatory scrutiny.

1.4.2 Hong Kong

Hong Kong is a global financial center with transparent regulation and an international investor base — an important bridge for DAT’s expansion into Asia.

Listing & Issuance Tools

Main Board issuers can conduct board-authorized placements (generally ≤20% of issued shares) without convening a shareholder meeting each time. Recently, several Hong Kong–listed companies like Boyaa Interactive have used placements and top-up placings to raise capital specifically for digital asset or crypto-related expansion after market rallies.

Regulatory Framework

Regulators are supportive of virtual asset activity but apply caution. Corporate crypto purchases are permitted with adequate disclosure, compliant funding sources, and AML/CFT adherence, robust custody, and continuing business substance under Rule 13.24. Under IFRS, holdings are treated as intangible assets: impairments are recognized but unrealized gains are generally not. Thus, HK DATs typically provide market value of holdings in the notes to aid investor assessment.

Investor Base

Mix of local and global capital. International hedge funds/family offices can access DAT exposure via HK equities; Mainland investors can participate through Stock Connect (though some small caps are excluded). Compared with the U.S., HK investors emphasize fundamentals and long-term story, so local DATs often highlight ongoing sustainable business operations beyond just a treasury model adhering to Rule 13.24. Exchanges may request clarification announcements on sharp moves to curb speculation ensuring investor protections.

Liquidity

Highly uneven. Large-cap stocks and Connect-eligible names tend to have deep turnover, while smaller caps stocks can be extremely thin and exhibit sharp swings when sentiment toward digital assets heats up. DATs are typically small/mid-cap; liquidity depends on sentiment and institutional participation. International and Mainland-accessible capital can create valuation upside for crypto-themed issuers, but that premium is generally more constrained than the extreme multiples sometimes seen in U.S. DAT names, where investors have historically paid very large premiums over the marked value of the underlying tokens. Arbitrage opportunities (vs. U.S. peers or ETFs) also draw global investors.

1.4.3 Japan

Japan has seen the rise of pioneers like Metaplanet and Quantum Solutions being leading DATs in the japanese market. Metaplanet is the largest Bitcoin-holding company in Japan and ranks fourth globally. It has been referred to as the “Strategy of Asia.” Quantum Solutions has also become the largest Ethereum-holding company in the Japanese market. The Japanese market is known for its prudent investment culture and strong institutional framework, which has recently attracted international investor interest. Japan’s regulatory environment, while cautious and risk-focused, provides a clear and structured framework for digital asset activities. Under the Financial Services Agency’s (FSA) supervision, companies may hold and disclose digital assets on their balance sheets provided they comply with existing accounting, disclosure, and transparency requirements.

Listing & Issuance Tools

Funding is primarily via third-party allotments or public offerings (new share issuance), under cautious processes. ATM is uncommon; convertibles require strict conditions and are typically underwritten by major securities houses. Compared with the U.S. and Hong Kong, Japanese fundraising is procedurally controlled and more negotiated. Japanese DATs often proceed gradually: first deploy own cash to buy crypto; after appreciation, conduct small placements at favorable levels to scale reserves (as Metaplanet did).

Regulatory Framework

Accounting treatment is similar to IFRS (crypto as intangible assets), making P&L measurements conservative. The FSA closely reviews crypto companies that enter crypto, requiring detailed business rationales, governance frameworks, and anti-speculation measures. Custody and security standards are stringent; assets must be with licensed custodians or protected by robust internal controls to avoid audit qualifications.

Investor Base

Dominated by domestic institutions (banks, insurers, pensions) and retail. The DAT trade has attracted investors looking to optimize capital efficiency. A major driver is tax policy: personal crypto gains can face taxes up to 55%, whereas equity capital gains are ~20%. Thus, buying Metaplanet stock can be a lower-tax proxy for Bitcoin exposure — an idiosyncratic feature of Japan.

Liquidity

Moderate overall. DAT stocks may start thin but can become active as awareness grows. There are no designated market makers; liquidity is organic. Names like Metaplanet soared during Bitcoin bull phases and later retraced — showing high correlation with BTC.

2. How DATs Finance Themselves

DAT financing tools are evolving rapidly, forming a multi-tiered, diversified toolkit. These vary by speed, cost, investor appetite, and disclosure complexity, suiting different stages and sizes of DATs.

At-the-Market Offering (ATM)

An ATM lets a listed company sell new shares directly into the market at prevailing prices in small, continuous tranches via a broker, accumulating cash over time. There’s no need to negotiate with specific investors, and the company controls execution.

ATMs don’t deliver lump-sum proceeds; capital is built gradually, depending on liquidity and sell cadence. But they avoid large one-off dilutions, fitting a steady, ongoing crypto allocation strategy.

Private Investment in Public Equity (PIPE)

A PIPE is a private placement of shares to specific institutions or investors, bypassing public offering processes to secure a large capital raise quickly.

PIPEs often come at a discount with other favorable terms to compensate for liquidity constraints. Their hallmark is speed: once terms are set, signing, funding, and issuance complete rapidly. For DATs seeking to build positions fast, PIPEs are an efficient “one-shot” solution.

Convertible Bonds (CB)

Convertibles combine debt and equity features. The issuer sells bonds with an option for investors to convert into equity at a preset price within a window. If the stock doesn’t rise, bondholders expect repayment; if it does, they convert to capture upside.

CBs are relatively fast and can raise large amounts. Coupons are usually lower because the conversion option has value. The key risk for a DAT is: if the stock underperforms, the debt must still be repaid. Weak price performance at maturity can force asset sales (e.g., selling coins) to meet obligations.

Preferred Shares (PS)

Preferred shares are hybrid securities with equity and debt characteristics. Strategy pioneered a suite of four preferred share series — STRC, STRD, STRF, and STRK — as alternative financing for its Bitcoin acquisition strategy. Functionally akin to digital credit products, they provide new capital without immediately diluting common shareholders (MSTR). Each series has distinct yields, seniority, and conversion terms.

Preferred shares are typically privately placed with specific investors, enabling fast, sizable fundraising. The cost is the dividend, but they avoid immediate common dilution. The STR series offered 5.6%–7% net annualized yields (after a 30% tax assumption). For DATs, this cost sits below common equity, above traditional debt.

Equity Line Agreement (ELA)

An ELA is a flexible “equity drawdown” arrangement: the DAT signs an agreement giving it the right (not the obligation) to sell common stock to an investor up to a specified limit and period.

Control sits with the company, which decides when and how much to sell based on share price, market conditions, and funding needs. This makes the ultimate financing amount more predictable, addressing prior uncertainty. Because the facility can be tapped as needed, the company can raise funds to buy digital assets without destabilizing the share price, and potentially narrow discounts when the stock trades below NAV.

Table: Comparison of key DAT financing tools

3. How to Assess a DAT’s Investment Value

Evaluating DATs requires a framework distinct from traditional companies. Performance depends on the underlying team leadership, capital markets execution, long term value of the asset, risk management as well as other financial indicators. Below are common key metrics, their formulas, and considerations.

Leadership

Soft factors like the founding team often matter most in the DAT model. DATs rely heavily on a founder’s influence in the community and sustained financing ability. For example, Michael Saylor’s impact on both community and investors, or Tom Lee for BitMine. A highly influential leader strengthens fundraising, keeping the DAT flywheel turning. This leadership moat is hard for imitators to replicate through financial engineering or governance alone.

Management and governance capability

Success depends on management’s timing and capital‑markets execution. Companies should weigh market conditions against their own share price and financial position to choose the right instruments for ongoing operations. For instance, Strategy relied heavily on convertibles early on, shifted toward ATM in 2024, and in 2025 issued multiple series of preferred shares such as STRK, STRF, STRD, and STRC.

Ecosystem participation and long‑term value

DAT is not merely “buy and hold.” Strong models embed the company in the underlying asset’s ecosystem to create mutual reinforcement. With ETH, for example, a DAT can stake to support network security and earn yield. Over time, they may also participate in low‑risk on‑chain protocols to enhance returns, and invest in ecosystem projects, incubation, and developer communities.

