The question everyone asks about quantum computing and Bitcoin is whether the threat is real. The more interesting question is what it would cost.

Quantum threat coverage follows a familiar arc: a new milestone in qubit count is announced, headlines declare that Bitcoin’s cryptography is doomed, and then nothing changes. The discourse oscillates between dismissal and catastrophism without ever engaging the arithmetic. Nobody asks what an actual attack requires in hardware, infrastructure, and energy, assuming the quantum computer already existed and worked.

That question has a concrete answer. Working through it reveals something the standard framing misses: the threat is real, it is bounded, and it is currently economically irrational for almost every Bitcoin address in existence. The exception is narrow and specific, and understanding it requires understanding the physics first.

Part I: How Quantum Computers Actually Work

Qubits and Superposition

A classical bit holds one of two values: 0 or 1. It is, at any given moment, in exactly one of those states. A qubit is different in a precise and often misrepresented way.

A qubit’s state is described by a vector in a two-dimensional complex Hilbert space:

$|\psi\rangle = \alpha|0\rangle + \beta|1\rangle$

where $\alpha, \beta \in \mathbb{C}$ and $|\alpha|^2 + |\beta|^2 = 1$. The quantities $|\alpha|^2$ and $|\beta|^2$ are the probabilities of measuring 0 or 1 respectively when the qubit is observed.

This is superposition, but not the qubit “being both 0 and 1 at once.” That framing, while common, is wrong in a way that matters. The qubit has no definite value until it is measured. The superposition is a property of the unobserved quantum state, not a claim about simultaneous values. Measurement collapses the state irreversibly to one of the two basis states.

What superposition enables is this: before measurement, quantum gates can manipulate the probability amplitudes $\alpha$ and $\beta$ in ways that have no classical analogue. A gate can put a qubit into equal superposition ($|\alpha|^2 = |\beta|^2 = 0.5$), rotate its state on the Bloch sphere, or entangle it with another qubit. The power of quantum computing comes from engineering these amplitudes so that the answer to a computational problem has high probability amplitude when the system is measured.

Entanglement

Two classical bits are entirely independent. Two qubits can be entangled, meaning they share a joint state that cannot be decomposed into independent single-qubit states. The canonical entangled state is the Bell state:

$|\Phi^+\rangle = \frac{1}{\sqrt{2}}(|00\rangle + |11\rangle)$

Measuring the first qubit and finding 0 instantly implies the second qubit will also be measured as 0, regardless of physical separation. This is real, experimentally verified, and routinely exploited in quantum algorithms.

What entanglement does not do is transmit information faster than light. No measurement outcome can be controlled or predicted before the fact, so no signal can be encoded in the correlations. What entanglement does enable is coordinated computation: an $n$-qubit entangled system carries $2^n$ complex amplitudes, and quantum gates can manipulate all of them. This is the substrate that makes Shor’s algorithm possible.

Quantum Gates and Circuits

Quantum gates are unitary linear operators acting on qubit states. All quantum gates are reversible, a consequence of unitarity. This distinguishes quantum computation from classical computation, where operations like AND and OR are not reversible.

The Hadamard gate creates equal superposition from a basis state:

$H = \frac{1}{\sqrt{2}}\begin{pmatrix}1 & 1\\ 1 & -1\end{pmatrix}, \qquad H|0\rangle = \frac{|0\rangle + |1\rangle}{\sqrt{2}}$

The CNOT gate entangles two qubits: if the control qubit is $|1\rangle$, the target qubit is flipped. The T gate introduces a phase:

$T = \begin{pmatrix}1 & 0\\ 0 & e^{i\pi/4}\end{pmatrix}$

Together with the Hadamard and CNOT, the T gate forms a universal gate set. The T gate plays a special role in fault-tolerant quantum computing: it is the most expensive gate to implement under error correction, and this cost feeds directly into the energy calculation.

A quantum circuit is a sequence of gates applied to an initial state, followed by measurement. The T-gate count is the standard measure of a circuit’s complexity under error correction.

