Twenty times. Not a fee discount. Not a compression ratio. Not an APY. A twenty-fold reduction in the estimated resource cost required to run Shor's algorithm against a 256-bit elliptic curve.
I pulled that number out of a dense passage of recent quantum-computing literature and sat with it for a while. Twenty times is not a rounding error. Twenty times is the difference between a machine that needs a building and a machine that needs a floor. In cryptography, resource thresholds do not degrade gracefully. They fall off a cliff. A problem that costs ten billion gate operations to solve is a research curiosity. The same problem at five hundred million gate operations is a procurement question.
That is where we now are. Quietly, without a single exchange listing, the quantum threat to Bitcoin and Ethereum has migrated from the category of "far-future theoretical" to the category of "medium-term engineering risk." And the market, in its current state of leveraged euphoria, has priced it at exactly zero.
Let me be precise about what I am and am not claiming. There is no working quantum computer today that can recover a Bitcoin private key. None. What changed is the cost curve, not the capability. But cost curves are how threats become real. Every existential risk in the history of computing started as a line on a graph that bent in the wrong direction.
I spent forty hours a week in my twenties reading smart contracts for vulnerabilities nobody else had flagged. I learned then that the market never prices an exploit until it is demonstrated. Not disclosed. Demonstrated. There is a difference, and the difference is usually measured in billions of dollars of destroyed capital.
So this is a warning, not a trade idea. Read it as an audit.
The Signature Stack, Stripped to Its Bones
To understand why a resource estimate matters more than a hardware press release, you have to know what we are actually protecting. The architecture of trust, stripped to its bones, is two algorithms and a hash function.
Bitcoin uses ECDSA over the secp256k1 curve for legacy P2PK and P2PKH addresses, and for SegWit's P2WPKH outputs. Taproot, activated in 2021 through BIP340, introduced Schnorr signatures. Both rest on the same hardness assumption. Given a public key, deriving the private key is computationally infeasible on classical hardware. Elliptic Curve Discrete Logarithm Problem. ECDLP. That is the entire safety story. Everything else โ the difficulty adjustment, the mempool, the halving schedule โ is economic engineering built on top of that single mathematical bet.
Ethereum uses ECDSA over the same secp256k1 curve for externally owned accounts. The consensus layer uses BLS signatures for aggregation across validators. Smart contracts can embed arbitrary signature verification logic, which means the attack surface is not one curve but a sprawling constellation of cryptographic primitives, some of them hand-rolled and unaudited.
Now the hash functions. SHA-256 secures Bitcoin's proof-of-work and address derivation. Keccak-256 secures Ethereum's address derivation and Merkle structures. These are symmetric primitives, and the quantum story for symmetric primitives is different. Grover's algorithm offers a quadratic speedup on brute-force search. To keep the same security margin, you double the key length. SHA-256 becomes SHA-512. That is a nuisance, not a catastrophe. Shor's algorithm is the catastrophe, because it does not merely speed up the search โ it collapses the structure of the problem. For elliptic curves and RSA, Shor is exponential and merciless.
That asymmetry matters enormously. It means the migration problem is concentrated, not universal. We do not need to replace hashing. We need to replace public-key cryptography. That is a narrower, more tractable problem โ and a more urgent one.
I remember the first time I grasped this distinction properly. I was auditing ERC-20 contracts in 2017, back when reentrancy was the fashionable way to drain a treasury. The lesson was the same as now. The vulnerability almost never lives where the marketing says it does. The interesting failure is always one layer down, in the assumption nobody bothered to write down.
What a Twenty-Fold Reduction Actually Buys an Attacker
Quantum resource estimates are usually reported with a single headline number โ logical qubits, or physical qubits, or gate count โ and that flattening hides almost everything important. A real estimate for executing Shor's algorithm on a 256-bit curve requires at least five distinct figures: the number of logical qubits, the number of non-Clifford operations, the magic state production rate, the physical qubit overhead of the error-correcting code, and the wall-clock time.
