On the tenth of September, the United States Department of Commerce did something no government had done at this scale: it converted public money into equity in three private quantum computing companies. The vehicle was the CHIPS and Science Act. The recipients were Rigetti Computing, D-Wave Quantum, and Quantinuum. The stated purpose, wrapped in procurement language about fault-tolerant hardware and error-correction systems, was to secure American primacy in a technology that still has no consumer product, no profitable unit economics, and no delivery date anyone will guarantee.
I read the disclosure three times. Not because the dollar figure startled me, but because of what the capital was actually purchasing. Not compute capacity. Not market share. Not revenue. It was buying optionality on a specific future: one in which the elliptic-curve cryptography securing roughly two trillion dollars of digital assets becomes functionally obsolete.
Follow the money, not the noise. And right now the money is pointing at a timeline that the crypto industry has spent a decade treating as science fiction.
But here is the technical discovery that made me put down my coffee. The threat vector being funded is not the one most holders imagine. The real vulnerability is not your address. It is your public key. And for a small, ancient, and extraordinarily valuable subset of the Bitcoin supply, that key has been exposed since the protocol's first block.
Bitcoin and Ethereum both secure ownership with the same mathematical primitive: the Elliptic Curve Digital Signature Algorithm, or ECDSA, running over the secp256k1 curve. The security of that primitive rests on one assumption. Recovering a private key from a public key requires solving the elliptic-curve discrete logarithm problem, which is computationally infeasible on any classical machine. A sufficiently large, fault-tolerant quantum computer running Shor's algorithm dismantles that assumption entirely. Not partially. Not gradually. Completely, in polynomial time.
There is a nuance that most coverage flattens, and it matters enormously for risk assessment. An unspent Bitcoin output is not one object. It is two. There is the address, which is a hash of the public key, and there is the public key itself. Hashing is not broken by Shor's algorithm. Grover's algorithm offers only a quadratic speedup against hash functions, which is manageable by increasing key lengths. So an address that has never been spent from remains, relatively speaking, protected. Grover is a nuisance. Shor is an executioner.
The moment you spend from that address, you publish your public key to the network, permanently and irreversibly. From that point forward, the only thing standing between your coins and a quantum adversary is the assumption that no such adversary exists.
This is why the migration conversation is not really about upgrading software. It is about a race between the publication of public keys across the blockchain's history and the arrival of a machine capable of exploiting them. Every signature ever broadcast is a data point. Every legacy address that received coins and spent them has left a fingerprint. The chain does not forget.
Into this gap stepped the two dominant networks, with two radically different philosophies. Ethereum, through its Foundation, has set a self-imposed deadline of December 2029, stood up a dedicated post-quantum research group, and begun sketching a migration path for its account model. Bitcoin, through its improvement proposal process, has seen BIP-360 and BIP-361 accelerate through discussion, neither activated, both contested. One chain has a coordinator and a clock. The other has neither.
One of these is a governance advantage. The other is a stress test of everything Bitcoin claims to be.
I need to address a technical misstatement that is circulating widely, because it is dangerous. Several summaries of this story describe BIP-361 as a staged migration from ECDSA to Schnorr signatures, and place it inside the quantum-resistance framework.
That framing is wrong, and it produces false comfort.
Schnorr signatures are a different construction for the same curve. They aggregate beautifully, they enable Taproot's privacy improvements, and they are a genuine engineering advance. But they are still built on secp256k1. Every Schnorr signature on a Bitcoin transaction is exactly as vulnerable to Shor's algorithm as the ECDSA signature it replaced. Migrating from ECDSA to Schnorr is a migration from a wooden lock to a slightly better wooden lock. Against a quantum adversary, it is decoration.
A genuinely post-quantum solution requires abandoning elliptic curves altogether, not rearranging them. That means lattice-based constructions, hash-based signatures such as the Merkle-root output types now entering the proposal pipeline, or other schemes grounded in problems that quantum algorithms do not efficiently solve. The distance between Schnorr and post-quantum is not a firmware update. It is a different branch of mathematics.
I spent the better part of 2017 reverse-engineering smart contracts for seven utility tokens, and the lesson I carried out of that year was not that code fails. It was that code fails quietly, and marketing fails loudly, and the two are usually confused. A staged signature migration sounds like progress. It is progress toward cheaper multisig aggregation. It is not progress toward surviving Q-Day. The distinction deserves to be stated plainly, because a holder who believes their Schnorr-enabled wallet is quantum-safe will not move their coins when the migration window opens, and that passivity is itself a risk factor.