Decoherence: The Fundamental Enemy

The reason quantum computers are difficult to build is decoherence. A qubit’s quantum state is fragile. Any interaction with the surrounding environment perturbs the state and destroys the superposition. Thermal photons, vibrations, and stray electromagnetic fields are all culprits.

Two timescales matter. $T_1$ (energy relaxation time) measures how long a qubit in $|1\rangle$ takes to decay to $|0\rangle$. $T_2$ (dephasing time) measures how long phase coherence in a superposition is maintained. In current superconducting qubit systems, the architecture used by IBM and Google, $T_1$ and $T_2$ are typically 100–500 microseconds.

This is why quantum computers must operate at 10–20 millikelvin, colder than deep space. Thermal energy at room temperature ($k_B T \approx 25\,\text{meV}$ at 300 K) is orders of magnitude larger than the energy splitting between qubit states (typically 5–10 GHz, corresponding to $\sim 0.02\,\text{meV}$). Even a single thermal photon destroys the qubit state. Maintaining 10 mK requires active refrigeration using dilution refrigerators. Their power requirements become central to the energy arithmetic below.

Quantum Error Correction and the Physical Qubit Overhead

The solution to decoherence is quantum error correction (QEC). The idea is to encode one logical qubit in many entangled physical qubits, such that errors on individual physical qubits can be detected and corrected without measuring the logical state.

The most practical QEC scheme for current hardware is the surface code. A distance-$d$ surface code encodes one logical qubit in a 2D array of $\sim 2d^2$ physical qubits. Data qubits are interspersed with ancilla qubits measured periodically to detect errors.

The achievable logical error rate is approximately:

$\epsilon_L \approx \left(\frac{\epsilon_p}{\epsilon_{th}}\right)^{\lfloor(d+1)/2\rfloor}$

where $\epsilon_p$ is the physical gate error rate and $\epsilon_{th} \approx 1\%$ is the surface code threshold, the physical error rate below which increasing $d$ exponentially suppresses logical errors.

To understand the overhead: suppose $\epsilon_p = 10^{-3}$ (current best superconducting qubits) and we need $\epsilon_L = 10^{-15}$ (required for a computation with $\sim 10^{13}$ gates). Solving for $d$:

$10^{-15} \approx \left(\frac{10^{-3}}{10^{-2}}\right)^{(d+1)/2} \implies d \approx 29$

A distance-29 surface code requires $\sim 2 \times 29^2 \approx 1{,}682$ physical qubits per logical qubit under these specific assumptions ($\epsilon_p = 10^{-3}$, $\epsilon_L = 10^{-15}$). Earlier analyses — notably Fowler et al. (2012) and pre-2020 resource estimates — used lower code distances corresponding to less stringent error budgets, producing the round figure of 1,000 physical qubits per logical qubit that appears frequently as a working baseline. The Webber et al. (2022) estimates used in Part IV incorporate their own full surface code analysis and should be treated as authoritative for those scenarios; the 1,000 figure here is a simplified illustration of the overhead concept.

NISQ vs. Fault-Tolerant Quantum Computing

Today’s quantum computers are noisy intermediate-scale quantum (NISQ) devices: 100–10,000 physical qubits, significant gate error rates, no error correction. They are not running Shor’s algorithm on cryptographically relevant key sizes.

Shor’s algorithm requires thousands of logical qubits, each backed by roughly 1,000 error-corrected physical qubits, executing $\sim 10^{13}$ fault-tolerant gates with negligible logical error rates. A 1,000-qubit NISQ device is not threatening Bitcoin. A 10-million-physical-qubit fault-tolerant machine would be. Media coverage of quantum milestones routinely conflates the two.

Part II: The Algorithms

Shor’s Algorithm

Shor’s algorithm, published in 1994, solves two related problems in polynomial time: integer factorisation and the discrete logarithm problem in any group. Both underpin the asymmetric cryptography used in Bitcoin.

