On September 10, the United States Department of Commerce did something governments rarely do with private technology firms: it took equity. Three quantum hardware companies — Rigetti, D-Wave, and Quantinuum — received capital through the CHIPS and Science Act, a sum reported around $300 million, earmarked explicitly for fault-tolerant quantum hardware and the error-correction systems that make fault tolerance possible.
The market read it as a science-funding story. I read it as a clock.
Follow the money, not the noise. When a government buys a stake rather than writing a grant, it is not funding curiosity. It is purchasing optionality over a capability it expects to matter. And the one capability that makes quantum computing strategically interesting — the one that turns a laboratory curiosity into a national-security asset — is the ability to run Shor's algorithm at scale. Shor's algorithm breaks elliptic-curve cryptography. Bitcoin and Ethereum both run on elliptic-curve cryptography. The distance between those two sentences is the entire subject of this article.
Context: What Actually Breaks
To follow this story you have to separate the thing the headlines sell from the thing that actually fails.
Bitcoin and Ethereum authenticate ownership through digital signatures. When you move coins, your wallet signs a transaction with a private key; the network verifies that signature against a public key derived from the same elliptic curve, secp256k1. That relationship — private key to public key, one-way today — is exactly the relationship Shor's algorithm inverts on a sufficiently large fault-tolerant quantum computer. Everything else in the quantum-crypto conversation is downstream of that single asymmetry.
Here is the part most coverage flattens. A Bitcoin address is not a public key. It is a hash of a public key, and hashing is not the same mathematical problem as key inversion. A quantum computer running Shor does not break hashes — that is Grover's territory, and Grover offers only a quadratic speedup, which is manageable with longer hash lengths. So an address that has never spent is, in a narrow and temporary sense, safer than the headlines suggest. The danger arrives the moment you sign. When you spend, your public key is revealed to the network. After that, the coins sitting in the change output — and the coins in any key that has ever signed — are exposed. As one researcher memorably framed it, spending from an address with quantum-vulnerable signatures is like publishing your safe combination in a newspaper and then hoping nobody hires a locksmith.
This is why the quantum risk in Bitcoin is not uniform. It is concentrated in a specific, uncomfortable place: coins whose public keys have been exposed since the earliest days, including the roughly one million coins attributed to Satoshi Nakamoto. Early P2PK outputs published the public key on-chain at the moment of creation, before anyone was thinking about quantum adversaries. Those coins have been exposed since genesis. They are also, in the purest sense, the least movable assets in the system.
That is the backdrop. Now the response.
Core: The Race, Its Corners, and Its Illusions
The Schnorr misdirection
If you take one technical correction from this piece, take this one.
A widely circulated framing describes BIP-360 and BIP-361 as a staged migration "from ECDSA to Schnorr signatures" and files that migration under the heading of quantum resistance. It is a dangerous conflation, and it is worth being blunt about why: Schnorr signatures run on the same secp256k1 curve as ECDSA. They are more elegant, they enable signature aggregation after Taproot, they improve privacy and block efficiency — and they are exactly as vulnerable to Shor's algorithm as the scheme they replace. Migrating from ECDSA to Schnorr is a functional upgrade. It is not a quantum defense.
I spent the better part of 2017 reverse-engineering token contracts that marketed themselves as "post-quantum" because they had renamed a library or bumped a key size. The pattern is old: swap a parameter, print a press release, let the assumption of safety do the work. A genuine post-quantum signature scheme replaces the underlying hardness assumption — from elliptic-curve discrete logarithms to lattice problems, hash-based constructions, or similarly structured problems that resist both Shor and Grover. Pay-to-Merkle-Root style constructions and lattice-based proposals live in that category. Schnorr does not. Confusing the two creates a false sense of safety, and false safety is more dangerous than acknowledged risk, because it removes the urgency to do the actual work.
Based on my audit experience, the most reliable sign that a project does not understand its own threat model is that it describes features as defenses. A feature improves something. A defense addresses a specific adversary. When the two are blurred, the roadmap quietly slips years behind reality.
Not all qubits are the same enemy
The second illusion is architectural, and it lives inside the investment itself.
D-Wave builds quantum annealers. Annealers solve optimization problems by letting a physical system settle toward a low-energy state. They are genuinely interesting machines, and they are genuinely useful for certain classes of optimization. They are also not gate-based, universal quantum computers, which means they cannot run Shor's algorithm as written. To break elliptic-curve cryptography you need a fault-tolerant, gate-model machine with enough logical qubits to execute and error-correct a full quantum circuit. Rigetti, Quantinuum, IBM, and Google are building in that direction. The annealing architecture is not the same threat, and bundling it into the same round of funding as the others tells you the government is investing in a sector narrative as much as in a specific capability.
