Quantum computing threat to Bitcoin

Bitcoin's signature schemes — ECDSA (legacy) and Schnorr (Taproot) — both rely on the elliptic-curve discrete logarithm problem, which a sufficiently large quantum computer running Shor's algorithm could solve in polynomial time, forging signatures from any exposed public key. The defensible response, articulated rigorously in NVK's 2026 Bitcoin & Quantum Computing research series: realistic CRQC timelines remain distant (breaking secp256k1 needs ~1,200-2,300 logical qubits with minutes of fault-tolerance, versus current hardware near 48 logical qubits with millisecond coherence); mature post-quantum signature designs already exist as concrete BIPs (BIP-360, SHRINCS, SHRIMPS, others); and orderly migration is operationally tractable. Grover's algorithm against mining is thermodynamically impossible. The unresolved concerns: ~6.26M BTC (~30-35% of supply) has exposed public keys, with ~1.7M BTC in old P2PK addresses (including Satoshi's ~1.1M) structurally unmigratable; and Lightning's adaptor signatures have no post-quantum construction in current theory. Verdict: real but distant.

---

Why this note matters

Paired controversy note: the event-level dispute over the migration process — Satoshi-coins consensus problem, BIP-360 deployment, community-coordination dynamics — is treated in The post-quantum migration debate. This Criticisms note engages the analytical question (is the threat real; is the response adequate in principle); the paired Controversies note engages the contested matters of the upgrade process itself.

The quantum threat is the most-discussed long-horizon cryptographic risk to Bitcoin, and mainstream coverage is consistently miscalibrated — either dismissing it as far-future science fiction or framing it as imminent existential threat. The note establishes the realistic timeline and threat model at higher resolution; distinguishes the exposed-public-key vulnerability (the actual surface) from “Bitcoin is broken by quantum computing” (the framing that conflates technical issues); surfaces the long-dormant-UTXO problem (Satoshi’s coins and other early P2PK coins) as the hardest-to-mitigate aspect; and articulates the mitigation path through post-quantum signature BIPs and coordinated migration.

The defensible position: track the realistic timeline through credible sources (NIST PQC standardization, hardware progress, Mosca’s theorem), recognize that the orderly-migration path requires the Bitcoin development process to function well at the relevant moment, and avoid both dismissal and panic.

---

The critique

A sufficiently large quantum computer breaks Bitcoin’s signature security. Specifically:

• Bitcoin’s elliptic-curve signature schemes (ECDSA on the secp256k1 curve for legacy addresses; Schnorr on secp256k1 for Taproot addresses) both rest on the assumption that the elliptic-curve discrete logarithm problem (ECDLP) is computationally infeasible.
• Shor’s algorithm (Peter Shor, 1994) solves ECDLP in polynomial time on a quantum computer with sufficient qubits and coherence — current estimates (CFS/EUROCRYPT 2026; Google QAI) suggest ~1,200-2,300 logical qubits would suffice to break secp256k1, requiring ~10,000-500,000 physical qubits given quantum-error-correction overhead, and sustained fault-tolerant operation for 9-18 minutes. Earlier estimates (Roetteler et al. 2017) projected higher numbers; the field has converged on tighter bounds.
• Once an adversary holds such a quantum computer (a “cryptographically relevant quantum computer” or CRQC), any address whose public key is publicly known is immediately vulnerable. The adversary takes the public key, runs Shor’s algorithm, recovers the private key, and can sign arbitrary transactions from that address.
• The vulnerability applies most directly to:
  • Legacy P2PK addresses (the earliest Bitcoin address format, used for the coinbase outputs of the early mining era including Satoshi’s coins; the public key is permanently visible). NVK identifies this as Tier A: approximately 1.7M BTC immediately vulnerable with no holder-side mitigation possible.
  • Any address that has been spent from (when a P2PKH address is spent from, the public key is revealed in the input script and is permanently on-chain). NVK groups this with reused-address exposure as Tier B: approximately 5.2M BTC, migratable to post-quantum addresses if owners take action.
  • Reused addresses (any address used multiple times where the holder has spent from it once leaks its public key) — included in Tier B above.
  • Mempool-window exposure (NVK Tier C): every transaction temporarily exposes its public key for ~10 minutes between broadcast and confirmation, theoretically vulnerable to a fast-CRQC attack.
• The vulnerability does not apply (immediately) to:
  • Unspent P2PKH/P2SH/P2WPKH addresses where the public key is hashed and not yet revealed (these have ~160 bits of hash protection rather than ~128 bits of elliptic-curve security)
  • Unspent P2TR addresses where the Schnorr key is x-only encoded (also revealed once spent from)

