On September 10, the United States Department of Commerce did something no crypto foundation has managed in fifteen years of token sales and ecosystem grants: it bought equity in three quantum computing companies in a single afternoon. Rigetti. D-Wave. Quantinuum. Roughly $300 million, routed through the CHIPS framework and structured as direct government stakes rather than research grants.
The crypto press filed it under "interesting" and moved on inside one news cycle. That reaction was the real story.
Because inside that trio of names sits a detail almost nobody with capital at risk bothered to verify. D-Wave builds quantum annealers. Annealers solve optimization problems by settling into energy minima. They cannot execute Shor's algorithm — the one algorithm that matters for breaking elliptic curve cryptography. Two of those three companies pose a theoretical threat to secp256k1. One does not belong in the sentence at all.
Minted in hope, burned in regret. This is always how it starts. A headline that overstates, a market that under-reads, and a technical reality that arrives three years late and two years after the point where fixing it was still cheap.
I have spent most of my working life reading code that people assured me was fine. It never is. But it is almost never broken in the place they were looking, either — which is why I want to separate what this announcement genuinely changes from what it only pretends to change.
What the threat actually is
Let me be precise about the machine everyone is now pricing.
Shor's algorithm, running on a sufficiently large fault-tolerant gate-based quantum computer, derives a private key from its corresponding public key in polynomial time. Both Bitcoin and Ethereum rest on secp256k1, an elliptic curve whose entire security assumption is that the discrete logarithm problem is hard. Shor dissolves that assumption. And it does not care whether you sign with ECDSA or with Schnorr, because both operations live on the same group.
That is the whole threat. Everything else is scheduling.
The schedule, at least publicly, now points at 2029 — and it points there twice. The Ethereum Foundation has stood up a dedicated post-quantum research effort and has been reported to be targeting December 2029 for core protocol readiness. IBM, separately, has committed publicly to delivering a fault-tolerant quantum system — the Starling programme — in 2029.
These are two entirely different kinds of 2029. One is a governance pledge from a foundation that controls a fraction of the network it stewards. The other is a hardware roadmap published by a company that has missed roadmaps before. The market reads them as a single clock. They are not a single clock. They are a coincidence that happens to be extremely useful to anyone selling urgency.
On the Bitcoin side, the response has been characteristically slow and characteristically serious. BIP-360, the Pay-to-Merkle-Root proposal, attacks the most immediate exposure by removing the quantum-vulnerable key path from taproot outputs. It has been discussed on the mailing list, tracked by Bitcoin Optech, and it remains unactivated. There is no Bitcoin deadline. Whether that reflects wisdom or paralysis depends entirely on which side of a block you sit.
We are in a market where nobody wants another upside story. Readers right now are asking a narrower, colder question: does the thing I am holding lose value for reasons that have nothing to do with price? That is the honest version of the quantum conversation, and it deserves an answer built from data rather than vibes.
The target is the public key, not the address
Here is where most explainers get it backwards.
The reassurance currently circulating is that Bitcoin addresses are hash-protected, so coins remain safe until they are spent. That is half true, and the missing half is the part that matters. A modern P2PKH output stores a hash of the public key. To attack it, a quantum computer would need to invert that hash — which Shor does not do, and which Grover only weakly weakens. So far, so comfortable.
But the moment you spend from that address, the full public key lands on-chain in the witness, and it stays there. Forever. Exposed. Any key that has ever signed is a key whose public half is now permanent public record, sitting in an immutable ledger, waiting for a machine that does not exist yet.
Then there is the older format. Early Bitcoin used Pay-to-Public-Key outputs, where the public key was written directly into the locking script in plaintext. Those outputs have been fully exposed since 2009. The estimated volume sitting in P2PK outputs runs into the millions of coins, and the largest single cluster is the roughly one million BTC attributed to Satoshi Nakamoto.
Those coins are not at risk in 2029. They are at risk now, and have been for sixteen years. No migration exists for them, because migration requires the owner to sign, and the owner has not signed in over a decade. Every block hides a confession. The confession here is that the oldest, most revered coins on the network are also the least defensible, and no amount of community reverence changes the mathematics of an exposed curve point.
The Schnorr category error
There is a framing making the rounds that describes Bitcoin's migration path as a staged move from ECDSA to Schnorr signatures, filed under a quantum-resistance heading. I want to be blunt about this, because I have watched it repeated by people who should know better.
Schnorr signatures over secp256k1 are not quantum-resistant. They are a different signing equation over the identical curve. Shor's algorithm does not attack your signing equation. It attacks the group. Taproot's Schnorr upgrade delivered real, measurable benefits — smaller multisig, better privacy, cheaper key aggregation. None of those benefits are post-quantum. A signature scheme becomes quantum-resistant when the underlying hard problem changes: lattice problems, hash functions, code-based constructions. Not when the algebra gets more elegant.
The confusion is understandable, and that is exactly what makes it dangerous. A reader hears "Bitcoin is migrating its signature scheme" and concludes that progress is being made. Progress is being made. It is just progress toward a different destination than the one being advertised.
When I audited a yield-harvesting vault back in 2018, the bug was never in the function everyone was reading. It was in the assumption nobody had written down. This is that assumption, operating at protocol scale, with a nine-figure market cap attached to the misunderstanding.
What the United States actually bought
Portfolio construction tells you what a buyer believes, more reliably than any press release.
