The immediate target is signatures, not mining

Bitcoin currently relies on elliptic-curve cryptography for transaction signatures, including ECDSA and Schnorr.

Classical computers cannot practically reverse a public key into its corresponding private key.

A sufficiently capable fault-tolerant quantum computer running Shor's algorithm could theoretically change that.

The most direct consequence would be the ability to forge signatures for coins whose public keys are exposed.

That is different from suddenly breaking SHA-256 proof-of-work in the same way. Bitcoin's signature system is the principal migration problem.

Bitcoin exposure is uneven

Not every Bitcoin output reveals a public key immediately.

Some address formats keep the public key behind a hash until a spend takes place. Early Pay-to-PubKey outputs expose it directly, while reused addresses and previously spent outputs can also reveal public keys.

Draft BIP-361 estimates that more than 34% of bitcoin has already exposed a public key on-chain.

That does not mean one third of all bitcoin can be stolen today.

No publicly known quantum computer is remotely capable of carrying out the required attack at practical scale.

The hard part is migrating an entire ecosystem

Bitcoin cannot force every holder to update a wallet overnight.

A new signature scheme first has to be researched, reviewed, implemented and accepted at the protocol level.

Wallet software, hardware signers, exchanges and institutional custody systems then need to support it.

Only after that can users begin moving potentially millions of UTXOs into quantum-resistant outputs.

That is why participants at the Stanford workshop focused less on guessing the date of a future Q-Day and more on having a tested migration process ready before the date matters.

There is no perfect Bitcoin post-quantum signature yet

Post-quantum signature algorithms already exist.

Bitcoin's problem is making them practical inside a blockchain with limited block space.

A Schnorr signature is roughly 64 bytes. Standard post-quantum signatures can be measured in kilobytes.

That difference directly affects how many transactions fit inside a block and how much users may need to pay for them.

Blockstream illustrates the tradeoff with a roughly 2,420-byte standardized post-quantum signature versus its experimental SHRINCS construction at about 324 bytes in a stateful mode.

Smaller does not automatically mean chosen. Security assumptions, implementation complexity and recovery behavior all need to be considered.

BIP-361 proposes a deadline for legacy signatures

One of the more aggressive migration proposals is draft BIP-361.

It assumes Bitcoin first gains a post-quantum output type.

A later phase would stop users from sending new funds into quantum-vulnerable legacy outputs, creating pressure for wallets and services to migrate.

Another phase would eventually tighten rules around legacy ECDSA and Schnorr spending.

The proposal is still a draft. It is not an activated Bitcoin rule and no network-wide deadline currently exists.

Unmoved coins create the hardest governance problem

A migration works cleanly when the original owner still controls the keys and can move the coins.

Bitcoin also contains old lost wallets, dormant holdings and early outputs whose owners may never return.

If those public keys remain vulnerable after a future quantum breakthrough, the network faces uncomfortable choices.

It could allow them to remain spendable and risk quantum theft, freeze them after a deadline, or try to create a recovery mechanism that can distinguish historical ownership from an attacker who can forge the old signature.

That is not only a cryptographic decision.

Making old coins unspendable can be described as network defense or as protocol-level confiscation depending on which side of the debate someone takes.

Satoshi's early coins expose the edge case

Many early Bitcoin rewards were paid to Pay-to-PubKey outputs where the public key is permanently visible.

Some of those coins are associated with Satoshi-era mining.

Modern wallet-recovery proposals can sometimes use a seed or hierarchical derivation path to prove historical ownership without relying on a broken elliptic-curve signature.

Bitcoin's earliest wallets predate BIP-32 deterministic seeds.

That means a recovery system that works for a modern hardware wallet cannot automatically rescue a 2009 wallet.

Hardware wallets have to survive the migration too

Hardware-wallet experts were included in the Stanford session for a practical reason.

Post-quantum signatures can require larger keys, more memory and more computation than current Bitcoin signatures.

A technically elegant protocol upgrade is not useful if common signing devices cannot perform it securely or require every holder to replace existing hardware.

Institutional custodians face the same issue at much larger scale, where multisignature policies and billions of dollars may need to migrate without interrupting normal operations.

Some of the cryptography is already being tested on Liquid

Blockstream Research moved part of the problem out of the paper stage in March 2026.

It demonstrated post-quantum-signed transactions on Liquid using its Simplicity smart-contract system.

Liquid provides a production environment where new signing techniques can be tested without immediately changing Bitcoin mainnet consensus.

Blockstream is also developing OP_CHECKSHRINCS as a possible Bitcoin opcode for hash-based post-quantum signature verification.

Neither project constitutes an activated post-quantum upgrade for Bitcoin itself.

Migration will probably happen in stages

The Stanford workshop did not attempt to choose one final algorithm.

Participants explicitly discussed a phased transition because post-quantum cryptography is still improving.

Bitcoin could introduce initial protections, support overlapping mechanisms during migration and preserve the option to adopt stronger or more efficient schemes later.

That is messier than a single clean replacement.

It may also be safer than locking the network into a cryptographic choice decades before anyone knows exactly what practical quantum hardware will look like.

Nobody is saying Bitcoin is about to break tomorrow

Coinbase explicitly describes quantum computing as a long-term risk rather than an immediate crisis.

Today's machines are orders of magnitude short of what would be required to attack Bitcoin's keys.

The urgency comes from the migration timeline rather than the attack timeline.

A decentralized network, millions of wallets and years of dormant funds take a long time to move.

Bitcoin has not chosen its post-quantum future yet. The important development is that its ecosystem is beginning to prepare for the logistics of choosing one before the choice becomes an emergency.