The $300 Million Signal: Why Bitcoin's Quantum Migration Is Not Post-Quantum

On September 10, the U.S. Department of Commerce finalized a $300 million award under the CHIPS and Science Act. Rigetti, D-Wave, and Quantinuum each receive up to $100 million — and, unusually, the federal government takes a minority equity stake in each. Against the $52 billion the same law authorized for semiconductors, $300 million is a rounding error. The structure is the precedent: Washington has classified quantum hardware as a national asset, and it wants ownership, not grants. Two facts traveled in the coverage of that announcement. Google Quantum AI's estimate that fewer than 1,200 error-corrected qubits could break 256-bit elliptic-curve cryptography. And a Bitcoin improvement proposal, BIP-361, described almost everywhere as a "staged migration from ECDSA to Schnorr signatures." The first is a real change in the threat model. The second is a description that is cryptographically wrong — and that error is the more consequential of the two, because migration decisions will be built on top of it. In the quiet, the protocol reveals its true intent. So let us start with what the code actually assumes. Bitcoin and Ethereum rest on the same floor: secp256k1, a 256-bit elliptic curve. Every signature that moves value on either chain is validated against the hardness of the elliptic curve discrete logarithm problem. Shor's algorithm solves that problem in polynomial time on a sufficiently large fault-tolerant quantum computer. This is not a hypothesis; it is a textbook result, and it means both chains are carrying what is best described as cryptographic debt — an obligation written in 2009 and 2015 that nobody scheduled for repayment. The two chains have chosen different repayment schedules. The Ethereum Foundation has set a hard deadline of December 2029 across the execution, consensus, and data layers, staffed with a dedicated post-quantum team. Bitcoin has no deadline, no owner, and two proposals to argue about: BIP-360, which would introduce a post-quantum output type, and BIP-361, which concerns signature structure. Tracing the code back to the silence of 2017, when I spent three months reverse-engineering the Solidity contracts of an ICO-era liquidity protocol and filed seven integer-overflow reports to a foundation that never replied, I learned to distrust exactly this kind of headline: the one that sounds technically precise and is not. The hardware ledger deserves its own reading. Rigetti works in superconducting circuits. D-Wave builds quantum annealers, a modality with limited relevance to Shor-style factoring. Quantinuum works in trapped ions, targeting hundreds of logical qubits. Google and IBM, notably, received nothing under this award; their programs are privately funded and further along on most roadmap charts. IBM's Starling target — 200 logical qubits and 100 million operations by 2029 — is the number the migration deadlines are effectively racing. The equity stake is the detail worth sitting with. Washington is not subsidizing research here; it is taking a position in the supply chain that produces the threat. That reframes the political economy of quantum hardware: these companies now have a government shareholder with an interest in their commercial success, which in practice means an interest in procurement, defense contracts, and controlled export. A firm with a federal equity holder does not behave like an independent vendor, and that has implications for how, and whether, it engages with civilian cryptography. Here is the problem with BIP-361 as reported. Schnorr signatures entered Bitcoin through BIP-340 and Taproot in 2021. They are more elegant than ECDSA — linear, aggregatable, the foundation of MuSig — but they are built on the same secp256k1 curve and the same ECDLP assumption. A Schnorr signature is not quantum-resistant. It cannot be. A migration from ECDSA to Schnorr is therefore not a post-quantum migration, and presenting it as one invites a category error into the most important cryptographic decision either chain has faced. What is actually required is a new signature family. Lattice-based CRYSTALS-Dilithium. Hash-based SPHINCS+ or Lamport schemes. These are standardized, they work, and they are heavy. Dilithium signatures and public keys run into kilobytes; SPHINCS+ signatures can exceed 17 KB depending on parameter set. Compare that to 64 bytes for Schnorr. Every input verifying a post-quantum signature consumes block space, and block space is the scarcest resource Bitcoin has. The migration is not free. It is a permanent throughput tax, paid in a currency the network has never had enough of. On Ethereum, the same bloat lands on calldata and blob space. Layer two is a promise, not just a layer — and that promise becomes more expensive when every settlement transaction carries a signature twenty times its current size. The rollup economics everyone models today assume ECDSA-sized proofs. Change the signature, and you change the fee market the entire L2 thesis is priced against. This dimension appeared nowhere in the coverage of the CHIPS award. Ethereum's coordination problem is different in kind. Its accounts are hashes of public keys, so migration is not a signature swap but an ecosystem event: exchanges, custodians, wallets, bridges, and