Hook
The filing was three paragraphs long. Nobody in crypto read it. Buried in a US Commerce Department disclosure, the government confirmed it now holds equity stakes — not research grants, equity — in Rigetti Computing, D-Wave Systems, and Quantinuum. Three quantum hardware firms, funded through CHIPS Act allocations, structured as strategic positions on the national balance sheet.
Here is the anomaly worth your attention: those three companies are not equally threatening to cryptography, and the market does not care. It has begun pricing them as a single block of "quantum risk." That is the first sign of a narrative forming faster than the facts beneath it. I have watched this movie before — in 2017, when every ICO whitepaper got priced as "the next Ethereum," and again in 2020, when every yield farm was valued as "the next Compound." The pattern never changes. A real technical substrate gets flattened into a tradable slogan, and somewhere in the flattening, the detail that actually matters gets quietly discarded.
The detail that matters here is a date: December 2029. Ethereum's foundation has set it as a self-imposed deadline to complete its post-quantum migration. IBM says its fault-tolerant Starling machine ships around the same year. Two calendars, independently authored, landing on the same square. Either the universe has a sense of humor, or someone is manufacturing urgency.
Context
To understand why this matters, you have to understand what is actually vulnerable. Not your wallet address. Your public key.
Every Bitcoin and Ethereum transaction is authorized by a signature — ECDSA today, with Schnorr increasingly adopted on the Bitcoin side. Both schemes rest on the same assumption: that the elliptic curve discrete logarithm problem is computationally hard. Shor's algorithm, run on a sufficiently large fault-tolerant quantum computer, dismantles that assumption. Not weakens it. Dismantles it.
Here is the part most coverage gets wrong. A hashed address — the string you paste into a wallet — is relatively safe, because the hash protects the underlying public key. But the moment you spend from that address, the public key is revealed on-chain and stays revealed forever. In Bitcoin's UTXO model, a spent output broadcasts its public key to anyone watching. And the earliest coins — the P2PK outputs mined before 2010 — exposed their public keys at birth. Satoshi's roughly one million BTC sits in exactly this format. Its public keys have been visible since the genesis era. That is the highest-value, highest-vulnerability pile of assets on Earth, and no one holds the private key to move it.
Core
I spent three weeks auditing the BIP-360 and BIP-361 proposals after a reader flagged something that sounded too clean. The claim, circulating through several newsletters, was that Bitcoin was "migrating from ECDSA to Schnorr signatures as its quantum defense." I want to be surgical here, because this error is dangerous: Schnorr signatures on Bitcoin run on the same secp256k1 curve as ECDSA. They are just as vulnerable to Shor's algorithm as the scheme they replace. Schnorr buys you signature aggregation, privacy improvements, and taproot composability. It buys you exactly zero quantum resistance.
Quantum resistance requires changing the mathematical hardness assumption itself — moving to lattice-based or hash-based constructions. BIP-360, properly understood, points toward Pay-to-Merkle-Root and hash-based output types. That is real post-quantum engineering. Labeling a Schnorr migration as "quantum defense" is the cryptographic equivalent of installing a louder doorbell and calling it a lock.
Now the second correction, the one the market is pricing wrong. Among the three government-backed firms, D-Wave builds quantum annealers. Annealing machines solve optimization problems through physical energy minimization. They cannot execute Shor's algorithm — the gate-based circuit model is a different architecture entirely. If your threat model treats Rigetti, D-Wave, and Quantinuum as equally dangerous to Bitcoin, you are wrong about one third of it. The genuine cryptanalytic threats come from gate-model vendors: Rigetti, IBM, Google, Quantinuum. D-Wave's inclusion is a policy signal, not a cryptographic one.
And the hardware timeline is routinely overstated. Google's recent claim of breaking RSA in under 1,200 logical qubits is an extrapolated estimate against a hypothetical error-corrected machine — not a demonstration. Breaking 256-bit ECC in practice demands millions of physical qubits with fault tolerance far beyond current state. So yes, the 2025 threat is fiction. But the 2035 threat is not, and migrating a two-trillion-dollar system to new cryptography takes a decade. That is the trap: the danger sits far enough away to ignore and close enough to panic.
When I was mapping DeFi composability in 2020, I learned to distrust any yield number that arrived without its failure mode attached. The quantum conversation is that same failure mode, arriving late to a party that has been running since 2009. I still remember the night I realized Terra's 20% yield wasn't a return — it was a countdown. This has the same texture. The clock started the day the first P2PK output was spent, and nobody set an alarm.
Contrarian
Here is where I part ways with the bullish migration narrative. The industry keeps framing this as a technical race. It is not. It is a coordination race, and humans are the bottleneck.
Ethereum's account model means every externally-owned account and every smart contract carrying signature-verification logic must migrate individually — millions of users, thousands of dApps, all on a synchronized clock. The foundation can announce a deadline; it cannot enforce one. Bitcoin is worse in a different direction: it has no coordinator at all. BIP-361's proposal to restrict legacy signatures after a migration window is, functionally, a mechanism to freeze unspent vulnerable coins. That collides head-on with the one question Bitcoin has never resolved — who has the authority to decide the fate of dormant property?
If that restriction activates, expect a fork. Not a technical fork. A constitutional one, replaying 2017's block-size war with quantum as the pretext. A chain preserving legacy signatures would emerge, and it would carry a strong property-rights argument. The most likely short-term casualty is not the network — it is the credibility of anyone pretending this is settled.
Takeaway
The real Q-Day is not the day a quantum computer breaks ECDSA. It is the day crypto has to prove it can coordinate a billion-dollar migration without a landlord. Watch three signals: the first logical-qubit milestone that survives peer review, the moment BIP-361 enters formal activation, and any signature from a Satoshi-era address. That last one would not be a migration. It would be a confession.
