Site icon AI Crypto News

Bitcoin and Quantum Computers: How Serious Is the Threat Really?

Hodl Herald
Bitcoin and Quantum Computers: How Serious Is the Threat Really?

Image created with ChatGPT

In the Bitcoin world, some debates keep coming back, flare up for a moment, then fade into the background again. At first glance, the Bitcoin quantum-computer debate looks like exactly that kind of topic.

And yet, since the start of 2026, it has clearly spilled out of the nerd corner. Suddenly a major bank CEO is sitting in Davos talking about quantum risk. A BIP with a “quantum” label is no longer being discussed only in some obscure forum, but circulated as part of a broader “roadmap.” And while some developers bristle at what they see as “FUD,” institutions are looking at the issue more like an asset-liability question: How big is the tail risk, and who ultimately absorbs it?

That is why the honest answer to the headline is not simply “yes” or “no,” but rather a bundle of technical details, timelines, governance friction, and one uncomfortable moral dilemma that Bitcoin usually prefers to avoid: What happens to coins that cannot migrate, or will not migrate?

Why Quantum Computers Could Hurt Bitcoin

The primary attack surface is not mining, at least not at first, but signatures. Once a “cryptographically relevant quantum computer” can practically solve discrete-log problems in the style of Shor’s algorithm, the security assumptions behind ECDSA and Schnorr begin to fail. That is not a new insight — Shor laid out the basic principle decades ago — but the practical question is this: when will hardware exist that can maintain enough logical qubits, stably enough, to do this within a realistic time window?

Bitcoin is in a strange position here. A large share of coins sits in output types where the public key is not permanently exposed on-chain, as in classic P2PKH or SegWit-style setups. That helps against long-exposure attacks, meaning attacks against public keys that remain visible for long periods of time. But it does not help against short-exposure scenarios, where the public key becomes visible during the spending process in the mempool and an attacker moves fast enough to sign a competing spend within that window.

And this is where a second, more Bitcoin-specific imbalance enters the picture: a meaningful backlog of legacy script types from Bitcoin’s early years, including P2PK and raw multisig, plus plain old address reuse. A May 2025 report from Chaincode Labs summed it up rather dryly: P2PK UTXOs may account for only a small share of the total UTXO count, but they represent a disproportionately large share of value and are, by design, “immediately vulnerable” because the public key sits directly in the scriptPubKey.

That same report also highlights an issue that often gets overlooked, but matters in custody and treasury environments: xpubs and public-key leakage outside the chain itself. Anyone widely sharing extended public keys changes the risk profile dramatically in a post-quantum world — especially because of cascade effects across non-hardened derivation paths. That is not some obscure edge case. It is routine in real-world payment setups.

How Close Is Q-Day, Really?

Timing is the core of the dispute. Not because anyone is disputing the math, but because the gap between “theoretically possible” and “operationally dangerous” is enormous in the quantum world. That is exactly what makes it so hard to price Bitcoin’s quantum-computer risk cleanly.

One thing many serious sources seem to agree on: migrations take a long time. The National Institute of Standards and Technology writes quite bluntly in its draft on migration considerations that post-quantum cryptography transitions can take significant time, and that previous cryptographic migrations have often taken more than a decade. In that same framework, Mosca’s theorem keeps coming up as a reminder: if the transition takes longer than the time remaining until the threat arrives, minus the period for which the data must stay secure, then you are already late.

NIST is also fairly specific elsewhere on timelines. Classical digital signature schemes such as ECDSA are described in draft guidance as “Deprecated after 2030” and “Disallowed after 2035.” That should not be mapped one-to-one onto Bitcoin — NIST writes standards for government and industry — but as a signal it is loud enough: ECC is not being treated in official transition planning as something that is safe forever.

Pressure is also building from the national-security bureaucracy. The National Security Agency has sketched out a CNSA 2.0 timeline under which certain classes of systems are expected to move “exclusively” to CNSA 2.0 algorithms by 2030 or 2033, including categories like browsers, cloud infrastructure, and operating systems. Again, not Bitcoin-specific. But it shifts the Overton window. It becomes harder to argue that the world will not take post-quantum risk seriously until 2045 when agencies are already printing 2030 and 2033 as planning dates in formal documents.

And then there are the voices from quantum research itself. In one DL News interview, Scott Aaronson, scientific advisor at StarkWare, delivered a line that sticks because it is so unusually direct: “The time to start thinking about this is now. An even better time would have been yesterday.”

