Quantum Threat: The Trillion-Dollar Security Race Has Begun

A new report from the Citi Institute argues that quantum computing is no longer a “future tech” discussion—it is a board-level security and financial stability issue. Quantum Threat: The Trillion-Dollar Security Race Is On (January 2026) warns that once a sufficiently powerful quantum computer emerges, widely used public-key cryptography—especially RSA and elliptic-curve cryptography (ECC)—could be broken, undermining digital identity, secure communications, and transaction integrity across the global economy. 

Citi frames “Q-day” as the point at which quantum systems can reliably break today’s public-key encryption at scale—but stresses the threat is already active through “harvest now, decrypt later” attacks. Adversaries can collect encrypted traffic today and decrypt it later when quantum capabilities mature, making long-lived sensitive data (financial records, state secrets, health data, critical infrastructure telemetry) vulnerable right now. 

On probability and timelines, the report cites estimates referenced by regulators and the Global Risk Institute (GRI): a 19–34% probability of widespread breaking of public-key encryption by 2034, rising to 60–82% by 2044. 

It also notes prediction markets (Kalshi) implying roughly a 40% chance of a “useful” quantum computer by 2030, while acknowledging that many experts view a cryptographically relevant quantum computer in the 2020s as unlikely. 

Citi’s most sobering message is systemic: quantum risk is not just about data theft—it’s about authentication failure and cascading disruption. The report references a Hudson Institute scenario modeling a single-day, quantum-enabled cyberattack on a top U.S. bank’s access to Fedwire (a critical real-time gross settlement system). The modeled indirect losses reach $2.0–$3.3 trillion in GDP-at-risk, equivalent to a 10–17% decline in annual real GDP, triggering a severe recessionary shock. 

The key insight: modern finance runs on cryptographic trust—identity, authorization, non-repudiation, and secure messaging. If those primitives fail even briefly at scale, the second- and third-order effects can outrun incident response.

Citi also highlights the exposure of public blockchains. It estimates that roughly 25% of Bitcoin is “quantum-exposed” due to address formats and key-reuse patterns that could allow quantum attackers to derive private keys once public keys are revealed. 

Citi’s core argument is urgency with realism: solutions are available, but implementation is hard. The global pivot is toward Post-Quantum Cryptography (PQC)—new algorithms designed to resist both classical and quantum attacks. NIST has already published its first finalized PQC standards (FIPS 203/204/205), including ML-KEM for key establishment and ML-DSA / SLH-DSA for digital signatures. 

Governments are also formalizing migration planning. The U.S. Office of Management and Budget’s memo on migrating to PQC directs federal agencies to begin structured transition work—inventorying cryptographic systems, planning upgrades, and moving toward crypto-agile architectures. 

What “quantum readiness” really means

Citi’s report reframes readiness as a multi-year operational transformation—similar in scale to (or larger than) Y2K—touching every layer of technology and vendor supply chains. The practical program is:

• Know what you have: cryptographic inventory across apps, devices, APIs, certificates, HSMs, and vendor tools.

• Build crypto-agility: systems designed to swap algorithms quickly without re-architecting everything.

• Prioritize crown jewels: identity, payments, authentication flows, certificates, and critical infrastructure controls first.

• Modernize vendors and ecosystems: cloud, telecom, outsourcing partners, and software suppliers must migrate in lockstep.

• Assume “harvest now, decrypt later”: protect data with long retention value earliest.

Citi’s “trillion-dollar security race” framing is not hype—it’s a recognition of asymmetric risk: the probability is uncertain, but the downside is systemic. The winners will be institutions that treat PQC as a resilience program (governance, architecture, procurement, training), not a last-minute crypto patch.