This matters for how you read the "threat." A policy that funds three companies does not mean three companies threaten Bitcoin. It means the United States has decided that quantum capability is a strategic good and is buying exposure to all of it — the useful, the adjacent, and the not-yet-relevant. The signal is real. The implication that the threat just got 50 percent larger is not.
The quantitative honesty is worth keeping close. Google's often-cited figure of under 1,200 logical qubits required for a cryptographically relevant attack is an estimate derived from resource models, not a demonstrated machine. IBM's roadmap points to delivering its Starling system in 2029 — a hardware milestone, not a cryptographic one. There is no public evidence that any existing machine can factor the numbers required to attack secp256k1, and the energy and error-correction requirements remain enormous. Volatility is the tax on impatience, and the mirror image of that truth is that fear, too, charges a premium when it is early.
Two chains, two theories of coordination
Here is where the story stops being about physics and starts being about governance — which is where I spend most of my attention.
Ethereum has set a self-imposed deadline: December 2029. It has stood up a dedicated post-quantum team, and it is treating migration as a program with owners and milestones. That is the Ethereum way — a foundation that can coordinate, set direction, and push a schedule. It is also, in this specific case, a structural advantage. When the coordination problem is genuinely hard, having a coordinator helps.
But Ethereum's advantage collides with its own architecture. Bitcoin's signature model is relatively narrow: a handful of output types, one verification path, and ECDSA over a single curve. Ethereum's account model and its vast surface of smart contracts that contain signature-verification logic mean migration is not one upgrade — it is one upgrade times thousands of applications, times the wallets that build on them, times the users who must move. A contract that verifies a signature inline cannot be migrated by a base-layer change alone; it has to be rewritten, redeployed, and re-audited, or it has to keep accepting signatures that no longer qualify as safe. The Foundation can set a date. It cannot set a date for every contract on the chain.
Bitcoin has the opposite profile. Its base layer is narrow, which makes the cryptographic change conceptually cleaner. But it has no coordinator, no deadline, and no institution with the authority to declare a migration window open or closed. Progress is a BIP process — proposals, mailing-list debate, rough consensus, miner signaling, and activation. BIP-360 and BIP-361 are discussed, debated, and above all unactivated. Which brings us to the proposal's most volatile clause.
The clause nobody has priced
Accounts of the BIP-361 framework describe a migration period after which legacy signature types would be restricted. Read that sentence as an economist rather than an engineer.
Restricting legacy signatures after a window means that coins which never migrate — because their owners are gone, or lost keys, or chose not to move — would lose their ability to move under the old rules. If the restriction is absolute, those coins are effectively frozen. If it is absolute and permanent, dormant supply is removed from circulation forever. That is a deflationary event on paper. It is also a constitutional crisis in practice, because it forces Bitcoin's community to answer a question it has avoided for fifteen years: who has the authority to determine the fate of a coin whose owner is silent?
The most exposed asset in that scenario is Satoshi's roughly one million coins, whose public keys have been visible since the earliest blocks. Those coins cannot migrate without a private key that may no longer exist in any usable form. And any rule that treats them as invalid is, functionally, a confiscation — even if it is dressed as a security upgrade. I have watched Bitcoin communities split over block size, and I can tell you the fault lines here are deeper, because they touch property rights rather than throughput. A soft or hard fork of this kind could plausibly produce a chain that keeps accepting legacy signatures and a chain that does not — the same fork logic that produced Bitcoin Cash in 2017, only with a more emotionally charged trigger.
What makes this hard to price is that it is contingent. It only matters if the migration window actually closes with legacy signatures actually restricted. Until then it is a proposal, and proposals do not move markets. Orphans of a governance debate do not price in until the debate becomes a vote.
The migration is a social problem wearing a cryptography costume
When people ask me what worries me most about the post-quantum transition, I do not describe a quantum computer. I describe a spreadsheet of a few hundred million people who have never heard the phrase "post-quantum" and do not know they are supposed to care.
Base-layer upgrades ship when a small group of developers and miners agree. Wallet software ships when companies decide to build it. But the actual migration — moving coins from vulnerable keys to safe ones — requires the participation of every holder, mediated by wallets they trust and exchanges that custody assets on their behalf. The coordination burden is not at the protocol layer. It is at the layer of MetaMask, Ledger, Coinbase, and a long tail of applications whose users will only migrate when the upgrade arrives unbidden, in a notification they might ignore.
I built a 50-page report in 2020 on how unstable stablecoin pegs moved real money across Latin American remittance corridors, and the lesson that stayed with me was about human friction. The math was elegant. The adoption was not. People routed around instability with whatever tool was already in their hand, even when a superior tool existed. Apply that to a migration that demands users understand a threat they cannot see, on a timeline they cannot feel, using software they have not yet been told to update. The binding constraint is not the algorithm. It is attention.