He then immediately added some caution, also in DL News: big “2030” roadmaps should be treated carefully, but if major players do start hitting those milestones, that is at minimum a datapoint that cannot just be waved away.

It is also important to frame the qubit debate correctly. Physical qubits are not logical qubits; error correction devours orders of magnitude. Resource-estimate work by researchers such as Roetteler, Naehrig, Svore, and Lauter did the space a real service for exactly that reason: it dragged the discussion out of the fog of “quantum breaks everything” and into numerical territory — this many qubits, this many gates. And nearly every serious estimate depends on assumptions about error rates, codes, and architectures. The range remains wide.

The Warning Camp: “Prepared, Not Scared” — and Still Uneasy

By 2026, the warning camp sounds less like panic and more like project management. The issue is path dependency: if migration takes five to ten years and the threat could arrive faster in a worst-case scenario, then the work needs to start early. Otherwise, Bitcoin could find itself trying to coordinate a soft fork under pressure — and that has historically been a bad place for Bitcoin to be.

Ethan Heilman framed it with a mix of specificity and shrugging realism. He sketched out an optimistic timeline: “Three years until it activates… Seven years total, but I’m just spitballing here. No one actually knows.”

His reasoning is straightforward: the process could take “many years,” and every piece of preparation buys time.

There is another point Bitcoiners often prefer not to dwell on. A migration is not just a Core problem. Wallets, custodians, payment flows, Lightning nodes, treasury software — all of that would have to follow. And, frankly, the ecosystem is not exactly famous for rolling out upgrades the way an operating-system vendor pushes a patch.

Hunter Beast, the author of BIP 360, probably offers the tone that is most resonant right now:  “prepared, not scared.” He said that in comments to DL News, and it clearly reads as a deliberate rejection of the idea that Q-Day is tomorrow.

But the harder edges appear quickly. In Jameson Lopp’s 2025 essay, Beast is quoted saying: “I don’t see why old coins should be confiscated… let those with quantum computers free up old coins.”

In other words, even within the warning camp there are two strands. One says: opt-in, cautious, no state-like intervention. The other says: if this becomes serious, then refusing to intervene is also a form of intervention — it just produces a different winner.

Alex Pruden of Project Eleven has sounded more explicit than many Bitcoin developers, but his argument is not purely technical. It is social as much as cryptographic: “Quantum computing poses a significant future threat to Bitcoin due to its slow governance.”

That is the kind of line developers may find borderline insulting. Outsiders, though, tend to nod, because Bitcoin governance is slow. Pruden also captured the basic intuition in a striking image: “There needs to be a new island we all go to… there needs to be a bridge… a migration protocol.”

That is, in a way, the whole Bitcoin quantum-computer issue in one metaphor.

And then there is Nic Carter as a kind of political amplifier: less focused on how many qubits are required and more focused on what the narrative does to capital. In one DL News piece, he said that “virtually everyone I have talked to is quietly concerned about Bitcoin” and that he had “yet to encounter” anyone who has seriously analyzed the risk and then entirely dismissed it.

These are not mathematical arguments. They are capital-markets arguments. And they matter because “quantum” has now diffused all the way up into institutions like UBS and Jefferies. UBS CEO Sergio Ermotti said in Davos, speaking to CNBC:

“The potential effect of quantum computing on the safety of [cryptocurrencies] still needs to be proved.”

That sounds mild. In risk-management language, though, it is basically a yellow flag. Unproven safety is not exactly a comforting label.

The Other Side: “A Lot of Noise, Not Many Qubits”

The opposing camp is not homogeneous either. It ranges from “the threat is real, but not today” to “please stop moving markets with science fiction.” And some people move between those tones depending on the context.

Michael Saylor is closer to the latter style. On the Coin Stories podcast, he said: “I don’t actually think that the quantum narrative is the greatest security threat to Bitcoin right now.”

Then came the familiar Saylor meta-point: every few years, some new narrative appears, and Bitcoin keeps going.

That is a valid point. But it is also a bit of a category error. “The China mining ban was not the end either” is not the same thing as “the signature assumption collapses.” Still, for many investors, it sounds reassuring because it places quantum back into the familiar drawer of recurring Bitcoin fear cycles.

Adam Back sits in this debate more as the anti-hysteria pole. In a widely cited tweet, he wrote: “Bitcoiners and developers are NOT in denial… quietly doing research… You’re not helping…”

The comment was aimed at Nic Carter. It is a very Back-like position: less “quantum is impossible,” more “your timing and your signaling are off.”

