The $300 Million Signal: Parsing the Entropy in the Post-Quantum Migration
Hook
On a Tuesday in September, the US Department of Commerce did something no prior administration had attempted: it took direct equity stakes in three quantum hardware firms — Rigetti, D-Wave, and Quantinuum — routed through the CHIPS and Science Act. The headline figure was modest. The structural implication was not.
Those three recipients do not build equivalent machines. Rigetti and Quantinuum work toward gate-based, fault-tolerant architectures — the class of system capable, in principle, of executing Shor's algorithm against elliptic-curve cryptography. D-Wave builds quantum annealers. An annealer cannot run Shor's algorithm. It cannot factor a 256-bit secp256k1 key, and it never will, because the architecture is a different computational species. Bundling D-Wave into the same announcement as its gate-based peers is either an accounting convenience or a category error. If you are pricing quantum risk to Bitcoin or Ethereum, that distinction is the entire game.
Context
To understand why, you have to separate the exposed layer from the protected one. Bitcoin and Ethereum secure ownership through ECDSA over secp256k1, with Schnorr signatures layered on top for newer constructions. Both schemes rest on the same hardness assumption: that recovering a private key from a public key via the discrete-log problem is infeasible. Shor's algorithm dissolves that assumption on a sufficiently large fault-tolerant quantum computer.
The subtlety most coverage misses is what is actually exposed. A standard P2PKH address is a hash of a public key. Until you spend from it, the public key sits behind a hash function — and hash functions resist quantum attack far better than elliptic curves do, because Grover's algorithm offers only a quadratic speedup, not an exponential one. The real target is any output whose public key is already visible on-chain. That includes every output that has been spent from, every P2PK output, and — critically — the earliest coinbase rewards from 2009 and 2010.
Satoshi Nakamoto's roughly one million BTC sit in early P2PK outputs. Their public keys have been exposed since genesis. They are, by construction, the highest-risk assets on the network — and they are also the ones whose private keys may no longer exist in any recoverable form.
Core
Here is where the two largest chains diverge, and where the coordination asymmetry becomes visible.
Ethereum has done something structurally coherent. The Ethereum Foundation has stood up a dedicated post-quantum cryptography team and attached a self-imposed migration deadline of December 2029. That deadline is arbitrary — it is a psychological anchor, not a technical inevitability. But it forces the ecosystem's downstream actors, wallets, indexers, RPC providers, into a shared calendar. In a system where nothing ships without coordination, an artificial deadline is a legitimate engineering tool.
Bitcoin has no such coordination body, and this is not a bug. The BIP process — BIP-360 and BIP-361 among the more recent proposals — is deliberately slow, deliberately adversarial, and deliberately impossible for any single actor to steer. Proposals are circulating. They are not activated. The distance between a circulated BIP and an activated soft fork is measured in years and, occasionally, in schisms.
I spent six weeks in 2024 auditing the fraud-proof game theory of the leading optimistic rollups, and the lesson I carried away applies here with uncomfortable precision: the hard part of any protocol migration is never the cryptography. It is the coordination surface around it. When you map the invisible costs of an abstraction layer, you find that the code is cheap and the humans are expensive.
Consider the Ethereum case honestly. Migrating from ECDSA to a lattice-based or hash-based scheme is not a flag flip. Every externally-owned account — essentially every retail wallet — must move to a new address format and sign with a new key. Every smart contract that performs signature verification in its own logic must be audited and, in many cases, redeployed. The account abstraction surface, the multisig implementations, the bridge validators, the hardware-wallet firmware — all of it becomes a dependency graph where a single unsupported node stalls the rest. Ethereum's account model amplifies migration complexity exponentially relative to a UTXO system, because stateful accounts carry their signing logic inside themselves.
Now the Bitcoin case. UTXO migration is, in principle, simpler: users sweep funds to new quantum-resistant outputs. But "users" here include dormant coins whose owners may be dead, institutional custody that has been layered through wrapped representations, and the approximately one million coins attributed to Satoshi. If the private keys to those coins are gone, no migration is possible. And any proposal that touches them — BIP-361 reportedly contemplates restricting legacy signature types after a migration window — walks directly into Bitcoin's most sensitive constitutional question: who has the authority to decide the fate of dormant property?
That is not a technical question. It is a property-rights question, and it is the one most likely to fracture the community.
Contrarian
Here is the counter-intuitive part, and I want to state it plainly because the prevailing narrative gets it backwards.
The market treats quantum risk as a hardware problem — a countdown to a qubit threshold, a race against IBM's stated 2029 delivery of its Starling system. That framing is comfortable because it is legible. You can track logical qubit counts. You can't track the eleven hundred organizational decisions required to migrate a wallet ecosystem.
I would frame it the other way. The most overestimated risk is the arrival of a cryptographically relevant quantum computer before 2030. The most underestimated risk is coordination failure — the probability that the ecosystem, given a working migration path, cannot execute it across millions of users and thousands of dependent applications in time.
Google's sub-1200 logical qubit estimate is a projection, not a demonstration. Fault-tolerant machines capable of running Shor's algorithm against secp256k1 require millions of physical qubits under current error-correction overheads. We are not close. But a migration that takes five to ten years to engineer cannot be started the year the threat materializes. That is the real bind: the timeline for defense is longer than the timeline we can reliably forecast for the threat.
And there is a second, quieter problem — one I flagged during my 2024 audit work. Some of the migration language now circulating conflates Schnorr signature adoption with post-quantum readiness. It does not follow. Schnorr signatures on secp256k1 are as vulnerable to Shor's algorithm as ECDSA is. They are a scalability and privacy improvement, not a quantum defense. If any part of the community treats a Schnorr migration as a step toward quantum resistance, that is a false sense of security — and false security is more dangerous than acknowledged ignorance, because it suppresses urgency. Verifying that a claimed migration is actually post-quantum means verifying the underlying hardness assumption changed, not the signing ergonomics.
There is a governance dimension here too, and it rhymes with every on-chain vote I have ever observed. The decisions that matter — whether to restrict legacy signatures, whether to treat dormant coins as forfeit, whether to adopt a specific NIST-standardized lattice scheme — will not be made by a broad community. They will be made by a small circle of core developers and, in Bitcoin's case, ratified or resisted by miners. Turnout in these processes is not a democratic expression; it is a negotiation among a few dozen people with the technical standing to block. That is not a criticism of Bitcoin. It is a description of how every sufficiently complex protocol actually governs itself.
Takeaway
So what should you actually watch, if the qubit count is the wrong variable?
Track the coordination signals, not the hardware press releases. Watch whether Ethereum's post-quantum team ships a working devnet before its 2029 anchor, because a testnet is the first honest proof that the coordination surface is traversable. Watch whether bitcoin's BIP-360/361 discussions move from proposal to activation, because the moment property rights enter the debate, you will see the real fault lines. And watch for any on-chain movement from the earliest P2PK addresses — because a signature from a presumed-dead key would reprice the entire question overnight, whether it signals migration or breach.
The quantum computer, when it matters, will not arrive as a surprise. It will arrive as a deadline everyone knew about and nobody coordinated around. That is the entropy worth parsing.
