The assumption is that Schnorr signatures are quantum-resistant. They are not.
Last week I spent four hours inside the BIP-361 discussion thread, and I watched a dozen competent developers describe the proposal as a "post-quantum migration path." This is a category error, and it matters, because a false sense of security in cryptography is worse than no security at all.
Schnorr, like ECDSA, lives on the secp256k1 curve. Shor's algorithm does not care about the difference. Both schemes collapse to the same broken discrete logarithm problem the instant a fault-tolerant machine of sufficient size powers on. BIP-361 accelerates signature aggregation and key path tweaks. It does not buy you a single day of quantum resistance. Tracing the assembly logic through the noise, the real migration work is happening in an entirely different layer of the stack, and almost no one is paying attention to where the actual exposure sits.
Consider the chain of events that landed this story in the press. The US Commerce Department took equity stakes in three quantum hardware firms, Rigetti, D-Wave, and Quantinuum, routing roughly $300 million through the CHIPS Act framework into "error-corrected quantum hardware." On the same news cycle, Ethereum's Foundation quietly restated a self-imposed deadline of December 2029 to complete a post-quantum cryptography migration, backed by a dedicated team. Bitcoin, meanwhile, has no coordinator, no deadline, and a governance model that makes the 2017 block size war look like a polite disagreement. And floating above both, a phrase repeated so often it has acquired the weight of fact: Q-Day, 2030, the year the assumption goes to zero.
That contrast is the whole story. Not the hardware. Not the threat. The coordination.
Here is where the market narrative and the cryptographic reality diverge. The threat model everyone repeats, "quantum computers will break Bitcoin," is technically correct in the limit and operationally misleading in the present. The real target is not the address. It is the public key.
In the UTXO model, an unspent P2PKH output is protected by a hash of the public key. Hashes are not efficiently invertible, even by a quantum adversary, because Grover's algorithm only provides a quadratic speedup and the search space is astronomically large. So far, so safe. But the moment that output is spent, or the moment it was born as a P2PK output, the format Satoshi used in the earliest blocks, the full public key is exposed on-chain, permanently, for anyone to read. Chaining value across incompatible standards, this is the seam where two worlds meet: the cryptographic guarantee of hash-based security, punctured by the operational reality that public keys leak the instant they sign.
There is an irony hidden in the timeline. Taproot, activated in 2021, pushed more of Bitcoin's activity toward Schnorr-based key path spends precisely because they are smaller, cheaper, and more private. But every key path spend reveals the full tweaked public key on-chain. The very upgrade the community celebrated as a scalability win quietly enlarged the set of exposed keys. The code does not lie, it only reveals, and what it reveals, block after block, is a public key.
Satoshi's approximately one million coins sit in early P2PK outputs. Their public keys have been visible since 2009. They are the single highest-risk asset in the ecosystem, and they are also structurally the least migratable, because migration requires a private key that no one has demonstrated exists.
Now the hardware side, which the press flattened into a single "quantum threat" blob. Three companies received government equity. Only two of them matter for cryptography. Rigetti and Quantinuum build gate-based quantum computers, the architecture capable, in principle, of running Shor's algorithm. D-Wave builds quantum annealers. Annealers solve optimization problems by relaxing toward a ground state. They do not execute arbitrary circuits, which means they cannot run Shor's algorithm, which means they pose essentially no direct threat to elliptic curve cryptography. The government's portfolio treats these architectures as interchangeable. They are not. The investment is real; the threat attribution is imprecise.
This is where I would stop if I were writing a market note. But the code does not lie, it only reveals. So let me go one layer deeper.
The Ethereum migration problem is not a cryptography problem either. It is a state problem. Bitcoin's script is intentionally limited, a handful of opcodes, a UTXO set that can be validated without global state. Ethereum is the opposite. Every account is an EOA governed by a private key, every contract that verifies a signature carries its own embedded verification logic, and there are millions of them. Replacing ECDSA with a lattice-based or hash-based scheme at the consensus layer is a weekend of engineering relative to what comes next: convincing every wallet vendor, every exchange, every custodian, and every smart contract author to migrate. The migration cost is not measured in compute cycles. It is measured in social coordination. And social coordination does not parallelize.
Bitcoin faces the mirror-image problem. It has no foundation to set a deadline, which is a feature until it becomes a bug. BIP-360 and BIP-361 crawl through a process designed to be slow precisely so that no single actor can rush it. Buried inside that process is a governance landmine that almost nobody is pricing: proposals that would eventually restrict or deprecate old signature types after a migration period. Restricting old signatures means freezing coins that never migrate. Freezing dormant coins means deciding, collectively, who owns the property rights to abandoned private keys. That is not a technical question. That is a constitutional one, and Bitcoin has never resolved it.
Here is the contrarian read. The industry is arguing about the wrong risk. The dominant fear, that quantum computers break ECC by 2029, is on current evidence overstated. Practical attacks on secp256k1 require millions of physical qubits operating under fault tolerance, and no published device is within two orders of magnitude. The published logical-qubit figures are estimates, not demonstrations. The 2029 deadline is a psychological anchor, not a physical inevitability.
The underestimated risk is the opposite: not that the quantum threat arrives too early, but that the migration completes too late, not because the cryptography is hard, but because the coordination is impossible. Auditing the space between the blocks, the failure mode is not a broken curve. It is a fragmented ecosystem where some users have migrated, some have not, some coins are frozen, and the property rights of the unmigrated remainder are contested in a governance fight that lasts a decade.
Chaining value across incompatible standards is always the hard part. Migrating the signature scheme is the easy part. The architecture of trust is fragile, not because the math is weak, but because the humans coordinating on top of it are slow, self-interested, and rarely aligned.
So watch the right signals. Not the breathless Q-Day countdown. Watch the BIP discussion threads for language about restricting old signatures. Watch whether Ethereum's PQC team ships a devnet signature scheme before 2027. Watch for any signature from an early-era address, because if a dormant Satoshi-era coin ever moves, it means either migration or compromise, and both are earthquakes.
The code will reveal which one it is. It always does.