On September 10, the U.S. Department of Commerce finalized CHIPS and Science Act awards worth up to $100 million each to three quantum hardware companies — Rigetti Computing, D-Wave Quantum, and Quantinuum — and took minority equity stakes in all three. The headline figure across the package is roughly $300 million.
Ignore the $300 million. Against the $52 billion semiconductor envelope created by the same statute, it is a rounding error. The number that deserves your attention is 1,200.
That is Google Quantum AI's published estimate for the number of error-corrected qubits required to break 256-bit elliptic curve cryptography. Bitcoin and Ethereum both sign with secp256k1. Both derive spending authority from a single hardness assumption: the elliptic curve discrete logarithm problem. Both are, in the strict sense, one algorithm away from a terminal event.
The funding did not change that arithmetic. It changed the calendar. The calendar is the only part of this story that is genuinely tradable.
Context
The three recipients represent three different bets on how to build a quantum computer. Rigetti pursues superconducting circuits. D-Wave builds annealing machines — a design well suited to optimization problems and largely unsuited to the structured arithmetic Shor's algorithm demands. Quantinuum, tied to Honeywell, builds trapped-ion systems and has publicly targeted hundreds of logical qubits.
Two entities that did not receive this round of funding are arguably further along. IBM's Starling roadmap commits to 200 logical qubits and 100 million operations by 2029. Google Quantum AI produced the 1,200-qubit estimate in the first place.
So the award list is informative in a negative direction. Follow the money only when it tells you something the engineers did not. Here it told us about procurement posture, not physics. A government taking equity in quantum hardware firms is a government that has internally ranked cryptographic collapse above venture return. That is a national-security ranking, not an industrial-policy one.
Against that, the two chains have published very different commitments.
Ethereum has a dedicated post-quantum team inside the Ethereum Foundation and has set a December 2029 deadline spanning three layers: execution, consensus, and data. It is top-down, dated, and therefore falsifiable. If the Foundation misses 2029, that miss becomes a public credibility event.
Bitcoin has no equivalent. Work is accelerating — BIP-360 proposes a post-quantum output type, BIP-361 sketches a phased migration away from ECDSA — but no entity can commit Bitcoin to a date. There is no project manager for a protocol with no owner.
That asymmetry is the entire story. Everything else is hardware.
The signature replacing ECDSA is not post-quantum
Start with the most consequential misreading in circulation. BIP-361 is widely described as a staged migration from ECDSA to Schnorr signatures. Read that as a quantum defense and you have already lost the argument.
Schnorr signatures, standardized for Bitcoin in BIP-340, are constructed on the same secp256k1 curve as ECDSA. They inherit the identical hardness assumption. A sufficiently large fault-tolerant quantum computer running Shor's algorithm breaks Schnorr exactly as efficiently as it breaks ECDSA. There is no quantum resistance in that migration whatsoever.
Code does not lie; people do — and the code here says something narrower and more interesting. The ECDSA-to-Schnorr migration is structural preparation. It enables Taproot-era key aggregation, signature batching, and the script flexibility a later post-quantum output type would need to plug into. It is plumbing. It is not armor.
I have seen this failure mode before, at smaller scale. In late 2019, finishing my master's thesis, I spent two months reverse-engineering early Uniswap v2 contracts, applying graph theory to token flow to hunt for arbitrage surfaces. What I found was an edge case in the price oracle logic that could be manipulated under high volatility — a sandwich surface the documentation implicitly assumed away. The lesson was not that the code was careless. The lesson was that documentation and mechanism diverge, and mechanism always wins. A changelog calling something a security upgrade does not make it one. You have to read the curve.
Real post-quantum migration means importing an entirely new signature family. Lattice-based CRYSTALS-Dilithium. Hash-based SPHINCS+. Lamport one-time signatures. These are not drop-in replacements, and the reason is size.
The cost dimension nobody has priced
Every one of those schemes carries signature and public-key payloads substantially larger than ECDSA's 64-byte signature and 33-byte compressed key. Dilithium public keys run past a kilobyte. Several hash-based constructions are larger still. Verification costs rise alongside.
This is not an abstract engineering footnote. It is a fee-market event.
Bitcoin's block space is the scarcest resource in the system and it is priced in a blind auction. Inflate the witness data of every spend and you inflate the marginal cost of every transaction competing for the same block. Ethereum's cost structure transmits differently — through calldata and blob pricing — but the direction is the same, and the second-order effects land squarely on rollup data-availability budgets, which is to say on L2 economics that are already thin.
