Hook
Two hundred million dollars. Three hardware companies. One minority equity stake each. On September 10 the U.S. Commerce Department finalized CHIPS Act funding of up to $100 million per firm for Rigetti, D-Wave, and Quantinuum — and, for the first time, took an ownership position in the companies it funded. The market read a quantum hardware story. I read an invoice.
The invoice is for cryptographic debt. And the most repeated technical detail in the coverage is wrong.
Reporting on the announcement has described Bitcoin's BIP-361 as "a phased migration from ECDSA to Schnorr signatures," framed as a post-quantum defense. Schnorr signatures are not post-quantum. They never were. Both ECDSA and Schnorr sit on the same secp256k1 curve, protected by the same assumption — the difficulty of the elliptic curve discrete logarithm problem. Shor's algorithm breaks both with equal indifference. A migration from ECDSA to Schnorr is an architectural improvement. It is not armor.
That single misread tells you how the entire sector is pricing this.
Context
Bitcoin and Ethereum share a load-bearing assumption: secp256k1. Every address, every signature, every custody arrangement rests on ECDLP being hard. Google Quantum AI's estimate — that attacking 256-bit ECC could require fewer than 1,200 error-corrected qubits — is the number that turned a philosophical threat into a calendar item.
The hardware side now publishes falsifiable roadmaps. IBM has named 2029 for Starling: 200 logical qubits, 100 million operations. Quantinuum, one of the funded firms, targets hundreds of logical qubits on an ion-trap architecture. These are not press releases. They are commitments someone can be held to.
The response on the crypto side has split along governance lines. Ethereum set a hard deadline of December 2029 across execution, consensus, and data layers, with a dedicated post-quantum team. Bitcoin has no deadline, no team, and no single party empowered to promise one. It has BIP-360, proposing post-quantum output types, and BIP-361, restructuring signature handling. Both remain drafts. Neither is deployed.
The U.S. government's move is the accelerant. Offering capital in exchange for equity, under a statute written for semiconductor fabs, signals that quantum capability is now classified as national infrastructure. When a state treats hardware timelines as security policy, the hardware timelines get real.
But hardware progress is not the same as cryptographic migration. Those are two different clocks, and the market keeps reading one while ignoring the other.
Core
Start where the coverage is thinnest: signature economics.
Post-quantum schemes worth taking seriously fall into two families — lattice-based, like CRYSTALS-Dilithium, and hash-based, like SPHINCS+ and Lamport. Both survive Shor. Both are expensive. A Dilithium signature runs on the order of a few thousand bytes; an ECDSA signature is roughly 71. That is not a rounding error. It is a two-order-of-magnitude expansion in block weight per transaction. On Ethereum, that propagates straight into gas, calldata, and the data-availability cost that L2s already fight over. On Bitcoin, it hits the block space cap with the same bluntness.
A chain that moves to post-quantum signatures does not just swap algorithms. It changes its fee market.
Then there is the address problem, and this is where Bitcoin diverges from Ethereum in a way the headline writers will not touch.
Ethereum addresses are hashes of public keys. The public key stays hidden until spend. A hash is not invertible, so the attack surface is narrow — you need the quantum machine at the moment of spend, not before.
Bitcoin is not so clean. Pay-to-Public-Key outputs, and any address reuse, expose the public key permanently on-chain. There are millions of BTC sitting in outputs of this class. Roughly one million of those coins are almost certainly Satoshi's. Their keys have been public since the chain's first blocks.
These addresses are not vulnerable after Q-Day. They are vulnerable now, because an adversary can record the chain today and decrypt later. Harvest now, decrypt later is not a forecast. For exposed-key outputs, it is an ongoing operation.
Which brings up BIP-361, and the part nobody wants to price. If the proposal restricts legacy signatures after a migration window, the coins that never migrate are not protected — they are locked. Possibly forever. That includes the Satoshi stash.
Read that again as a market mechanic. Circulating supply contracts. Scarcity narratives get louder. And the same event, viewed from the property-rights side, is a governance detonation: a protocol imposing permanent exclusion on coins whose owners are silent, absent, or dead.
The code will compile. The politics may not.
Now the two chains' coordination surfaces, because this is the real divide. Ethereum can promise 2029 because a foundation can commit. Whether it can deliver is a separate question — the migration touches every wallet, exchange, custodian, bridge, and DeFi contract. The base layer is the easy part. The long tail is where promises die.
That is where the de facto coordinators appear: exchanges and regulated custodians. No retail holder migrates a wallet unprompted. Real migration rates will be set by a handful of centralized venues and their timelines, not by protocol researchers. Ethereum's deadline is a coordination device, not a delivery guarantee.
Bitcoin has the opposite profile. Its base-layer work is slower to coordinate but cleaner in scope; its long tail is identical in difficulty. The difference is that Bitcoin has no one to blame and no one to deliver. Rough consensus, or nothing.
Contrarian
Here is where the urgency camp earns its keep, and I will not dismiss it.
The reflex on my side of the table is complacency dressed as realism: Q-Day is 2030-plus, logical qubits require thousands of physical qubits each, current hardware is years from threshold. All true. Google's 1,200 error-corrected qubits is a physics estimate, not a shipping date, and the engineering gap between the two is the kind of thing that swallows a decade.
But the bulls arguing for urgency have a sharper point than the complacent crowd admits. The risk does not begin at Q-Day. It begins at the moment an adversary can record. For hidden-pubkey addresses, that moment is the spend. For exposed-pubkey addresses, that moment was 2009. The clock on the second category has been running for seventeen years.
The bulls are not wrong about the threat. They are wrong about the trigger. The threat is not a future event that happens to you. It is a present exposure you have already accumulated and cannot retroactively remove.
I do not trust the audit; I trust the exploit. And the exploit here does not need a quantum computer yet. It needs patience and a database.
There is one more thing the urgency camp gets right that the skeptics miss entirely: the migration window itself is an attack surface, not a sanctuary. While old and new signature schemes coexist, replay risk rises, governance surfaces widen, and any protocol that restricts legacy signatures creates a class of frozen capital that someone will try to seize through fork politics. The transition is when systems are weakest.
Takeaway
The $300 million is small against the $52 billion semiconductor budget. Its weight is symbolic. The real signal is the equity stake — a government deciding that whoever controls quantum hardware controls a piece of national cryptographic infrastructure. That is a policy statement about timelines, and it should be read as one.
The actual fight is not quantum hardware versus cryptography. It is migration speed versus coordination decay. Every block that passes adds DeFi contracts, bridges, and custodial arrangements that must be migrated, each one raising the cost of the next attempt. The longer the procrastination, the smaller the set of coins that can realistically be moved before the window closes.
So the question is not whether quantum computers will break secp256k1 on schedule. The question is who holds the pen when the migration becomes mandatory — and whether the answer includes a million coins whose owner has not spoken in seventeen years.
The transaction is permanent. The mistake does not have to be.