The mathematical core is quantum period finding. To factorise $N$: choose random $a < N$ and define $f(x) = a^x \bmod N$. This function is periodic: $f(x + r) = f(x)$ for some period $r$. Finding this period classically takes sub-exponential time for the best known algorithms (GNFS). Shor’s algorithm finds it in polynomial time by:

1. Preparing a superposition of all possible inputs $|x\rangle$
2. Evaluating $f(x)$ coherently using reversible modular exponentiation
3. Applying the Quantum Fourier Transform (QFT) to extract the period $r$ from the interference pattern
4. Using $r$ classically to obtain the factors of $N$

The Elliptic Curve Discrete Logarithm Problem (ECDLP), which is the security basis of ECDSA, reduces to the same period-finding structure in the group of the curve (Proos and Zalka, 2003; Roetteler et al., 2017).

The complexity contrast is stark:

For secp256k1 specifically, Roetteler et al. (2017) estimate the quantum circuit requires approximately 2,330 logical qubits and roughly $5.6 \times 10^9$ Toffoli gates; after the standard 7-T-gate-per-Toffoli decomposition this is $\sim 4 \times 10^{10}$ logical T-gates. Applying error-correction and magic-state-distillation overhead to each logical T-gate (author’s extrapolation) yields an estimated $10^{12}$–$10^{13}$ physical gate operations. At 1 microsecond per gate, naive sequential execution would take months to years. Parallelism, achieved by adding more qubits, compresses wall-clock time at the cost of dramatically increasing qubit count.

What Has Actually Been Demonstrated

The gap between Shor’s algorithm on paper and Shor’s algorithm on real hardware is significant enough to warrant its own accounting.

The first experimental demonstration came in 2001, when Vandersypen et al. at IBM factored the number 15 on a 7-qubit NMR quantum computer. The result was real, but the number was not chosen at random. $N = 15 = 3 \times 5$ was selected because the multiplicative group $\mathbb{Z}_{15}^*$ has a convenient structure: the period used in Shor’s period-finding step turns out to be $r = 2$, which means the quantum Fourier transform collapses to a single-qubit operation. The circuit complexity was minimal by design.

In 2012, Martín-López et al. factored 21 using photonic qubits, and a separate group used NMR to factor 143 = 11 × 13. The photonic experiment used a compiled circuit, meaning the quantum gates were pre-optimised with knowledge of the answer. The 143 factoring also relied on a pre-compiled approach. Neither constitutes a general-purpose run of Shor’s algorithm in the sense that would be required for cryptographic applications.

The pattern across all experimental demonstrations is the same: the number to be factored is chosen because its group structure produces a small period $r$, and the quantum circuit is often compiled with the factors already known. Critics, including Scott Aaronson, have noted that several of these experiments are closer to verifying a known result than to solving an unknown one. A circuit that works for $N = 15$ because $r = 2$ tells you essentially nothing about whether a general Shor’s implementation can factor a 2048-bit RSA modulus, where $r$ can be as large as $N/2$.

In 2023, a group of Chinese researchers (Bao Yan et al.) published a paper claiming to threaten RSA-2048 using a combination of quantum annealing and classical optimisation. This generated significant press coverage. It was not Shor’s algorithm. The approach used QAOA-style variational methods, the quantum hardware involved was an annealer rather than a gate-based machine, and independent analysis showed the method does not scale to cryptographically relevant key sizes.

As of 2026, the largest number factored by a genuine, non-pre-compiled execution of Shor’s algorithm on gate-based hardware remains in the tens. The jump from there to the $2^{256}$-order group of secp256k1 is not incremental. It requires fault-tolerant quantum hardware that does not yet exist at any scale.

Grover’s Algorithm

Grover’s algorithm addresses unstructured search. Given $f:\{0,1\}^n \to \{0,1\}$ with a unique satisfying input $x^*$, find $x^*$. Classical algorithms require $O(2^n)$ queries. Grover’s achieves $O(2^{n/2})$, a quadratic speedup.

Effect on symmetric cryptography and hash functions:

Grover’s threat is mitigable by doubling key and digest lengths. It is a parameter change, not an algorithm replacement. Shor’s algorithm breaks the underlying mathematical assumption of ECDSA entirely. No parameter choice salvages a 256-bit elliptic curve against a sufficiently large fault-tolerant quantum computer.