Total exposed-key supply: approximately 6.26M BTC (~30-35% of total supply) per Chaincode Labs analysis cited in NVK’s research. The remaining 65-70% sits in never-spent addresses with public keys hashed — safe until first spend.

Grover’s algorithm against mining is not a real threat. A separate quantum attack — using Grover’s algorithm to speed up the SHA-256 hashing that Bitcoin mining depends on — would require approximately 10²³ physical qubits and 10²⁵ watts of power, roughly 3% of the Sun’s total energy output. NVK summarizes: “quantum mining is thermodynamically impossible.” The quantum threat to Bitcoin is specifically a signature-forgery threat against exposed public keys, not a mining-attack threat.

Bitcoin’s monetary system depends on ECDLP. A CRQC that breaks ECDLP can spend any exposed-public-key UTXO. The framing of “quantum will break Bitcoin” conflates the signature-forgery threat (real for exposed keys) with mining attacks (thermodynamically infeasible).

---

Key proponents

The critique is not advanced by Bitcoin opponents primarily — it is advanced by serious cryptographers and security researchers, including many within the Bitcoin community itself.

Foundational academic work:

• Michele Mosca (University of Waterloo) — the Mosca’s theorem framing for migration urgency; “How fast is the development time T (until CRQC), how fast is the shelf-life requirement S, how long is the migration time M?”
• Various NIST post-quantum cryptography (PQC) workstream contributors — the standardization effort that produced CRYSTALS-Dilithium, Falcon, SPHINCS+ as post-quantum signature standards (finalized 2024)
• Various academic cryptographers publishing on Shor’s-algorithm resource estimates for elliptic-curve cryptography (Roetteler, Naehrig, Svore, Lauter — 2017 paper estimating Shor’s resource requirements for ECDLP)
• CFS/EUROCRYPT 2026 and Google Quantum AI — updated logical-qubit estimates (1,200-2,300 for secp256k1)

The Bitcoin-specific research consolidation (NVK’s 2026 series; the most rigorous Bitcoin-side engagement):

• Rodolfo Novak (NVK) — Bitcoin & Quantum Computing research series at bitcoinquantum.space; 4 parts (April 2026); 17 named researchers; 14 mitigation proposals; the canonical Bitcoin-community treatment of the quantum question
• 17 researchers named across the series including Ethan Heilman (BIP-360 author), Jonas Nick (Blockstream; SHRINCS/SHRIMPS), Pieter Wuille, Tim Ruffing (Taproot script-path post-quantum security proof), Matt Corallo, conduition, jesseposner (PQ HD Wallets), Olaoluwa Osuntokun (zk-STARK BIP-32 escape), Tadge Dryja, Greg Maxwell, Robin Linus (Binohash), Avihu Levy (StarkWare; Quantum Safe Bitcoin)
• Chaincode Labs — exposed-supply analysis (~6.26M BTC, 30-35% of total)
• Bitcoin Optech newsletter — ongoing coverage of post-quantum BIPs and Delving Bitcoin discussions

Within-Bitcoin technical voices (engaged before NVK’s consolidation):

• Adam Back — has commented on quantum considerations in various venues
• Andrew Poelstra (Blockstream Research) — has worked on post-quantum considerations for Bitcoin
• Bitcoin Core developer mailing list — periodic threads tracking post-quantum research

Hardware-side and policy-side voices:

• IBM, Google, Quantinuum, and other quantum-hardware vendors — publishing roadmaps for fault-tolerant quantum computing (and revising them backward; see below)
• NSA and other intelligence agencies — issued PQC migration guidance (NSA CNSA 2.0, 2022) recommending migration of national-security-relevant systems by 2035

Physicists skeptical of CRQC ever emerging:

• Leonid Levin, Mikhail Dyakonov, Gil Kalai, Tim Palmer — cite “fundamental physical barriers” that may render large-scale fault-tolerant quantum computing impossible; expert predictions in NVK’s survey range from 2029 to “never”

Bitcoin-critical voices on the issue (Krugman, Roubini, Gerard, White) cite quantum threats among other concerns but are not the primary source of the technical analysis. Mainstream media coverage is consistently poorly calibrated.

