chain · quantum risk
Ethereum EOAs, Account Model, and Quantum Risk
Verdict
EOAs are classical key pairs. Quantum risk is about those keys and how applications grant them power—not about “accounts” as a magic shield.
Overview
Ethereum uses an account model: balances and nonces live on addresses. Externally owned accounts are controlled by private keys that produce ECDSA signatures. Contract accounts are controlled by code, which is itself often governed by keys or multisigs.
Compared with Bitcoin, there is no general “hash of pubkey until spend” story for ordinary EOAs. Active accounts are public participants. That is excellent for UX and terrible for assuming hidden keys.
Quantum planning for Ethereum users starts with key inventory and ends with protocol-level signature migration—months and years of work, not a weekend wallet reinstall.
What breaks
- secp256k1 private key recovery from public keys under Shor
- Unlimited token allowances from EOAs to hostile or brittle contracts
- Social recovery / guardians that still rest on classical keys without agility
Mitigations
- Minimize long-lived hot EOAs for large value
- Review allowances and session keys as part of incident drills
- Track account abstraction designs for crypto-agility—not marketing alone
FAQ
Is a smart contract wallet quantum-proof?
Only if its authorization path uses quantum-resistant cryptography end-to-end. Most production designs still depend on classical signers or guardians.
How is this different from Bitcoin address reuse?
Bitcoin often delays pubkey reveal until spend for hashed outputs. Ethereum EOAs are address-centric and frequently publicly active; the hygiene lessons differ even though both can fall to Shor once keys are known.
Key concepts (technical dictionary)
Terms used on this page — open a definition: