InvisibleHill

Posted on Aug 8 • Originally published at invisiblehill.com

Bitcoin’s Quantum Problem Is a Governance Problem

#bitcoin #security #blockchain #computerscience

Originally published by InvisibleHill Research. This cross-post preserves the original research cut-off and source list.

Quantum computing will not “decrypt Bitcoin.” That phrase is technically wrong
and politically distracting.

A sufficiently capable quantum computer could do something narrower and more
dangerous: derive a private key from a visible public key, then produce a valid
signature and spend coins it does not own. The blockchain would not be hacked.
Its rules would be followed with a stolen key.

No existing machine can do this. Today’s best public demonstrations are still
learning how to preserve and operate a small number of error-corrected logical
qubits. But the resource estimates are falling, post-quantum standards now
exist, and Bitcoin upgrades slowly by design. Waiting for an attack is not a
serious plan.

The cryptography is solvable. The harder problem is the migration: how to move
millions of coins, what to do about owners who never move, and whether the
network should eventually reject signatures that are mathematically valid
under today’s rules. Quantum computing is therefore not only a security threat.
It is a test of Bitcoin’s claim that no committee decides whose money is real.

Two algorithms, two very different threats

Public discussion often combines Shor’s algorithm and Grover’s algorithm into
one quantum menace. They do different things.

Shor’s algorithm attacks ownership. Bitcoin uses elliptic-curve
cryptography on the secp256k1 curve for ECDSA and Schnorr signatures. Given a
public key, a large fault-tolerant quantum computer running Shor’s algorithm
could solve the discrete-logarithm problem and recover the corresponding
private key. With that key, the attacker could sign a normal transaction.

Grover’s algorithm weakens search. Bitcoin’s proof of work and many internal
commitments depend on SHA-256 and other hash functions. In an idealized quantum
computer, Grover’s algorithm gives a quadratic speedup: a 256-bit preimage
problem has roughly 128-bit quantum security. That is a meaningful reduction,
but 2^128 remains an enormous search space. Quantum mining would also face
serial gate costs, hardware scarcity, competition from classical ASICs, and the
network’s difficulty adjustment.

The practical conclusion is clear. The first systemic quantum risk is not a
miner rewriting the chain. It is a key-recovery attacker spending coins from
outputs whose public keys are already visible.

Not every coin is equally exposed

Bitcoin has several output types, and they reveal different information.

Early pay-to-public-key (P2PK) outputs place a public key directly on-chain.
Modern Taproot outputs also contain a public key in the output. Coins in those
formats offer a future quantum attacker unlimited time to work: the public key
is visible as long as the coin remains unspent.

Pay-to-public-key-hash formats, including common SegWit addresses, work
differently. The output commits to a hash of the public key. The public key is
revealed only when the owner spends. If the address has never been reused, a
quantum attacker must recover the private key and replace the transaction in
the brief interval before confirmation.

That creates two clocks. A long-exposure attack can target an already
visible key for months or years. A short-exposure attack must observe a
transaction in the mempool, recover the key, and front-run the owner, perhaps in
minutes. The latter requires a much faster machine.

Address reuse defeats the concealment. Once a public key has appeared in a
previous spend, any remaining or newly received coins controlled by the same
key become long-exposure targets. Extended public keys and some wallet
descriptors can create exposure off-chain as well.

This nuance cuts both ways. It means the entire supply is not waiting naked for
the first quantum computer. It also means the oldest coins, reused addresses,
and Taproot outputs are natural first targets. A successful theft from a famous
dormant address could cause a market crisis before the attacker had the speed
to threaten ordinary transactions.

How far away is the machine?

Nobody can responsibly give a date for a cryptographically relevant quantum
computer. Qubit counts in headlines are poor forecasts because a noisy physical
qubit is not a reliable logical qubit, and logical qubits alone say little about
gate speed, connectivity, error correction, or how long a circuit can run.

Google’s 105-qubit Willow processor crossed an important threshold in 2024. A
larger error-correcting code suppressed errors better than a smaller one, and a
101-physical-qubit code preserved one logical memory longer than its best
component qubit.
That was a scientific milestone, not a cryptographic computer. Shor’s algorithm
against secp256k1 requires a large universal fault-tolerant machine executing a
deep sequence of reliable operations, not merely storing one encoded state.

The gap is still enormous, but it is no longer useful to describe it with a
number from five years ago. A 2026 resource study accepted by PRX Quantum
describes circuit designs using fewer than 1,500 logical qubits and estimates
that, under specific superconducting-hardware assumptions, fewer than 500,000
physical qubits could recover a secp256k1 key in
minutes.
That estimate is not a delivery forecast. It assumes error rates, connectivity,
control, and manufacturing at a scale nobody has demonstrated. It does show
why “millions of qubits” should not be treated as a permanent safety margin.

There is another reason to start early: migration time. NIST finalized its
first post-quantum standards in 2024, including the lattice-based ML-DSA and the
hash-based SLH-DSA for digital signatures. The U.S. government’s transition
planning contemplates phasing out vulnerable public-key cryptography in the
2030s. Bitcoin cannot assume that banks, browsers, and governments will spend a
decade migrating while a global decentralized asset will improvise later.

The sensible stance is neither “quantum winter forever” nor “Q-Day in 2029.” It
is to treat arrival time as a wide distribution and make migration progress
observable.

The first step exists, but it is not the finish

Bitcoin Improvement Proposal 360 is the most concrete protocol step so far. It
proposes Pay-to-Merkle-Root (P2MR), a new output type similar to Taproot but
without the elliptic-curve key-path spend. The output commits directly to a
script-tree root, so it can avoid leaving a long-lived public key exposed.

