The short answer
No score moved. On 13 August we repointed two of them. Bitcoin's exposure dimension had cited a Forbes write-up of a Deloitte study and now cites Deloitte directly. Cardano's exposure dimension cited an Input Output announcement for address-model claims it never makes, and now cites CIP-19. One unmeasured claim about how much ADA has moved was removed, not resourced.
What changed and why
The exposure dimension asks a narrow question: how much of a chain's supply sits behind a public key that a quantum computer could act on. That question only means something if the numbers behind it can be traced. Two of ours could not be traced cleanly, so we fixed them.
- Bitcoin. The exposure figure was sourced to a Forbes article that was reporting on work Deloitte did. The citation now points at Deloitte's own analysis of quantum computers and the Bitcoin blockchain, which is where the figure comes from.
- Cardano. The exposure dimension cited Input Output's Cardano Vision 2026 announcement for claims about the address model, stake key visibility, and the share of ADA that has moved. That article makes none of those claims. The address-model part now cites CIP-19, which is the specification that actually defines it.
- The unmeasured claim. We had no source for how much ADA sits at addresses whose keys are already public. Rather than hunt for a citation to fit a number we had already written, we deleted the number. The profile now says plainly that no published measurement of Cardano's exposed share could be found.
CIP-19 defines a Shelley address as a payment credential plus a delegation credential. Each credential is a blake2b-224 hash of an Ed25519 verification key. A hash is a one-way fingerprint, so an address alone does not reveal the key. That structural point stands. What we could not support was the quantity.
What this does not mean
This is a sourcing correction, not new information about either chain. Nothing shipped, nothing was withdrawn, and no engineering position changed.
- It does not mean Cardano's exposure is lower than we said. It means we no longer state a figure we could not source. Absence of a measurement is not evidence of safety.
- It does not mean the Deloitte figure changed. Only the pointer changed, from a secondary write-up to the primary work.
- It does not mean either chain has selected a post-quantum signature scheme. Neither has.
Why we publish correctionsA citation that does not support its claim is a defect even when the claim turns out to be right. We would rather log the fix than quietly reword the sentence.
Where both chains stand now
Both ratings are unchanged by this correction. Bitcoin still signs with ECDSA and Schnorr on secp256k1, and BIP-360 removes the quantum-vulnerable key path from new outputs without naming a post-quantum replacement. We covered that in detail in what Bitcoin is, and is not, doing about quantum. Cardano still signs with Ed25519, with post-quantum replacements for its signature, key-evolving signature and VRF primitives in design. A separate correction covers the D3.1 deliverable.
If you hold BTC or ADA
Nothing about your position changed today. What changed is how much you can trust one line on each profile, which matters if you use the index to reason rather than to skim.
- For Bitcoin, the exposure claim is now one click from the study that produced it. Read it yourself if the number is load-bearing for you.
- For Cardano, treat the exposed share as unknown rather than low. If you have ever spent from an address, its key is public. That is true on both chains, and it is the mechanic behind harvest now, decrypt later.
- If you want the practical version, is my crypto safe from quantum computers walks through what you can and cannot control today.
Every change we make to a rating or a citation is logged in the changelog, including the ones that move nothing.
Where to go next
- Bitcoin: the full rating Every dimension score, with the source behind each one, and what the rating means if you hold it.
- Cardano: the full rating Every dimension score, with the source behind each one, and what the rating means if you hold it.
- Harvest now, decrypt later: what it means for your crypto This is the reason experts say the quantum threat is already here, even though the machine that would carry it out is not. It is simpler than it sounds.
- Is my crypto safe from quantum computers? If you have seen the scary headlines about quantum computers and crypto, here is the calm version. What is true, what it means for the coins you hold, and what is worth doing about it.
- Will quantum computers break Bitcoin? This is the mechanism, explained without the maths. How a quantum computer would actually take coins, how much of Bitcoin is in reach, and what Bitcoin is doing about it.
Sources
Every dated event above carries its own primary source. These are those sources, each checked on the date shown.
- CIP-19: Cardano addresses Cardano Improvement Proposals · primary · checked 18 August 2026
- Quantum computers and the Bitcoin blockchain Deloitte Netherlands · primary · checked 18 August 2026
- Cardano Vision 2026: the research program securing Cardano Input Output · primary · checked 18 August 2026
- BIP-360: Pay to Quantum Resistant Hash Bitcoin Improvement Proposals · secondary · checked 18 August 2026
- BIP-361 bips.dev · secondary · checked 18 August 2026
This is a security-readiness assessment, not investment advice.