Bitcoin Is Not Quantum-Proof. It’s Just That It Doesn’t Matter Yet.

And while the community argues about how many bytes fit in an OP_RETURN, the clock is already running.

The most repeated narrative in Bitcoin circles when the quantum topic comes up is some variant of: “experts say it’s decades away” or “there are more pressing issues.” Both claims are technically defensible. Both are also a comfortable way of doing nothing.

The uncomfortable truth is this: Bitcoin today has accidental, partial, post-quantum resistance — and it erodes with every block mined. It is not a designed property. It is a consequence of how the protocol works that will, over time and without intervention, disappear.

Understanding why requires separating three layers that the community tends to conflate: the elliptic curve cryptography that protects signatures, the hashing that protects addresses, and the real-world exposure of public keys on-chain. That is the entire argument.

Why Bitcoin Resists Today — But Not By Design

Bitcoin uses two cryptographic primitives that have radically different quantum vulnerability profiles: digital signatures based on elliptic curve cryptography (ECDSA over secp256k1), and hash functions (SHA-256 and RIPEMD-160) that protect addresses.

Digital signatures rely on ECDSA over the secp256k1 curve. Shor’s algorithm can break elliptic curve cryptography in polynomial time on a sufficiently large, fault-tolerant quantum computer. This is not speculation; it is mathematics established since 1994. Once a quantum computer with ~3,000 logical qubits exists (recent literature estimates between 2,000 and 4,000 logical qubits for ECDSA-256), any exposed public key can have its private key derived.

Addresses, on the other hand, are hashes. A typical Bitcoin address (P2PKH, P2SH, Bech32) is the result of applying SHA-256 and RIPEMD-160 to the public key. Grover’s algorithm can speed up search over hash functions quadratically, effectively reducing SHA-256’s security from 256 bits to 128 classical-equivalent bits. That is still computationally irrelevant for any attacker in the foreseeable future. Grover does not break SHA-256; it weakens it to something that remains perfectly secure.

Bitcoin’s real defense today is this: as long as the public key is not exposed, there is nothing for Shor to attack. In Bitcoin’s UTXO model, the public key is only revealed at the moment of spending. Before that, what the network knows is the hash of the public key. A quantum attacker who cannot see the public key cannot use Shor to derive the private key.

This is real quantum resistance — but it is conditional, and it depends entirely on user behavior and address architecture.

Where That Defense Breaks Down

Three exposure vectors make the current resistance fragile in practice.

The first is address reuse. Every time a spend occurs from an address, the public key is exposed in the transaction signature. If anyone subsequently receives funds at that same address, those funds are protected solely by ECDSA, with the public key already known to the entire network. A sufficiently capable quantum computer could derive the private key and steal those funds. Address reuse is a known problem, widely condemned, and widely practiced. Centralized exchanges, poorly designed wallets, and users who copy and paste “their Bitcoin address” as if it were a bank account number continue to generate this problem at scale.

The second is the confirmation window. When a transaction is broadcast to the network but not yet confirmed, the public key is exposed and the transaction can be replaced (if RBF is enabled), creating a temporal window where a sufficiently fast quantum adversary could sign a competing transaction using the derived private key. This attack requires quantum derivation to be faster than confirmation time, which is not the case today — but it establishes a concrete urgency threshold: when a quantum computer can do this in minutes, the protocol has an immediate problem regardless of address reuse.

The third is the volume of Bitcoin in legacy P2PK outputs. The earliest Bitcoin transactions, including blocks mined by Satoshi, used Pay-to-Public-Key rather than Pay-to-Public-Key-Hash. In P2PK, the public key sits directly in the locking script. There is no hash concealing anything. An estimated 1.7 million BTC remain in P2PK outputs with their public keys fully exposed. Among them, almost certainly, Satoshi’s coins. These are funds that have not moved since Bitcoin’s early years and that a mature quantum computer could drain without depending on any user behavior failure whatsoever.

The Real Timeline: Neither Tomorrow Nor Never

The “decades away” argument deserves to be unpacked because it is frequently imprecise.

What researchers say with more rigor is that quantum computers with practical error correction do not yet exist. IBM, Google, and others measure physical qubits, not logical ones. Quantum error correction requires thousands of physical qubits per useful logical qubit. The gap between what exists today and what is needed to attack ECDSA-256 is genuinely large.

But “large” is not the same as “comfortably manageable.” Bitcoin operates with a security horizon that must be measured in decades, not years. A cryptographic transition at the protocol level, with the degree of distributed consensus that Bitcoin requires, takes years. NIST completed its post-quantum standardization process in 2024 after eight years of work. Implementing any analogous scheme in Bitcoin implies BIP proposals, debate, client implementation, activation via soft fork or hard fork, and gradual adoption. If that process begins when the risk is already imminent, it arrives too late.

The correct framing is not “we have decades.” It is: “the time we have is sufficient only if we start using it now.”

