On a September morning, the U.S. Department of Commerce disclosed equity stakes in three quantum hardware firms โ Rigetti, D-Wave, and Quantinuum โ funded through the CHIPS framework for fault-tolerant quantum hardware and error-correction systems. The market read it as a warning shot aimed at every public-key cryptosystem on earth. I read it as a taxonomy error.
D-Wave builds quantum annealers. Annealers do not run Shor's algorithm. They minimize cost functions over an Ising landscape. They cannot factor a 256-bit elliptic curve order, and no amount of government capital rewrites that physics. Two of the three names on that check are materially relevant to cryptography. One is decorative. If a three-hundred-million-dollar headline is being used to reprice the risk of Q-Day, the denominator is wrong from the first sentence.
The code doesn't care about a press release.
That single detail โ a mislabeled threat vector buried inside a policy announcement โ is the cleanest illustration of everything wrong with how this debate is being conducted. Institutions are capitalizing hardware, foundations are publishing deadlines, and almost nobody is reading the byte-level consequences. So let me do what I am paid to do. Disassemble the machine, not the narrative.
The context first, because the context is where the confusion is manufactured.
Every signature that secures Bitcoin and Ethereum today rests on the same mathematical assumption: that finding the discrete logarithm of a public key over the secp256k1 elliptic curve is computationally infeasible. ECDSA enforces this. Schnorr does too. Both live on the same curve. Both fall to the same algorithm. Shor's algorithm, running on a sufficiently large fault-tolerant gate-based quantum computer, solves the discrete log problem in polynomial time. That is the entire threat in one sentence.
When Ethereum set a self-imposed December 2029 deadline and stood up a dedicated post-quantum cryptography team, it was signaling awareness, not readiness. When Bitcoin's BIP-360 and BIP-361 gained momentum in developer discussion, the community was signaling that the conversation had moved from academic mailing lists to concrete proposal text. Neither is activated. Neither is close. Both are proposals, and proposals are cheap.
Here is where I need to stop the reader cold, because this is the part almost every summary gets wrong. I have seen BIP-361 described as 'a phased migration from ECDSA to Schnorr signatures' and folded into a post-quantum narrative. That is not merely imprecise. It is dangerous. Schnorr signatures are not quantum-resistant. They are an efficiency and aggregation improvement layered on the same secp256k1 elliptic curve, and they are exactly as vulnerable to Shor's algorithm as the ECDSA they replace. A chain that migrates to Schnorr and declares itself quantum-safe has done nothing but re-tile the lobby floor while the foundation cracks. A genuine post-quantum migration replaces the elliptic curve wholesale โ with lattice-based, hash-based, or code-based constructions โ not with a nicer signature over the same vulnerable group.
I know this mistake intimately. During an audit engagement I cannot name, I watched a team conflate two separate upgrade tracks in their roadmap and present 'signature modernization' as a security control in a risk register. It passed three levels of internal review. It would have failed a single competent cryptographer. The lesson from that engagement is now permanent in how I write: terminology drift precedes exploit.
Now the core. Where the actual key material lives, and why it matters more than the headline.
The quantum threat does not strike addresses. It strikes exposed public keys. This distinction is buried in almost every popular explanation, and it is the load-bearing wall of the entire analysis.
In Bitcoin's UTXO model, an unspent output locked to a public key hash โ the P2PKH address you are familiar with โ is protected by the hash function, not by the curve. An attacker who has only the address must still break SHA-256 or RIPEMD-160 to recover the public key. That is a hard problem even for a quantum adversary, because Grover's algorithm offers only a quadratic speedup against hashing, not the exponential collapse that Shor's delivers against discrete logs. Hashing buys you time. The curve does not.
But the moment a P2PKH output is spent, the public key is revealed to the network. The moment a coin sits in a legacy P2PK output โ the format used in Bitcoin's earliest blocks โ the public key was exposed from the day it was created, whether or not it was ever spent. And this is where the structure of the problem turns ugly.
Satoshi Nakamoto's roughly one million coins sit in early P2PK outputs. Those public keys have been visible on-chain since 2009. Rusting in plain sight for over fifteen years. If a cryptographically relevant quantum computer ever arrives, those coins are not merely at risk โ they are the first thing a rational adversary with the capability would harvest, and they are the single largest concentration of vulnerable value in the history of the asset class.
The uncomfortable truth that follows is that those coins cannot be migrated by any protocol mechanism. Migration of a P2PK output requires the private key holder to sign a new transaction. If the holder is unavailable โ and after sixteen years, the base case is that the holder is unavailable โ then no fork, no proposal, no date on a calendar can move that value. A PQC upgrade protects coins that can sign. It does nothing for the coins that cannot.
