On the day Google's quantum hardware team published its magic-state cultivation results โ a 40x reduction in physical error rate at 99.99% two-qubit fidelity, demonstrated on a 105-qubit Willow-class processor โ Bitcoin printed $81,857, up 1.19% on the session.
Read that again. The most credible external threat to secp256k1 signature security produced a green candle.
Most coverage filed this as a science story with a crypto footnote. That framing is wrong in both directions. The science is real โ a 40x error-rate improvement published in a peer-reviewed venue is not marketing collateral. But the number that matters for Bitcoin is not 40. It is 4,762.
That is the ratio between the roughly 500,000 physical qubits a Shor-class attack on secp256k1 is estimated to require, and the 105 qubits actually sitting in the machine. Every quantum headline since 2013 has been an argument about whether that ratio is shrinking fast enough to matter. This one is no different. What is different โ and what almost nobody priced โ is that the real deadline is not set by Google's roadmap. It is set by a governance process that has not yet produced a single BIP number, and by 2.3 million coins with no one alive who can sign for them.
Tracing the genesis block of market sentiment here requires separating three clocks running at three different speeds.
Bitcoin's security model is a two-layer construction, and nearly every public discussion of "quantum risk" collapses the layers into one.
When you receive bitcoin to a fresh address, the chain stores only HASH160(pubkey) โ a RIPEMD-160 digest of a SHA-256 digest. The full public key stays hidden until you spend. Spending reveals it. So does address reuse. So does any P2PK output, the format Satoshi used through 2010, where the public key was written directly into the locking script from genesis onward.
That distinction determines the entire threat model. Shor's algorithm inverts the elliptic curve discrete log โ public key to private key โ in polynomial time on a sufficiently large fault-tolerant machine. Grover's algorithm attacks hashes, and only quadratically. A 160-bit HASH160 preimage falls from 2^160 to roughly 2^80 under Grover. Still far outside any plausible machine. A 256-bit SHA-256 preimage falls to 2^128.
So the exposed surface is not "Bitcoin." It is a specific subset: coins sitting on reused addresses whose public keys were revealed by a prior spend, coins in P2PK outputs, coins in spent outputs with unspent siblings. Everything else sits behind a hash wall that quantum computing does not meaningfully breach at current or near-current scale.
I have watched this narrative cycle four times. 2013, when a Canadian researcher's paper circulated and the price did nothing. 2017, when the ICO boom turned every existential question into a marketing asset โ that was also the year I audited 40,000-plus lines of Solidity for three early-stage projects and found twelve distinct logical flaws in the Uniswap precursors, forcing emergency pauses on token sales. The lesson from that year was not about reentrancy. It was that projects with flawed architecture failed regardless of how loud the marketing got. 2021, when "quantum-resistant" became a token ticker suffix. 2024, when Willow shipped 105 qubits and the discourse repeated itself verbatim.
Each cycle asks the same three questions and answers none of them: how many qubits, on what timeline, and who decides the migration. The third question is the only one that has never moved an inch.
Here is the part of the Google result the coverage missed. Google did not publish a Bitcoin threat assessment. It published a machine-scale benchmark โ and machine scale is the common denominator that lets you compare a quantum chemistry simulation against an ECDSA break on the same axis.
That is methodologically honest and strategically uncomfortable. It means every improvement in error correction simultaneously lowers the bar for useful quantum computation and for the attack. The two move together. A 40x error-rate reduction is not a Bitcoin-specific development; it is a general-purpose efficiency gain whose cryptographic implications are downstream and unquantified.
So the question is not whether the threat got 40x closer. It is what 40x does to the physical qubit requirement.
The Overhead Constant, Not the Exponent
Fault-tolerant quantum computing spends most of its budget on error correction. In surface-code architectures, logical qubits are assembled from many physical qubits, and the required code distance scales with the physical error rate. Published analyses of magic-state distillation โ the process producing the non-Clifford resource states Shor's algorithm consumes โ have put distillation overhead on the order of 95% of total compute.
Cultivation techniques reduce that overhead. A 40x drop in physical error rate compresses the constant term in the resource equation: fewer physical qubits per logical qubit, less distillation machinery, shorter circuit depth, better effective utilization of what you already built.
It does not change the exponent. And the gap Bitcoin cares about is dominated by the exponent plus the sheer count of logical qubits required to run modular exponentiation over a 256-bit curve.
My own back-of-envelope, with assumptions stated explicitly: if physical qubit counts double every 18 months โ a Moore-adjacent cadence quantum hardware has roughly tracked for a decade โ then closing a 4,762x gap requires log2(4762) โ 12.2 doublings, or about 18 years. That lands near 2043. Compress the cadence to 12 months and you land near 2037. Compress it to 9 months, which is what a genuine engineering breakout looks like, and you are in 2035.