Financial indicators

Alongside the qualitative factors, use quantifiable metrics to analyze a specific DAT’s status. Post‑investment, monitor these indicators to manage positions, including decisions to add or exit.

Financial Metrics

Net Asset Value (NAV)

Refers to the total market value of the company’s digital assets minus related liabilities, divided by the number of shares outstanding to get per‑share crypto asset value.

NAV Multiple (mNAV)

The ratio of share price to per‑share NAV, indicating the premium or discount versus underlying crypto value. It can also be approximated by company market cap divided by treasury asset value.

mNAV > 1 implies a premium. mNAV < 1 implies a discount. Deeper interpretation: mNAV reflects the market’s view of the company’s “future value creation” ability. Calculations can be refined using basic versus fully diluted share counts.

If mNAV > 1, the stock trades at a premium to its coin value; if mNAV < 1, it trades at a discount. At a deeper level, mNAV expresses the market’s view of the company’s future value-creation capacity. One can refine calculations using basic vs. fully diluted share counts.

Bitcoin/Base-assets per Share (BPS)

The amount of a given crypto (often BTC or ETH) held per share.

This shows capital allocation efficiency. If, after accounting for dilution, per‑share holdings still rise, existing shareholders’ exposure is “amplified” and value is being created. Strategy, for example, increased BTC per share from about 0.001 to roughly 0.045+, implying a strongly positive “Bitcoin Yield.” The opposite — frequent issuance without sufficient purchases — erodes BPS.

Bitcoin Yield

Proposed by Galaxy Digital in 2025, this measures the percentage change of BTC per share after accounting for dilution. It’s the change in BTC per share over a period divided by beginning BTC per share. For example, if BTC/share rises from 0.01 to 0.015 over a year, Bitcoin Yield = 50%. It’s akin to a fund’s return but specific to per-share digital asset accretion — a key indicator of whether the DAT flywheel is working.

Leverage

Not DAT-specific per se, but investors should track debt relative to asset value (e.g., Debt / Market value of holdings) or debt per coin (debt per BTC). Excessive leverage amplifies upside and downside and must be assessed via financial statements.

In all, DAT equities are a way to participate in crypto bull–bear cycles via a traditional equity wrapper. The allure is the dual positive impact of crypto price + premium expansion in bulls (e.g., MicroStrategy vastly outperformed Bitcoin from 2023–2025). Conversely, during bear market, the dual impact can also amplify losses (asset decline + premium flipping to discount) causing premiums to vanish and market caps shrink — prompting broader skepticism of the theme.

4. Risk Management

DAT operations span four core functions: raising capital, asset management, revenue streams, and coin/equity dual-growth mechanics. Risks arise both internally (financing structure, custody/operations, organizational design) and externally (market volatility, policy changes) due to the highly volatile underlying assets.

During capital raising, DATs commonly use equity and convertibles. Different instruments carry different risks.

Financing Structure Risks:

Equity Financing Risks

With ATMs, companies can continuously issue small amounts in the open market. Though each tranche is small, cumulative issuance expands share count, diluting existing holders and EPS. Beyond the usual effects, ATMs face three key risks:

1. Timing risk: Long execution windows mean persistently weak prices can force lower sale prices, raising capital costs and jeopardizing targets.
2. Uncertain size/pricing: ATM outcomes depend heavily on market conditions and liquidity which companies have less control hence complicating treasury planning.
3. Transparency concerns: Running repurchases alongside issuance demands strict compliance to avoid any appearance of market manipulation.

Debt Financing Risks

Convertibles can include put features. If the stock trades below thresholds for an extended period, investors may exercise their puts to force redemption at par value. Large-scale puts can create cash-flow stress, forcing high-cost refinancing to meet redemptions, amplifying credit risk in the event that cryptocurrencies fall in value.

Governance Risks:

During the asset management phase, companies holding significant financial assets must balance two primary objectives: custody security and enhancing investment returns. Beyond meeting the core requirement of asset security, effective allocation is essential to optimize management returns. This phase presents the following risks:

• Custody & Operational Risk: Key management, hacking, and internal fraud are ever-present threats. DATs rely on third-party custodians or use multisig wallets and cold storage, yet history has seen exchange thefts and lost keys.
• Allocation Risk: Moving from single asset to diversified allocations may be constrained by investor agreements and increases custody complexity and management difficulty. Having more assets also increases volatility of shares.
• Business Model Risk: Pure “buy-and-hold” strategies can carry opportunity costs; value must be enhanced through staking and other designs to improve returns. For example, many U.S. Ethereum-holding companies generate income by participating in staking, forming a differentiated business model from pure BTC holders.
• Liquidity Risk: Reflected in average trading volumes, bid-ask spreads, and market-making depth. In extreme market conditions, assets may be difficult to liquidate quickly, potentially triggering a liquidity crisis.

Business Risk

Running a DAT company that relies on continuous funding and value accrual to tokenholders through token purchases can bring several challenges:

• Financial Sustainability: Excessive leverage and opex compress margins and long-term financial health. If company is unable to manage debt financing effectively, this could lead to valuable assets unwinding.
• Asset Disposition Risk: Forced sales may occur at market lows or amid illiquidity — creating a dual impact on both shares and asset value.

External Risks

At the coin/stock dual-growth mechanism level, if the strategy is appropriate, a virtuous cycle can be formed. However, DATs also face external risks from the macroeconomic environment:

Market Risk: Black swans or negative narratives can trigger sharp drawdowns. BTC declines can often lead to magnified declines in altcoins. Asset dwindling value translates into stock price declines. If liquidity tightens and/or negative signals proliferate, investors may redeem en masse; managers then sell at low prices to meet outflows, risking a redemption–selloff–NAV drop–more redemptions spiral that can culminate in default.

Policy & Regulatory Risks:

• Policy Continuity: Crypto policies often track political leadership. A shift in administration to one unaccepting of crypto could change direction and challenge existing frameworks.
• Legal Characterization: Different regulatory regimes around the world regulate the listings of digital asset treasury firms differently. Some countries may oppose the trading of pure cash/liquid assets company without a viable and sustainable business model hence hindering the growth of DATs.
• Jurisdictional Differences: Tax regimes and crypto acceptance vary widely, creating a complex compliance landscape.

Conclusion

This report outlined, from both operator and investor perspectives, how to build and how to invest in DATs, introduced a key metric set, and discussed related risks. The next part of this series will focus on practical FAQs frequently encountered by DATs.

References

• https://www.metaera.hk/contents/232749
• https://foresightnews.pro/article/detail/90339
• https://app.artemisanalytics.com/digital-asset-treasuries?tab=overview
• https://www.theblock.co/data/treasuries/bitcoin-treasuries

Digital Asset Treasury (DAT) Report, Volume 2: How to Build One and How to Invest in One was originally published in HashKey Capital Insights on Medium, where people are continuing the conversation by highlighting and responding to this story.

Download the report here: DAT Report — Chinese | DAT Report — English

How DAT is Reshaping the Investment Landscape

Over the past five years, the Digital Asset Treasury (DAT) model has progressed from a niche experiment into a recognized capital market trend, embraced by firms ranging from MicroStrategy in the United States to Metaplanet in Japan, as well as dozens of other publicly listed companies worldwide. DAT companies have not only reshaped the balance sheet of their companies by incorporating digital assets such as Bitcoin and Ethereum but also provided investors with a way to differentiate themselves from their competitors. By incorporating digital assets such as Bitcoin and Ethereum into their balance sheets, DAT companies not only reshape their capital structure but also provide investors with an alternative investment opportunity that is different from ETFs and funds.

This report, as the first of our DAT series, will give a primer on DATs and analyze its strategic significance in the capital market and crypto ecosystem. Through data and case studies, we will see why more and more companies are choosing to become “coin stocks” and how this model can serve as a bridge between traditional finance and the world of digital assets.

1. What is DAT

DAT is a business model in which a publicly traded company pursues a strategy of accumulating digital assets such as Bitcoin and Ethereum as a core part of its business. It is not only an adjustment of asset allocation, but also a strategic positioning of enterprises for the future digital economy.