---

What’s right about the critique

Several factual and theoretical points are correct:

Shor’s algorithm is real and well-understood. The mathematics is not in dispute. A sufficiently large quantum computer breaks ECDLP and thus Bitcoin’s current signature schemes.

Long-dormant exposed UTXOs are a permanent vulnerability surface. Satoshi’s coins (estimated ~1.1 million BTC mostly in early P2PK addresses) and other early-mining-era P2PK coins have public keys permanently visible on-chain. No holder-side action can hide them. If a CRQC emerges, those coins are immediately spendable by any holder of the CRQC. Estimates of permanently-exposed-key UTXOs range from 1.5-4 million BTC depending on counting methodology.

Migration is non-trivial. A coordinated migration to post-quantum signature schemes would require:

• BIP design and community review for the specific post-quantum scheme(s) to adopt
• Soft-fork activation (the Bitcoin upgrade pattern)
• Wallet software updates across the ecosystem
• Holder action to move funds from legacy addresses to post-quantum addresses
• Some holders may not migrate (lost keys, abandoned coins, inattentive holders) — those coins remain exposed permanently

Timeline uncertainty cuts in both directions. Estimates of when a CRQC emerges range from “highly unlikely before 2040” (mainstream conservative) to “potentially within 10 years if certain hardware advances pan out” (more aggressive). The uncertainty is real; complacency is risky; alarmism is also risky.

Bitcoin’s calcification could become a vulnerability. The slow-evolution discipline that protects against frivolous protocol changes also slows the response to genuine threats. If the Bitcoin development community is unable to coordinate a post-quantum migration within the threat window, the holder base suffers.

---

The Bitcoin-side response

The response operates on several layers. The most consolidated articulation is in NVK’s 2026 Bitcoin & Quantum Computing research series; specific points below draw heavily from that work.

Timeline realism

The most realistic estimates of cryptographically-relevant quantum computing place the threat well beyond near-term horizons:

• Current quantum hardware (2026): 48 logical qubits (Quantinuum), 4,158 physical qubits (IBM). Coherence sustained in milliseconds. Breaking secp256k1 requires 1,200-2,300 logical qubits with 9-18 minutes of sustained fault-tolerant operation.
• The scaling gap: approximately 25x in logical qubits, 120x in physical qubits, and a roughly 5-6 orders of magnitude gap in sustained-coherence duration. Closing all three simultaneously requires multiple breakthroughs, not incremental progress.
• Largest number factored by a quantum computer to date: 15. Cryptographic systems broken by quantum computers to date: zero.
• Vendor-roadmap regression as evidence against compressed timelines: per NVK’s analysis, “every vendor roadmap has been revised backward. IBM dropped its million-qubit target. PsiQuantum missed its 2025 deadline.” Trajectory is being revised toward longer timelines, not shorter.
• Expert predictions range from 2029 to “never”: serious physicists including Levin, Dyakonov, Kalai, and Palmer cite “fundamental physical barriers” that may render large-scale fault-tolerant quantum computing impossible. NVK’s survey concludes: “The 3-5 year timelines driving public panic are not supported by current hardware trajectories.”
• NIST PQC standardization completed in 2024 (FIPS 204/205/206); mainstream-cryptography migration is in early stages with target dates around 2030-2035. Bitcoin’s migration timeline can track these.

NVK’s summary: “There is no operational quantum threat to Bitcoin today.” This is not “the threat is far away.” It is “the threat is real and the timeline allows planning, not panic."

