Hook
IBM announced a quantum milestone. The press ran the familiar headline: Bitcoin's quantum threat inches closer. The market shrugged. In the seven days after the announcement, bitcoin traded in a band roughly coin-flip symmetric around its prior volatility; options implied volatility did not break; no migration to hardware wallets marked the data. That indifference is not a verdict. It is the second data point in a story that was already concluded before the physics was consulted.
Here is the first data point, the one the coverage got right: IBM's claim is real. Their processor did perform a task that a classical machine could not reproduce within a reasonable budget, under a defined verification framework. That matters for materials science, for optimization, for a narrow class of mathematical problems. It does not matter for secp256k1. Shor's algorithm has existed since 1994; the theory has not changed, only the hardware. And the hardware remains orders of magnitude below the threshold required to derive a private key from a public key on Bitcoin's curve.
I have spent sixteen years in this industry, the last six as a crypto security audit partner. In 2017, I audited the 2x2x4 protocol before its mainnet launch, simulating flash-loan attacks in Python; I found a reentrancy path that would have allowed infinite borrowing against under-collateralized positions. In 2022, I traced $8 billion of commingled FTX funds through Alameda addresses while everyone else wrote emotional op-eds. The code does not lie, but it often omits. This IBM story is an omission factory.
The threat underneath the headline is real — but it is not located where the headlines point. The migration deadline is closer, not because of IBM's hardware, but because Bitcoin's governance process has not started.
Context
Bitcoin's security model rests on two cryptographic pillars: SHA-256 and RIPEMD-160 for address synthesis, and the Elliptic Curve Digital Signature Algorithm — ECDSA on the secp256k1 curve — for transaction authorization. The latter is the vulnerable one. Shor's algorithm solves the elliptic-curve discrete logarithm problem in polynomial time. Run it on a sufficiently powerful quantum computer, and a public key surrenders its private key in hours, not centuries.
The catch is the phrase "sufficiently powerful." The resource estimates are well established. For a 256-bit curve, work by Roetteler, Gheorghiu, Mosca and others puts the requirement at roughly 2,300 to 4,000 logical qubits, with on the order of 10¹² Toffoli gates for the discrete-logarithm step. Because each logical qubit must be encoded across hundreds or thousands of physical qubits to correct the errors that plague today's devices, that translates into millions of physical qubits — under realistic surface-code assumptions, tens of millions, and plausibly a decade of runtime.
IBM's current hardware lineage — the Condor processor with its declared 1,121 physical qubits, the Heron variants that followed — does not approach this. The processor count alone is not the bottleneck. The bottleneck is gate fidelity, decoherence time, and the overhead of error correction. A thousand noisy physical qubits do not form a single stable logical qubit of the distance required. The gap between "trusted quantum advantage" and a discrete-log break is not a thin line. It is a chasm measured across four dimensions: logical qubit count, gate fidelity, computation depth, and coherence lifetime.
The more meaningful threshold is the "cryptographically relevant" one — the point at which a quantum machine can factor a 2,048-bit integer or take a discrete log on a 256-bit curve. No credible public roadmap places that threshold before the mid-2030s at the earliest; median estimates cluster in the 2040s. Surveys of the post-quantum cryptography community put the probability of a cryptographically relevant machine by 2035 at between one in thirty and one in ten. That is not zero. That is the actual threat. Security is the absence of assumptions — and the quantum narrative is full of assumptions.
Core — A Systematic Teardown
1. "Trusted" is a verification claim, not a power claim
The first omission in the coverage is the meaning of "trusted." IBM's recent results employ a verification protocol in which the quantum device's output is checked either by an expanded classical simulation or by a cross-validated classical estimate. The word "trusted" refers to this verification layer. It does not mean "beyond classical." It means the result was subjected to a defined process of checking.
The 2019 parallel is instructive. Google claimed "quantum supremacy" on its 53-qubit Sycamore processor, completing a random-circuit sampling task in 200 seconds that their estimate said would take the Summit supercomputer 10,000 years. Within months, Chinese researchers demonstrated an improved classical simulation that ran the same task in minutes on a different architecture. The supremacy claim narrowed, then collapsed under scrutiny.
IBM's claim will face the same gauntlet. The paper, when fully public, will be tested by competing classical algorithms, by competing quantum teams, and by applied cryptographers who have no incentive to see the world panic. After sixteen years of reading protocol post-mortems, my default posture toward any public milestone is: real, incremental, and overstated in import. The market's shrug is rational, but it is rational for the wrong reason. The technology is not fraudulent. The milestone simply does not alter the cryptocurrency attack vector.
2. The qubit math, corrected
The source article repeats a common figure: "millions of logical qubits" required to crack ECDSA. This is wrong — and the error matters, because it flatters the threat.