Let me be precise about my confidence here. I have moderate uncertainty about the exact contents of the most recent revision of BIP-361. Proposals evolve, and I am reading discussion threads, not signed specifications. But the cryptographic claim I am making is not uncertain. Schnorr over secp256k1 is not quantum-resistant. That is not a matter of interpretation. It is a theorem.
Now the architecture question, because the money itself reveals the confusion.
Three companies received government equity. Only two of them represent a direct threat to elliptic-curve cryptography.
Rigetti builds superconducting gate-based quantum computers. Quantinuum builds trapped-ion gate-based machines and is, by most public benchmarks, the strongest performer on quantum volume. Both architectures can, in principle, execute Shor's algorithm given enough logical qubits, enough coherence time, and enough error correction. They are the real threat.
D-Wave is a different animal. D-Wave builds quantum annealers. Annealing is an optimization paradigm. It is exceptionally good at finding low-energy configurations in certain combinatorial landscapes, and it has genuine industrial applications in logistics, scheduling, and materials simulation. But annealing is not a gate model. It does not run Shor's algorithm. It cannot, even in theory, factor the integers that underpin RSA or solve the discrete logarithms that underpin ECDSA in the way a universal quantum computer can.
This matters because a portfolio of quantum hardware companies presented as a unified national security bet is actually a portfolio of two very different risk profiles. If the goal is cryptographic advantage, one of the three recipients is largely orthogonal to that goal. If the goal is industrial policy across a broad quantum frontier, all three make sense. The disclosure does not clarify which objective dominates, and I suspect the answer is that both are present and neither is fully articulated.
Follow the money, not the noise. And when you follow it here, you find that the headline, America is funding quantum machines that will break Bitcoin, is imprecise in a way that matters. Two of the three bets are existential. One is adjacent.
The deeper signal is simpler and more uncomfortable. A state actor has decided that quantum capability is strategic infrastructure worth owning equity in. That decision has nothing to do with Bitcoin's price. It has everything to do with the timeline on which Bitcoin's cryptography stops being cryptography.
Here is where the analysis stops being abstract.
Not all Bitcoin is equally exposed. The supply divides into categories with radically different quantum risk profiles, and the aggregate number, roughly two trillion dollars, hides a distribution that should terrify anyone responsible for custody.
At the top of the risk stack sit Pay-to-Public-Key outputs, the earliest and most primitive transaction format. In a P2PK output, the public key is not hashed. It is written directly into the output script, in plaintext, visible to anyone running a node from the moment the block is mined. The hash protection that shields P2PKH addresses does not exist here. There is nothing between the public key and the chain.
Now recall the origin story. In January 2009, the genesis block rewarded fifty coins to a P2PK output. The coins mined in Bitcoin's first months and years overwhelmingly used this format, because it was the format available. Estimates of the dormant supply attributed to the earliest mining era, including the roughly one million coins widely believed to belong to Satoshi Nakamoto, are in the range of hundreds of thousands to over a million BTC. Every one of those outputs carries a public key that has been visible on-chain since the day it was created.
This is the highest-risk asset class in the entire digital economy. Not because the owner is careless, but because the exposure is structural and irreversible. You cannot retrofit a hash onto a public key that has already been broadcast. The chain already knows.
Contrast this with a modern hardware wallet. A user generates an address, receives coins, and never spends. The public key remains unknown to the network, protected behind a hash. Under a quantum attack, that user is comparatively safe until the moment they transact. The danger window opens at the point of spending, when the public key is revealed and the transaction sits in the mempool awaiting confirmation. A sufficiently capable adversary, watching the mempool in real time, could in theory derive the private key and race the original transaction with a competing spend.
That scenario, mempool interception, is the one I find most credible as the first practical attack surface. It does not require breaking the entire historical ledger. It requires breaking one signature, once, in a window of seconds to minutes. And it requires only that the victim is moving old coins.
The bitter irony is that the migration itself is the moment of maximum vulnerability. To move your Bitcoin into a post-quantum output type, you must first sign with your old key. You must expose what you have been hiding. Every holder who migrates passes through a brief window in which they are as exposed as a 2010-era miner. Coordinating that migration, staggering it, protecting the mempool, becomes an operational security problem at global scale.
