On September 10, the U.S. Department of Commerce took equity in three quantum hardware companies. Rigetti. D-Wave. Quantinuum. The cheque was small by sovereign standards โ roughly $300 million against a defense budget measured in trillions. The wires were routed through the same legislative plumbing that funds semiconductor fabrication. The market read it as a science funding story and moved on within a session.
It is not a science funding story. It is a ledger event.
Here is the part the press release buried under the phrase "fault-tolerant quantum systems." One of those three companies, D-Wave, builds quantum annealers. Annealers do not run Shor's algorithm. They cannot factor the integers that underpin secp256k1. They are optimization machines. Useful for portfolio rebalancing and logistics routing. Useless for breaking elliptic curve cryptography. If you are pricing quantum risk into BTC or ETH tonight, and you just bid up a basket of "quantum stocks" because the Commerce Department did, you have bought the wrong instrument. You have bought noise. You have, in the most literal sense, provided exit liquidity to someone who read the architectural footnote you skipped.
I spent years pricing options on volatility surfaces most people never see. The first rule of that desk is simple. The market does not price the event. It prices the expected time to the event. Get the clock wrong by five years and every hedge you build is a donation.
The clock here is wrong. And the mislabelling runs deeper than the ticker symbols. Somewhere in the current discourse, Schnorr signatures are being sold as a quantum defence. They are not. When the code bleeds, the ledger keeps the truth โ and right now the ledger is telling a story that almost nobody in this market is reading correctly.
The Threat Model Nobody Actually Wrote Down
Start with the mechanics, because the narrative has detached from them entirely.
Bitcoin and Ethereum both secure ownership through elliptic curve digital signatures. Bitcoin primarily uses ECDSA over secp256k1. Ethereum uses ECDSA as well, with an evolving landscape around account abstraction and alternative signature schemes. Both rest on the same hardness assumption: the elliptic curve discrete logarithm problem. Given a public key, recovering the private key is computationally infeasible with classical hardware.
Shor's algorithm collapses that assumption. Not partially. Not probabilistically. It solves the discrete log problem in polynomial time on a sufficiently large fault-tolerant quantum computer. The operative words are "sufficiently large" and "fault-tolerant," and I will return to both, because those two adjectives are where the entire timeline argument lives and dies.
Now the part that gets skipped in every thread I read.
Public key exposure is the attack surface. Not the address.
A Bitcoin address is not a public key. In the standard Pay-to-Public-Key-Hash model, the address is a hash of the public key. Hashing is not broken by Shor's algorithm. Grover's algorithm gives a quadratic speedup on brute-force search, which sounds threatening until you do the arithmetic: a 256-bit hash with a quadratic speedup still requires something like 2^128 operations. That is not a practical attack. It is a physics exercise.
So the naive reading is that Bitcoin is safe โ the address is hashed, the hash is quantum-resistant, done.
That reading fails the moment you look at when the public key actually appears on the ledger.
The public key is revealed when you spend. Redemption script. Signature. Broadcast. From the instant that transaction is in the mempool, the public key is public. If a quantum adversary existed with the capability to run Shor's at scale, the attack window is the interval between broadcast and confirmation โ seconds to minutes โ during which the key is exposed and the transaction is not yet final. That is a real but tight window, and it is a mining-race problem more than a cryptography problem.
The far more dangerous category is different. It is the set of outputs whose public keys are already exposed and have been for years. Early Pay-to-Public-Key outputs. Pre-2010 coinbases. Addresses that reuse keys. Anything that has ever signed.
The canonical case is the most famous one. The early mining rewards attributed to Bitcoin's pseudonymous creator are, by the consensus of on-chain analysts, held in Pay-to-Public-Key outputs. That means the public keys have been visible on the ledger since the earliest blocks. There is no hash shield. There is no reveal window. There is simply an exposed key sitting on a public database, waiting for a machine that can invert the curve.
The rough figure cited across the ecosystem is in the range of a million BTC in these exposed-key categories. I will not pretend the number is precisely known โ the estimation methods vary, and different analysts classify differently. But the order of magnitude is not seriously disputed, and the structural point is not disputed at all: a meaningful pool of supply has no cryptographic shield beyond the difficulty of the underlying problem itself.