Digital Asset Treasury Companies (DATs) have become an important narrative in the digital asset ecosystem as institutional capital continues to flow in and actively seek digital asset allocation. These companies are typically publicly traded and have publicly announced plans to make significant long-term accumulation of digital assets part of their core business strategy.

Exemplified by the success of MicroStrategy along with favorable regulatory policies in the U.S. regulatory level, have driven the rapid growth of digital asset treasury companies. The executive order signed by President Trump officially allows for the creation of a strategic Bitcoin reserve; meanwhile, institutional investors are now able to measure digital asset positions at fair value, enabling digital asset strategies to be recognized and validated on corporate balance sheets. Driven by these favorable factors, market demand for digital asset treasury has followed quickly. In terms of regional distribution, the U.S. is the largest market for these treasury companies. Such companies are still required to follow stringent capital reporting requirements and must work closely with regulated custodians, cryptocurrency exchanges, and market makers for successful execution of the strategies. Other regions are following suit, with Asian firms taking a more prudent approach, balancing risk appetite with regulatory robustness.

Currently, most treasury firms hold mainly Bitcoin and Ethereum, but some organizations are starting to accumulate other emerging high-quality assets, such as Solana, XRP, HYPE, SUI and others. According to current public data, publicly traded companies hold a total of 1,011,352 Bitcoins, or about 5% of all Bitcoins on the network, with MicroStrategy being the largest holder. Corporate positions in Bitcoin have doubled in size since 2025. Meanwhile, the Ethereum treasury companies’ total holdings of approximately 5.25 million ETH represent approximately 4.34% of the entire network’s Ethereum.

2. Brief History and Development of DAT

DAT first gained traction when MicroStrategy announced in December 2020 that its **Bitcoin purchases in 2020 totaled more than $1 billion.** Over the course of five years, MicroStrategy has increased its Bitcoin holdings several times through its own cash, bond issues, and stock offerings. As of September 16th, data shows that MicroStrategy holds 638,985 Bitcoins, making it the largest Bitcoin holding company.

According to MicroStrategy Bitcoin holdings data, MicroStrategy increased its Bitcoin holdings at a rate of less than 100,000 per year for the first four years, surpassing 200,000 in 2024, and approaching 200,000 Bitcoins in 2025.

Based on the chart below on the adoption of Bitcoin treasury companies, MicroStrategy’s annual increase in Bitcoin holdings is accompanied by 64 additional publicly listed firms that began holding Bitcoin between the end of 2024 and the first half of 2025, bringing the total to 190 public companies. Alongside these, 64 private firms have also disclosed current or past Bitcoin holdings. Collectively, these public and private entities hold approximately 1,011,352 and 299,207 BTC, respectively.

The historical trend chart of Bitcoin holdings shows that the growth in Bitcoin holdings of publicly traded companies jumped at the beginning of 2021 and the end of 2024, primarily driven by several operations by MicroStrategy. Bitcoin holdings of unlisted companies jumped in the second half of 2022, mainly due to the inclusion of 164,000 bitcoins held by Block.one.

These Bitcoin holding companies span across countries, with half of the publicly traded companies coming from the U.S. and Canada, and nearly half of the private companies coming from the U.S., as shown in the pie chart data.

The evolution of Bitcoin DAT has been marked by consistent, steady participation across multiple companies and regions.

Over the past five years, the composition of DATs has become increasingly diversified, expanding beyond Bitcoin to include other large-cap digital assets such as ETH and SOL. Ethereum-based DATs emerged in April of this year and nearly doubled in size during July and August, reflecting a rapid acceleration in growth.

In comparison to Bitcoin DATs, there are 17 Ethereum-based DAT entities, collectively holding about 3.88 million ETH. The profiles of these 17 treasury companies consist of 15 listed companies, 1 is preparing to go public, and 1 is an on-chain agreement. The listed companies include 12 U.S. companies and 3 Chinese (Hong Kong) listed companies. There is a clear difference in this distribution compared to Bitcoin DAT, especially with the presence of one subject, the on-chain protocol ETH Strategy, whose tokens are STRAT issued at Uniswap. This situation stems from the differences in the technical aspects of Ether and Bitcoin, with Ether’s smart contracts allowing the construction of complex DApps and therefore a richer ecosystem.

Solana is closely followed by eight listed entities in three countries, according to coingecko data.

Bitcoin, Ethereum, and Solana are the main assets held by digital asset treasury companies. Below, we break down the key adoption metrics between DATs of these 3 assets.

From the table, we can learn that the number of companies holding BTC is much higher than that of Ethereum and Solana, reaching 15 times and 30 times of them respectively, a phenomenon that underscores Bitcoin’s value propositions as an asset diversification and inflation hedge.

An analysis of DAT companies by asset market share reveals significant concentration risks. Among BTC DAT companies, MicroStrategy holds 49% of the market — substantially higher than the second-largest holder at 13%. While MicroStrategy’s dominance reflects scale, its outsized position and high BTC exposure conceal potential vulnerabilities. As a market bellwether, any sharp decline in Bitcoin’s price or disruption of its DAT strategy could pose systemic risks. For ETH DAT companies, concentration is even more pronounced: the largest holder controls 55%, followed by 21% for the second, with the top three collectively accounting for 90%. This indicates a highly unbalanced structure. By contrast, the SOL market is more evenly distributed, with the top three holders each maintaining roughly 30% market share, suggesting a relatively balanced market structure.

Beyond BTC, ETH, and SOL, DATs also hold a range of other altcoins as underlying assets. These include public chain tokens such as TRX, SUI, and XRP; exchange platform coins like BNB; decentralized contract platform tokens such as HYPE; and even niche tokens like the Trump family’s WLFI. The value of these holdings varies widely, typically ranging from approximately $300 million to $2 billion. This continues to intensify going into Q3 2025, and we expect more DATs to emerge with other assets as underlying or hold a mix of cryptocurrencies or a mix of cryptocurrencies and DAT companies’ equity stake.

Multi-asset DATs are beginning to emerge. For example, Lion Group (LGHL) announced in September that it would convert all of its SUI and SOL holdings into HYPE tokens. In addition, some DATs have started investing in each other. A case in point is KindlyMD (NASDAQ: NAKA), a subsidiary of Nakagawa Holdings, which disclosed plans to participate in the international equity financing of Metaplanet, a Japanese company specializing in Bitcoin reserves.

3. Characteristics of DATs

Digital asset treasury (DAT) companies — whether single- or multi-asset — represent an emerging business model that both parallels and diverges from ETFs, traditional corporations, and other listed financial products. While they share baseline obligations such as financial reporting and regulatory compliance, DATs stand out through their heightened transparency in digital asset holdings, their ecological integration with the blockchain ecosystem, and their emphasis on aligning compliance standards with evolving digital finance regulations.

Strategy Openness as a Strategic Advantage

Firms are required to publicly announce their DAT strategy and disclose positions during financial reporting periods. However, several firms like MicroStrategy have taken the approach of voluntary disclosure beyond regulatory requirements that have enabled them to quickly gain trust and a premium in the market. MicroStrategy has also introduced a new metric called “Bitcoin Yield,” which measures the percentage increase in the number of BTC held per share. This voluntary transparency helps attract investors who support a long-term strategy, while also serving the broader market by ensuring a clearer understanding of potential risks.

Ecological Synergy

The fate of DAT companies is deeply tied to the ecosystem of digital assets they hold. When a company holds a large amount of a certain token, it becomes a significant stakeholder in that blockchain ecosystem and thus has an incentive to invest resources in advancing the ecosystem. One notable example is BitMine Immersion, the largest ETH treasury holder, which actively participates in staking the Ethereum to maintain the network’s security while generating additional staking yields. The company’s own growth and the ecosystem’s prosperity form a positive cycle — the company benefits from token appreciation and new revenue channels, while the ecosystem benefits from having less speculative activity surrounding its native token. This synergy generates shared value for DAT investors and project communities alike, while contributing to the long-term sustainability of the digital asset ecosystem.

