Quantum Threat

Published on X, 31 March 2026. Original post.

My take on Quantum Computing & Bitcoin: The Real Data and Why a Network-Level Attack Is Not Reasonable or Feasible.

Most quantum-Bitcoin headlines scream “Bitcoin is doomed!” That’s mostly fear-mongering noise. Google’s March 2026 whitepaper added updated numbers. Here’s the full picture in plain English. Core reality: Bitcoin’s network properties make a large-scale quantum attack or shutdown not reasonable and practically impossible. The limited risk is targeted theft from wallets with already-exposed public keys. Meanwhile, traditional centralized systems (banks, brokers, SMS 2FA, BACS, SWIFT, payment rails) would likely be the first and far more vulnerable targets — making the heavy focus on Bitcoin a pointless distraction.

1. The Quantum Threat Numbers (Shor’s Algorithm)

Bitcoin uses secp256k1 elliptic curve math to protect private keys. Shor’s algorithm on a quantum computer could theoretically derive the private key from a visible public key.

Thread baseline (2017 arXiv): Needed 10–20 million physical qubits (2,330 logical qubits × 4,000–8,000 error-correction overhead) for a one-day break.

Google Quantum AI March 2026 update: Optimized circuits now require ≤1,200 logical qubits + 90M Toffoli gates or ≤1,450 logical qubits + 70M Toffoli gates. Realistic hardware: well under 500,000 physical qubits (some models 100k–300k). Fast scenarios: 9–23 minutes to crack an exposed key.

Google’s own deadline: Internal post-quantum migration moved to 2029.

Plain meaning: Quantum progress is real and faster than many expected, but today’s machines (Google Willow ~105 qubits) are still noisy and far from fault-tolerant. A practical, large-scale threat is still years away.

Vulnerable supply: 5.9–7 million BTC (20–35% of supply). The thread correctly notes effective risk is already down to ~10% thanks to:

• 70–80% of transactions using P2SH/SegWit (delays public key exposure),
• address reuse below 5%,
• many legacy coins inactive,
• 20–25% in multisig or cold storage.

Fresh non-reused SegWit/Taproot addresses stay much safer until spent. Hard lattice problems (SVP, CVP, LWE, SIS) remain NP-hard in high dimensions with exponential search space. No efficient quantum solver threatens NIST standardized parameters after the 2024 Yilei Chen bug. Grover’s quadratic speedup on SHA-256 has limited practical impact due to error correction and Bitcoin’s rules.

2. NIST PQC Standards and Signature Options

NIST’s multi-year process delivered usable standards in 2024:

• FIPS 204 – ML-DSA (Dilithium): Efficient lattice-based primary (~2–4 KB signatures).
• FIPS 205 – SLH-DSA (SPHINCS+): Stateless hash-based conservative backup (~8–17 KB, optimizable) that relies only on proven hash functions.

Hash-based schemes (SPHINCS+ stateless, XMSS stateful with WOTS+/Merkle trees, Lamport one-time) depend solely on hash preimage/collision resistance — aligning with Bitcoin’s SHA-256 philosophy. Lattice-based (Dilithium primary, Falcon compact) offer efficiency but use new math assumptions (LWE/SIS linked to worst-case SVP/CVP). Larger signatures can affect block throughput, but optimizations and soft forks help. NIST recommends starting migration planning by ~2030, with stronger deprecation after 2035 in many contexts.

3. Energy, Logistics, Materials & Economic Barriers

Thread’s 10–20M qubit baseline: 50–100 MW sustained power (2.3–4.7 GWh per attack), 10–20 tons niobium (3–7% of global annual supply), 100–200 dilution refrigerators ($1–2M each). Hardware ~$10.5–22B; full attack cost $64–142B. Google 2026 reductions bring hardware to ~$5–20B, but real systems still need hundreds of MW to GW for impact. Bitcoin uses ~150–200 TWh/year; global 2035 electricity demand ~25,000 TWh. Sustained high-power quantum operations would be logistically very difficult.

Economic reality: Gains at $1M/BTC (Santostasi power law, R²=0.95) look large (~$590B mitigated), but success would crash price, blacklist coins, and cause panic — destroying most value.

4. Game Theory: Attacker vs Community Incentives

Attacker side: Massive upfront costs ($50–140B+), scarce materials, energy demands, and geographic concentration. Even if successful, the attack tanks Bitcoin’s price and makes stolen coins worthless or blacklisted. Rational attackers see strongly negative ROI plus geopolitical risks. “Harvest now, decrypt later” is cheaper but still faces network countermeasures.

Community side: Miners, holders, node runners, and developers all benefit from Bitcoin staying secure — their wealth depends on it. Incentives align toward defense: honest nodes reject bad blocks, developers propose soft forks, users migrate coins. Decentralization means no single point of failure.

What this means: Game theory heavily favors defense. Attackers bear all the risk and cost; the community protects a shared high-value asset.

5. Reality Check: Traditional Finance Would Be Hit First

Here’s the important point many headlines ignore: Centralized traditional systems would be the first and far more vulnerable targets. Banks, brokers, stock exchanges, SMS 2FA, BACS, SWIFT, payment processors, and government databases all rely heavily on the same vulnerable cryptography (RSA, ECC) but lack Bitcoin’s decentralization. They have single points of failure, centralized databases, and much easier targets for “harvest now, decrypt later” attacks. A quantum breakthrough would likely cause chaos in traditional finance long before it meaningfully affects Bitcoin’s decentralized network. Focusing primarily on Bitcoin while ignoring these far more fragile centralized systems is a classic fear-mongering tactic. Bitcoin’s design (global nodes, soft forks, aligned incentives) actually gives it a structural advantage in a post-quantum world compared to traditional infrastructure.

6. Bitcoin’s Network Properties and Upgrades

• Global node distribution: >25,000 reachable nodes worldwide — invalid changes get rejected fast.
• Decentralized hashrate & difficulty adjustment: Recalibrates every ~2 weeks.
• Soft-fork adaptability: Proven with SegWit and Taproot.

BIP 360 (Pay-to-Merkle-Root / P2MR): Merged February 2026. New output type removes vulnerable key-path spending and commits only to a Merkle root. BTQ Technologies deployed the first working implementation on Bitcoin Quantum testnet v0.3.0 (March 2026).

Hardware: SEALSQ QS7001 secure element reached production samples in March 2026 and supports NIST post-quantum algorithms for cold wallets. Chaincode Labs outlines a dual-track path: short-term contingency soft forks if needed, and 7-year optimal migration. Soft-fork costs remain modest ($2.4–8.4M over 7–10 days per thread).

7. What This Actually Means for You and the Bitcoin Community

• Network-level attack or shutdown is not reasonable: Global nodes, difficulty adjustment, energy/logistics walls, materials, economics, and game theory make it practically impossible — even with 2026 qubit reductions and Google’s 2029 deadline.
• Your coins: Stop address reuse. Use multisig and cold storage. Move high-value holdings to fresh modern addresses when practical. Effective risk is already ~10%.
• Traditional finance is the bigger near-term concern: Banks and centralized systems will likely feel quantum pressure first. Bitcoin’s decentralization gives it a real advantage here.
• Bitcoin is adapting: BIP 360 testnet work and NIST standards (Dilithium primary, SPHINCS+ hash backup) provide clear tools. The community is taking measured steps.