Part III: What Specifically Is at Risk

ECDSA on secp256k1

Bitcoin’s signature scheme is ECDSA over the secp256k1 curve, defined by:

$y^2 = x^3 + 7 \pmod{p}, \quad p = 2^{256} - 2^{32} - 977$

A private key is a scalar $k \in \mathbb{Z}_n$ chosen uniformly at random. The corresponding public key is:

$Q = kG$

computed by scalar multiplication on the curve through repeated point addition. Security relies on the ECDLP: given $Q$ and $G$, recovering $k$ requires approximately $2^{128}$ group operations classically. Shor’s algorithm reduces this to polynomial time.

Address Vulnerability Taxonomy

Not all Bitcoin addresses face the same quantum exposure. The distinction turns on when, and whether, the public key is revealed.

Pay-to-Public-Key (P2PK) is Bitcoin’s original output format, used by Satoshi Nakamoto and the early miners. The public key is embedded directly in the UTXO locking script, permanently visible on the blockchain. A quantum attacker can extract the private key from these outputs without waiting for any on-chain activity. Approximately 1 million BTC remains locked in P2PK outputs.

Reused P2PKH addresses reveal the public key on first spend. Any UTXO at an address that has previously signed a transaction has an exposed public key recoverable from the blockchain, making it functionally equivalent to P2PK for a quantum attacker.

Fresh P2PKH, P2WPKH, and P2TR store funds as a hash of the public key: $\text{address} = \text{HASH160}(Q)$. The public key is not revealed until the owner creates a spending transaction. These addresses are only vulnerable during the mempool window.

The Mempool Window Problem

When a Bitcoin holder spends from a fresh address, the signed transaction is broadcast to the network and sits publicly in the mempool for approximately 10 minutes before miners include it in a block. During this window the transaction contains $Q$, revealed for the first time.

An attacker watching the mempool must:

1. Observe the transaction and extract $Q$
2. Run Shor’s algorithm to recover $k$ from $Q = kG$
3. Construct a competing transaction redirecting funds to an attacker address
4. Broadcast it with sufficient fee to be mined first

Step 2 is the binding constraint. The quantum computer must solve a 256-bit ECDLP in under 10 minutes. This time constraint drives the most extreme end of the qubit requirement estimates.

Hash Functions Are Not the Problem

SHA-256 and RIPEMD-160 face only Grover’s quadratic speedup. The effective security of SHA-256 against preimage attacks is:

$2^{256} \xrightarrow{\text{Grover}} 2^{128} \text{ quantum operations}$

$2^{128}$ quantum operations is not a near-term concern. Hash-based address security is sound.

Part IV: The Energy Arithmetic

Suppose a working fault-tolerant quantum computer of sufficient scale exists. What does running the attack actually cost?

Layer 1: Qubit Requirements by Attack Window

Webber et al. (2022) provide the most comprehensive published estimates for breaking Bitcoin’s ECDSA specifically, assuming superconducting qubits with physical error rate $\epsilon_p = 10^{-3}$ and gate time $\tau = 1\,\mu\text{s}$, with surface code error correction.

$N_{\text{physical}} \approx \begin{cases} 1.9 \times 10^9 & \text{10 minutes (mempool window)} \\ 3.17 \times 10^8 & \text{1 hour} \\ 1.3 \times 10^7 & \text{1 day} \end{cases}$

The relationship is not linear in time. Compressing the attack from 1 day to 10 minutes requires roughly 150 times more qubits, because additional parallelism substitutes for sequential computation time.

The gap between current hardware and the minimum required for any attack is three to five orders of magnitude.