When I audited the BZRX lending logic in 2019, before mainnet, I found a reentrancy path that every reviewer before me had walked past. The finding earned me five ETH and a permanent habit. The habit is this: stop reading the claim, start reading the state. The claim was that the contract was safe. The state said otherwise. Ninety-nine percent of the quantum conversation in this market is claim-reading. The state is sitting in the UTXO set, fully visible, and it is not what the narrative says it is.
The Hardware Ledger: Reading Qubit Numbers Like an Options Book
The quantum hardware companies are the ones you have to underwrite with the same skepticism you apply to a token with a beautiful whitepaper and an unaudited treasury.
Start with architecture, because architecture determines whether a machine is even relevant to the threat.
There are two broad families. Gate-based universal quantum computers, built from qubits that can be entangled and manipulated through logical gates โ IBM, Google, Quantinuum, Rigetti. And quantum annealers, which solve optimization problems by evolving a physical system toward a low-energy state โ D-Wave's core business.
Shor's algorithm requires a gate-based machine. It requires millions of physical qubits to reach something in the range of a few thousand logical qubits, depending on whose error-correction model you accept, and those logical qubits need to be stable enough to run a deep circuit without decoherence wiping the result.
Annealing does not get you there. An annealer is not a universal computer. It cannot implement the circuit that Shor's algorithm describes. This is not a subtle distinction. It is the difference between a machine that can break your keys and a machine that can optimize a delivery route.
So when I see the Commerce Department take equity in three companies and the market treats all three as equivalent quantum-threat exposure, I see a pricing error. Two of the three, Rigetti and Quantinuum, sit in the gate-based lineage where the cryptography threat actually lives. One, D-Wave, does not. If you cannot articulate that difference, you should not be trading the sector.
The progress data is similarly mangled. The widely circulated figure for Google's achievement is something under 1,200 logical qubits โ and even that framing gets misread. Projections and estimates get republished as demonstrated results. Roadmaps get read as delivered hardware. IBM's 2029 delivery target for its fault-tolerant Starling system is a target, not a tape-out.
Here is the discipline that matters. On an options desk, you never price a strike off a press release. You price it off the term structure of realized volatility. For quantum, the realized volatility equivalent is the count of stable, error-corrected logical qubits actually executing non-trivial circuits. Not physical qubits. Not estimated logical qubits. Not roadmap slides.
Physical qubit counts have been climbing for a decade and mean almost nothing for cryptography, because physical qubits are noisy. The bottleneck is error correction. You need many physical qubits to build one reliable logical qubit โ ratios in the hundreds-to-one territory depending on the hardware modality and the error rate. So the number that matters is the one almost nobody publishes, because almost nobody has it.
That asymmetry is the entire trade. The public has a number that sounds scary. The practitioners have a number that sounds slow. The gap between those two numbers is the mispricing.
The Schnorr Misdirection
Now the technical error that bothers me more than any price.
There is a recurring claim in circulation, dressed up with proposal numbers and merge-adjacent language, that Bitcoin's migration toward Schnorr signatures constitutes a quantum-defence path. The implication is that moving from ECDSA to Schnorr is a step toward post-quantum security.
It is not. It is not close to being. And the confusion is dangerous precisely because it is plausible-sounding.
Schnorr signatures in Bitcoin are defined over the same curve as ECDSA. Same secp256k1. Same underlying discrete logarithm problem. Same vulnerability to Shor's algorithm. The switch to Schnorr buys you signature aggregation, smaller multi-signature constructions, improved privacy through key aggregation, and cleaner threshold schemes. Those are real and valuable properties. None of them are quantum resistance.
A quantum adversary running Shor's algorithm does not care whether the signature is ECDSA or Schnorr. Both reduce to extracting a private scalar from a public point on an elliptic curve. The algorithm is agnostic to the encoding format of the signature. You have changed the packaging. You have not changed the lock.
Post-quantum signature schemes live in an entirely different mathematical universe. Lattice-based constructions such as those standardized in the NIST process, hash-based signatures, and other candidates that do not reduce to discrete logarithms or integer factorization. Replacing secp256k1 with a lattice-based scheme is a quantum migration. Renaming the signature algorithm while keeping secp256k1 is not.
I flagged a similar category of error in a lending protocol once โ a check that looked like a guard but validated a stale variable. It passed review, passed test, passed a fork simulation, and would have failed in production. The failure mode was not a bug in the code. It was a bug in the reading of the code. This Schnorr mislabel is the same species of error at protocol scale. It creates a false sense of progress. False safety is worse than acknowledged danger, because acknowledged danger gets funded and fixed, and false safety gets a press release.