I want to be precise about what this model is and is not. It is a sensitivity test on an assumption, not a forecast. Its value is that it produces a range โ 2035 to 2043 โ that brackets the exact window in which Bitcoin's proposed migration is supposed to complete. A range that overlaps a deadline is a different kind of problem than a number that does not.
The Threat Model Has an Edge
In 2022 I spent three months reverse-engineering Terra's mint-burn mechanism before the collapse became consensus. The lesson I carried out of that exercise was not about algorithmic stablecoins. It was that threat models without explicit boundaries get priced as total losses, and total-loss pricing is almost always wrong. I published a 10,000-word framework on algorithmic fragility and watched the market apply it as panic rather than as structure โ which taught me that the delivery mechanism matters as much as the analysis.
Applied here: the quantum threat to Bitcoin has a hard edge, and the edge is legible on-chain.
P2PK outputs carry the public key in the locking script. Direct Shor target. This is the oldest coin cohort and the largest single concentration of vulnerable value. Reused addresses reveal the pubkey on every spend and leave it exposed indefinitely. Spent outputs with unspent siblings share the same exposure class.
Everything else โ a never-spent P2PKH or P2WPKH address โ is protected by a hash preimage that Grover reduces to 2^80. That is a real reduction and a real long-term concern. It is not a 2035 concern, and anyone who tells you it is has not done the arithmetic.
This is where the forensic lens on the blue-chip provenance trail becomes useful. The vulnerable cohort is not randomly distributed across supply. It is concentrated in the earliest, most blue-chip coins โ the ones with the deepest provenance and the least recoverable key material. Vulnerability and prestige are correlated here, which is exactly backwards from how the market usually prices risk.
30.2% Is a Narrative Artifact
The number that circulated alongside the Google paper was 30.2% of supply โ roughly 6.04 million BTC, about $494 billion at the $81,857 print โ sitting in addresses with publicly visible public keys.
That figure is arithmetically defensible and analytically useless, because it merges two populations with opposite properties.
When I split the cohort against published chain data, the shape was clear:
| Cohort | Size | Property | |---|---|---| | Exposed but live | ~3.74M BTC | Holder can sign a migration transaction | | Exposed and frozen | ~2.3M BTC | No known signer | | Hash-protected | ~70% of supply | Grover-only exposure |
The 3.74 million is a logistics problem. The 2.3 million is a structural one. Logistics problems get solved with tooling and a deadline. Structural problems get solved with governance, or they do not get solved.
There is a methodological caveat worth flagging, because it changes how you should read every downstream headline. The 30.2% figure depends on a classification heuristic โ which outputs count as exposed, how spent-and-reused addresses are bucketed, whether P2PK is treated as one cohort or several. Shift the heuristic by a few percentage points and the dollar figure moves by tens of billions. Data provenance is the input to the narrative, not a neutral observation of it.
The Fee Fear Is Wrong
The most common objection I hear to coordinated migration is that moving 3.74 million BTC would clog the chain and cost a fortune.
I modeled it, in the same way I modeled Curve's 3CRV pool across 10,000 yield-farming iterations back in 2020 โ build the mechanics, stress the parameters, see which assumption actually binds. That model flagged the impermanent-loss trap before the ZRX move, and the reason it worked was not predictive accuracy. It was that it forced every hidden assumption into an explicit parameter.
Assume an average exposed UTXO size of 0.5 BTC, giving roughly 7.5 million UTXOs. Consolidate at 10 inputs per transaction. A P2WPKH input runs about 68 vB, so a 10-in/1-out transaction lands near 722 vB. That is 750,000 transactions, about 541.5 million vB of block space.
At roughly 1 vMB of usable block space per block, that is about 541 blocks of pure consolidation. Around 3.8 days of full blocks, assuming nothing else touches the chain.
At 50 sat/vB, total cost comes to roughly 271 BTC โ about $22 million at current prices. At a 10x stress rate of 500 sat/vB, it is roughly $221 million.
Against a $494 billion exposure, that is 0.0045% to 0.045%. The fee market is not the binding constraint on migration. It never was. Anyone citing congestion as the reason migration is infeasible is describing a problem they have not sized, and sizing is the first thing a real audit does.
The Derivative Stack Nobody Models
Bitcoin's exposed surface is not 6.04 million BTC. It is 6.04 million BTC plus every derivative claim on it.
Wrapped BTC on bridges, threshold-signature custody arrangements, MPC wallets, and any DeFi position collateralized by an asset whose custody chain touches secp256k1 โ all of them inherit the curve. A bridge that validates signatures with ECDSA inherits the same exposure as the base layer, with none of the base layer's governance machinery to fix it. Bridges do not have BIPs. They have upgrade keys and multisigs.