"Harvest now, decrypt later” doesn’t apply to Bitcoin in the usual sense

A common framing of the quantum threat — “adversaries can record encrypted data today and decrypt it years later when CRQC emerges” — applies to encryption schemes (TLS, PGP, banking systems). It applies only weakly to Bitcoin because Bitcoin’s signature model proves ownership without exposing the private key. There is no Bitcoin-encrypted-data being recorded; there are only public keys whose exposure begins at first-spend.

NVK’s framing: HNDL “largely no” applies to Bitcoin. The exposed-public-key problem is real but operates on a different mechanism — the keys are public by protocol design once revealed, not encrypted-but-later-decryptable.

Recent quantum-progress claims have been theater

Specific empirical disconfirmation of “the threat is here now”:

• April 2026 “17-bit ECDLP demo”: NVK’s Part 4 code review demonstrates the demo’s private key was classically pre-solved via group enumeration and baked into the circuit as compile-time constants before quantum-hardware execution. The 27% success rate matches random-noise distribution. NVK’s verdict: “classical computations wearing quantum costumes.”
• Prior quantum-factoring demos (Shor’s algorithm on 15, 21, etc.) have similar issues — the inputs are selected to make the algorithm work on small hardware, not to demonstrate Shor’s scaling to cryptographically relevant numbers.

This doesn’t refute the long-term threat; it refutes specific media framings of “quantum just broke crypto.”

Grover’s algorithm against mining is thermodynamically impossible

A separate quantum-attack framing — “Grover’s algorithm gives a quadratic speedup against SHA-256, so quantum miners will dominate” — collapses on energy economics. NVK’s analysis: quantum mining of Bitcoin would require approximately 10²³ physical qubits and 10²⁵ watts of power, roughly 3% of the Sun’s total energy output.

This is not a “very expensive” attack — it is a thermodynamically impossible attack. Grover’s quadratic speedup is real but evaporates when you account for the energy required to operate the quantum hardware needed to compete with classical mining. The quantum threat is specifically a signature-forgery threat against exposed public keys, not a mining-attack threat.

The orderly-migration path (with named BIPs and proposals)

Bitcoin’s response trajectory has moved well beyond “BIPs may be developed” — concrete proposals exist and are in active development:

1. BIP-360 (Ethan Heilman) — new bc1z address type removing quantum-vulnerable key-path from Taproot; defers specific post-quantum signature algorithm selection to allow flexibility. Running testnet via BTQ Technologies (v0.3.0, 50+ miners, 100K+ blocks).

2. SHRINCS (Jonas Nick, Blockstream) — hash-based post-quantum signatures producing 324-byte signatures at NIST Level 1 security. Already deployed on Liquid sidechain. Sub-millisecond verification. State-management is the unsolved engineering gap.

3. SHRIMPS (Nick extension) — supports multiple backup devices with ~2,500-byte signatures. Same state-management gap.

4. Quantum Safe Bitcoin (QSB) (Avihu Levy, StarkWare) — requires no soft fork; uses hash-to-signature puzzle exploiting RIPEMD-160 pre-image resistance. Cost: $75-150/transaction. Not yet mainnet-demonstrated but trajectory-favorable.

5. Binohash (Robin Linus) — earlier hash-grinding approach (~$50/tx); largely superseded by QSB.

6. PQ HD Wallets (jesseposner) — post-quantum hierarchical deterministic wallet schemes; Raccoon-G (March 2026) solved the HD-wallet problem via threshold construction.

7. zk-STARK BIP-32 Escape (Olaoluwa Osuntokun) — allows BIP-32 seed owners to prove knowledge of seed without revealing it, using SHA-512’s quantum resistance. Proof generation ~50 seconds (M4 Max), size ~200KB. Provides migration path for BIP-32-derived keys without exposing seeds to CRQC during migration.

8. NIST PQC primitives as building blocks: SPHINCS+ (hash-based; conservative but large signatures); CRYSTALS-Dilithium (lattice-based; faster); FALCON (lattice-based; smallest signatures).

9. Additional research across 15+ Delving Bitcoin threads and 20+ Optech newsletter issues by Tim Ruffing, Matt Corallo, conduition, Greg Maxwell, Tadge Dryja, and others.

The migration would proceed via soft-fork activation (standard Bitcoin upgrade pattern, adding new address types without breaking existing wallets). Operationally similar to SegWit 2017 and Taproot 2021. Non-trivial but precedented.