There is a second layer to this. Proposal numbering is not a proof of content. BIP-360 and BIP-361 circulate with different descriptions depending on who is summarizing, and the summaries have drifted from the technical substance. If you are making allocation decisions based on a two-line description of a Bitcoin Improvement Proposal, you are trading a headline. That is a strategy with a negative expected value and a very fast half-life.
Bitcoin's Real Problem Is Not the Math. It Is the Meta.
Assume, for the sake of argument, that a clean post-quantum signature scheme exists and is audited. Assume the cryptography is solved. Bitcoin still has a harder problem, and it is not on the cryptography layer.
Bitcoin has no coordinating authority. That is the design. It is also the constraint.
The migration path runs through the BIP process, which means rough consensus among developers, miners, node operators, exchanges, custodians, and an enormous population of passive holders. There is no deadline. There is no foundation with a mandate. There is no vote that terminates debate. There is a mailing list, a set of reference implementations, and a social process that has historically taken years to settle questions far less consequential than this one.
And this question is the most consequential one Bitcoin has ever faced, because it collides directly with the property-rights absolutism that defines the culture.
The proposals that circulate involve phasing out or restricting legacy signature types after a migration window. On its face, that is a rational defensive measure: if old signature schemes remain valid, an adversary equipped with a quantum computer can still forge them, so the network must eventually refuse them. A gradual deprecation is the obvious engineering answer.
But the engineering answer and the governance answer are not the same answer, and in Bitcoin, the governance answer always wins in the end.
Because restricting legacy signatures means making certain coins unspendable. Not by theft. By consensus rule. And the coins most likely to be affected are the ones whose owners are not around to migrate: lost keys, abandoned wallets, and the single largest category of exposed-key supply in the entire ledger.
That is not a technical decision. That is a referendum on whether dormant coins are property or a public liability. Bitcoin has never answered that question, because it has never had to. A quantum migration forces the answer.
Every governance structure has a delegation problem, and Bitcoin's is worse than most people admit. The formal process is open. The practical process converges on a handful of developers and a handful of pools, because everyone else is too busy or too uninformed to review a cryptographic proposal line by line. That is delegation by default, and delegation by default centralizes. The DAO world learned this the expensive way, and the pattern is not limited to token-voting systems. Bitcoin just does it with code review instead of token voting, and the resulting concentration is harder to see because there is no dashboard for it.
So the honest read is this. The cryptography is the easy part. The meta is the hard part. And the meta does not move on a 2029 schedule because nobody set one.
Ethereum's 2029 Deadline and the Coordination Tax
Ethereum has the opposite problem. It has coordination capability and suffers for it.
The Ethereum ecosystem has a coordinating body, dedicated research capacity, and an internal deadline for post-quantum readiness set near the end of 2029. On paper, that is a structural advantage. A system that can decide things can execute things. Bitcoin cannot decide things quickly, so Bitcoin cannot execute things quickly.
But Ethereum's architecture makes the execution exponentially more expensive.
Start with the account model. Ethereum's externally owned accounts sign with ECDSA. Migrating them means migrating users. Not a protocol upgrade. Users. Millions of them, each of whom must move assets to a new address format or upgrade a wallet, each of whom must understand why, each of whom will do it late, badly, or not at all.
Then layer on the contract surface. Ethereum is not just a signature ledger. It is a general-purpose execution environment, and inside that environment sits an enormous body of deployed contract logic that validates signatures. Multisigs. Gnosis Safe-style vaults. Bridge contracts. Threshold schemes. Account abstraction implementations. Each one embeds assumptions about signature formats. Each one is immutable or upgrade-gated in its own idiosyncratic way. Each one becomes a migration dependency.
And then the DeFi stack. Lending markets, automated market makers, liquid staking derivatives, perpetual exchanges. The migration touches their authentication paths, their oracle interactions, their governance mechanisms. I have written before that the interest rate models in the major lending markets are administrative constants dressed up as market discovery โ curves set by governance, not by continuous discovery of the cost of capital. That is a flaw in normal conditions. During a migration, it becomes a compounding liability, because the parameters that clear the market are maintained by the same governance layer that now has to coordinate a signature overhaul. When Aave's rate curve can be changed by a vote, the curve is an opinion. When a signature scheme must be changed by a vote, the signature scheme is also an opinion, and opinions take time to converge.