Layer 2: The Refrigeration Problem

Superconducting qubits operate at 10–20 millikelvin. The Carnot coefficient of performance for refrigerating from $T_h = 300\,\text{K}$ down to $T_c = 0.015\,\text{K}$ is:

$COP_{\text{Carnot}} = \frac{T_c}{T_h - T_c} = \frac{0.015}{300 - 0.015} \approx 5 \times 10^{-5}$

Every joule of heat removed from the 15 mK stage costs at least 20,000 joules to pump out at room temperature, assuming a perfectly efficient refrigerator. Real dilution refrigerators operate far below Carnot efficiency.

Current large-scale dilution refrigerators (Bluefors XLDsl, Oxford Triton series) host tens to low hundreds of physical qubits in today’s systems. The Bluefors XLDsl spec sheet lists up to 1,008 coaxial lines — a line count, not a qubit count; each qubit typically requires multiple dedicated lines. A figure of 1,000 physical qubits per fridge represents an optimistic projection of future dense packaging used here as a working assumption, not a current hardware specification. Electrical power consumption for these systems is approximately 10–25 kW per unit based on published cryogenic system datasheets and vendor documentation; the calculations below use 10 kW (the conservative lower end of that range).

For reference: the total electrical generating capacity of the United Kingdom is approximately 75 GW. The mempool-window attack requires refrigeration infrastructure equivalent to 25% of the UK’s entire grid, before accounting for anything else.

Layer 3: Classical Control Overhead

Each physical qubit requires dedicated room-temperature electronics: microwave signal generators, arbitrary waveform generators, cryogenic amplifiers, digitisers, and real-time classical processors for syndrome decoding.

IBM’s Quantum System Two houses three 133-qubit Heron r1 processors for a total of 399 physical qubits. IBM has not published a precise power draw figure; an estimate of approximately 25 kW total system power circulates in industry sources but is not from IBM’s official specification sheet. Using that figure:

$P_{\text{control}} \approx \frac{25\,\text{kW}}{399\,\text{qubits}} \approx 63\,\text{W per physical qubit}$

This is a lower bound. It assumes linear scaling of control overhead, whereas real systems face increasing complexity in routing, decoding, and inter-fridge coordination.

Layer 4: Total Power and Economics

Combining refrigeration and control:

The energy consumption across all three scenarios is approximately the same at roughly 60–63 GWh. Shorter attacks require more qubits, and more qubits consume proportionally more power. The attack window compresses the time but expands the power draw, leaving total energy nearly constant.

At USD 0.05/kWh industrial electricity rates, the pure energy cost of any quantum attack on a Bitcoin ECDSA key is approximately USD 1.15 million. The near-constant energy (~23 GWh) across all three attack windows is not a coincidence: shorter attacks require more qubits (and thus more power), but over a shorter duration, leaving the product approximately constant. For high-value targets, this is not a prohibitive operating cost. The binding constraint is capital expenditure.

Hardware capital cost:

IBM does not publish per-system prices. An industry estimate of approximately USD 75M per IBM Quantum System Two (399 qubits across three Heron processors) circulates in analyst and procurement discussions; this is not a stated IBM figure. Extrapolating:

$\text{CAPEX}_{1\text{hr}} \approx \frac{3.17 \times 10^8}{399} \times \text{USD 75M} \approx \text{USD 59.6 trillion}$

Using a hypothetical optimistic floor of USD 10M per 399-qubit system (no specific source; assumes aggressive future cost reduction):

$\text{CAPEX}_{\text{optimistic}} \approx \frac{3.17 \times 10^8}{399} \times \text{USD 10M} \approx \text{USD 7.9 trillion}$

Still approximately 8% of global GDP.

Reference comparisons:

The Satoshi exception:

Approximately 1 million BTC sits in P2PK outputs from Satoshi Nakamoto and the early mining era, all with permanently exposed public keys. At USD 100,000 per BTC, this is approximately USD 100 billion.

The electricity cost of a 1-day attack on these outputs is roughly USD 1.15 million. The energy arithmetic is cleared by the target value. The hardware capital cost, roughly USD 7.9 trillion under optimistic assumptions, is not. Notice the asymmetry though: as quantum hardware scales and per-qubit costs fall by orders of magnitude, the electricity cost stays constant while capital cost becomes the variable that changes. There exists a hardware cost threshold below which P2PK attacks become economically rational. It is not inconceivably far from the current trajectory.