This is the same structural failure I documented in BAYC metadata in 2021, where 15% of the "decentralized" collection pointed at centralized IPFS nodes prone to censorship. The flaw was never in the asset you were looking at. It was in the dependency you had not opened. In 2017 the dependency was an unaudited contract. In 2021 it was a storage pointer. In 2026 it is a signature curve sitting underneath a wrapper that markets itself as infrastructure.
Which is also why the current Layer 2 debate is a distraction. The industry spends enormous energy arguing about data availability layers โ dedicated DA, DA committees, DA-as-a-service โ for rollups that do not produce enough data throughput to saturate a shared availability layer in the first place. Meanwhile the actual inherited risk sits one layer down, in the signature scheme every one of those bridges validates against. The DA conversation is about where to put the receipts. Nobody is auditing what the signature on the receipt is worth in 2040.
The Two Clocks
Published migration research puts a phased post-quantum adoption window at 2026 through 2031 โ roughly five years of coordinated protocol work from a standing start.
The naive quantum arrival window from my own sensitivity model is 2035 to 2043.
Read together, those two ranges say something specific: the migration window closes before the threat arrives, under most assumptions. That is genuinely good news, and it deserves to be stated plainly against the ambient doom.
The bad news is that "under most assumptions" is carrying the entire argument. The migration clock is a governance clock, and governance clocks do not run on schedule. The quantum clock is an engineering clock, and engineering clocks occasionally jump. A moving target is only safe if the thing chasing you moves at a constant speed, and nothing about magic-state cultivation suggests constant speed.
Truth is not found; it is compiled. The compiled state of this question, as of today, is: sufficient buffer, insufficient process.
Here is where the consensus analysis inverts.
The quantum threat to Bitcoin is a probability problem. It has a multi-decade horizon, a defined technical solution โ NIST has standardized multiple post-quantum signature schemes โ and a migration path that has already been scoped. In risk terms, it is well-behaved. It is the kind of problem that gets solved by competent people with a deadline.
The 2.3 million frozen coins are a certainty problem. They exist now. They have no signer. They will still have no signer in 2043. No standard, no roadmap, and no amount of engineering talent resolves them, because the obstacle is not technical.
The disposal trilemma has no clean branch.
Freeze them. Requires a protocol-level rule rendering specific outputs unspendable. That is confiscation by consensus. It establishes a precedent that Bitcoin's supply is not absolutely owned but conditionally owned โ a philosophical break with the property narrative that has driven seventeen years of institutional adoption. The precedent damage almost certainly exceeds the quantum damage it prevents.
Rescue them. Requires deriving private keys from public keys. That is, definitionally, the attack. A rescue mechanism is a master key, and a master key is the single largest centralization event in the network's history, voluntarily executed.
Ignore them. Leaves a permanent liability that grows more acute as quantum capability advances, with no mechanism to resolve it and no entity accountable for it.
Every branch damages something the network claims to be. That is the actual systemic flaw โ not in the cryptography, but in the assumption that a decentralized protocol can resolve a zero-sum distributional question without a decision-maker. The cryptography has a known answer. The distribution has none.
And the +1.19% print is not a rational discount. It is inattention. The market read a quantum paper as a technology headline because the paper was published by Google and not by a threat actor. Narrative risk of this class is systematically underpriced because the threat's time scale โ years โ is orthogonal to the holding period of the marginal price-setter โ days. That mismatch does not resolve gradually. It resolves in a gap.
Three observable signals will tell you when this narrative reprices from background noise into priced risk, and none of them is a press release.
The first is a BIP number. The moment a post-quantum migration proposal enters Bitcoin's formal standardization process, the coordination clock starts publicly and the 2026โ2031 window becomes falsifiable. Until then, every timeline is a blog post with good formatting.
The second is the first exchange publishing a custody policy for post-quantum address migration โ including, explicitly, what it will do with frozen balances it controls. Coinbase's October discussion post listed freeze, rescue, and phased-adoption options and correctly labeled none of them final. That was the opening of a negotiation, not its conclusion, and the market should read it as a signal that no coordinating body currently exists.
The third is the qubit milestone. Ten thousand physical qubits is a headline. One hundred thousand is a repricing event. The gap between those two numbers is where the narrative flips from tail risk to front-page risk, and where 4,762x stops looking like a moat and starts looking like a countdown.
The uncomfortable question is not whether Bitcoin can survive a quantum machine. The technical answer there is yes, and the path is documented. The uncomfortable question is whether a network that cannot yet agree on what to do with 2.3 million ownerless coins can execute a five-year cryptographic migration on a schedule it does not control, against an adversary whose progress it cannot measure in advance.
That is the flaw worth auditing.