The Ethereum Foundation's involvement is worth reading precisely, not sentimentally. A foundation with a stated deadline, research budget, and influence over the upgrade pipeline has the capability to move the ecosystem. It also concentrates the decision. Foundations publish their holdings. Their treasury addresses are traceable. Their contributors are known. That transparency is a feature of legitimacy and a liability in adversarial conditions, and it means the migration is not purely a technical project โ it is a political project with a visible center of gravity.
Here is the coordination tax, stated plainly. Bitcoin will be slow because nobody is in charge. Ethereum will be fast and messy because somebody is. Neither is cheap. The difference is who gets blamed when the migration economy revalues.
The Dormant Coin Black Swan
The line item I would put at the top of a risk memo is the one nobody is trading.
There is a large quantity of supply that has not moved in years, some of it in exposed-key formats from the earliest era. If the engineering community proceeds with a legacy-signature deprecation, that supply becomes functionally unspendable unless its owners come forward with signatures. Some of those owners cannot. Some are presumed to have died, discarded hardware, or simply lost interest. Some may hold keys they cannot access for reasons entirely mundane.
I have seen a version of this before, at a much smaller scale. In 2022, when the Terra ecosystem unwound and took a large fraction of my book with it, the casualty was not the price. The casualty was the assumption of liquidity. Positions that looked portable were not portable. Exits that looked available were not available. The lesson I took was structural: the danger is never the headline drawdown. It is the part of your balance sheet that turns out to be illiquid exactly when you need to move.
A deprecation of legacy signatures is that lesson at the protocol level. The supply is on the ledger. The spendability is conditional. And the condition is a consensus rule that may or may not be adopted.
If deprecation is adopted, the bull case is mechanical. A meaningful tranche of supply exits circulation permanently. Scarcity tightens. The bear case is legitimacy. Bitcoin's central claim is credible neutrality and absolute property rights. A rule that makes coins unspendable is a rule that decides property outcomes, and the community has split over far smaller questions. The 2017 block size conflict produced a permanent fork and a rival asset. There is no reason to believe a deprecation of legacy signatures would be less contentious, and every reason to believe it would be more.
The market is not pricing this. Look at the term structure of almost any BTC instrument and you will find nothing resembling a governance-risk premium. The options surface does not carry a tail for coordination failure. That is not because the risk is small. It is because the risk is unmodelled, and unmodelled risks do not get priced until they get realized.
The Contrarian Read: Retail Is Pricing the Wrong Variable
Here is the divergence, stated in the terms I actually use when I am sizing positions.
Retail is pricing the event. Quantum computers break Bitcoin. Headline. Panic. Buy or sell.
That is the wrong variable. The event is not the risk. The time to the event is the risk, and the capacity to respond before the event is the second-order risk.
Run the numbers honestly. Breaking secp256k1 requires a fault-tolerant, gate-based quantum computer with thousands of stable logical qubits running deep circuits. The current state of the art, across every credible vendor, is orders of magnitude away. The bottleneck is error correction, and error correction is a materials and engineering problem with no guaranteed slope. Reasonable people disagree about whether that gap closes in a decade or three. Nobody credible thinks it closes this year.
So on a one-to-three-year horizon, the probability of a practical elliptic-curve break is low. On a five-to-fifteen-year horizon, it is not low, and it is rising. That is not a trade. That is a slow-motion solvency question with an enormous execution window.
Where the market is genuinely wrong is in the middle term. The consensus behaves as though the migration can be done reactively, at the moment of need. That is false for structural reasons. A signature migration in a system this large takes years of specification, implementation, testing, wallet coordination, exchange coordination, and social consensus. You cannot start it when the qubit count gets scary, because by then you are already late.
So the asymmetry is this. Short term, quantum risk is overpriced. Long term, migration preparation is underpriced. The correct exposure is not a directional bet on BTC or ETH. It is exposure to the tooling layer that has to exist before the migration can happen, and the reality is that almost nobody in this market can name three credible projects in that layer.
There is a second thing the consensus gets wrong. It treats this as a Bitcoin problem or an Ethereum problem. It is neither. It is a problem for the entire settlement substrate of digital assets. If a major L1's signature layer degrades in credibility, the shock travels instantly into bridges, custodians, exchanges, stablecoin issuers, and every protocol that references the chain's security in a marketing deck. The dependency graph is fully connected and almost nobody has mapped it.