Part V: Post-Quantum Cryptographic Alternatives

The question of when quantum hardware will threaten Bitcoin’s cryptography is separate from the question of what to do about it. The latter has a reasonably complete answer today. NIST completed its Post-Quantum Cryptography standardisation process in 2024, publishing three algorithm standards: ML-DSA (FIPS 204), SLH-DSA (FIPS 205), and ML-KEM (FIPS 206).

Lattice-Based Signatures: ML-DSA and FALCON

ML-DSA (formerly CRYSTALS-Dilithium) is built on the hardness of the Module Learning With Errors (MLWE) problem. No polynomial-time quantum algorithm for MLWE is known, and the problem has been studied rigorously since Regev’s foundational 2005 work.

FALCON (Fast Fourier Lattice-based Compact Signatures over NTRU) is a second NIST-standardised scheme, based on NTRU lattices. It produces substantially smaller signatures than ML-DSA but is considerably more difficult to implement correctly.

Size comparison with ECDSA:

$\text{ECDSA-256:} \quad \text{pubkey } 33\text{ B},\quad \text{sig } 64\text{ B}$

$\text{ML-DSA-87:} \quad \text{pubkey } 2{,}592\text{ B},\quad \text{sig } 4{,}595\text{ B} \quad (72\times \text{ larger sig})$

$\text{FALCON-1024:} \quad \text{pubkey } 1{,}793\text{ B},\quad \text{sig } 1{,}280\text{ B} \quad (20\times \text{ larger sig})$

FALCON’s implementation risk is non-trivial. Signing requires sampling from a discrete Gaussian distribution over a lattice, which is subtle to implement in constant time. Side-channel attacks against incorrect FALCON implementations have been demonstrated in published literature. ML-DSA’s signing procedure is simpler and less vulnerable to timing attacks.

Hash-Based Signatures: SLH-DSA

SLH-DSA (formerly SPHINCS+) makes no algebraic assumptions. Security reduces entirely to the collision resistance and pseudorandomness of the underlying hash function. If SHA-256 behaves as a pseudorandom function, with Grover’s speedup factored in, SLH-DSA is secure.

$\text{SLH-DSA-256s:} \quad \text{pubkey } 64\text{ B},\quad \text{sig } 29{,}792\text{ B} \quad (465\times \text{ larger sig})$

The security assumption is maximally conservative. The cost is size: 29,792-byte signatures. Signing requires approximately $2^{17}$ hash function evaluations. On modern hardware this takes milliseconds, but it is orders of magnitude slower than ECDSA.

Full Comparison

Byte sizes are from FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA), and the FALCON round-3 specification. Mcycle figures are from the eBACS (ECRYPT Benchmarking of Cryptographic Systems) benchmarking suite at bench.cr.yp.to, measured on x86-64 with AVX2; exact figures vary by platform and implementation.

The Bitcoin Migration Problem

Bitcoin’s transaction format stores signatures in witness data. A Taproot (P2TR) input costs approximately 57.5 virtual bytes today. Replacing ECDSA with a post-quantum scheme has direct block capacity consequences:

Vbytes computed as total weight units divided by 4, where each input contributes 41 non-witness bytes (× 4 WU each) plus witness bytes (× 1 WU each), with ~20% of the 4M WU block weight reserved for block overhead. ECDSA witness: 1 stack-item varint + 64-byte Schnorr signature. PQC witness: 1 stack-item varint + compact-size length prefix + signature bytes.

FALCON is the only current PQC signature scheme that approaches practical viability for a Bitcoin soft fork. Its 6.4× throughput reduction compares favourably to 21× for ML-DSA or 131× for SLH-DSA. Whether this is acceptable involves tradeoffs in fees, block size, and Layer 2 architecture that extend beyond the cryptographic question.