Compliance Evolution

As U.S. regulation and accounting have evolved — most notably FASB’s move to fair-value accounting for crypto assets — DATs are becoming an increasingly common sight. What was once atypical (corporate direct holdings of volatile digital assets) is now addressed through clearer recognition, measurement, and disclosure frameworks in SEC filings. U.S.-listed DAT firms are subject to PCAOB-audited reporting and robust risk disclosures; many also adopt third-party, qualified custody and enhanced controls as best practices, even where not strictly required by rule. Meanwhile, the advent of spot Bitcoin and Ethereum ETFs offers compliant alternatives for investors and heightens expectations around governance, transparency, and risk management. Looking ahead, the convergence of traditional capital market regulatory frameworks and digital asset standards globally carved out new opportunities for DAT companies to benefit from crypto upside while being regulatory compliant.

4 Comparison with other financial instruments

A central perspective in assessing the investment value of DAT is to analyze it comparatively within the broader spectrum of financial instruments. We have selected direct investments in cryptocurrencies, cryptocurrency spot ETFs, and shares of DAT companies, evaluating them across four key dimensions: liquidity efficiency, price elasticity, leverage structure, and downside protection (see table below for details). Our analysis suggests that DAT is not a simple replacement for the first two financial instruments, but rather a more advanced, composite vehicle that combines the characteristics of both equity and crypto assets, providing a unique source of alpha for professional investors.

Beyond Beta: Seeking Structural Alpha

At its core, direct and ETF investing is about capturing cryptocurrency beta returns, i.e. the underlying returns of the market. However, DAT’s investment logic goes beyond beta, with its core appeal being the acquisition of structural alpha.

• Direct ownership delivers pure play exposure: returns move with the underlying coin.
• Even with the benefits of compliance and convenience, ETF returns are essentially the underlying price performance net of the expense ratio — i.e., beta exposure.
• For DAT investors, the source of return is diversified: it includes not only the appreciation of the underlying crypto assets, but also from secondary market discounts, smart leverage, cross-market arbitrage, onchain yield generation capabilities, and the execution of the management team. This alpha does not come purely from market volatility, but rather from the value creation capabilities from experts with both traditional finance and digital assets background.

Upgrading the Dimension of Risk Management: From Passive Exposure to Active Management Traditional frameworks often treat volatility as a risk to minimize.

By contrast, a well-structured DAT can treat market variability as a managed input — sometimes even a revenue source — through portfolio construction, balance sheet choices, and market microstructure tools. While direct coin holders and plain-vanilla crypto ETFs primarily deliver beta exposure (absent derivatives or overlay strategies), a DAT’s corporate toolkit enables more active risk and return management:

• By issuing non-callable long-term debt (e.g., convertible bonds), DAT can magnify returns in bull markets, while in bear markets, its debt structure provides a cushion against the risk of mandatory liquidation due to margin calls.
• When DAT’s share price falls below its NAV (mNAV<1) due to market panic, this in itself attracts value investors and arbitrageurs, creating a built-in “safety cushion” mechanism, a dynamic risk-adjustment capability that the other two types of investment do not have at all.

In summary, DATs are not merely another route to hold cryptocurrencies; they are corporate vehicles that pair digital-asset exposure with balance-sheet and governance tools. For professional investors, DATs can complement direct or ETF holdings by potentially improving capital efficiency and enabling more active risk management — subject to mandate, governance quality, liquidity, and regulatory constraints. It represents not a replacement for the past, but an upgrade to the investment paradigm of the future. As Dr. Xiao Feng, founder of HashKey Group, says: “ETFs are good, but DAT is better”. The “better” part comes from its alpha creation ability, which comes from deep expertise both in traditional finance as well as in the digital asset space.

5. The Significance of DAT

As a new vehicle for connecting the traditional financial world with digital assets, the emergence of digital asset treasury companies is significant in a number of ways:

DAT is a bridge for traditional investors to enter the crypto ecosystem

Similar to ETFs, DAT companies provide a bridge for investors who are unable or inconvenienced to hold cryptocurrencies directly. However, DAT operates more flexibly than ETFs, as many institutional investors (e.g., public funds, pensions, etc., in some countries) are constrained by regulation from directly purchasing Bitcoin or related ETFs but can buy shares of overseas listed companies. Consequently, the DAT structure can broaden the addressable investor base for crypto exposure and help channel traditional capital into the digital-asset ecosystem, subject to local regulations and investment policies.

High-profile corporate allocations — such as MicroStrategy’s initial Bitcoin purchases — also drew broad attention from corporate treasuries, brokers, and other financial institutions, contributing to greater institutional engagement with digital assets. In this sense, DAT companies have acted as a bridge between traditional capital markets and the crypto ecosystem, normalizing crypto exposure within institutional portfolios.

Empowering the blockchain ecosystem and realizing a closed loop of value

The rise of digital asset treasury (DAT) companies has introduced a meaningful new channel of capital into the crypto ecosystem, supporting a self-reinforcing value cycle. On the market side, DATs accumulate tokens in secondary markets and — where permitted — deploy on-chain yield strategies (e.g., staking or liquidity provision). These activities can deepen liquidity, act as token sinks, and support price discovery, potentially dampening speculative churn and helping to foster greater ecosystem growth.

This kind of growth flywheel can make ecosystem more mature and realize a win-win situation for DAT investors and the project.

Refocusing on Long-Term Value Amid Short-Term Volatility

The DAT model reframes attention from short-term price moves to long-term value creation. While crypto businesses are often tagged as “speculative” and “volatile,” DATs emphasize building per-share net digital asset value rather than trading around quarterly fluctuations. For example, Caikou has stated that its core financial objective is to grow net digital asset value per share over time. In practice, this means management prioritizes sustained coin accumulation and the long-run fundamentals of the underlying assets, instead of opportunistic buying and selling to manage near-term P&L. As investors begin to assess DAT companies through a value-investing lens, the segment’s valuation framework can become more disciplined and stable. When long-horizon capital (e.g., value-oriented funds) starts investing in these companies in future, this improves the investor mix and may help temper extreme swings in both equity and token prices.

Ultimately, the focus shifts from short-term speculation to long-term asset compounding: the central question becomes whether the company’s per-share stack of Bitcoin/Ethereum — and the underlying networks’ fundamentals — are likely to be worth more in five to ten years. If so, interim drawdowns are less concerning. This mindset encourages more long-term holders and can support healthier, more resilient valuations across the digital-asset space.

Conclusion

Situated at the nexus of traditional finance and digital assets, digital asset treasury (DAT) companies act as bridges, enablers, and anchors. They broaden access by channeling traditional capital into crypto, expanding both the investor base and market acceptance. Their operational discipline in strategic accumulation and transparent reporting also foster a more mature ecosystem, strengthening regulatory alignment and a long-term fundamentals lens. Collectively, their rise underscores a broader participation in the digital economy: more companies are beginning to treat digital assets as strategic resources to be allocated and actively managed.

Our next report details the playbook for launching and running DAT companies and outlines a practical, investor-oriented approach to valuation.

References

• 財華社_財華網_財華社集團肖風香港演講全文：DAT 比 ETF 更好 我眼中的數字資産金庫​
• The Rise of Digital Asset Treasury Companies (DATCOs), https://www.galaxy.com/insights/research/digital-asset-treasury-companies
• Digital Asset Treasury Strategy, https://crypto.com/en/research/dat-strategy-coms-jul-2025
• Cryptocurrencies in the Balance Sheet: Insights from (Micro)Strategy — Bitcoin Interactions https://arxiv.org/pdf/2505.14655
• Adding Bitcoin to a Corporate Treasury https://www.fidelitydigitalassets.com/research-and-insights/adding-Bitcoin-corporate-treasury

Digital Asset Treasury (DAT) Report, Volume 1: Background and Introduction was originally published in HashKey Capital Insights on Medium, where people are continuing the conversation by highlighting and responding to this story.

On July 30, 2025, Ethereum celebrated its 10th anniversary. From its original vision as a “World Computer” to its evolving role as a settlement layer for assets, data, and applications, Ethereum is undergoing a profound and subtle transformation. As interest from traditional financial institutions accelerates and technical upgrades move forward, Ethereum is developing a dual-engine ecosystem driven by both technology and finance. At the same time, Ethereum’s core development teams appear to be re-centering their technical focus on Layer 1.