A twenty-fold reduction in resource cost can arrive through any one of those channels, or through a combination. It might be a better circuit decomposition that shortens the arithmetic. It might be a more efficient fault-tolerant technique that reduces the magic state factory's cost. It might be a lower-overhead error-correcting code. Each of these improvements compounds. Cryptographers have been compounding them downward for a decade.
This is the part that the casual reader misses. There is no single moment when quantum computing "arrives." There is a long sequence of papers, each shaving a constant factor off the previous best estimate, each dismissed individually as incremental, and each one additive to the rest. The estimates from 2015 look absurd in hindsight. They assumed gate counts and qubit budgets that later work reduced by orders of magnitude. A twenty-fold step in a single publication is not incremental. It is the kind of result that resets a roadmap.
Think about what that means for the attacker's calculus. If you are a nation-state adversary, you do not need to be able to break a key in an afternoon. You need to be able to break it before the protocol you are attacking migrates away from it. That is the only deadline that matters. The relevant question is never "can a quantum computer break ECDSA?" It is "can a quantum computer break ECDSA before the last exposed public key is rotated?"
That reframing is brutal. It means every reduction in resource cost does not just move the attacker closer. It moves the migration deadline closer. And migration is the slowest thing in this entire industry. If you want proof, look at how long it took Bitcoin to activate a relatively modest upgrade like Taproot, and how long it is taking the community to agree on things that are considerably simpler than re-engineering the signature scheme that everyone's savings depend on.
The Harvest-Now-Decrypt-Later Problem Has a Blockchain-Specific Twist
In traditional cryptography, the harvest-now-decrypt-later threat is well understood. An adversary records encrypted traffic today, stores it, and decrypts it once quantum hardware matures. The confidentiality of today's communications is retroactively compromised.
Blockchains make this worse in a way that is specific and underappreciated. On a blockchain, the public key is not always encrypted. In the common case, it is published, just never linked to the rotating private key it implies. But for a class of outputs, the public key is exposed permanently and in plaintext, forever, on every full node.
The worst offenders are the oldest outputs. Pay-to-Public-Key outputs embed the public key directly in the locking script. When those coins were minted, that was the standard. There are hundreds of thousands of these outputs still unspent. Their owners โ or their owners' heirs, or their widows, or their forgotten hardware wallets โ may never move them. A quantum adversary does not need to catch those keys in flight. The keys are sitting on the table, in the open, and have been for over a decade.
The same is true of any address that has ever spent from. Once you have revealed your public key to authorize a transaction, that key is exposed. If you reuse the address, an adversary with a sufficiently powerful quantum computer has a known target. If you are careful and use a fresh address every time โ which good wallet software encourages โ you partially mitigate the risk. But the historical ledger is not careful. The historical ledger is a museum of exposed public keys.
And then there is Satoshi's roughly one million Bitcoin. Under the standard analysis, a non-trivial portion of those coins are in P2PK outputs. They have never moved. Their public keys are exposed. They cannot be rotated, because to rotate a key you must first sign with it, and to sign you must possess it, and whoever possesses those keys has not touched them in fifteen years. Those coins are, in the cold language of cryptography, un-migratable. They are a permanent reservoir of exposed signatures controlled by no one who is currently acting.
When I modelled CBDC interoperability and Bitcoin ETF custody in 2024, I spent weeks calculating settlement latency and cross-border friction. I did not spend enough weeks on cryptographic longevity. That omission now looks like the single largest blind spot in that entire class of analysis. A custodian's liability is not just the coins it holds. It is the algorithm that secures them, and the clock ticking on that algorithm.
Where the Hardware Actually Is
I want to ground this in reality, because the quantum space attracts both maximalism and denial, and neither is useful. There is no functional quantum computer capable of attacking a real Bitcoin key. Full stop.