The migration also surfaces a harder problem than scheme selection: the UTXO set. Approximately 20–25% of Bitcoin’s circulating supply sits at addresses with exposed public keys: P2PK outputs, reused addresses, and custodial wallets. These funds cannot migrate to post-quantum addresses without owner participation. Satoshi Nakamoto’s P2PK coins, by definition, cannot be migrated. They remain permanently exposed.

The Harvest-Now-Decrypt-Later Consideration

For encrypted communications, the quantum threat is already operationally active: an adversary can record ciphertext today and decrypt it once sufficient quantum hardware matures. This is the harvest-now-decrypt-later (HNDL) attack, and it motivates urgent migration of long-lived encrypted channels regardless of when fault-tolerant quantum computers arrive.

ECDSA signatures are not subject to HNDL in the same sense. A signature is verified immediately and reveals nothing confidential. However, P2PK outputs are structurally analogous: the public key is permanently visible on the blockchain, and the computation to extract the private key can be deferred indefinitely. For early Bitcoin outputs with exposed public keys, the window for “decrypting later” is already open.

Conclusion

The quantum threat to Bitcoin is real, bounded, and currently economically irrational for the vast majority of Bitcoin addresses in existence.

The energy arithmetic shows that any quantum attack on ECDSA-256 consumes approximately 23 GWh of electricity, costing roughly USD 1.15 million regardless of the attack window chosen. That cost is not the binding constraint. The binding constraint is hardware: roughly USD 7.9 trillion in capital expenditure under optimistic assumptions for a 1-hour attack. The electricity is affordable. The hardware is not.

The narrow category where the logic begins to close is P2PK outputs: Satoshi-era coins with permanently exposed public keys, representing approximately USD 100 billion at current prices. The electricity cost is cleared by the target value. The hardware capital cost remains the barrier, though it is the variable that scales with technology. The energy cost stays roughly constant.

Post-quantum cryptographic standards are finalised and implementable today. FALCON offers the best tradeoff for Bitcoin’s specific constraints: signatures 20× larger than ECDSA, no known quantum attack, and the most viable path toward a soft-fork migration. The engineering and social coordination required to migrate the UTXO set is more demanding than any cryptographic challenge.

The question is not whether quantum computers will eventually break ECDSA. They will, once hardware reaches sufficient scale. The question is whether the cryptographic migration happens before the economic threshold is crossed. For the addresses that cannot migrate, that threshold is the only thing standing between them and an adversary with the right machine.

Enrico Rubboli is co-founder of Mintlayer.

References

• Webber, M. et al. (2022). “The impact of hardware specifications on reaching quantum advantage in the fault tolerant regime.” AVS Quantum Science, 4, 013801. doi:10.1116/5.0073075
• Fowler, A.G. et al. (2012). “Surface codes: Towards practical large-scale quantum computation.” Physical Review A, 86, 032324. doi:10.1103/PhysRevA.86.032324
• Bernstein, D.J. & Lange, T. (eds.). eBACS: ECRYPT Benchmarking of Cryptographic Systems. bench.cr.yp.to
• Roetteler, M. et al. (2017). “Quantum resource estimates for computing elliptic curve discrete logarithms.” ASIACRYPT 2017, LNCS 10625, pp. 241–270. eprint.iacr.org/2017/598
• Banegas, G. et al. (2021). “Concrete quantum cryptanalysis of binary elliptic curves.” IACR TCHES, 2021(1), pp. 451–472. doi:10.46586/tches.v2021.i1.451-472
• Proos, J. & Zalka, C. (2003). “Shor’s discrete logarithm quantum algorithm for elliptic curves.” Quantum Information and Computation, 3(4), pp. 317–344. arxiv:quant-ph/0301141
• Regev, O. (2005). “On lattices, learning with errors, random linear codes, and cryptography.” STOC 2005, pp. 84–93. arxiv:quant-ph/0510164
• NIST (2024). FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA), FIPS 206 (ML-KEM). csrc.nist.gov
• Bluefors (2024). XLDSL Dilution Refrigerator Measurement System Specifications. bluefors.com
• IBM (2024). IBM Quantum System Two Technical Specifications. ibm.com/quantum