This report takes a relatively underexplored angle, Ethereum as a treasury asset, to reassess the network’s evolution and technical strategy. With more institutions (ETFs, public companies) beginning to accumulate and hold ETH, can this trend align with Ethereum’s protocol development and spark new synergies? By analyzing the deeper motivations behind Ethereum’s roadmap and introducing upcoming technical changes, this report aims to provide insight into how Ethereum’s future trajectory may be shaped by treasury-driven considerations.

1. “World Ledger” and Institutional Reserves

Ethereum is undergoing a deep identity transformation. It was once the playground for developers experimenting with decentralized applications: Web3’s “operating system.” Today, however, it is increasingly regarded as a global value ledger. This shift is evident not just in community discourse but in the evolving narrative and the asset type of ETH.

Narrative Shift: World Computer → World Ledger

One of the most notable changes in Ethereum this year is its narrative. On June 20, Vitalik Buterin retweeted ConsenSys founder Joseph Lubin, explicitly affirming that “Ethereum L1 is the World Ledger.”

This marks a sharp departure from the previous “World Computer” vision, where Ethereum served as a platform for complex on-chain logic (e.g., DeFi contracts). In contrast, the “World Ledger” framing emphasizes Ethereum as a global settlement layer for value, especially for assets like stablecoins and real-world assets (RWA).

Notably, both Vitalik and Lubin specified “Ethereum L1,” indicating a renewed focus on the base layer rather than the ecosystem at large.

Asset Shift: Institutional ETH Treasury Accumulation

In tandem with this narrative shift, institutional actors have begun acquiring ETH as a treasury reserve. According to Bitwise CIO Matt Hougan, from mid-May 2025 onwards, Ethereum-based exchange-traded products (ETPs/ETFs) and corporate treasuries have purchased approximately 2.83 million ETH, compared to just 89,000 ETH newly issued in the same period, a demand-to-supply ratio of 32:1. This imbalance is believed to be a key factor in ETH’s recent price appreciation.

As per the Strategic ETH Reserve tracker, several institutions now hold more ETH than even the Ethereum Foundation. For example, U.S. public company BitMine Immersion Technologies (founded by Tom Lee) holds around 566,800 ETH, and SharpLink Gaming (associated with Joseph Lubin) holds about 360,800 ETH.

2. ETH vs BTC: Distinct Treasury Models

Institutional ETH accumulation invites comparisons with Strategy’s sustained Bitcoin purchases. However, Ethereum’s monetary design differs substantially from Bitcoin’s.

Bitcoin has a fixed supply cap and a predictable issuance schedule (halving every 4 years). Holding a certain amount of BTC effectively secures a fixed percentage of the total monetary base.

In contrast, Ethereum’s issuance changed dramatically after the 2021 London upgrade and EIP-1559. Now, a portion of ETH transaction fees (base Fee) is burned. When on-chain activity is high, the burn rate can lead to net deflation. When activity is low, ETH issuance results in net inflation. Thus, ETH supply is tightly linked to network usage.

This makes Ethereum less “buy-and-hold” friendly as a treasury asset: without sufficient L1 activity, ETH becomes inflationary, diminishing its scarcity. This effect intensified after the 2024 Dencun upgrade, which slashed L1 gas fees and dramatically reduced ETH burn, leading to Ethereum’s first sustained inflation trend since The Merge.

According to data from ultrasound.money, Ethereum currently experiences a net issuance of around 70,000 ETH per month — roughly one-third of the Ethereum Foundation’s holdings. This means even large institutional buyers face challenges maintaining a significant impact.

In contrast, Bitcoin’s issuance schedule is unaffected by network activity. As a result, Ethereum’s value accrual is more usage-dependent: only when there is sufficient on-chain activity and fee burn can ETH maintain its “ultrasound money” status.

3. Shifting Ethereum’s Technical Roadmap

Given the tight linkage between ETH’s economic model and network usage, boosting mainnet activity has become essential to maintaining ETH’s value.
For years, Ethereum has followed a “Rollup-Centric” roadmap: keep L1 lean and secure, offload scaling to Layer 2. Vitalik has repeatedly articulated this vision, emphasizing rollups as the primary medium-term scalability solution. This strategy made sense when L1 gas fees were high, and TPS was limited.

However, Rollup-Centrism has a side effect: L2s siphon transactions away from L1, dampening fee burn. Combined with EIP-1559, this leads to declining ETH consumption on the base layer.

Since April 2025, Ethereum Foundation co-executive Tomasz Stańczak has signaled a strategic pivot: renewed attention to L1 scalability and user experience. The goal: increase L1 capacity and attract more on-chain activity to reassert Ethereum’s role as a global ledger while restoring ETH’s deflationary dynamics.

4. Key Technical Measures Supporting This Shift

Ethereum is already implementing several upgrades to strengthen L1 throughput and value capture:

• Gas Limit Increases: In 2025, Ethereum raised the per-block gas limit multiple times — from 30M to 36M and then to 45M. This increases block capacity, boosting L1 TPS from ~15 to nearly 18.
• L1-Based Rollup Sequencing: Projects like Based Rollups assign L2 sequencing to Ethereum L1 validators rather than centralized operators. This enhances censorship resistance and enables cross-rollup composability. Taiko and Surge Rollup are early adopters.
• L1 zkEVM with Real-Time Validity Proofs: Ethereum developers are exploring zkEVM integration directly at L1. This would let validators confirm block correctness using zero-knowledge proofs, skipping full transaction execution and improving efficiency. Projects like Succinct and Boundless are working to enable this.
• Fusaka & Glasterdam Hard Forks: Two major network upgrades, Fusaka (expected November 2025) and Glasterdam (tentatively 2026), will implement key proposals discussed below.
• RISC-V Execution Layer (Long-term): Vitalik proposed switching Ethereum’s execution architecture to the RISC-V instruction set to improve performance and fairness. Though a long-term effort, this could yield up to 100x execution speed improvements.

5. Highlights in Fusaka & Glasterdam

The next two major upgrades, Fusaka and Glasterdam, aim to boost both L2 support and L1 scalability.

Fusaka Upgrade (Q4 2025)

Fusaka builds on Pectra but focuses more on data availability and future performance enhancements than user-facing features.

EIP-7594: PeerDAS Allows validators to sample only small data chunks (blobs) instead of downloading full data, enhancing scalability and supporting L2s.

EIP-7987 (from EIP-7825) Sets a per-transaction gas cap of 16,777,216 (²²⁴) to prevent single transactions from monopolizing entire blocks. This enables future block-level parallelism and execution optimizations.

Glasterdam Upgrade

Focuses squarely on L1 scaling and consensus improvements.

EIP-7928: Block-Level Access Lists (BAL) Provides clients with read/write sets in advance to enable deterministic multi-threaded execution. This reduces worst-case latency and improves predictability and scalability.

EIP-7732: ePBS (Execution-Proposer Separation) Decouples execution from consensus, enabling higher block throughput without harming stability. Potential for 3–4x gas increases per block. Still under active debate, particularly around MEV implications.

EIP-7782: Shorter Block Times Proposes reducing block times to 6 seconds. This would double block frequency, reduce confirmation latency, and distribute proposer rights more widely. It requires coordination with execution and network layers.

Together, these proposals aim to significantly improve Ethereum’s L1 throughput while preserving decentralization and security.

6. Conclusion and Outlook

From the above analysis, it’s clear that Ethereum is undergoing a comprehensive transformation, from its narrative to its technical roadmap, shifting from a “World Computer” to a “World Ledger.” This shift is driven by two key forces: externally, the macro environment, as more institutions and traditional enterprises begin adding ETH to their balance sheets, necessitating a robust and high-throughput settlement layer; and internally, by the requirements of Ethereum’s economic model, which depends on sustained fee burn on the mainnet for ETH to maintain its “ultrasound money” properties.

Looking ahead, Ethereum’s upcoming upgrades over the next few years will likely revolve around a central goal: increasing on-chain activity. Whether through the adoption of zero-knowledge proofs to lower verification costs, or by optimizing the consensus mechanism to accelerate block times and expand capacity, all efforts point toward supporting more transactions and applications on-chain. On the application side, we may see emerging asset classes like real-world assets (RWA) become new engines of mainnet activity, bringing high-value transaction volume to Ethereum and solidifying its role as the global ledger.

