Hong Kong’s central bank puts a number on lenders' quantum preparedness. It's very low.

The Quiet Threat in the Server Room

I spend a lot of time talking to founders about the next six months. We obsess over user acquisition, tokenomics, and whether GPUs will get cheaper. But there is a slow-motion wrecking ball swinging toward the entire financial infrastructure that almost no one is building for yet: quantum computing. We have treated it like science fiction for a decade, but the regulators are starting to count down the days.

The Hong Kong Monetary Authority, or HKMA, recently took a temperature check of their banking industry's quantum readiness. They released a whitepaper and a new Quantum Preparedness Index to measure how well-guarded these institutions are against the potential for quantum computers to tear through current encryption. The results were not great. Actually, they were pretty dismal. Most lenders are sitting in the low-preparedness zone, essentially hoping that the hardware breakthrough remains a few years away.

As a builder, you might think this is an enterprise problem for the big legacy banks. It isn't. If the base layer of global finance has its cryptographic foundations cracked, every bridge, every oracle, and every smart contract we have built on top of that trust becomes a liability. We are looking at a fundamental shift in how we secure data, and right now, the people holding the keys are still using old locks.

Understanding the Quantum Gap

The core of the problem is something called Shor’s algorithm. In plain language, most of the encryption we use today—including the stuff protecting your private keys and your bank’s internal wire transfers—is based on the fact that it is incredibly hard for a traditional computer to find the prime factors of a huge number. It would take a supercomputer longer than the age of the universe to do it. A sufficiently powerful quantum computer, however, could do it in minutes.

The HKMA isn't saying that this happens tomorrow. But they are highlighting a very specific risk: Store now, decrypt later. State actors or sophisticated hacking groups can harvest encrypted data today, sit on it for five years, and then run it through a quantum processor once the hardware catches up. For a bank, that means historical transaction data, identity documents, and private communications are already vulnerable.

The index shows that while banks are aware of the risk, very few have a roadmap. They are stuck in the awareness phase. In a builder's world, that’s the equivalent of having a GitHub repo with a README and zero lines of code. It’s a plan to have a plan, and in the face of exponential hardware growth, that is a dangerous place to be.

Why Builders Should Care

If you are building in the crypto or AI space, you are likely already dealign with high-velocity data. We pride ourselves on being at the cutting edge, but we are often just as guilty as the banks of relying on NIST standards that are rapidly aging out. When a central bank starts putting out whitepapers with indices, it is a signal that the regulatory environment is about to change. We can expect new requirements for "post-quantum cryptography" or PQC to start showing up in licensing requirements soon.

Here is what this looks like for a founder today:

• Technical Debt: If you are building a protocol today using standard elliptic curve cryptography without a migration path, you are layering on technical debt that could kill the project in five years.
• Infrastructure Resilience: Dependency on legacy banking rails for on-ramps means your service is only as secure as the HKMA’s least-prepared bank.
• The Opportunity: There is a massive gap in the market for developer tools that simplify the integration of PQC into existing stacks.

The HKMA report suggests that the industry needs to move toward crypto-agility. This is a term I really like. It means designing systems where you can swap out one cryptographic primitive for another without rebuilding the entire architecture. Most current systems are rigid. They are built like concrete bunkers; if the door breaks, you have to tear down the walls. We need to start building like Lego bricks.

The Timeline Problem

The skeptics will tell you that we are still years away from a stable, error-corrected quantum computer that can break 2048-bit RSA. They might be right. But building a financial system is not like shipping a feature update. It takes years to test, audit, and deploy new security standards at scale. If the banks wait until the quantum computer is sitting in a lab in Zurich or Beijing, it is already too late.

The HKMA is correctly identifying that the transition period is the most dangerous time. During the shift from classical to quantum-resistant systems, we will have hybrid environments that are notoriously difficult to secure. Mistakes will be made. Keys will be exposed. This is where the real threat to the user lies—not just in the theoretical math, but in the sloppy implementation of the cure.

Looking Forward

I don't love the hype around quantum, just like I don't love the hype around AI. But I do respect the math. The HKMA’s low score for banks isn't an indictment of their IT departments; it’s a reflection of how difficult this transition is going to be. They are trying to wake up an industry that is used to moving at the speed of bureaucracy.

For those of us in the trenches building new financial primitives, we have an advantage. We are smaller, faster, and more adaptable. We can start implementing post-quantum standards now while the big banks are still filling out the HKMA’s surveys. This isn't about being paranoid; it's about being the last one standing when the old locks finally stop working.

The takeaway is simple: The regulators are signaling that the current cryptographic standard has an expiration date. If your roadmap doesn't include a plan for quantum resistance, you're not building for the future—you're building a legacy system that just hasn't realized it's obsolete yet.

We need to stop thinking about quantum as a future problem and start treating it as a current architectural requirement. The banks may be slow to the party, but as builders, we can't afford to be.

Read the original at CoinDesk →