The proposal is deliberately modest. Its own specification says P2MR protects
against long-exposure attacks, not the short-exposure window after a public key
is revealed.
Full protection still requires a post-quantum signature scheme inside the
spending script.

That separation is good engineering. P2MR can reduce today’s attack surface and
create a clean place for a future signature opcode without forcing the network
to choose an immature algorithm immediately. It can be activated through a
soft fork, preserving compatibility for nodes that have not upgraded.

The difficult part is size. A Schnorr public key is 32 bytes and a signature is
64 bytes. Standardized post-quantum signatures are generally measured in
thousands or tens of thousands of bytes. Bitcoin has intentionally scarce block
space. Replacing every signature naively would reduce transaction throughput,
raise fees, enlarge the blockchain, and make node operation more demanding.

Developers are studying lattice signatures, hash-based signatures, aggregation,
commit-and-reveal constructions, and zero-knowledge proofs that verify a
post-quantum authorization more compactly. Each trades bandwidth, computation,
assumptions, implementation risk, and maturity. NIST’s selection is valuable
evidence; it is not an automatic answer for a consensus system that may need to
validate signatures for generations.

The lost-coin dilemma

Suppose Bitcoin adds a sound post-quantum output and gives holders years to
migrate. Most active users, exchanges, custodians, and institutions move. Some
coins do not.

They may belong to people who missed the deadline. The keys may be in cold
storage. The owner may be dead. The coins may be deliberately dormant. Or the
keys may be permanently lost. The blockchain cannot distinguish among these
stories.

Once a quantum attacker can recover old private keys, the network faces three
uncomfortable choices.

Honor the existing signature rules. A quantum-generated signature is
valid, so miners include it. This preserves protocol continuity but rewards
theft. Dormant coins could suddenly enter liquid supply, and no observer
could tell whether the spender was an owner or an attacker.
Disable vulnerable signatures before the attack. This protects the
network from mass theft but strands any owner who failed to migrate. A rule
intended to defend property becomes a collective decision to freeze it.
Create a recovery mechanism. Owners could prove knowledge of an old
secret using a post-quantum construction and reclaim funds after elliptic-
curve spends are disabled. This reduces confiscation risk but adds protocol
complexity, privacy questions, and new failure modes.

The argument becomes most intense around coins attributed to early miners,
including Satoshi Nakamoto. If those keys are lost, a quantum computer could
turn economically dormant supply into active supply. If the network freezes
them, critics will say developers changed the rules to protect the price. If it
does not, critics will say it knowingly legalized theft.

No cryptographic primitive can answer that question. The answer will come from
social consensus expressed through software, miners, economic nodes, wallets,
and users.

A credible migration plan

A robust plan should be staged long before an emergency.

First, measure and reduce exposure. Wallets and custodians should inventory
output types, address reuse, extended-key handling, and recovery paths. Users do
not need to panic-move coins today. They do need modern backups and software
capable of participating in a future migration. Wallet defaults should stop
creating avoidable long-exposure keys.

Second, activate an upgradeable quantum-safer output. P2MR or a comparable
design would let cautious holders move before the final signature choice is
settled. Exchanges and hardware wallets need test vectors, descriptors, fee
estimation, recovery procedures, and years of operational testing.

Third, select at least two authorization paths. A primary scheme and a
conservative backup based on different mathematical assumptions would reduce
the danger of discovering a flaw after billions of dollars have migrated.
Hybrid signatures can require both classical and post-quantum authorization
during the transition.

Fourth, publish triggers. The network needs evidence thresholds for
accelerating migration and, eventually, disabling vulnerable spends. A July
2026 developer discussion proposed a cryptographic “tripwire”: a signature by a
published nothing-up-my-sleeve key could prove that secp256k1 had been broken
and automatically disable elliptic-curve paths in new protected outputs. The
idea is not finished, but it correctly asks who gets to declare the emergency.

Finally, decide the legacy policy while the choice is still abstract. A
multi-year notice period, transparent activation sequence, and narrowly scoped
recovery design are more legitimate than an overnight patch after a theft.
The worst time to debate property rights is while a quantum attacker is moving
coins.

What this means for Bitcoin’s value

Quantum risk is unlikely to appear in the price as a smooth annual discount. It
will arrive through discrete credibility events: a new error-correction result,
a smaller resource estimate, a state program, a public key-recovery
demonstration on a weaker curve, or a successful Bitcoin testnet migration.

If protocol work stays ahead of hardware, each milestone can increase
confidence. Bitcoin would demonstrate that fixed monetary rules do not require
frozen technology. If governance stalls while the hardware gap closes, the
same milestone can trigger a rush to safer output types and a repricing of
dormant-coin risk.

An actual theft would be different. The immediate problem would not be a change
to the 21 million cap; quantum computers cannot mint arbitrary bitcoin under
current rules. It would be a sudden transfer from inactive or compromised
owners to an adversary with no acquisition cost and every incentive to sell or
destabilize the market. Confidence in custody and settlement would matter more
than the formal supply schedule.

Bitcoin has survived bugs, forks, exchange failures, and political bans because
the protocol and its users adapted without changing the core monetary bargain.
Quantum computing asks whether they can do that prospectively, before the threat
forces a choice between theft and confiscation.

That is why the work should begin while it still feels early.

Sources

This analysis separates cryptographic possibility, engineering readiness, and
network governance. Resource estimates are scenario-dependent and should not be
read as arrival-date forecasts. Technical context is current through January 26, 2026.