Downstream infrastructure inherits this bottleneck. Exchanges holding customer assets cannot migrate ahead of the protocols, and protocols cannot finish until exchanges migrate. Wallets cannot ship support for address formats that do not exist yet. Every layer is waiting on the layer above. That is not a technical failure. It is a designed-in property of a decentralized stack, and in this specific context it is a liability.
What it does to the asset itself
The quantum question does something subtle to Bitcoin and Ethereum as assets, and it is worth separating the channels.
On supply, the effect is bifurcated and speculative. If legacy signatures are ever restricted, dormant coins leave circulation, which is mechanically deflationary — but the legal and social legitimacy cost of getting there is enormous, and the market has historically punished chains that appear to override ownership. On the other side, restriction never happens, and the supply conversation is noise.
On demand, the effect is about confidence. Bitcoin's value proposition is partly the claim that it is the most secure settlement network in existence. A credible quantum threat challenges the word "secure" at its foundation. Even if the practical risk is a decade out, the repricing of a tail risk can happen long before the tail arrives. That is not an argument for panic; it is an argument for treating migration progress — or its absence — as a variable in valuation rather than a curiosity.
The deeper asymmetry is this: a chain that completes a post-quantum migration proves something a chain that does not cannot. It proves governance resilience under a threat that affects everyone. Over a long horizon, that proof is worth more than any single upgrade, because it demonstrates that the network can absorb an existential technical challenge without fracturing. Networks that survive their own hardest coordination problems tend to compound.
The national-security frame, and the uncomfortable question inside it
There is a regulatory dimension to the American investment that deserves more attention than it is getting, and it is not the securities question. Bitcoin and Ethereum have settled into a commodity-like posture as far as the major regulators are concerned. The quantum story does not move that needle.
What it does move is the framing. When the Department of Commerce takes equity in quantum firms, it is asserting that quantum capability is a matter of national strategy. That assertion carries two implications for crypto. The first is benign: government interest in post-quantum standards — the NIST process producing lattice- and hash-based primitives — accelerates the standardization that every chain will eventually depend on. The second is less comfortable. If the state is both a shareholder in the entities that could build a cryptographic-relevant machine and the arbiter of the standards that defend against it, then crypto's post-quantum security becomes, in part, a function of a single government's decisions. The migration may be decentralized at the protocol layer and centralized at the standards layer. That is a dependence worth naming.
And there is a question almost nobody is asking out loud: if the machine capable of breaking elliptic-curve cryptography is expensive, state-scale, and increasingly state-owned, who is the likely first possessor? The answer is not a lone hacker. It is a nation-state. A world in which the first practical quantum attack on a public key is a state capability is a different world than the one the community imagines when it worries about "hackers." It is a world where the threat is not theft but leverage.
Contrarian: The Real Risk Is the Reflex
Here is my contrarian reading, and it cuts against both the doomers and the comfortable.
The most likely near-term outcome is not a quantum break. It is a mismatch between narrative and substance. The hardware progress is real but slower than the fear implies; the migration progress is real but slower than the fear demands. That gap is where speculation lives. Expect a wave of "quantum-resistant" tokens, chains, and wallets that have done little more than relabel a curve or lengthen a hash — exactly the pattern I dissected in 2017, when seven audited utility tokens turned out to be liquidity traps wrapped in governance theater. Expect funds to flow toward the narrative before the engineering. Expect the phrase "post-quantum" to be used most loudly by the projects that understand it least.
But the contrarian case is not that the threat is fake. It is that the threat's timing is a psychological anchor rather than a physical certainty. Ethereum chose 2029. IBM's Starling is scheduled for 2029. The community's "Q-Day" assumption is 2030. Those dates rhyme, and rhyme is not causation. A migration genuinely takes five to ten years. So the correct posture is neither panic nor complacency, but a stubborn insistence on the engineering calendar rather than the marketing one. The chains that treat this as a decade-long infrastructure program — not a narrative to trade — will be the ones that emerge intact.
And the answer to "will Bitcoin and Ethereum survive the quantum transition" is probably yes — but the interesting question was never survival. It was whether the two largest crypto networks on earth can execute the single hardest coordination task in their histories, on a clock they do not control, against an adversary they cannot see, without splitting in the attempt.
Takeaway
America just bought a stake in the clock. Bitcoin and Ethereum do not own it, cannot slow it, and have no shared plan for reaching the finish line. The migration that matters is not the one the white papers describe. It is the one where a hundred million people, a thousand applications, and two incompatible governance cultures have to move in the same direction at the same time. Volatility is the tax on impatience — but the deeper tax here may fall on those who mistake a feature for a defense and a deadline for a solution. When the window starts to close, which chain will still be standing on the other side?