every DeFi contract holding user funds must move in a compatible order. The signal here is that the base layer is the easy part. The long tail is where migrations die. Then there is the part Bitcoin cannot design around easily. P2PKH addresses expose only a hash of the public key until spent. P2PK outputs — the original format, used by the earliest coins — expose the full public key permanently. Address reuse does the same. Estimates place millions of BTC in such outputs. Roughly one million of those belong to Satoshi Nakamoto. Against quantum hardware, those coins are not a future risk. They are a standing liability, and an adversary can record those public keys today. Harvest now, decrypt later is usually described as a forward-looking scenario. For exposed keys, the harvesting has been underway for a decade; the chain itself is the archive. In 2021 I worked with a five-person team auditing ERC-721 order-matching implementations at three marketplaces and found an off-chain signature forgery path that could have drained roughly $2 million in assets. The lesson was never that a signature was weak. It was that nobody had asked what the signature actually proved. Authenticity is not minted, it is verified, and Bitcoin is about to run that interrogation at the scale of a million coins that have no owner to answer for them. In 2025 I led a team examining zero-knowledge proofs inside institutional custody for ETF-approved assets and found an implementation flaw in a provider's rollup that quietly compromised the anonymity those proofs were supposed to guarantee. The pattern repeats. The primitive was fine; the deployment was not. Signature migrations will fail the same way, in the seams between standards and shipping. The consensus reading is that this funding accelerates Q-Day and therefore accelerates Bitcoin's exposure. I would frame it differently. The funding accelerates the migration timeline, and the migration itself is the larger hazard. BIP-361 proposes restricting legacy signature types after a migration window closes. If a meaningful fraction of holders do not move, their coins are not merely vulnerable — they are locked, permanently, with no recovery path. That could touch Satoshi's million. A protocol that treats unmigrated property as forfeit has made a governance decision, not a cryptographic one, and there is no precedent for it in Bitcoin's history. The proposal's authors understand this. Much of the coverage does not. A third item sits in the blind spot: the transition window itself. While legacy and post-quantum signatures coexist, the network runs two verification paths in parallel, and parallel cryptographies create transitional attack surfaces — replay, ambiguous validity, and governance manipulation during the changeover. Nobody has modeled that window honestly, because it is not a cryptographic problem. It is an operational one, and operational problems are the ones that get shipped. Two things are also being flattened in the rush to write Q-Day stories. First, the logical-versus-physical qubit gap. Google's 1,200 is error-corrected qubits. Current hardware operates in the tens to low hundreds of physical qubits, with error rates that have not crossed the threshold for scalable correction, and a single reliable logical qubit can require thousands of physical ones. IBM's Starling roadmap targets 200 logical qubits by 2029; Quantinuum, in ion traps, targets hundreds. These are credible programs, not marketing — but they are not a cryptanalytic break either. Q-Day in 2030 may be simultaneously overpriced in urgency and underpriced in difficulty. Both errors are being made at once. Second, the migration burden does not sit on the base layer. It sits in wallets, exchanges, custodians, bridges, and the ETF custody stack. Hundreds of millions of holders will not migrate themselves. They will migrate when Coinbase or Binance moves their balance for them. That makes centralized custodians the de facto coordinators of a supposedly decentralized migration — and the ETF custody layer the most concentrated, slowest-moving, most publicly visible target of all. Every pixel carries a history we must respect, and respectfully migrating fifteen years of address history is an unsolved problem, not a roadmap line. There is a market consequence that has not been priced. Call it a quantum tax: a persistent valuation discount applied to assets whose cryptographic foundation carries an unpriced migration risk. Bitcoin is the more exposed side, because its custody layer is the least coordinated and its oldest coins the most vulnerable. Ethereum absorbs the same tax more gracefully, since its foundation can at least commit to a date — though a missed 2029 deadline would cost it credibility that is hard to rebuild. In a market where leverage is more interesting than lattice assumptions, none of this is on the screen. In the quiet, the protocol reveals its true intent. Bitcoin's intent was never to have a compliance deadline, and the uncomfortable finding of this year is that quantum resistance may require one. The chain with a date and a standing team will ship first. The chain with no owner will argue longest, and the argument will be about who gets to decide what happens to a million silent coins. The window is real. What breaks first may not be the curve.