The current state of the art is measured in physical qubits, with error rates that are improving but still far from what fault tolerance demands. The notable recent milestones have been about crossing error-correction thresholds โ the point at which adding more physical qubits to build a logical qubit actually reduces error rather than increasing it. That is a genuine achievement, and it is the necessary precondition for everything else. It is also a long way from a cryptographically relevant machine.
The gap is not a matter of doubling. It is a matter of several orders of magnitude in both qubit count and gate fidelity. A cryptographically relevant machine for ECDLP would require thousands of logical qubits, each built from hundreds or thousands of physical qubits, each capable of sustaining high-fidelity operations for the duration of a deep circuit. The engineering is staggering. But the word "staggering" has been applied to every generation of this technology, and every generation has shrunk the estimate for how staggering the next one needs to be.
So here is the honest map. The hardware is not there. It is closer than the consensus believed two years ago, and each reduction in the resource estimate compresses the window. The question for any rational observer is not "is it possible?" It is "what is the probability-weighted cost of being wrong?"
Being wrong about quantum means losing everything. Being early about quantum means programming a migration you would have needed eventually anyway. That asymmetry should drive institutional behavior. For the most part, it is not driving it yet.
Bitcoin's Address Problem Is Really a Data-Structure Problem
When people talk about a "quantum upgrade" for Bitcoin, they usually talk about it as a cryptographic problem. Pick a post-quantum signature scheme, deploy it, done. That framing is wrong. The hard part is not the cryptography. The hard part is the data structure.
Consider what a migration would actually require. You would need a new script type that verifies post-quantum signatures. You would need wallets to support it. You would need a soft fork โ or a hard fork, depending on how the new verification integrates with legacy consensus. You would need the miners to run the code. You would need exchanges, custodians, hardware wallet manufacturers, and every layer of tooling in between to update atomically enough that no one hogs value during the transition.
And even if all that happens, it does not retroactively protect exposed keys. A post-quantum output type protects new coins moved into it. It does nothing for the old coins whose public keys are already public. To protect those, the owner must move them โ which requires them to sign before the threat is realized, and requires them to decide to do so.
This is where the cryptography ends and the game theory begins. The moment it becomes credible that a quantum attack is imminent, every holder of an exposed-key address has an incentive to move first. Whoever moves first pays a transaction fee, gets into the new system, and is safe. Whoever moves last faces a mempool that is on fire. There is a real possibility of a coordinated but chaotic rush, and there is a real possibility of a minority of coins being lost entirely because their owners never got the memo.
I have seen this movie before, at a smaller scale. In 2020, I led a stress-test of Uniswap V2's automated market maker under simulated high-volatility conditions. The interesting result was not the impermanent loss numbers โ those were predictable. The interesting result was how the system behaved when every participant tried to exit simultaneously. Liquidity provision is fine in equilibrium. It is the disequilibrium that kills you, and the transition to post-quantum cryptography is a giant disequilibrium waiting to happen.
Ethereum's Migration Is Harder Because It Has More to Preserve
If Bitcoin's migration is a data-structure problem, Ethereum's is a systems problem, and systems problems are worse.
Ethereum's consensus layer relies on BLS signatures for aggregation. A post-quantum replacement would need to preserve aggregability, which is a much harder ask than simply verifying an individual signature. Lattice-based schemes exist, and some of them support aggregation, but the performance characteristics are different, and the security proofs are different, and the codebase that depends on those proofs is enormous.
The execution layer is worse still. Ethereum's smart contracts can encode arbitrary verification logic. That means the migration is not a single protocol change. It is a long tail of contract-level decisions, many of them made years ago by developers who are no longer active, some of them deployed as immutable bytecode with no upgrade path at all. A protocol that prides itself on composability has composed itself into a corner where a single foundational assumption is changing and an unknowable number of contracts are quietly betting against that change.
Account abstraction complicates this in an interesting direction. A flexible account model is precisely the abstraction layer you would want when swapping signature schemes. If accounts are programmable, signatures can be modular. If signatures are modular, migration becomes an upgrade rather than a fork. So the very complexity that makes Ethereum hard to migrate also gives it the tooling to migrate. That tension is not a contradiction. It is the characteristic shape of every Ethereum problem.