The correct number is thousands of logical qubits. Roetteler et al. estimated approximately 2,330 logical qubits for a 256-bit elliptic curve. Gidney and Ekerå, in their landmark 2019 paper, showed how to factor a 2,048-bit RSA modulus with roughly 20 million physical qubits and an 8-hour runtime at a 10-microsecond clock cycle. Their estimate remains the best cost model we have.
The operative word is "logical." Each logical qubit requires a surface code at a chosen distance. At distance 20 to 30, each logical qubit consumes 800 to 1,800 physical qubits. Error-corrected logical gates — not raw qubit count — are the binding constraint. The threshold theorem is unforgiving: with current physical error rates, the resource overhead lands in the 10⁷ to 10⁸ range. This is the difference the article's "closer" erases.
IBM's public roadmap projects thousands of physical qubits in the 2026–2028 window. On the current best error-correction models, that yields perhaps half a dozen logical qubits at low distance. Shor's algorithm on secp256k1 requires thousands of logical qubits and a computation depth of 10¹² gates. The distance is not being "inched"; it is being reduced at a pace consistent with decades, barring a fundamental break in error-correction technology.
What the articles omit is that algorithmic compression can cut the gate count. Variational methods, hybrid classical-quantum approaches, and improved fault-tolerant implementations of elliptic-curve arithmetic are in active development. Recent papers have pushed the Toffoli count for elliptic-curve discrete logarithm lower. Compiling the truth from fragmented logs: the log says the distance is shrinking. It says nothing about the rate being fast enough to meet the migration timetable.
3. Bitcoin's actual attack surface, mapped
The second omission is in Bitcoin's covenant structure. Not all address formats are equally exposed.
P2PK outputs — the original Coinbase rewards and early transactions — embed the full 65-byte public key on the chain from creation. Their private keys are the first to fall after the discrete-log threshold is crossed. A meaningful fraction of the early supply still rests in P2PK outputs. Every one of those coins is a pre-recorded target.
P2PKH addresses, the standard format for most of Bitcoin's existence before SegWit, store a 160-bit hash of the public key. The key is not exposed until the address is spent. This is the crucial detail. A quantum adversary of sufficient power can either wait and monitor the mempool for a reveal-and-spend transaction, or attack the hash preimage directly. Grover's algorithm halves the effective security of the hash — from 160 bits to roughly 80 bits — which remains far beyond any quantum machine on any credible roadmap. The practical risk for a P2PKH UTXO is a "spend-and-grab": the moment the owner broadcasts a transaction that reveals the public key in the input script, an adversary with a cryptographically relevant computer can race to derive the private key and rebroadcast a double-spend. In a quantum world, the window between broadcast and confirmation is the only shield.
This creates a migration scissor. Every UTXO spent after the adversary's threshold arrives is a UTXO that can be stolen. Address reuse becomes a compounding liability. If I were asked to audit Bitcoin's quantum exposure using on-chain data, here is the checklist I would run:
- Tally UTXOs locked in P2PK outputs — public keys already visible on the ledger.
- Tally P2PKH UTXOs with prior spend history — public keys revealed at the last spend.
- Identify address-reuse clusters — the same key used across multiple UTXOs multiplies blast radius.
- Examine change-address patterns — many wallets still send change to a derived address in the same batch as a key reveal.
- Estimate the collateral damage from a single compromised key in a multisig or a pooled custody output.
The code does not lie, but it often omits. The ledger has been compiling the target list since 2009. The articles about IBM never open the ledger.
4. Taproot does not solve this. Governance does.
The solution is not a new address format; it is a new signature scheme. Bitcoin needs a post-quantum signature option — candidate designs include Lamport-based one-time signatures, Winternitz one-time signatures, and stateless hash-based schemes like SPHINCS+. This requires activation through a soft fork. Taproot's Schnorr signatures, despite being newer, do not help. Schnorr remains an elliptic-curve signature; the curve is the problem, not the signature algorithm's structure.
In my EigenLayer restaking risk assessment in 2024, I flagged a slashing-condition ambiguity where duplicate signatures across different operator sets could produce unintended penalties. The quantum migration question has the same shape: a single ambiguity in the upgrade path — address format migration, transaction version handling, wallet compatibility — can produce catastrophic outcomes across an entire asset class. Governance, not physics, is the failure mode.
The migration window is not governed by IBM; it is governed by Bitcoin's political consensus process. Bitcoin has an upgrade path. It has executed soft forks under adversarial conditions with Speedy Trial and high activation thresholds. But a post-quantum signature scheme is not a weekend project. It touches every layer of the stack: address generation, key derivation, hardware wallets, multisig scripts, CoinJoin, Lightning channels, PSBTs, and the entire tooling ecosystem.