Ethereum presents a mirror-image problem with its own logic. The account model is simpler on paper and far worse in practice. Every externally owned account โ the default 0x address โ exposes through its behavior and contract interactions a signature history that a future quantum adversary can mine. And the deeper issue is not the tens of millions of EOAs. It is the smart contracts whose verification logic hard-codes ECDSA assumptions. Each one must be individually rewritten, re-audited, and redeployed. Or abandoned. The foundation's 2029 deadline is a governance artifact. It is not a delivery schedule for a migration that touches every wallet, every dApp, every signer in the ecosystem.
Which brings me to the contrarian position, and I will state it plainly, because the polite version has been said enough times.
The dominant fear is that a quantum computer will break cryptography. The dominant reality is that cryptography is the easy part. The bottleneck isn't the mathematics. It's the coordination.
Ask yourself what the actual deliverable of a post-quantum migration looks like. It is not a paper. It is not a BIP number. It is every Ledger device firmware being updated. It is MetaMask shipping a new signing path and every browser extension user clicking through an upgrade they do not understand. It is every exchange coordinating the migration of billions in custodial balances. It is every DeFi protocol rewriting verification logic without introducing a single new reentrancy path. It is every indexer, every RPC provider, every block explorer, every hardware wallet, every custodial service, every bridge adapting in a window that nobody can enforce.
I have led an audit where five external teams had to synchronize on a consensus-layer interface. We rejected twenty percent of the initial designs for lacking formal verification, and that discipline delayed the launch by two weeks. It also prevented a cross-chain bridge exploit that would have drained nine figures. Two weeks of coordination friction across five teams. Multiply that by the number of independent actors in the Bitcoin and Ethereum ecosystems and you begin to understand that 'migration deadline' is a category error. You can set a deadline for a team. You cannot set a deadline for a civilization.
Resilience isn't audited in the winter. It is audited in the quiet summer, long before the first frost, by the people who plan for threats that have not yet arrived. And here is what the quiet planning reveals: the systems best positioned to migrate quickly are the ones least decentralized. Ethereum has a foundation that can name a date and staff a team. Bitcoin has a mailing list and a philosophy. Both of those are weaknesses wearing different clothes. The centralized chain migrates but sacrifices its claim to neutrality. The decentralized chain preserves its neutrality but cannot move fast enough to matter. There is no configuration of the system in which both properties hold under deadline pressure.
Now the second-order consequence, which almost nobody is pricing. BIP-361, as I understand its proposal scope, includes provisions that would eventually restrict or deprecate old-style signatures after a migration window. Read that clause for what it actually is. It is a mechanism to force migration by invalidating the old signing path. And once you accept that a protocol can decide that dormant, unspent, un-signed coins are no longer spendable in their original form, you have opened the single most sensitive door in Bitcoin's constitution: the question of whether inactive coins remain the property of their holders or become subject to collective decision.
That is not a cryptography question. That is a property rights question. And the answer cannot come from developers, because developers do not own the coins. It cannot come from miners, because miners enforce rules but do not legislate them. It cannot come from the foundation, because there is no foundation. It can only come from a social consensus that Bitcoin has historically resolved by splitting โ 2017 gave us the most expensive demonstration of how that process ends.
The third unspoken risk is that the 2029 anchor is a psychological artifact, not a technical forecast. IBM's Starling delivery target coincides with Ethereum's deadline in a way that feels less like convergence and more like coordinated narration. Google's estimated sub-1200 logical qubit milestone is an estimate, not an achievement. No published result demonstrates a cryptographically relevant quantum computer. The honest assessment is that the near-term risk is overstated by almost everyone selling urgency, and the long-term risk is understated by almost everyone enjoying the calm. The threat is a chronic condition, not an acute event. Chronic conditions still kill, but they kill slowly, and slow killers are the ones people negotiate with until it is too late.
The migration window narrative serves a function. It sells hardware. It sells new chains with 'native quantum resistance' as a marketing line. It sells research budgets. Some of that money is genuinely well spent, and I will not pretend otherwise โ the PQC standardization work at NIST is real engineering and it matters. But the same window that funds real work also funds theater. The discipline is in separating them. Read the proposal text. Check the signature scheme. Confirm the curve. A migration that never changes the underlying group is not a migration. It is a rebrand.
Takeaway.
If you hold assets, the correct move today is not to panic and not to ignore. It is to understand which of your coins sit in exposed-key outputs, because that is the exposed flank regardless of when the adversary arrives. If you build, the correct move is to make your signature verification logic upgradeable now, before you need it, while the cost is zero and nobody is watching. And if you govern, the correct move is to confront the dormant-coin question in the open, deliberately, before an external threat forces a rushed answer that splits the network.
Watch three signals over the next eighteen months: the first stable logical-qubit milestone that moves past estimation into demonstration, the movement of any long-dormant early address, and whether BIP-361 discussion turns from signature deprecation into asset-invalidation language. Those three data points will tell you more about the real timeline than any deadline or press conference ever will. Silence on all three is not safety. It is the quiet before someone decides the question for you.