I learned the shape of this during the Bored Ape mint war in 2021, running a three-developer operation with paid RPC nodes while thousands of others competed for the same blocks. We secured twelve mints and exited within 48 hours. The edge was not taste. The edge was infrastructure. The same is true here. When the migration becomes urgent, the winners will be the teams that already built, already tested, and already shipped. Everyone else will be paying for speed at the worst possible moment.
Where the Actual Exposure Sits
Let me lay out the transmission chain, because the second-order effects are where the mispricing lives.
The origin is upstream: quantum hardware, funded by sovereign capital, with equities available to public markets. The middle is the signature layer โ the code that converts ownership into an unforgeable authorization. The downstream is everything a user touches: wallets, exchanges, custodians, DeFi protocols, bridges, indexers, RPC providers.
The upstream is where the policy catalysts land. Sovereign equity stakes in quantum vendors are the closest thing to a scheduled volatility event in the sector, and they will keep coming.
The middle is where the engineering risk sits, and it is the least tradable layer because it is not a business. It is an upgrade path.
The downstream is where the pain will be real and underestimated. Wallets are the bottleneck nobody models. A protocol upgrade can be shipped by a small team. Getting millions of users to migrate their wallet software, verify new address formats, and move assets requires tooling, incentives, education, and trust โ the last of which is the scarcest resource in crypto.
Exchanges add another layer. Centralized exchanges hold enormous client balances. If signature formats change, every deposit path, every withdrawal path, every internal accounting assumption about address ownership has to be revalidated. That work requires centralized coordination among entities that compete with each other. There is no reason to expect it to be fast.
And there is a market structure consequence I want to be explicit about. Arbitrage is just violence disguised as math. Whenever a migration creates a temporary divergence in what is spendable, what is accepted, and what is trusted, there will be a window where the mispricing is enormous and the participants are few. Those windows do not last. They get closed by the first well-capitalized team with the right infrastructure. If you want to capture that, you need to be building now, while the spread is theoretical.
What I Am Watching, and What I Would Do
I do not trade narratives. I trade measurable state. So here is the state I measure.
First, logical qubit counts as reported by gate-based vendors, specifically error-corrected qubits running non-trivial circuits. Not physical qubits. Not projections. Not roadmaps. If a vendor reports stable logical qubits in the hundreds, that is a genuine regime change and the entire timeline argument reprices. Until then, treat the announcements as marketing with a technical vocabulary.
Second, the deprecation proposals. Watch the discussion lists, not the summaries. What matters is whether any proposal moves from discussion into a formal activation path, and whether the legacy-signature restriction survives review. If it does, the governance conflict becomes the dominant variable, and the split risk becomes real.
Third, Ethereum's research output. A devnet running post-quantum signatures is a genuine milestone. A blog post describing a plan is not. The distinction between a plan and a working test network is the entire difference between coordination capability and coordination aspiration.
Fourth, and this is the one that would move everything, activity from early-era exposed-key addresses. If a long-dormant coinbase output from the first year of the chain ever signs, the market will not ask who did it. It will ask whether the key was migrated or extracted, and in the absence of information, the second narrative will win the first hour of trading. That is a black box in the most literal sense โ an input everyone can see and nobody can explain, and the price will move before the explanation arrives.
Fifth, the standardization pipeline. Post-quantum standards are being set by a specific national body, and that means the migration path for every chain will inherit a set of assumptions chosen outside the crypto ecosystem. That is a dependency worth tracking, because standards are where technical defaults become institutional gravity.
The position I would take is not a directional bet on the two largest assets. It is a structural bet that the migration tooling layer becomes a real market, and that the teams building audited post-quantum signature implementations, migration utilities, and new address standards will be the ones with pricing power when urgency arrives. That window is open now. It closes the moment the urgency is obvious.
And on a personal note, from the desk where I actually sit. I shorted a collapsing ecosystem in 2022 while the rest of the market panicked, and I did it because I had already written down what would happen to liquidity before it happened. That is the only edge that survives. Not conviction. Preparation.
The quantum threat to Bitcoin and Ethereum is real, slow, and badly modelled on both ends of the timeline. The short-term panic is noise. The long-term coordination failure is not. Somewhere between those two errors, an entire market is looking at the wrong number on the wrong clock, confident that the code will save it. Arbitrage is just violence disguised as math, and the arbitrage here is between what the ledger can prove today and what the narrative promises in five years.
When the code bleeds, the ledger keeps the truth. The question is whether anyone will be reading it when the first signature fails.