The blocksize war of 2017 was a battle over a one-megabyte parameter. It split the community for years, produced a competing chain, and consumed political capital for half a decade. A post-quantum migration changes the fundamental signature algebra. It is larger than SegWit. It is larger than Taproot. And it must be executed before an unknown date in the distant future. The genuine timeline is not IBM's roadmap; it is the industry's willingness to begin a decade-long upgrade without a crisis.
Ethereum has already commissioned structured post-quantum research. But Bitcoin has not. No BIP for a quantum-safe signature migration is in active negotiation. No working group has published a threat model that accounts for the harvest-now-decrypt-later strategy. The discussion remains at the level of headlines. That is the real information gap. The article tells you the threat is closer. It does not tell you that the threshold for action is not technical — it is political.
5. The incentive structure of the narrative
Whom does the quantum-threatening narrative serve? Follow the incentives, as I do in every audit.
IBM benefits from a market-positioning signal. A "trusted quantum advantage" claim, even with caveats, competes for research credibility, government funding, and enterprise cloud contracts. A headline that says this "inches closer to breaking Bitcoin" is free advertising.
Media benefits from evergreen anniversary stories. Google in 2019. IBM in 2025. The click curve is steady.
Commentators benefit from engagement. The "quantum threat is coming" story is one of the few narratives that can be endlessly repackaged without new facts.
And the quantum-resistant token ecosystem benefits from every moment of attention. Every alleged quantum threat is a marketing subsidy for projects that have not yet demonstrated a substantiated security claim. In sixteen years of protocol audits, I have seen the same pattern: a security narrative is weaponized to promote a solution before the threat is fully specified.
Let me be precise. The motivation of the actors does not falsify the physics. The argument is not "because IBM benefits, the claim is false." The argument is: because the incentives exist, the claim must be subjected to the same verification standards as a smart contract audit. Demand the appendix. Demand the error bars. Demand the resource estimate.
Contrarian — What the Bulls Got Right
The bulls are not wrong. The quantum threat is a shared infrastructure threat, not a Bitcoin-specific one. A cryptographically relevant quantum computer, if it arrives, will first target TLS certificates, SSH keys, corporate VPNs, national critical infrastructure, and bank payment systems. Bitcoin is a modest target by comparison. The legacy financial system that Bitcoin aspires to replace will already be in chaos when the first discrete log is solved. RSA-2048 is the more likely first victim; it requires similar resources and secures the entire internet.
The bulls are also right that Bitcoin has survived existential scares. The 2022 exchange collapse narrative. The 2017 China ban. The 2011 wipeout, the 2018 drawdown, the ETF approval cycles. None of these changed the supply schedule. The cap remains 21 million. The halving mechanism remains immutable. A quantum paper, even a legitimate one, does not touch those properties.
The bulls' blind spot is the belief that "Bitcoin can upgrade" is an automatic answer. It is not. Taproot took four years from proposal to activation. A post-quantum signature scheme will take longer because the trade-offs are more severe. Lamport signatures produce large signatures. SPHINCS+ signatures can be tens of kilobytes. Bitcoin's block size is 4 million weight units. A single SPHINCS+ signature could consume a significant share of a block's weight budget — a trade-off that changes the economics of block space, fee markets, and Lightning. These are not trivial parameters. They are the core of Bitcoin's social contract.
The second bull blind spot is "harvest now, decrypt later." It costs nothing to snapshot the entire Bitcoin UTXO set and every revealed public key. The adversary does not need to spend now; they need to be capable later. Every coin whose public key is already exposed is a committed target. The ledger is the target list. This is not a 2040 problem. It is a data collection problem that has been running since 2009.
Takeaway
The next time someone writes that quantum computing is "inching closer" to Bitcoin, demand three numbers: the logical qubit count at which Shor breaks secp256k1, the projected year that count is realistically reached, and the quantity of BTC already sitting in exposed-key outputs. Those three figures will do more for the conversation than the headline did.
The real question is not whether IBM's machine is impressive. It is whether the Bitcoin community can start a decade-long governance process before the physics forces it. The market's shrug says the risk is zero, which is a statement about market narrative, not about quantum mechanics. In my audits, the worst failures were not the ones with the loudest warnings; they were the ones with silent prerequisites.
Zero trust is not a policy; it is a geometry. Bitcoin's geometry — the shape of its key-management assumptions, its address formats, its governance process — requires revision before the first logical qubit of the discrete-log threshold is manufactured. The code does not lie, but it often omits. IBM's thesis omits the physical-qubit-to-logical-qubit chasm. The bull case omits the governance failure mode. Compiling the truth from fragmented logs is the only exercise that matters.
The question the source article did not ask, and the one every reader should ask: has the network's threat model changed today? No. Has its migration deadline moved closer? Yes — every milestone makes the deadline real, even if it is decades away. The news is not that the quantum wasp is circling. The news is that Bitcoin is still building the nest, and the wasp has already photographed every entrance.