References:

• Bitwise首席投资官：以太坊因结构性需求激增迎来大幅上涨
• Vitalik Buterin Backs Ethereum L1 as Institutions Boost Holdings
• ETH Reverts to Inflationary Asset Following Fee-Reducing Dencun Upgrade
• Ethereum Foundation shifts focus to user experience, layer-1 scaling
• Ethereum is scaling: TPS, gas limit up as validators back 45M target
• Ethereum roadmap targets zkEVM in mainnet within a year
• Ethereum’s Next Upgrade ‘Fusaka’ Could Cut Layer-2 and Validator Costs
• 从EIP-7987到L1 zkEVM：以太坊L1的扩容进阶之路
• Ethereum 2030: The leaner L1 and its performance and aligned rollups
• An MEV Perspective on Glamsterdam
• ACDC #161: Insights
• EIP-7732 the case for inclusion in Glamsterdam
• EIP-7782: The case for 2x shorter slot times in Glamsterdam
• EIP-7928: Block-level Access Lists: The Case for Glamsterdam
• Block-level Access Lists (EIP‑7928) explainer

Reframing Ethereum’s Technical Roadmap Through the Lens of Treasury Strategy was originally published in HashKey Capital Insights on Medium, where people are continuing the conversation by highlighting and responding to this story.

Bitcoin’s Evolution Through Three Distinct Phases (2010–2025)

Background

Satoshi Nakamoto mined the first block of Bitcoin in 2009, and a digital currency and payment system has been born ever since. Early community discussions and related literature studies focused on whether Bitcoin is a currency or an asset, and what risk-return attributes it has. After identifying Bitcoin’s more asset-oriented positioning, scholars began to compare Bitcoin with traditional assets, such as gold, and investigated whether it could be used as an effective money market hedging tool alongside Bitcoin’s safe-haven attributes.The strong outbreak of Bitcoin, especially in the aftermath of the COVID-19 crisis, has led to more research focusing on the linkage between Bitcoin, as a part of the global financial markets, and particular financial asset classes (e.g., stocks, currencies, foreign exchange).

In studying the dynamic correlation of assets, we find that different scholars have adopted various schemes to explore the dynamic correlation between Bitcoin and different financial asset classes, such as Granger’s causal analysis, Johansen’s co-integration analysis, various DCC models, random matrix theory and principal component analysis, ADCC-GARCH, etc. In this paper, we finally adopt the DCC model used in the paper published by Jong-Min Kim, Seong-Tae Kim, and Sangjin Kim in 2020 for studying the dynamic correlation between Bitcoin and various financial assets. The paper is On the Relationship of Cryptocurrency Price with US Stock and Gold Price Using Copula Models, in which the paper examines the relationship between cryptocurrency (Bitcoin), the US stock market (S& P 500) and gold prices in a highly volatile financial environment during the COVID-19 epidemic.

In that paper the methodology uses four dynamic conditional correlation (DCC) models, namely DCC, NA-DCC, GC-DCC, and GCNA-DCC.The sample is selected from daily closing price data from January 2, 2018 to September 21, 2020.

Model description and sample selection

The dynamic conditional correlation (DCC) model is a multivariate volatility model proposed by Engle (2002) that can be used to simulate and estimate the time-varying correlations between multiple assets (time-varying correlations）It captures the concept of correlation clustering, that is, the correlation between variables may be high at some times and low at other times. Depending on the research object, the DCC model has been widely applied and modified since its proposal, and Jong-Min Kim, Seong-Tae Kim, and Sangjin Kim’s empirical study on Bitcoin in 2010 is one of them.

This article is based on the paper published by Jong-Min Kim, Seong-Tae Kim, and Sangjin Kim. The sample selection range is expanded to the past fifteen years and the research objects include Bitcoin and the S&P 500 Index, gold, the CSI 300 Index, and the HSI. The S&P 500 Index is used as a proxy variable for the US stock market, the CSI 300 Index is used as a proxy variable for the the Shanghai and Shenzhen stock market, the HSI is used as a proxy variable for the Hong Kong stock market, and gold is selected due to its safe-haven nature.

The paper affirms the feasibility of applying the GC-DCC and GCNA-DCC models to high-volatility financial data, so this paper selects GC-DCC as the model studied in this article. The sample range is the daily logarithmic returns from July 15, 2010 to June 3, 2025, with 5438 data for each asset. We obtained our Bitcoin data from coinmarketcap, the gold data from investing.com, Standard & Poor’s 500 Index (S&P 500 Index), CSI 300 Index (CSI300), Hang Seng Index (HSI) data from WSJ website 。

The above chart shows the raw price trends of Bitcoin, S&P 500 Index, Gold, CSI 300 Index, and HSI since July 2010. The first three markets show the same long-term growth trend and they have seen significant growth after the outbreak of the COVID-19 pandemic (2020), which may be related to the market volatility, safe-haven demand, Global monetary policy easing. Compared with gold and the S&P 500 Index, Bitcoin has shown more obvious characteristics of sharp rise and fall. The trends of the CSI 300 Index and Hang Seng Index have been more similar over the past 15 years, and compared with the first three, their overall trends have been relatively stable and they have developed independent trends.

Logarithmic Return Trend Analysis

In the empirical analysis, in order to ensure the stationarity of the time series under study, the rate of return used in this paper is the logarithmic rate of return. Thus the daily closing price series are converted into logarithmic return time series. In order to simplify the expression, the data names in the charts in this article will be simplified. LBTC, LSP500, LGOLD, LCSI300 and LHSI are used to represent the logarithmic returns of these four types of assets. The calculation method is:

log returnt=ln(Pt)-ln(Pt-1)

log returntis the logarithmic rate of return, Pt for the closing price of the t day ,Pt-1for t-1. First, we conduct basic descriptive statistical analysis on the yield series of each asset after processing, and the results are shown in the table below.

From the basic descriptive statistics of the data, the mean and standard deviation of Bitcoin’s yield are quite different from the mean of the S&P 500 Index, Gold, CSI 300 Index, and Hang Seng Index yield series, and Bitcoin’s price fluctuations are relatively the most violent. From the perspective of skewness and kurtosis, the skewness of each yield series is negative, showing a left-skewed distribution, and the kurtosis values are all greater than 3, with an overpeak phenomenon, which is consistent with the characteristics of peaked and thick-tailed financial data. In addition, the JB statistic values of the daily logarithmic return series of the five assets are all large, which also shows that the logarithmic return series of the five markets reject the assumption of normal distribution.

From the above figure we can see that Bitcoin logarithmic returns fluctuated frequently and dramatically from July 2010 to 2014 (e.g., -0.8 to +0.5), and then fluctuated again in late 2017 to early 2018 and on March 12, 2020 (exceeding ∓0.2). The volatility of the logarithmic returns of the S&P 500 Index, the CSI 300 Index, and the Hang Seng Index is much smaller than that of Bitcoin, and the logarithmic returns mainly fluctuate between -0.1 and +0.1. The volatility range of the logarithmic returns of gold is the smallest (-0.08 to +0.04), reflecting its safe-haven properties.

Bitcoin’s history crashes three times

Bitcoin’s extreme volatility before 2014 was caused by a variety of factors. First, the early market size was small, with a total market value of less than US$10 billion, and poor market depth. Large orders could easily cause drastic price fluctuations. Second, the trading platform lacked transparency, compliance, and security. Several exchanges that emerged between 2010 and 2014 generally had security risks, and their operating cycles mostly lasted only 1–2 years. They lacked compliance supervision and transparent operating mechanisms. Early Bitcoin transactions were still very primitive until the emergence of exchanges changed this situation.

The most representative of these is the Mt. Gox exchange, which once occupied 80% of the Bitcoin trading market after it was transformed into a Bitcoin exchange in July 2010. However, it suffered its first hacker attack in 2011, which led to a price crash. In 2014, it went bankrupt due to a system vulnerability and lost 850,000 Bitcoins. Both crises caused severe market fluctuations.