What I would watch is the developer discourse. Not the announcements โ the discourse. When the core research community starts treating a post-quantum signature transition as a first-class roadmap item, that is the signal that the migration clock has started. Until then, everyone is talking around it.
The Standard Already Exists. Adoption Is the Bottleneck.
The most damaging misconception in this entire discussion is that we have no solution. We do. The standards body responsible for this class of work finalized its first post-quantum standards in 2024, and the suite has continued to expand. Lattice-based key encapsulation and signatures are standardized. Hash-based signatures are standardized. Code-based schemes are in the pipeline as backups.
The existence of the standard should be reassuring. It is not, because standards are not deployments. A standardized algorithm in a PDF is a hypothesis. A standardized algorithm running in a hardware wallet is a fact. The distance between those two states is measured in years and in the political capital required to get consensus around a change.
I have watched this gap my whole career. FIPS documents are published, and then the industry spends half a decade arguing about whether the implementation is constant-time, whether the key sizes are tolerable, whether the performance hit is acceptable, and whether anyone actually trusts the parameter choices. By the time the answer is "yes," the threat model has usually moved.
For blockchains the friction is higher, because blockchains cannot patch a deployed contract. They cannot rotate a compromised credential at the institutional level. They are, by design, resistant to forced change. That resistance is a feature in every context except this one.
The zk-Proof Question Nobody Has Answered Cleanly
I spent six months of the 2022 bear market optimizing zk-SNARK circuits for a mid-sized Layer 2, shaving fifteen percent off proof generation time. It was unglamorous work during a period when the market was pricing despair. It taught me something I keep returning to: zero-knowledge proofs are cryptographic objects built from other cryptographic objects, and their quantum-resistance is inherited, not guaranteed.
The honest answer is that the landscape is uneven. SNARK constructions rely on elliptic curve pairings, which are exactly the structures Shor's algorithm attacks. That is a serious problem for the transparent, pairing-friendly proofs that dominate production deployments. STARKs, which rest on hash functions and low-degree testing, inherit the milder symmetric-primitive story. Grover halves their effective security, which is a key-size adjustment, not a funeral.
So the zk ecosystem is bifurcated. The more efficient systems are the more quantum-vulnerable ones. The more quantum-resilient systems are the more computationally expensive ones. That trade-off is already visible in every benchmark chart, and it will become a first-order design consideration the moment a credible migration timeline appears.
And there is a nuance that almost nobody discusses: zk-proofs are not just a privacy tool. They are a scaling tool, and increasingly a compliance tool. If regulators latch onto zero-knowledge proofs as their preferred mechanism for privacy-preserving audit โ and the trajectory in the CBDC space suggests they might โ then the quantum vulnerability of pairings stops being an academic concern and becomes a regulatory risk. I have modelled cross-border settlement latency in an environment where standardized APIs could cut delays by double digits. That model assumed the cryptography underneath would still be valid in a decade. It is a safe assumption in most contexts. It is not obviously safe in this one.
The CBDC Layer Will Move First, and That Tells Us Something
Here is the prediction I am most confident about, and it is a prediction about institutional behavior rather than about hardware.
Central bank digital currency systems will migrate to post-quantum cryptography before Bitcoin or Ethereum do. Not because central bankers are more far-sighted, but because they have a single decision-maker, a compliance apparatus, and no need for network consensus. A central bank can adopt a new standard by writing a specification. A decentralized network can adopt a new standard only by persuading thousands of independent actors that the change is worth making.
This has an uncomfortable implication for the long-term narrative. The "safe asset" story for Bitcoin has always rested partly on its cryptographic conservatism โ on the fact that it changes slowly, deliberately, and only under overwhelming consensus. In the specific context of a signature-scheme migration, that same conservatism becomes a liability. The properties that make a system resistant to capture also make it resistant to rescue.