And then there is Bitcoin Core developer Matt Corallo — important not because he simply waves the issue away, but because his skepticism lands on a point the warning camp often underestimates: adoption.

In a bitcoin-dev email from February 2026, he put it bluntly. A new, more expensive address type, he argued, would see “~zero adoption in consumer wallets” “until its urgent, at which point its obviously… way too late.” That is not really a quantum argument at all. It is a human-beings-are-lazy argument.

Corallo effectively flips the debate around: if a solution is not adopted meaningfully before Q-Day, then it mainly functions as a psychological comfort blanket. And comfort blankets are dangerous if the problem later turns out to be real.

“The drawback being that it will see zero relevant adoption until its way too late,” he wrote.

The skeptical camp has another technically serious point too: upgrading too early is also risky. Post-quantum signatures are young, ecosystem support is still thin, implementations are more complex, and there have already been examples in the NIST process where candidate systems were later broken. That creates an awkward balance: too early may mean locking into the wrong cryptographic system; too late may mean walking into a wreck.

What Has Been Done So Far — and Why BIP 360 Is Not “The Solution”

One evergreen mistake would be to sell BIP 360 as a complete quantum fix. The text of the proposal itself does not do that. In fact, it is strikingly narrow in scope.

BIP 360, “Pay-to-Merkle-Root” or P2MR, is designed as a soft fork. It preserves functionality similar to P2TR — script trees and Tapscript — while removing the key-path spend. The idea is that P2MR outputs would be resistant to long-exposure attacks from cryptographically relevant quantum computers, because there would no longer be a permanently visible Taproot key sitting in the output as a target.

The proposal says this explicitly: P2MR does not protect against short-exposure attacks, meaning cases where the public key appears in the mempool during spending. For that, post-quantum signatures would be needed, and a separate proposal would have to address them later.

In practical terms, BIP 360 is more of a quantum-ready container than the actual post-quantum signature transition itself. And that is precisely why it is politically clever. It avoids a large part of the “which PQ signature, which parameters, which standard” fight and first creates an output type that could later accommodate new opcodes.

BIP 360 also contains one small but narratively useful detail: new mainnet addresses would begin with bc1z under SegWit v2 and Bech32m. That is the kind of visible change that forces wallets and custodians to engage with the topic — at least in theory.

Why “in theory”? Because adoption remains a social problem. Two schools of thought collide directly in the bitcoin-dev thread. Heilman wants to buy time and increase algorithmic agility through P2MR plus a hash-based PQ signature, discussed in that context as SLH-DSA or SPHINCS+.

Corallo pushes back: if it is ten times more expensive, nobody will use it until the house is already on fire.

That friction is not noise. It is the core issue. Bitcoin’s post-quantum resilience is less a cryptography problem than a coordination problem. The Chaincode Labs report says that quite clearly: broader engagement is still missing, the current initiatives are early and exploratory, and the community will eventually have to make choices that reach deep into questions of ideology and property rights — burn versus steal.

For the bigger picture, it also helps to remember the institutional reality. The BIPs process is a channel for publication and discussion, not an activation stamp. The BIPs repository states explicitly that being published there does not mean a proposal has community consensus or that it is about to be adopted.

What a Migration Might Actually Look Like

A Bitcoin quantum-computer migration is not an upgrade button. It is more like a multi-year reconstruction effort spanning several layers — protocol, wallets, infrastructure, and then the really difficult phase: moving UTXOs with broad global participation.

A plausible migration sketch, based on BIP 360, the bitcoin-dev discussions, and the Chaincode Labs report, looks something like this.

First, the protocol needs a secure destination. BIP 360 is designed exactly as that sort of harbor: script trees stay, key path goes. That protects against long-exposure attacks on Taproot-style targets and creates a platform for later integrating post-quantum signature opcodes.

Then comes the part people tend to underestimate: waves of wallet and custody upgrades. Heilman did not talk about years for specification, review, testing, and activation by accident — and then more years after that to get to 90% migration, which even he described as optimistic, more spitballing than certainty.

At some point, the network then has to move value. Not theoretically. On-chain. The Chaincode Labs report describes a dual-track strategy for this: short-term contingency measures, roughly over two years, running in parallel with a longer-term path of around seven years. That is really just another way of saying that nobody knows whether the danger becomes acute in 2035 or 2045. So the ecosystem would have to build a short-term emergency kit while the cleaner solution matures.

