Quantum Money is an old proposal that solves the forgeability problem of traditional banknotes, by leveraging the No-Cloning Theorem.

Recently, blockchains solved the Double-Spending problem allowing them to be de facto usable as money. Indeed even though on a blockchain you can forge as many coins as you wish, the other participants will not accept your claims.

Are there any aspect which make quantum money a superior alternative to blockchain digital currencies?

  • 3
    $\begingroup$ Lack of massive energy consumption with quantum money, as opposed to Nakamoto-style consensus on blockchains, is the first thing that comes to mind. $\endgroup$ Mar 28, 2020 at 18:41
  • $\begingroup$ Yea, I was thinking to that too. Admittedly that's not negligible, even though many new "green" consensus algorithm are being studied. $\endgroup$
    – Rexcirus
    Mar 28, 2020 at 19:00
  • 1
    $\begingroup$ Also security of Wiesner-style private-key quantum money has security guarantees that aren't based on the computational difficulty of inverting a hash function. $\endgroup$ Mar 28, 2020 at 19:27
  • 3
    $\begingroup$ I would compare these two concepts on their level of practical maturity and security: PoW blockchains are available and secure today at some level of cost. Quantum money, which requires carrying a coherent quantum state around as a banknote, is not practical today and has a certain cost w.r.t. keeping the banknote coherent. Once quantum money and computers become available, cheap, and small enough to carry around, they may also be strong enough to make the public-key cryptography used in PoW blockchains insecure, thus requiring significant upgrades, where quantum money may play a role. $\endgroup$ May 20, 2020 at 6:47

2 Answers 2


I propose the following advantages to quantum money, over and above blockchain-based cryptocurrencies.

  1. The security of Nakomoto-style cryptocurrencies (read, Bitcoin) is based on computational assumptions, at least in that there is a assumption that inverting SHA256 hashes is likely computationally difficult. However, Wiesner-style private-key based quantum money is based on more information-theoretic assumptions, namely the no-cloning theorem/no signaling theorem/etc. Accepting that the no-cloning theorem is a better assumption than the difficulty of inverting hash functions may not be for everyone, but at least it's a difference.

  2. Nakomoto-style blockchains have a famous problem in their energy usage, which appears to grow exponentially with acceptance of the cryptocurrency. But both Wiesner-style ("private-key"), and even "public-key" quantum money schemes such as those based on knots don't appear to have a lot of similar disadvantages in energy usage; there is no "proof-of-work" at play in quantum money.

  3. Investigating schemes for quantum money may also provide schemes for digital signatures/commitment. For example, for certain public-key systems, if a scheme cannot easily be used as quantum money then it may be used for commitment. Bitcoin doesn't seem to have similar win-win opportunities.

  4. For me, quantum money is fun to think about, and proposes some interesting problems in-and-of themselves, that are orthogonal to that of bitcoin. For example, I would like to learn more about Kane's proposal on modular forms, and Shor has recently teased quantum money based on lattices. Does anyone seriously envision quantum money with valuations/market capitalization similar to that of bitcoin ($120B), say, in the next 10 years? I doubt it, but still, fun to think about.


This work (which I'm a co-author) discusses the properties that different forms of money have. The paper discusses cryptocurrencies such as Bitcoin, and public quantum money. The following figure is taken from there, where the two relevant columns are highlighted: table

The advantages, some of which were not mentioned by others, is that public quantum money is locally verifiable (meaning, unlike Bitcoin, you don't need to be connected to the internet), there are no transaction costs, low latency, has an unbounded throughput (e.g., Bitcoin can only support <10 transactions per second, globally), provides better privacy guarantees (untraceable, at least to some extent), more fungible than Bitcoin and other cryptocurrencies which are not privacy oriented, and is energetically much more efficient (as it doesn not reuqire proof-of-work). Public quantum money could be issued by a cenral bank (similarly to cash), and in this case it would enjoy other benefits such as of it being legal tender, stable and have a better reputation.

The drawbacks of public quantum money are: it is not divisible or mergeable, does not allow proof-of-payment nor proof-of-reserves, does not provide smart contracts functionalities, and it can't be backed-up.

There are some more advnaced primitives, such as quantum lighting and one-shot signatures, which can be used to eliminate some of the drawbacks mentioned above: see here and here. Unfortunately, we currently don't have constructions which are provably secure in the plain model for these primitives. I consider constructing these primitives an important open problem.

  • $\begingroup$ Welcome! You may also enjoy this other question I asked a while ago, which was inspired by one of your lectures. $\endgroup$ Jan 11, 2023 at 17:03
  • $\begingroup$ Also, regarding fungibility of Farhi et al., perhaps someone would be willing to pay more money for a uniform superposition of all knot diagrams of knots having particularly nice features - someone might pay top dollar for a bunch of qubits in the superposition of a knot related to the Conway knot, given its infamy? $\endgroup$ Jan 11, 2023 at 20:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.