In December 2017, the ICO craze caused the price of Bitcoin to soar to a historical peak of nearly $20,000, but this craze did not last. In January 2018, the market took a sharp turn for the worse, and the price began to fall precipitously, falling below the $10,000 mark in February. There were multiple factors behind this round of plunge: the crazy expansion of the ICO bubble in 2017 accumulated huge risks, a large number of low-quality projects collapsed in 2018, and further led to regulatory panic; at the same time, the hard fork war of Bitcoin Cash (BCH) in November further exacerbated market turmoil, causing a serious setback to speculators’ confidence.

In contrast, the “312 crash” on March 12, 2020 (a halving in 24 hours) was mainly due to the panic in the global financial market caused by the new crown epidemic. The liquidity crisis in the traditional market was transmitted to the encryption field, coupled with the serial liquidation of high leverage in futures trading in the market.

Although the causes of these crises are different, the former is the lack of attention to security, opacity and bubble burst in the industry, and the latter is the external impact, but they all deeply exposed the high volatility and fragility of the cryptocurrency market in its early development stage. However, these crises also promoted the upgrade of risk control of exchanges, the improvement of regulatory frameworks and the process of investor education, laying the foundation for the subsequent market to become more mature.

Empirical Analysis and Results

Summary of GC-DCC results

In order to further study the time-varying correlation between Bitcoin, S&P 500 Index, Gold, CSI 300 Index and Hang Seng Index, we conducted an empirical study on GC-DCC modeling. The following table gives the basic statistical characteristics of the dynamic correlation coefficients between the four variable groups.

It can be seen that the mean value of the DCC between Bitcoin and the S&P 500 Index is 0.107, ranging from -0.376 to 0.729; the mean value of the DCC between Bitcoin and gold is 0.052, ranging from -0.443 to 0.601; the mean value of the DCC between Bitcoin and the CSI 300 Index is 0.046, ranging from -0.426 to 0.418; the mean value of the DCC between Bitcoin and the HSI is 0.013, ranging from -0.417 to 0.431. From the difference in the size of the mean, it is more obvious that there is a certain long-term linkage relationship between Bitcoin and the S&P 500 Index, while the DCC between Bitcoin and the HSI is the smallest. At the same time, the standard deviation of the DCC between these assets shows that the standard deviation of the DCC results of Bitcoin and S&P 500 Index is largest, indicating that the volatility spillover between Bitcoin and S&P 500 Index is relatively large.

The following figure is a graph of DCC of each sequence, which clearly shows the similarities in the dynamic correlations between the sequences:

• There is great volatility. The positive correlation mainly appeared before 2012 and after 2020, while most of the negative correlations appeared between 2012 and 2020.
• After 2018, the amplitude began to expand and new peaks continued to appear.
• All showed a deep V trend at the beginning of 2024. As Bitcoin rises to reach all-time highs in late 2023-early 20204, surpassing $100,000 USD.

Note: The dotted lines indicate segmentation dates. This article divides the samples into Phase 1 (2010/7/15~2014/1/1), Phase 2 (2014/1/1~2020/1/1), and Phase 3 (2020/1/1~2025/6/3)

After statistics, the GC-DCC results between Bitcoin and S&P 500 Index, Gold, CSI 300 Index, and HSI all show positive over 50% of the time from July 2010 to June 2025, with Bitcoin’s positive correlation with S&P 500 Index reaching over 65% of the overall time. And the frequency of positive correlation of DCCs increases significantly with time.

As shown in the DCC trend chart, this article divides the samples into three phase according to the similarity between the development process of Bitcoin and the DCC curve, namely phase 1 (2010/7/15~2014/1/1), phase 2 (2014/1/1~2020/1/1), and phase 3 (2020/1/1~2025/6/3). According to the DCC curve, the following conclusions can be drawn:

• All showed a large fluctuation correlation in phase 1, and mainly showed a positive correlation;
• In phase 2, the correlation fluctuates in a narrow range around 0;
• phase 3 is the five years after the outbreak, during which the correlation has been above 0 for a long time, and the up and down fluctuations widened , with multiple deep V shapes.

In addition, the correlation trend between Bitcoin and the CSI 300 Index and the HSI is close and quite different from the other two. For example, in the period of 2010–2014, LBTC and LCSI300 were mostly positively correlated, and the fluctuation range changed from narrow to wide, while LBTC and LSP500 and LGOLD showed a change from positive correlation to negative correlation, and the fluctuation range changed from wide to narrow. After 2020, the correlation coefficient trend between LBTC and LCSI300 also showed a differentiation from other trends.

Since the price trend and logarithmic return trend of the HSI are close to those of the CSI 300 Index, and the correlation trends of the two with Bitcoin are similar, we have separately done the DCC results of the CSI 300 Index and the Hang Seng Index. The results show a long-term positive correlation. Before 2018, the correlation was long-term above 0.4, and after 2018, it jumped to 0.6 and fluctuated. This high positive correlation makes the Hang Seng Index and the CSI 300 Index highly similar.

Bitcoin and gold also have safe-haven properties

Judging from the DCC curve of LBTC-LGOLD, the correlation between the two fluctuates rapidly in special years, such as the end of 2011, January 2017, November 2018-January 2019, the first half of 2020, the second half of 2022, and 2024. These time points are exactly when the global Economic Policy Uncertainty Index (EPU) is at a high point. The EPU index was first constructed by scholars Baker, Bloom and Davis in 2012. They developed the EPU index based on the frequency of words related to the three concepts of economy, policy and uncertainty that appeared simultaneously in the top ten major newspapers in the United States. At present, the index is the GDP-weighted average of the EPU indexes of multiple countries. The higher the EPU index, the greater the degree of uncertainty in global economic policies.

It can be seen from the figure that during periods of highly unstable economic policies (i.e. when the EPU index is above 200), such as the 2011 debt ceiling debate, the 2017 US election, the first US trade war 1.0 in 2018, the 2020 COVID-19 pandemic, the 2022 Russia-Ukraine war, and the 2024 US election, DCC has soared. This shows that during periods of global instability, Bitcoin and gold are highly correlated, and Bitcoin has shown safe-haven properties at these moments.

Institutional Entry Drives Bitcoin and S&P 500 Index’s Linkage

The DCC trend between Bitcoin and S&P 500 Index was similar to that of gold before 2020, but it became different after 2020. The former has been at a high positive level for a long time, while the correlation with gold has fluctuated around 0.

The DCC between Bitcoin and the S&P 500 Index has shown a structural upward shift after 2020. The reason behind this is that the properties of Bitcoin have undergone fundamental changes and have been affected by the Federal Reserve’s interest rate hike and cut policies.

From the above figure, we can see that the interest rate hike and cut trend has been going on since 2016, but the impact of the interest rate hike and cut policies on Bitcoin prices did not become apparent until 2019. The figure shows that from 2016 to 2019, the federal interest rate gradually increased, but the correlation between Bitcoin and the S&P 500 Index fluctuated around 0. After March 16, 2020, the DCC between Bitcoin and the S&P 500 Index soared significantly, and remained positively correlated for the next five years.

From March 2022 to July 2023, the Federal Reserve began to raise interest rates 11 times in a row. During this period, the correlation between the Bitcoin and the S&P 500 Index remained above 0, but despite this, it has shown a downward trend. Even after the interest rate hikes stopped, the correlation between the two dropped to 0 from August 23 to February 24. The logarithmic returns of Bitcoin and the S&P 500 Index responded to the interest rate hike and cut policies at the same time, which shows that there is a certain linkage between Bitcoin and the S&P 500 Index.

This linkage is driven by the entry of institutions into the crypto market. In August 2020, MicroStrategy purchased Bitcoin for the first time. Spent about $250 million to buy 21,000 Bitcoins. Tesla bought $1.5 billion worth of Bitcoins in early 2021. As of July 8, 2025, 257 entities, including public and private companies, ETFs and countries, hold 3,407,573 Bitcoins, accounting for 16.227% of the total Bitcoins supply.

Analysis of the three major stages of Bitcoin

According to the analysis in the previous article, Bitcoin has gone through three stages: 2010 to 2014, 2014 to 2020, 2020 to 2025.