The unsolved gap: Lightning Network adaptor signatures

NVK identifies one critical gap that the post-quantum research has not yet resolved: Lightning Network adaptor signatures have no known post-quantum construction in theory. This is “the most significant unsolved problem in post-quantum Bitcoin” — the single load-bearing cryptographic assumption that the post-quantum migration cannot currently address.

Implications:

• A post-quantum migration that preserves on-chain Bitcoin signature security may still leave Lightning Network’s specific cryptographic primitives exposed
• Lightning’s HTLC and PTLC constructions depend on specific properties of Schnorr/ECDSA that don’t have direct post-quantum analogs
• Research on quantum-secure Lightning is active but no consensus solution exists

This is an honest acknowledgment, not a defeater. The Lightning ecosystem has time to develop quantum-secure constructions; the gap is non-trivial; tracking is appropriate.

Mosca’s framework

Mosca’s theorem provides a useful framing: migration must complete before CRQC emerges, accounting for migration time M, shelf-life S of the data being protected, and threat-emergence time T. For Bitcoin specifically:

• T (CRQC emergence): highly uncertain; realistic central estimate 15-25 years; expert range 2029-never
• M (Bitcoin migration time): 3-7 years for active funds (soft-fork design, activation, wallet rollout, holder migration); permanent for some long-dormant funds
• S (Bitcoin’s shelf-life requirement): indefinitely — funds need to remain spendable by their owners as long as the holder maintains custody

The framework suggests Bitcoin should begin serious post-quantum design work well before CRQC is imminent. The work has begun, and NVK’s 2026 series is one demonstration that the Bitcoin development community is engaging the problem proactively. Whether the development process moves fast enough is the open execution question.

The Satoshi-coins problem

The long-dormant UTXO problem is genuinely unresolved. NVK’s Tier A (~1.7M BTC immediately vulnerable in old-P2PK addresses) is the core of this concern. Several positions exist:

• “Move them now” — some proposals suggest a coordinated voluntary migration where current owners of legacy P2PK coins (those who still have keys) move funds to post-quantum addresses. Satoshi’s coins specifically would remain exposed since Satoshi has not signed any transactions since 2010.
• “Burn them by consensus” — more aggressive proposals suggest a consensus rule that invalidates spending from legacy ECDSA addresses after a certain block height, effectively burning long-dormant coins. This is highly controversial; it conflicts with Bitcoin’s “rules-don’t-change” property.
• “Accept the supply shock” — the laissez-faire position: when CRQC emerges, exposed coins will be spent by whoever holds the CRQC. The market absorbs the supply shock. This is uncomfortable but consistent with Bitcoin’s neutrality property.
• “It depends on who has the CRQC first” — if state actors (US, China) develop CRQC first and use it on Satoshi’s coins, the dynamics are different from open-market criminal exploitation. Some scenarios produce a controlled disclosure; others produce a chaotic supply shock.

NVK’s practical recommendation for current holders: “Stop reusing addresses. Keep long-term cold storage in addresses you have never spent from.” This moves holdings from Tier B (migratable but exposed) into the hashed-key safe category, reducing per-holder exposure regardless of how the broader Satoshi-coins problem is resolved.

None of the consensus-level positions is fully satisfying. The Satoshi-coins problem is the unresolved part of the quantum threat that cannot be addressed by orderly migration of active funds.

Financial-incentive analysis of quantum FUD

A useful context for evaluating mainstream quantum-threat coverage: NVK’s Part 2 documents $40+billioningovernmentfundingflowingtothequantumindustryversuslessthan$1 billion in 2024 quantum-industry revenue. The financial-incentive analysis: quantum executives collectively sold $930millioninstockwhilebuyingonly$4.3 million — a 216:1 sell-to-buy ratio.

The implication: the quantum industry has substantial financial incentives to overstate near-term threat to justify continued funding flows. This doesn’t refute the underlying physics but it should calibrate how a Bitcoin holder evaluates quantum-threat headlines. Industry-funded research and vendor announcements are not neutral; track them with appropriate skepticism.