If Bitcoin's migration problem is a matter of cryptography and supply, Ethereum's is a matter of software archaeology, and it is considerably worse.
Ethereum's base layer is more adaptable than Bitcoin's in some respects. It has a foundation that can set deadlines, researchers who can be hired, and a development culture that ships upgrades on a quarterly cadence. Recent history suggests the network can coordinate complex, network-wide changes without the kind of existential schism that Bitcoin experienced in 2017. That is a real advantage, and I do not want to understate it.
But Ethereum is not a ledger of coins. It is a ledger of state, and embedded in that state is a sprawling, heterogeneous universe of signature verification logic, spread across hundreds of thousands of smart contracts, most of it frozen, some of it upgradeable, a great deal of it unmaintained.
The account model compounds the problem. Every externally owned account, every wallet with a private key, must individually migrate to a post-quantum signing scheme. There is no protocol-level mechanism that can reach into a user's device and rotate their key. That is a social and operational process, not a technical one, and it must be carried out across millions of users, thousands of wallets, and dozens of hardware vendors, each with its own release cycle, its own test burden, and its own incentive to be late.
Then there is the contract layer. Smart contracts that verify signatures, multisigs, governance modules, bridges, account-abstraction paymasters, and an entire ecosystem of infrastructure that assumes ECDSA verification is available and cheap, all of it must be rewritten or replaced. Some of it cannot be rewritten at all, because the keys that would authorize an upgrade are themselves held in accounts that need to migrate. There are contracts on Ethereum whose administrative control rests on a single EOA, and whose upgrade path depends on that key existing in its current form.
The Foundation's December 2029 target is admirable. It is also, in my assessment, optimistic. Not because the cryptography is unsolved, but because the coordination surface is enormous. My 2020 research on stablecoin peg instability and cross-border remittance flows in Latin America taught me that the hardest part of any financial system is never the protocol. It is the last mile, where real people with imperfect information and competing incentives have to change their behavior.
Renaming a signature scheme in a specification is trivial. Getting a pension fund in Buenos Aires, a remittance corridor operator in Manila, and a hobbyist with a Ledger from 2019 to all rotate their keys before a deadline that no one is enforcing, is not.
Set aside the cryptography for a moment and consider the monetary consequence, because this is where the discussion genuinely departs from anything the market has priced.
If Bitcoin eventually adopts a mechanism that restricts or invalidates signatures from legacy output types after a migration window closes, the coins that do not migrate become, depending on the design, either unspendable or contingent on a future consensus change. For most of the supply, this is a non-event. Active holders will move.
For the dormant supply, it is a different story. Coins whose owners are deceased, lost, or simply indifferent cannot be migrated. There is no legal representative on-chain. There is no mechanism by which the protocol can rotate a key it does not control. The roughly one million coins attributed to Satoshi's era are the extreme case, but they are not the only case. Analysts have long estimated that between two and four million Bitcoin have not moved in a decade or more. A meaningful fraction of that is genuinely lost. A meaningful fraction is not.
The mechanical effect of invalidating legacy signatures is a supply reduction. Coins that can no longer be spent are, in the strictest economic sense, removed from the float. On paper, that is deflationary, and deflationary events are supposed to be bullish.
I do not think that is the right way to read it, and I want to be careful here. The coins are not burned. They are frozen by consensus rule. The difference matters, because a burn is an act of the owner, and a freeze is an act of the collective. One is property being exercised. The other is property being overridden.
The market does not currently distinguish between these two things. It will.
This brings us to the governance fault line, and to the reason I believe the Bitcoin side of this story is far more consequential than the quantum hardware headline.
Bitcoin has no foundation. It has no deadline. It has a rough consensus process that has historically converged only under extreme pressure, and it has a deep, well-documented institutional allergy to any change that touches property rights. The block size wars were not ultimately about megabytes. They were about who gets to decide, and they left scars that still shape every subsequent debate.
A proposal that would restrict the validity of legacy signatures after a migration window is, in effect, a statement that the protocol has the authority to render a class of property unspendable. Whether or not that is technically necessary, it is constitutionally explosive. The question it raises is not about cryptography. It is about whether the network's security interests can override the property rights of inactive holders.
And that question has no clean answer, because both sides are correct. The security argument is real: if vulnerable outputs remain spendable indefinitely, the network carries an unpriced systemic risk. The property argument is equally real: a monetary system whose rules can be changed to strand holdings is a monetary system whose core promise has been weakened.