Phase 1 (July 15, 2010 ~ January 1, 2014) “Peer-to-peer cash”

During this period, Bitcoin had just been born for two years and had developed from the geek circle to the mining circle. It was still in a wild growth period. Judging from the logarithmic return rate and volatility trend, it fluctuated violently from 2010 to 2014. During this period, the DCC of the Bitcoin with S&P 500 Index, gold, CSI 300 Index and HSI was also relatively unstable, with several obvious spikes.

The reason behind this instability is that the macro environment was in a slow recovery period after the 2008 financial crisis. Secondly, the Bitcoin market was relatively small at the time, and Bitcoin buyers were in a stage of extreme speculation or satisfying darknet transaction needs. This article believes that Bitcoin before 2014 had more payment currency attributes.

Darknet

In February 2011, 26-year-old Ross Ulbricht created the first successful darknet market, Silk Road, a “deep network” that operates using Tor ‘s hidden services. The website was banned by the FBI on October 2, 2013. It was revealed that within less than three years, the website had achieved 1.2 million transactions with a total transaction value of 9.5 million Bitcoins. The FBI also successfully tracked more than 700,000 Bitcoins flowing directly from the Silk Road marketplace to Ulbricht’s personal account.

The Chainalysis (2019) report shows that the share of Bitcoin sent to the darknet reached a maximum of 7% in 2011–2013, while after 2013 the share rapidly declined and fell, remaining at 1% in 2013–2015, and after 2015 due to the development of privacy coins such as Monroe Coin and stablecoins led to a further rapid decline in the share of Bitcoin in the darknet and fell.

Phase 2 (January 1, 2014 to January 1, 2020) “Digital Gold”

In December 2013, the price of Bitcoin exceeded that of gold for the first time. Bitcoin began to be frequently compared with gold. An important promoter of Bitcoin’s early “digital gold” narrative are Wall Street analyst Wences Casares and cryptocurrency supporter Trace Mayer. Wences Casares proposed in the Wall Street Journal and in a speech at Stanford University that Bitcoin’s scarcity (up to 21 million coins) and decentralization make it “gold in the digital age.” Trace Mayer proposed the concept of Bitcoin’s “hard money” and compared it to gold. The community then debated the positioning of Bitcoin as a “payment” or “value storage.”

Bitcoin has experienced three halvings in 2012, 2016, and 2020 during this phase, entering a period of rapid development. The price of Bitcoin in US dollars has risen from double digits to four digits. Due to its drastic price fluctuations, in the debate,Bitcoin has gradually evolved from “peer-to-peer cash” to “digital gold”.

From 2014 to 2020, the crypto market entered a period of explosive growth in terms of products, infrastructure, players, and gameplay. These developments not only enriched the entire cryptocurrency industry, but also supplemented Bitcoin’s other value attributes beyond its digital gold reserve value:

• Products: Ethereum smart contracts, stablecoins, private transactions, Monero, NFT
• Infrastructure: public chain, wallet, exchange, data platform, tg bot
• Economic mechanisms: ICO, IEO, yield farming, lending, derivatives
• Players: Miners, VCs, Developers, Traders

At this stage although lightning network payments and Bitcoin Layer 2 have been developing, with the issuance of Tether (USDT) and the launch of the privacy coin Monero in 2014, these more stable and private cryptocurrencies have already met the original payment needs. Bitcoin’s payment currency attributes have been further weakened at this stage.

On the contrary, the value of Bitcoin’s gold reserves is slowly being reflected. And gradually integrate it into the traditional financial system：

• November 2016 — Chicago Mercantile Exchange (CME) releases Bitcoin Reference Rate(BRR)。For the first time, the price of Bitcoin was included in the pricing system of the traditional financial market, laying the foundation for the launch of subsequent financial products (such as futures).
• October 2017 — Chicago Mercantile Exchange (CME) launched Bitcoin futures. Allowing investors to hedge risks or speculate through compliant channels means that institutional funds can legally participate in the Bitcoin market. CME’s endorsement further enhances the financial legitimacy of Bitcoin.
• January 2018 — Switzerland begins accepting Bitcoin for tax payments.It shows that sovereign entities recognize Bitcoin, similar to the historical role of gold as a means of tax payment.
• September 2019 — Bakkt’s physically delivered Bitcoin futures are officially launched.The physical delivery mechanism directly links the futures market to spot supply, similar to the physical delivery logic in the gold futures market.

Phase 3 (2020/1/1~2025/6/3) Reserve Assets

The outbreak of the epidemic at the end of 2019 caused fluctuations in the global financial market. The DCC empirical results of this phase also showed significant differences from the other two phases, with multiple deep V and positive peaks. At this stage, many companies and countries began to use Bitcoin as reserves, and liquidity flowed into the crypto market significantly.

National Reserve

According to the Bitcoin Treasury, governments hold 527,656 bitcoins, accounting for 2.5% of the total. The top three countries holding bitcoins are the United States, China, and the United Kingdom, all of which were seized by law enforcement.The detailed statistics are shown in the following table.

— —

Company reserves — Bitcoin are included in the balance sheet

According to statistics, 147 public companies have held Bitcoin, covering a total of 28 countries and regions. Among them, the countries and regions with the largest number of companies holding Bitcoin are the United States (45 companies), Japan (32 companies), Canada (8 companies), China (8 companies), Hong Kong (8 companies), and Germany (7 companies).

The relevant information of the top ten Bitcoin holding companies is statistically analyzed in the following table. It can be seen that most companies have a background in the encryption industry, with mining companies being the most numerous. MicroStrategy holds nearly 600,000 bitcoins, accounting for 70% of the total holdings of public companies.

Based on the market value of public companies, we can calculate the amount of Bitcoin held by each company and the company’s market value (i.e. Bitcoin holdings/company market value). Then, by taking the average value, we can statistically calculate the situation of this indicator in various countries and regions, as shown in the figure below.

After calculation, the average value of global Bitcoin holdings divided by the market value of public companies is about 0.507. It can be seen that this indicator in China is about 1.68 times the global average, and Germany (DE) and the Cayman Islands (KY) are 3.263 and 4.462 respectively, which are 6.44 times and 8.8 times the global average.

The anomaly of BTC/M.Cap in these three regions is that three of them hold a large amount of Bitcoin:

Conclusion

This paper explores the dynamic correlation between Bitcoin and gold, S&P 500 Index, CSI 300 Index, and HSI by selecting the historical price data in the past 15 years. According to the DCC empirical results demonstrated, the dynamic correlation between Bitcoin and S&P 500 Index has gone through three phases: from 2010–2014, it is across positive and negative, and fluctuates significantly up and down; from 2014–2020, the dynamic correlation fluctuates around 0 up and down, and the fluctuation decreases; from 2020–2025, the dynamic correlation between Bitcoin and S&P 500 Index shows a significant positive correlation in the long term.

According to the DCC curve results, the three phases correspond to the three phases of Bitcoin, 2010–2014 is the “peer-to-peer cash” payment system phase, Bitcoin is mainly based on monetary attributes, with frequent darknet transactions and imperfect exchange infrastructure; 2014–2020 is the digital gold phase, the correlation curve between Bitcoin and gold is compared with the EPU index curve, during several periods of global economic instability (EPU index >200) , its correlation curve and the EPU index appeared to synchronize the response of the spike; 2020–2025 for the asset reserve phase, Bitcoin is mainly a strategic reserve attribute, reflected in the governments hold 527, 656 Bitcoin (2.5% of the total), and 1,151,815 Bitcoin (5.4% of the total), held by public and private companies.

Reference

https://www.mdpi.com/2227-7390/8/11/1859
https://www.blocktempo.com/iran-bitcoin-mining-darkness/
https://cointelegraph.com/explained/which-countries-secretly-own-the-most-bitcoin-beyond-the-us-and-china
https://coingeek.com/german-police-seize-30m-in-btc-bch-connected-to-pirated-movie-website/
https://pdf.dfcfw.com/pdf/H3_AP202409191639929209_1.pdf

Bitcoin Macro Market Co-movement was originally published in HashKey Capital Insights on Medium, where people are continuing the conversation by highlighting and responding to this story.