---

Counter-arguments and tensions

”The timeline is much shorter than mainstream estimates suggest; CRQC could emerge in <10 years”

The tension: Quantum-hardware progress has been faster than many predicted; specific architectural breakthroughs (topological qubits, advanced error correction) could compress the timeline significantly. Conservative estimates may be exhibiting status-quo bias.

Response: Possible but unlikely. Per NVK’s 2026 analysis, the scaling gap is approximately 25x in logical qubits and 120x in physical qubits, plus a 5-6 order-of-magnitude gap in sustained-coherence duration. Compression of the timeline below 10 years would require multiple simultaneous breakthroughs in unrelated engineering domains (error correction, coherence, gate fidelity, qubit count). Crucially, vendor roadmaps have been revised backward, not forward — IBM dropped its million-qubit target; PsiQuantum missed its 2025 deadline. The empirical trajectory is decelerating relative to earlier optimism, not accelerating. The realistic central estimate accounts for the possibility of acceleration but does not assume it; serious physicists in NVK’s expert survey include “never” as a possibility.

”The Bitcoin development community is too calcified to migrate in time”

The tension: Past protocol upgrades (Taproot, SegWit) have taken years from proposal to activation. The post-quantum migration is more complex than either of these. The community’s response to controversial upgrades (block size wars, ordinals debates) has been slow and divisive. A 5-7 year migration window may not be enough.

Response: Real concern; the execution risk is non-trivial. Mitigations: (1) the post-quantum migration is technically additive (new address types) rather than restrictive, which simplifies soft-fork design; (2) the threat motivates broader consensus than typical protocol upgrades; (3) initial design work has begun ahead of urgency, providing schedule margin. But the concern is legitimate and should track the actual development process over time.

”Post-quantum signature schemes are themselves not fully battle-tested”

The tension: Lattice-based schemes (Dilithium, Falcon) have been studied for ~10 years but lack the multi-decade adversarial scrutiny that ECDSA/Schnorr have. Hash-based schemes (SPHINCS+) are more conservative but produce much larger signatures (8-30 KB vs <100 bytes). Adopting a post-quantum scheme that is later found to have weaknesses would be catastrophic.

Response: Real concern; the scheme-selection question is non-trivial. NIST PQC standardization has provided substantial scrutiny (multi-year competition; deep cryptographic review); the surviving schemes are the most-vetted post-quantum signatures available. Multi-scheme approaches (hybrid signatures combining classical and post-quantum) reduce the catastrophic-weakness risk. The Bitcoin development community should track post-quantum cryptanalysis carefully through the migration period.

”Satoshi’s coins should not be a Bitcoin-network concern”

The tension: The long-dormant-UTXO problem is framed as a Bitcoin-wide vulnerability, but the holders of those coins (mostly anonymous; some demonstrably lost) bear the risk individually. The network’s job is to enforce its rules; if exposed coins are spendable by CRQC holders, that is a feature of the rules, not a bug.

Response: Partially valid but understates the system-wide effects. A sudden supply shock of 1-4 million BTC entering circulation would materially affect market price and undermine confidence in Bitcoin’s “fixed supply” property. The network may not be able to prevent it but the holder base should understand that this is a tail risk distinct from the migration risk for active funds.

”Bitcoin’s quantum-vulnerability framing is overstated by critics”

The tension: Quantum-threat coverage in critic literature is sometimes superficial — citing “quantum computers will break Bitcoin” without specifying the realistic timeline, the exposed-vs-protected distinction, or the mitigation path. This makes the threat sound more imminent than it is.

Response: Yes, mainstream critic coverage is often poorly calibrated. But the underlying critique — that Bitcoin’s signature security depends on the non-existence of CRQC — is correct, and the response is to articulate the threat honestly rather than dismiss it. This note’s treatment is calibrated; mainstream-media coverage often is not.

---

Verdict: Real but distant; mitigation path exists and is in active development; long-dormant exposed UTXOs are the residual structural concern

NVK’s summation captures the calibrated position: “The quantum threat to Bitcoin is real but distant; today’s demos are classical computations wearing quantum costumes.”