D-Wave's machines are annealers. They excel at combinatorial optimization and they are genuinely useful for logistics, materials simulation, and scheduling. What they cannot do is run a universal gate circuit, which means they cannot run Shor's algorithm, which means they cannot break ECDSA at any qubit count. You can scale an annealer to a million qubits and Bitcoin's curve will not notice.
Rigetti builds superconducting gate-based systems. Quantinuum builds trapped-ion gate-based systems. IBM and Google build gate-based systems. These are the architectures that matter for the cryptographic threat, and they are the architectures where fault tolerance remains the unsolved problem — not qubit count. What matters is logical qubits, error-corrected and stable. Current estimates for breaking 256-bit elliptic curve cryptography range into the thousands of logical qubits and the millions of physical ones. The industry is not within an order of magnitude of that. It may not be within two.
So the government bought a category, not a capability. That is a defensible national strategy and a terrible trading signal. If you are pricing your BTC exposure against a D-Wave press release, you are pricing the wrong machine.
Ethereum's real problem is not cryptographic
Ethereum has the cleaner story and the harder job.
Its Foundation can set a deadline. Its researchers can specify a signature scheme. What neither can do is migrate millions of externally owned accounts, each of which is defined by a single secp256k1 key pair, plus every deployed smart contract that calls ecrecover internally, plus every account abstraction module layered on top of that, plus every wallet, indexer, RPC provider, bridge, and exchange that has hardcoded the current signing assumptions into its stack.
The Ethereum migration is not a cryptography problem. It is a social engineering problem wearing a cryptography costume. The base layer can ship a new precompile. What it cannot do is reach into a Ledger device sitting in a drawer in Seoul and update it.
That is the asymmetry nobody prices. Ethereum's coordination advantage — a foundation, a research budget, a published timeline — makes the proposal side faster. It does not make the adoption side faster. And with hybrid signature schemes, where you sign with both the old curve and a post-quantum scheme during a transition window, every transaction roughly doubles in size. Gas costs move. Blocks fill differently. Fee markets reprice. Gas fees were the only truth we paid for, and they will tell us honestly how expensive this transition is.
The dormant coin deadlock
The most under-discussed element of the Bitcoin response is what happens after the migration window closes.
If the community adopts a rule that disables legacy signature validation after a cutoff — and proposals along these lines have been floated — then every coin that has not migrated becomes unspendable. Not burned in a ceremony. Not provably destroyed. Just invalid. Silently converted from property into a hash on a chain that will no longer honor it.
Consider what that means for the Satoshi cluster. If those keys cannot migrate because no living party holds them, then the network has to decide, by rough consensus, whether to invalidate a million coins. There is no technical answer to that. There is only a political one.
The 2017 block size war was a fight over one megabyte. This would be a fight over whether the protocol has the authority to extinguish ownership of unspent outputs. That is not a scaling debate. That is a constitutional convention.
And the market consequence cuts both ways. Removing one to two million coins from spendable supply is deflationary on paper — a supply shock that any token economist would celebrate. But a chain that has demonstrated it will invalidate dormant keys has also demonstrated that its property rights are contingent on participation. Institutional allocators who spent 2024 underwriting custodial risk for ETF structures will read that precedent very carefully, and I do not think they will like the chapter.
The bottleneck nobody is funding
Three hundred million dollars went into quantum hardware. Almost none of it went into migration tooling, and that is the actual shortage.
The cryptography is largely solved. NIST finalized its post-quantum standards in 2024 — ML-KEM for key encapsulation, ML-DSA and SLH-DSA for signatures, spanning lattice-based and hash-based constructions. These are deployable today. Crypto agility, the ability to swap primitives without rewriting consensus, is a known engineering discipline.
What does not exist is the last mile: a signed, tested wallet upgrade path for tens of millions of users who do not read release notes. Address format changes. Custodians coordinating cold storage migrations across legally distinct entities. Testnets that have actually validated hybrid signatures under load. None of this is glamorous, and none of it gets a ribbon-cutting.
Liquidity flows, but integrity stagnates. The money is chasing the threat, not the fix.
What the bulls, for once, got right
I have spent this piece dismantling a narrative, so let me be fair to the other side, because they are not entirely wrong.
The bulls are right that this is not an emergency. A practical quantum attack on secp256k1 in the next four years is unlikely, and anyone claiming otherwise is selling something. They are right that post-quantum cryptography is mature enough to deploy. They are right that Bitcoin's refusal to move fast has, historically, prevented it from moving wrong. They are right that Ethereum's ability to execute a consensus change — the Merge — in a matter of years proves that governance at that layer is not fictional.
Where the bulls are wrong is in treating network effect as a defense. Network effect protects a chain from competitors. It does nothing against an exposed curve point. Value does not make a key harder to derive.
The blind spot is the aging supply itself. A meaningful share of Bitcoin has not moved in five years or more, and those coins are disproportionately the ones with the oldest, most exposed output types. The least mobilizable supply is also the most vulnerable supply. And the deepest risk of all is not that the machine arrives on schedule. It is that 2029 passes quietly, the fear narrative decays, and the industry loses a decade of urgency three years before it actually needed it.
We chased the glow, not the ledger. We always do.
Takeaway
History is written in hex, not headlines. The question was never whether Shor's algorithm shows up on a calendar someone published. It is whether an industry that could not agree on a block size can coordinate millions of strangers around a threat none of them can see, on a deadline set by a machine that does not yet exist — and decide, in the same breath, who gets to keep the coins that cannot answer.
The code did not fail us. We simply never read the part that mattered.