What I would watch for is the moment a major central bank publishes a post-quantum migration roadmap with dates. That document will do more to accelerate decentralized migration than any academic paper, because it converts an abstract risk into a competitive comparison. Nobody wants to be the network that everyone else is calling obsolete.
The Contrarian Case: The Threat Is Real, the Panic Is Misplaced
Now let me argue against myself, because the most useful thing an analyst can do in a bull market is to stress-test the bearish case they just built.
The contrarian position is not that quantum risk is fake. It is that the way quantum risk gets priced is backwards.
The market's likely reaction to a major quantum breakthrough announcement is a sharp sell-off followed by a slow, grudging recovery once people remember that a resource estimate is not an attack. That reaction would be wrong, and the people who understand the difference will be positioned to buy the panic. But that is a trading insight, not a structural one. The structural insight is harder to swallow.
Here is the real contrarian claim. The quantum threat may end up being the most bullish thing that happens to Bitcoin's cryptographic architecture in a decade. Not because the threat is good, but because responding to it forces the ecosystem to do something it has been avoiding: a genuine, coordinated, technically deep protocol-level upgrade. The last time Bitcoin executed something in that category was Taproot, and it took years. A signature migration would be larger. Executing it would prove that the network can still move.
There is a second, subtler contrarian point. The quantum timeline is not a cliff. It is a fog. Nobody knows when it arrives, and every estimate is a distribution, not a date. In a fog, the correct strategy is not panic and not denial. It is incremental hedging. Start the research. Build the libraries. Standardize the interfaces. Prototype the wallets. Do the unglamorous work now, when it is cheap, so that when the fog clears you are not scrambling.
This is exactly the discipline I have applied to every technical problem I have ever worked on. When I was twenty-two, auditing ICO contracts, I identified reentrancy vulnerabilities in three major fundraising projects. Two of them had already raised. None of them wanted to hear it. The vulnerability was real, it was demonstrable, and it was ignored until it was no longer deniable. The pattern never changes. The only variable is how much value is destroyed between the demonstration and the response.
What I Am Actually Watching
I do not trade on quantum headlines. I read them for structure. Here is the short list of signals that would change my model.
First, logical qubit counts. Physical qubits are vanity metrics. Logical qubits are the only number that maps to cryptographic capability. When credible demonstrations push into the low thousands of logical qubits with acceptable error rates, the conversation changes from speculative to concrete.
Second, adoption of the post-quantum standards inside core developer communities. Not press releases โ commits. The moment a Bitcoin Core or an Ethereum research repository contains a serious migration proposal with a timeline and a testnet, that is the signal. Watch the mailing lists.
Third, any demonstration, however slow, of a real key recovery using quantum hardware โ even on a testnet address, even if it takes days. The psychological impact of a demonstration dwarfs the technical impact. The market prices demonstrations. It does not price distributions.
Fourth, the counterpart: any evidence of the migration actually happening. A new address type. A hardware wallet supporting post-quantum keys. A custodian publishing a cryptographic longevity policy. These are the boring milestones that actually matter, and they will occur before the dramatic ones.
Takeaway
I have spent my career verifying claims at the code level, and the code-level claim here is narrow and defensible. The resource cost of attacking elliptic curve cryptography has fallen, and it will keep falling. The hardware is not there. The migration is not started. The window between those two facts is the only thing that matters, and it is closing at a rate that nobody in this market is currently measuring.
Navigating the storm with empirical precision means accepting that the most important risk in the next decade may be one that produces no price chart, no funding round, and no narrative until the day it produces all three at once. Clarity emerges from the chaos of verification, and the verification here points in one direction.
The question is not whether Bitcoin and Ethereum will migrate to post-quantum cryptography. They will, because they have no choice. The question is whether they will migrate before they need to, or after. Only one of those outcomes is survivable at scale, and the decision is being deferred right now, in a bull market, by people who are too busy counting to look down at the foundation they are standing on.