An exchange publishing a blog post about post-quantum cryptography is not news. An exchange publishing one that carefully says quantum computers threaten "the signature systems used to authorize transactions" โ the word signature, not encryption โ is something else entirely. That phrasing implies somebody inside that organization has already completed a threat taxonomy. They distinguished elliptic curve discrete logarithms from hash functions. Public affairs departments do not make that distinction. Engineers do.
The substantive claim floating through market commentary last week came from Coinbase, which framed quantum risk as a long-horizon concern and pointed toward BIP-360 โ a draft proposal to introduce a new output type built on post-quantum signature schemes. No activation date. No consensus rule. No merged code. The proposal sits in the review stage, which is the lowest maturity tier a Bitcoin change can occupy and still be discussed in public. Everything else circulating โ timelines, migration percentages, quantum-readiness scores โ was inference layered on top of a two-paragraph statement.
What follows is an audit of the actual gap, not of the announcement.
The Threat Model Everyone Gets Wrong
Bitcoin's existing signature infrastructure rests on ECDSA for legacy outputs and Schnorr for Taproot. Both depend on the hardness of the elliptic curve discrete logarithm problem. A cryptographically relevant quantum computer running Shor's algorithm collapses that assumption entirely. This much is uncontroversial.
What is controversial is which coins are actually exposed, and here the public discussion has been sloppy in a way that systematically understates the problem.
A pay-to-public-key-hash output does not reveal its public key until the moment it is spent. A pay-to-taproot output hides the key inside a commitment. For these coins, a holder could theoretically upgrade to a quantum-resistant output type without ever exposing material an adversary could attack. The migration path exists. It is expensive. It is not impossible.
Now consider pay-to-public-key outputs โ the format used in Bitcoin's earliest mining era. The public key sits in the output script itself, permanently, in plaintext, on every node's disk. It has been there since 2009 and 2010. No upgrade changes that. The exposure is already complete. An adversary with a future quantum machine does not need real-time computational advantage to attack these coins. They need a copy of the chain and patience โ a record-now-forge-later strategy. The public keys are already recorded.
This is the single most consequential technical detail in the entire debate, and it is routinely compressed into a subordinate clause about "older unspent outputs." The quantity of value sitting in that exposure class is non-trivial, and it includes coins whose owners are dead, coins whose keys are lost, and coins held by entities who have no operational capability to participate in any migration whatsoever.
BIP-360 in its current form is opt-in. That is the correct design choice for a voluntary network, and it is also the design choice that guarantees the most vulnerable coins receive no protection at all. Opt-in security cannot reach holders who are not present.
The Inequality That Actually Matters
Listen to the framing long enough and you will hear the argument: quantum computers are not here yet, so there is time. This is true and it is irrelevant, because the variable that determines risk is not threat arrival. It is the difference between threat arrival and migration completion.
Bitcoin's change cycle operates in years. SegWit took roughly four years from proposal to reliable network adoption. Taproot took a comparable arc. Both were voluntary, both had obvious user-facing benefits, and both still required years of coordination among node operators, wallet vendors, mining pools, and exchanges. Post-quantum migration is strictly harder than either. It touches consensus, wallet derivation paths, hardware security module firmware, and the MuSig2 signature stack that Lightning channels depend on for their 2-of-2 constructions.
That last dependency deserves more attention than it receives. Lightning channels are not individually upgradeable. Both peers in a channel must support the same signature scheme, or the channel does not function. Introducing a quantum-resistant scheme into Lightning creates a compatibility partition โ old channels on one side, new channels on the other โ and channels are long-lived financial instruments that cannot be force-migrated without closing them. The layer-two complexity here exceeds the layer-one complexity, which is the opposite of how this problem is usually described.
Then there is hardware. A soft fork defines new rules. It does not upgrade the secure element inside a Ledger or a Coldcard. Hardware security certifications run on twelve to twenty-four month cycles, and device vendors have their own firmware release cadences, their own supply chains, and their own commercial incentives. If the dominant hardware vendors do not support a new address type, users cannot self-custody under it, and the migration stays theoretical. Hardware manufacturers are de facto veto holders in this process, and they are not in the room where the proposal is being discussed.
The Cryptography Allocates Its Own Risk
Here is the contrarian edge, and I want to be precise about it because it cuts against the prevailing narrative that BIP-360 represents prudent preparation.
NIST standardized post-quantum signature schemes are large. ML-DSA signatures run in the low thousands of bytes. SLH-DSA signatures range from eight to fifty kilobytes depending on parameter set. Schnorr signatures are sixty-four bytes. We are discussing a signature size increase of two to three orders of magnitude.
Bitcoin's block size limit does not move. Signatures occupy block space. Therefore a shift to post-quantum signatures constitutes an implicit tax on on-chain settlement โ every transaction costs more block space for identical economic function. This is a real cost borne by real users, and it arrives to defend against a threat that has not materialized. Nobody upgrading gains throughput. Nobody upgrading gains functionality. The entire expenditure is against a tail risk.
Bitcoin has never successfully shipped a change with that incentive profile. Every major protocol upgrade in its history carried a user-visible benefit โ cheaper transactions, better privacy, new scripting capability. Post-quantum migration carries none. It is pure expenditure. Expecting a voluntary, rough-consensus network to execute a pure-expenditure change on schedule is an assumption I have watched fail in every audit environment I have worked in.
There is a second-order cryptographic risk too, one that gets almost no airtime. Post-quantum schemes are young. The 2022โ2024 standardization process saw candidate algorithms fall to classical cryptanalysis โ Rainbow was broken outright, SIKE was demolished on a laptop. Locking a dominant network into a specific signature family in the late 2020s means betting that family survives a decade of adversarial attention from every cryptanalyst on Earth. If it does not, you have migrated from one assumption to a cheaper one and bought yourself another decade of debt.
The Only Signal Worth Watching
Here is what I would track, based on years of watching protocol governance fail and succeed. Not research papers. Not quantum hardware announcements, which produce one-day price noise and no structural change. The signal that matters is a regulated custodian or an ETF's qualified custodian formally requiring quantum-resistant address support from a protocol team. That event converts this from a discussion into an engineering ticket with a deadline attached. Compliance pressure through custody requirements has moved this industry faster than any community debate ever has, and the federal post-quantum migration timelines now landing on government contractors will reach crypto custodians by transmission, not by choice.
But notice what that acceleration does not solve. A custodian can require quantum-resistant addresses tomorrow, and the P2PK coins from 2010 will remain exactly as exposed as they were before, because their owners are not present to opt in. The industry will complete its migration and leave the most fragile segment of the supply untouched, and the debate over what to do with those coins โ freeze, burn, force-migrate, or accept โ will be the genuinely difficult governance question of the decade.
Code does not care about your vision. And the coins mined before anyone thought to hide a public key are not waiting for a roadmap.