The proposals will be debated by developers, miners, exchanges, and holders, none of whom share identical interests. Developers want a coherent, defensible design. Miners want fee revenue and continuity. Exchanges want operational clarity and no customer losses. Holders of active coins want a migration path that does not compromise them. Holders of dormant coins, if they exist at all, are not at the table.
I have watched governance theater up close. On-chain voter turnout on the largest DAOs has hovered below five percent for years, which means that in practice a handful of whales and venture funds decide outcomes that are then narrated as community consensus. Bitcoin's process is different in kind, more open and more adversarial, but the structural truth rhymes. The loudest voices are the ones with the most to gain from a particular resolution.
Which is why I expect the Bitcoin migration debate to bifurcate. A permissive path, allowing legacy signatures forever, preserves property rights and leaves the tail risk open. A restrictive path, sunsetting legacy signatures, closes the risk and invites a legitimacy crisis. The third option, a fork, is always on the table, and it has precedent. If a faction believes the restrictive path violates the property guarantee that defines Bitcoin, they can preserve a chain that does not enforce it, exactly as happened in 2017. The resulting asset would be smaller, less liquid, and philosophically purer. That is roughly the profile of every chain fork in crypto history.
There is a regulatory layer here that most crypto-native analysis skips, and it is where the government's equity position becomes genuinely interesting.
The United States already dominates the post-quantum cryptography standardization process through NIST. The algorithms that the crypto industry will adopt over the next decade, lattice-based schemes, hash-based signatures, and the rest, are being selected, parameterized, and published under American institutional leadership. That is a form of soft power that operates quietly and permanently. A blockchain that migrates to NIST-standardized algorithms is, in a meaningful sense, adopting American cryptographic infrastructure.
Now add the equity stakes. The government is not merely setting standards. It is a shareholder in companies developing the machines that would render the current standards obsolete. If a state-controlled or state-influenced quantum enterprise reaches the threshold of cryptographic capability, the relationship between that state and the encryption securing global finance shifts from competitive to something closer to structural. The government would not need to attack anyone. It would simply be the entity with the capability.
I am not suggesting a conspiracy. I am pointing at an incentive structure. A government that holds equity in gate-based quantum computing has a financial and strategic interest in that technology maturing, and a corresponding interest in controlling what it does with that capability. The dual-use nature of fault-tolerant quantum machines, useful for chemistry and materials science and equally useful for cryptanalysis, means that the boundary between civilian research and national security capability is blurred by design.
For crypto, the near-term consequence is likely benign. Standardization is good, and coordination is better than chaos. The longer-term consequence is a form of dependency. If the post-quantum future is built on algorithms the American government selected, and if the machines capable of breaking the previous generation are partly government-owned, then the sovereignty that decentralization promised becomes a more complicated claim than it was in 2009.
Let me map the transmission, because the practical question for anyone reading is not whether Shor's algorithm works. It does. The question is who bleeds first, and when.
The quantum hardware and semiconductor sector is the immediate beneficiary. Government equity, government contracts, and a narrative that pulls in private capital. Rigetti and Quantinuum map directly onto the cryptographic threat. D-Wave maps onto industrial optimization, which is a real business but not the one the story is selling.
The upstream threat creates downstream demand. Post-quantum migration services, cryptographic auditing, key-rotation tooling, and new address format standards will become a genuine industry, likely small at first and then urgent. This is the most underrated opportunity in the entire narrative, and it is unglamorous, which is exactly why it is underrated.
Exchanges and custodians sit in an awkward position. They hold a substantial fraction of all Bitcoin and Ethereum in omnibus wallets, and they will need to coordinate migration across millions of customer accounts, under regulatory supervision, without a single downtime event that spooks markets. Their incentives point toward waiting for someone else to establish the pattern, which means they will be late, which means their risk window will be wide.
Wallets are the bottleneck nobody wants to name. An open-source wallet with a small maintainer base, distributed across app stores and hardware vendors, must ship post-quantum support, test it against every historical address type, and persuade users to upgrade. Multiply that by thousands of wallet implementations across a dozen chains. The base layer could be ready in 2028 and the user-facing layer could still be fragmented in 2031.
DeFi is the hardest hit. Contracts that verify signatures, multisignature governance modules, cross-chain bridges whose security models assume ECDSA verification, and account-abstraction infrastructure will all require rewrites. Some of these contracts are upgradeable. Some are not. The ones that are not will become permanent, unupgradeable, quantum-vulnerable artifacts, and the assets inside them will need to be evacuated by whoever holds the keys.