One concrete example of what such emergency paths could look like is Commit-Delay-Reveal, or CDR. The report describes CDR as a three-stage process that would let users move funds from old, non-quantum-resistant outputs into quantum-resistant ones, with a mandatory delay phase acting as a safety mechanism. The point is not convenience. It is to reduce attack options in a stressed scenario.

At the same time, the bitcoin-dev mailing list is already discussing concrete building blocks such as a new CHECKSIG-style construction for SLH-DSA. NIST uses SLH-DSA as the standard name for SPHINCS+, and it appears in NIST IR 8547 as a post-quantum signature family. In mailing-list shorthand, that becomes placeholders like OP_SLH_CHECKSIG or OP_SPHINCS_CHECKSIG. These are not activated features, obviously. Still, they show that the conversation has long since moved into implementation territory.

And now comes the politically toxic part: what happens to coins that do not migrate? Lopp frames it as “Freeze or not to freeze?” and makes clear that “confiscation” may not even be the most precise term. It would be closer to burning — making certain outputs permanently unspendable. He argues that the situation is still “far from a crisis,” but that Bitcoin’s slow change process is exactly why the issue should be debated seriously now.

That decision is directly tied to market mechanics. Corallo argues, in substance, that the market would likely prefer forks that disable insecure spend paths. One summary of his position put it as follows: “market is gonna prefer the fork with insecure spend paths disabled”

You do not have to love the wording. The logic is still clear enough. If a chain split emerges between one side with more supply because stolen coins re-enter circulation and another side with less supply because vulnerable coins are effectively burned, the economic pull will not be neutral.

Heilman makes a related market point in the same discussion. He sees “no scenario” in which the market would choose the side with “materially… 5-10x higher supply.” That is a striking line because it translates the moral question into a pricing question.

The Uncomfortable Side Questions That Also Matter

Part of the Bitcoin quantum-computer debate is, frankly, distraction. The other part is exactly the stuff that determines whether Bitcoin breaks or adapts over the long term: second-order effects.

First, mining. Grover’s algorithm theoretically offers a quadratic speedup for hash search, which means it also touches proof-of-work. But in practice this is not a “tomorrow we get a 51% quantum miner” story. The Chaincode Labs report argues that the impact on mining is constrained by the lack of efficient parallelization, along with algorithmic, economic, and hardware limitations — in contrast to the more direct signature threat. Even so, some centralization risk would remain if quantum mining ever became dominant, along with possible instability from correlated fork events.

Second, “harvest now, decrypt later” is a standard phrase in these debates, but Bitcoin is not TLS. NIST explains the distinction fairly clearly in IR 8547: authentication systems do not face the same harvest-now-decrypt-later dynamic as encryption systems. What matters is whether the algorithm is secure at the time of authentication or signing. For Bitcoin, that means old, already confirmed transactions are not going to be “decrypted,” but unspent funds can become targets once public keys are exposed permanently or even temporarily.

Third, institutional psychology. Carter’s basic point is that the issue is already here; many just are not speaking loudly about it yet. Jefferies strategist Christopher Wood dropped Bitcoin from a model portfolio and described the store-of-value narrative as less solid. Whether one agrees with that conclusion is almost secondary. The more important point is that the market is increasingly trading quantum as a narrative risk even though the relevant hardware still does not exist.

Fourth, upgrade sociology. The DoD CIO memo on preparing for post-quantum migration is not about Bitcoin, but it offers a good illustration of how large organizations tackle this kind of thing: inventory first, identify responsible parties, build processes, set deadlines. That is exactly the kind of mundane organizational work Bitcoin cannot centrally mandate, which means execution across the wallet and custody landscape will be highly uneven.

Fifth, the myth that only old coins are affected. The Chaincode Labs report stresses that address reuse acts as an accelerator: once a public key has appeared on-chain even once, a script type that would otherwise only face short-exposure risk can turn into a long-exposure problem. That affects services, exchanges, treasury setups — not just fossilized coins from 2009.

And finally, no one actually knows whether Bitcoin would find a single path in a real emergency or whether it would split. Pruden has suggested, in essence, that a fork is likely if the largest unresolved disputes — migration and the treatment of un-upgradable coins — remain unresolved. Lopp, by contrast, has tried to pull the discussion away from pure “when is Q-Day?” speculation and toward the game theory of migration design. That feels close to what will probably decide the issue in the end: not physics alone, but coordination.

Exit mobile version