What Needs to Be Hardened and How

The technical community already has clarity on the directions of work. The problem is not lack of knowledge; it is lack of priority.

Post-quantum signatures in the protocol. NIST standardized ML-DSA (formerly CRYSTALS-Dilithium) in 2024 as its primary post-quantum digital signature scheme, and SLH-DSA (SPHINCS+) as a hash-based alternative. Both are candidates to replace ECDSA in Bitcoin. The problem is that Dilithium signatures range from 2,400 to 4,900 bytes depending on security level, compared to ~72 bytes for an ECDSA signature — a 30x to 70x size increase. In terms of block capacity, this would represent a brutal reduction in throughput unless additional tradeoffs are adopted.

Active research exists into more compact schemes. FALCON (also standardized by NIST as FN-DSA) produces signatures of ~690 bytes, which is more tractable, though with significant implementation complexity due to its lattice arithmetic over Gaussian polynomials. The work of designing the optimal scheme for Bitcoin — balancing size, security, and efficient verification — is non-trivial and has not received the attention it deserves in core development channels.

Migration of vulnerable UTXOs. The problem of 1.7 million BTC in P2PK outputs is particularly delicate because some of those funds likely belong to people who lost access to their wallets, and others almost certainly belong to Satoshi himself. Any proposal to confiscate or burn those outputs faces deep philosophical objections about ledger immutability. Yet the alternative of doing nothing and leaving those BTC as spoils for the first sufficiently capable quantum actor is not a neutral position either: it has consequences for price, for the security narrative, and for the system’s legitimacy.

An intermediate proposal that has circulated is setting a forced migration deadline, years in advance with extensive warning, after which P2PK outputs would be considered unspendable. It is controversial. But the conversation needs to happen.

Hash-based address hardening. Taproot (P2TR) uses Schnorr over secp256k1, not ECDSA. That does not make it post-quantum; it remains vulnerable to Shor. But Taproot’s architecture — with its Merkle script tree and the separation between internal and tweaked keys — is more amenable to extension toward hybrid schemes. Academic proposals exist for ECDSA+Dilithium hybrid schemes where both signatures must be valid, requiring an attacker to simultaneously break a classical and a post-quantum algorithm. That incremental transition, which does not require abandoning classical security while adding post-quantum coverage, is probably the most pragmatic path for Bitcoin.

What the Community Should Stop Doing

At the time of writing, a disproportionate fraction of Bitcoin’s technical and political energy is consumed by the debate over the OP_RETURN data limit.

For those unfamiliar with the details: OP_RETURN is an opcode that allows storing arbitrary data in Bitcoin transactions by explicitly marking those outputs as unspendable. The current debate revolves around whether Bitcoin Core should raise or remove the default 83-byte limit on these outputs — whether doing so opens the door to non-financial use of the blockchain that some consider spam and others consider legitimate.

It is a real debate. It is not a trivial debate. It has implications for mempool policy, for the nature of the protocol, and for what counts as valid use of Bitcoin.

But it is also a debate about metadata bytes in an arbitrary data field, while the fundamental cryptographic security of the system has an expiration date that shortens with every advance in quantum computing.

The disproportion is striking. The same forums and repositories that generate hundreds of comments about OP_RETURN have post-quantum discussions that can be counted on one hand.

Bitcoin’s governance is hard by design. Protocol conservatism is a feature, not a bug. But that conservatism only functions as a virtue when the conservative consensus is well-informed and correctly prioritized. Spending technical and political capital on mempool policy disputes while indefinitely deferring the conversation about the most important cryptographic transition in the protocol’s history is a misallocation of the community’s scarce attention.

The Window Is Not Infinite

Bitcoin today holds a reasonable defensive position against the quantum threat. It is not unprotected. But that protection is conditional, partial, and not guaranteed over time.

The condition is correct user behavior: not reusing addresses, using modern script types, avoiding unnecessary public key exposure. Many users do not meet that condition, and many historical UTXOs fail it by design.

The partiality comes from the fact that legacy P2PK outputs and already-exposed keys have no defense. They are vulnerable right now to any sufficiently capable quantum adversary, and the only variable is when that adversary exists, not whether it does.

The lack of guarantee over time stems from the protocol having no defined path toward post-quantum signatures yet. There is no BIP in advanced stages. There is no technical consensus on which scheme to use. There is no institutional urgency within core development.

Quantum computing will not arrive on an obvious, announced day. It will come incrementally — with each hardware iteration, each improvement in error correction, each academic paper extending the boundary of what is attackable. The moment when an attacker can use Shor against ECDSA-256 practically may not be publicly known until after the first attack has already occurred.

Bitcoin survived Mt. Gox, the block size wars, its creator’s silence, adversarial regulation across multiple jurisdictions, and market cycles that destroyed the vast majority of its contemporaries. It has the resilience of a system no one fully controls.

But none of those threats attacked the cryptography on which ownership of every satoshi rests. This one does.

The community has time. But it has exactly enough time to start now — and not a year from now.

@benjacusu