Traditional finance, by contrast, may be a net beneficiary. Institutional adoption has always been constrained by the perception that crypto is technically fragile. A network that demonstrably executes a global cryptographic migration, on a published timeline, with audited post-quantum primitives, becomes materially more attractive to conservative allocators. The migration is terrible for incumbents and excellent for the story institutions want to tell.
Volatility is the tax on impatience. And the market's impatience here is pointed in the wrong direction. It wants to know when quantum computers will break Bitcoin. The more useful question is which participant in the ecosystem will be operationally ready first, and which will still be arguing about governance when the deadline arrives.
Here is my contrarian position, stated as plainly as I can manage.
The consensus reading of this story is that American quantum investment brings Q-Day closer, that Bitcoin and Ethereum are now in a genuine race against time, and that the appropriate response is concern. I think that reading is directionally wrong in the short term and dangerously complacent in the long term, which is an unusual combination.
In the short term, the threat is overstated. A cryptographically relevant quantum computer requires millions of physical qubits operating with sufficient coherence and error correction to yield thousands of stable logical qubits. The most cited figure in circulation, a projection of under twelve hundred logical qubits by a major technology firm, is an estimate, not an achievement, and it is an estimate of capability, not of cryptographic relevance. Breaking a single secp256k1 key is a substantially harder problem than running a benchmark. Between 2025 and 2029, I assign a low probability to a practical ECC-breaking demonstration. The urgency narrative is built on anticipation, not arithmetic.
In the long term, the complacency is the problem. Migration at scale takes five to ten years even when everyone agrees. Bitcoin does not agree on anything quickly. If the industry waits for a credible demonstration before starting, it will already be too late, because the migration window will be shorter than the migration itself. The correct frame is not a race against a machine. It is a race against our own coordination capacity, and we are losing that race comfortably.
The most underappreciated risk in this entire topic is not quantum computers. It is that a technically solvable problem gets trapped in a governance debate and never gets solved. Bitcoin's property-rights deadlock and Ethereum's last-mile coordination burden are both social problems wearing cryptographic clothing.
The most overrated risk is the panic itself. Quantum fear is a perfect narrative instrument, because the threat is invisible, the timeline is unfalsifiable, and the remedy is a token that claims to have solved it natively. I expect a wave of new chains marketing native post-quantum resistance, most of which will substitute a marketing claim for an audit. The same instinct that produced a thousand ICO white papers in 2017, several of which I audited personally, will produce a thousand quantum-resistant pitch decks now. Follow the money, not the noise. The noise here will be exceptionally loud.
The decoupling thesis, in short: the security of Bitcoin and Ethereum will not be determined by quantum hardware. It will be determined by whether their communities can execute coordinated change under a deadline they cannot control, and the evidence to date suggests that one of them can and the other has not yet demonstrated that it wants to.
What I am watching is specific, because general concern is useless.
I am watching the logical qubit count, not the physical one, because physical qubits are marketing and logical qubits are engineering. I am watching BIP-360 and BIP-361 move from discussion to activation, because the moment they do, the property-rights fight begins in earnest, and the shape of that fight will tell us whether Bitcoin can migrate at all. I am watching Ethereum's post-quantum team ship a testnet, because theory that does not compile is not a strategy. I am watching the dormant addresses, particularly the earliest ones, because a signature from a wallet that has been silent since 2009 would be the single most consequential on-chain event in the history of the asset.
And I am watching the wallets. When Ledger, Trezor, and the major software wallets publish post-quantum roadmaps with dates, the migration will have started. Until then, everything else is commentary.
The tide does not ask for permission, but protocols do. That is the whole problem. A quantum computer will arrive on its own schedule, indifferent to the governance debates of the systems it threatens. Whether Bitcoin and Ethereum meet it from a position of readiness or a position of stalemate is not a question of physics. It is a question of whether two communities can agree on what they are willing to sacrifice, and how quickly they are willing to say so out loud.
I have watched this industry solve hard technical problems in months and easy social problems in years. The quantum migration is the reverse: technically tractable, socially brutal. The winners will not be the chains with the best cryptography. They will be the chains that can get a hundred million people to change a key before a deadline nobody is enforcing.
That is a strange thing for a decentralized system to be good at. I am not yet convinced either one of them is.