The quantum threat to Bitcoin is real. The mathematics of Shor’s algorithm is not in dispute. The realistic timeline (per NVK’s hardware-trajectory analysis, expert physicist surveys, and vendor-roadmap regression) places the threat well beyond near-term horizons — expert estimates range from 2029 to never, with the engineering trajectory currently revising backward rather than forward. The mitigation path exists as concrete BIPs and proposals (BIP-360, SHRINCS, SHRIMPS, QSB, PQ HD Wallets, zk-STARK BIP-32 escape, and others), in active development by 17+ named researchers.

A serious assessment:

• Active-funds risk: manageable through orderly migration via the existing soft-fork BIP pipeline; SHRINCS already operational on Liquid sidechain
• Inactive/long-dormant-funds risk (NVK Tier A, ~1.7M BTC including Satoshi’s coins): largely unaddressable through holder action; permanent structural vulnerability if CRQC emerges
• Execution risk: the Bitcoin development community’s ability to coordinate post-quantum migration within the threat window is the dominant variable; the work has begun ahead of urgency
• Timeline risk: a faster-than-expected CRQC emergence compresses the response margin; current trajectory does not suggest acceleration but cannot rule it out
• Cryptographic risk: post-quantum signature schemes are well-studied (NIST PQC competition; multi-year scrutiny) but less battle-tested than ECDSA/Schnorr; multi-scheme hybrid approaches reduce catastrophic-weakness risk
• Unsolved gap: Lightning Network adaptor signatures have no known post-quantum construction; the most significant residual cryptographic problem
• Practical holder action: per NVK, “Stop reusing addresses. Keep long-term cold storage in addresses you have never spent from.” Moves holdings from Tier B (migratable but exposed) to hashed-key safe category.

This is a critique worth tracking actively. It is not a critique that justifies dismissing Bitcoin; it is a critique that justifies investing in the development process and tracking the realistic threat timeline. Mainstream-media coverage is consistently poorly calibrated; the Bitcoin-community treatment via NVK’s series and adjacent research is substantially better-grounded than the popular framing.

---

Open questions for further development

• What is the right cadence for the Bitcoin development community to begin formal BIP work on post-quantum signature schemes? Too early risks adopting an immature scheme; too late risks insufficient migration window.
• How does the Satoshi-coins problem get resolved? Multiple proposed approaches each have significant costs; the community has not yet had a serious sustained debate on the trade-offs.
• If a CRQC emerges suddenly (vs incremental progress), what is Bitcoin’s response capacity? Emergency soft forks have precedent (the 2010 inflation bug) but the post-quantum migration is much larger in scope.
• How do post-quantum-vulnerable cryptocurrencies (essentially all current ones) respond if one of them migrates first vs last? First-mover and last-mover dynamics may matter.
• What is the realistic adoption curve for post-quantum addresses once they exist? Holder migration patterns from past upgrades (SegWit adoption took years; Taproot adoption is ongoing) suggest the migration will be partial for a long time.

---

Canonical sources for this note

The principal Bitcoin-side consolidation (load-bearing for this note):

• NVK (Rodolfo Novak) — Bitcoin & Quantum Computing research series at bitcoinquantum.space (April 2026; 4 parts; 17 named researchers; 14 mitigation proposals). The most rigorous Bitcoin-community treatment of the quantum question. Part 1 establishes the threat-overstatement framing; Part 2 documents the financial-incentive misalignment in the quantum industry; Part 3 surveys 14 post-quantum proposals; Part 4 deconstructs the April 2026 17-bit ECDLP demo as “classical computations wearing quantum costumes.”

Foundational quantum-cryptography papers:

• Shor, Peter — Algorithms for Quantum Computation: Discrete Logarithms and Factoring (1994) — the original Shor’s algorithm
• Roetteler, Naehrig, Svore, Lauter — Quantum Resource Estimates for Computing Elliptic Curve Discrete Logarithms (2017) — earlier resource estimates for breaking secp256k1
• CFS/EUROCRYPT 2026 and Google Quantum AI — updated logical-qubit estimates (1,200-2,300 for secp256k1)
• Mosca, Michele — Cybersecurity in an era with quantum computers (2018) — the Mosca’s theorem framing for migration urgency

Post-quantum cryptography standardization:

• NIST Post-Quantum Cryptography Standardization process (2016-2024) — produced CRYSTALS-Dilithium, Falcon, SPHINCS+ as standardised post-quantum signatures
• NIST FIPS 204, 205, 206 (2024) — the formal post-quantum signature standards
• NSA Commercial National Security Algorithm Suite (CNSA) 2.0 — migration guidance for national-security systems

Bitcoin-specific post-quantum proposals (catalogued in NVK’s Part 3):

• BIP-360 (Ethan Heilman; BTQ Technologies testnet) — bc1z address type
• SHRINCS / SHRIMPS (Jonas Nick, Blockstream) — hash-based signatures; deployed on Liquid sidechain
• Quantum Safe Bitcoin (QSB) (Avihu Levy, StarkWare) — no-soft-fork hash-to-signature puzzle
• Binohash (Robin Linus) — earlier hash-grinding approach
• PQ HD Wallets (jesseposner); Raccoon-G (March 2026) — HD wallet threshold construction
• zk-STARK BIP-32 Escape (Olaoluwa Osuntokun) — seed-knowledge-without-revelation
• Multiple additional contributions across 15+ Delving Bitcoin threads and 20+ Optech newsletter issues by Tim Ruffing, Matt Corallo, conduition, Greg Maxwell, Tadge Dryja, others

Empirical exposed-supply analysis:

• Chaincode Labs — exposed-public-key supply analysis (~6.26M BTC, 30-35% of total; Tier A 1.7M / Tier B 5.2M / Tier C mempool-window breakdown)

Bitcoin-specific quantum discussions:

• Bitcoin Core developer mailing list — periodic threads on post-quantum considerations
• Bitcoin Optech newsletter — ongoing coverage of post-quantum BIPs
• Bitcoin Magazine — various articles on the quantum threat
• Adam Back, Pieter Wuille, Andrew Poelstra — technical talks and conference presentations
• Delving Bitcoin forum — 15+ active threads on post-quantum signature schemes

Quantum-hardware progress and skepticism:

• IBM Quantum roadmap (annual updates) — and the publicly-documented backward revisions (million-qubit target dropped)
• Google Quantum AI roadmap
• Various academic publications on quantum-hardware milestones
• Quantinuum (48 logical qubits as of 2026), IonQ, Rigetti progress reports
• PsiQuantum 2025-deadline miss (publicly documented)
• Physicist skepticism: Leonid Levin, Mikhail Dyakonov, Gil Kalai, Tim Palmer — fundamental-physical-barriers arguments

Critic engagement:

• Various Bitcoin-critical articles citing quantum threats (Gerard, White, others)
• Academic literature on cryptocurrency vulnerabilities including quantum
• Bernstein research note: “Quantum threat to Bitcoin neither existential nor novel” (DL News coverage)
• Nobel-physicist-warning coverage (CoinDesk April 2026) — typically poorly calibrated; useful as exemplar of mainstream framing

As of 2026-05-15: NIST PQC standardization completed; NVK’s Bitcoin & Quantum Computing series has consolidated the Bitcoin-community engagement; BIP-360 and SHRINCS both have operational deployments (testnet and Liquid sidechain respectively); quantum-hardware progress continues incrementally with backward-revised vendor roadmaps; the realistic threat timeline remains well beyond near-term horizons.

---

Related notes

Within the Criticisms section:

• Long-term security budget — adjacent technical-protocol critique
• Consensus-layer attack theories — adjacent protocol-attack-surface critique
• Protocol-evolution constraints — the migration-execution question
• Criticisms of Bitcoin — the section sub-MOC

Technical foundations section:

• Signature schemes in Bitcoin
• Public key cryptography
• Bitcoin addresses
• Soft forks and hard forks

These technical foundations notes are the natural homes for the cryptographic-primitive treatment; this criticism note treats the threat model and engagement, not the primitives themselves.

Adjacent thinker pages:

• Greg Maxwell — Bitcoin cryptographic thinker; has discussed quantum considerations
• Pieter Wuille — Schnorr signatures and Taproot designer; quantum-considerations contributor
• Adam Back — has commented on quantum threats in various venues

The sub-MOC home:

• Criticisms of Bitcoin