In the summer of 2020 I built a Python scraper to track LP inflows across Compound and Aave, hunting a statistical arbitrage in sETH yield rates that persisted for roughly 72 hours. It paid. But what stuck with me was how fast a real, measurable discrepancy got arbitraged into nothing once enough capital noticed. Capacity constraints get priced. Post-quantum signature bloat is a capacity constraint. Alpha hides in the margins, and this margin is unpriced precisely because the migration has not shipped yet.
Follow the gas, not the hype. Post-quantum migration is, before anything else, a gas story.
Ethereum's own roadmap documents acknowledge that the ecosystem migration workload — wallets, custodians, bridges, DeFi contracts, exchanges — likely dwarfs the base-layer change. That is not a technical problem. It is a coordination problem, and coordination problems do not resolve on deadlines.
Exposure geometry: which coins are actually vulnerable today
Not all Bitcoin outputs are equally exposed. A P2PKH address publishes only the hash of a public key; the key itself is revealed at the moment of spending. An address that has never spent remains, in a narrow sense, quantum-latent.
Not so for P2PK outputs and any address that has been reused. Those published their public keys to the chain permanently. An attacker with a sufficiently capable machine does not need to wait for the owner to move. The key material is already public record.
Now scale it. Millions of BTC sit in public-key-exposed outputs. Roughly one million of those coins are attributed to Satoshi Nakamoto's early mining.
This means the quantum threat is not a single future event. Harvest now, decrypt later is already in progress. Anyone with a chain indexer and patience is accumulating exactly the data a future machine would need. For exposed addresses, the risk window opened years ago. It closes only when those coins move to a post-quantum output — and for Satoshi's coins, they cannot move.
The lock-up risk and the deflation trap
Here the analysis gets genuinely uncomfortable, and here BIP-361 stops being a technical upgrade.
BIP-361 contemplates restricting legacy signature types after a migration period. The stated intent is to force stragglers off vulnerable cryptography. The consequence, for anyone who does not migrate in time, is that their coins become unspendable. Permanently.
Strip out the cryptography and state it plainly: a protocol change could lock hundreds of thousands — plausibly millions — of BTC out of circulation, including the Satoshi stash.
The reflexive market read is deflationary. Fewer spendable coins, equal or greater demand, higher price per unit. I have watched enough supply-side narratives get priced and then re-priced to distrust that reflex. Data doesn't flinch at a clean number — it asks who is allowed to spend it.
The honest read is a governance disaster wearing a bullish costume. A change that extinguishes property rights over the most famous coins in the system attacks Bitcoin's founding claim: that holdings are unconfiscatable. It also likely forks the chain. A minority that rejects the restriction keeps the old signature rules. You get two Bitcoins, two claims on the same history, and years of noise about which one is real.
Ethereum has a structurally easier version of this problem, for an unglamorous reason. Account addresses there are hashes of public keys, and contract accounts can be upgraded in logic. Migration is still a coordination nightmare, but it is rarely an extinction event for a specific holding.
Logical qubits are not physical qubits
One more deflation of the fear. The 1,200 figure is denominated in error-corrected qubits. Error-corrected qubits are not physical qubits, and the gap between them is not a factor of two. Realizing one high-quality logical qubit typically requires thousands of physical qubits under current error-correction schemes. Public hardware remains in the tens-to-low-hundreds physical qubit range, with error rates that have not crossed the practical correction threshold.
Read carefully, this cuts both ways. It means Q-Day is not imminent, which argues against panic. It also means the engineering distance is enormous, which argues against assuming the hardware side is the slow lane. The honest position is that the 2029 dates on both roadmaps are planning artifacts, not forecasts. Anyone presenting them as either a certainty or a joke is selling something.
Institutional custody is the concentrated failure point
One of my 2024 projects was an attribution analysis on spot Bitcoin ETF flow data for a Geneva-based fund. Reported daily inflows and on-chain exchange reserves did not reconcile. Coins were moving to cold storage faster than the headline numbers implied, and correlating that divergence against whale wallet behavior gave us a short-term supply-shock trade ahead of a 12 percent move. The technique was reconciliation. The boring kind.
Apply the same lens here and the picture is uncomfortable. Spot ETF vehicles and large custodians hold enormous, publicly identifiable, slowly-governed balances. Their decision chains run through compliance, legal, and vendor procurement. They are the least nimble holders in the system and the most attractive targets. If migration depends on voluntary action, the entities holding the most and moving the slowest are exactly the ones you would bet against.
There is a mirror-image problem on the infrastructure side. Exchanges, custodians, and wallets must all support new address and output types before users can migrate to them. In practice, migration rate will be set by five or six large venues, not by the protocol.
Contrarian: the framing is wrong in both halves
The consensus framing is that $300 million accelerates a quantum arms race, and that crypto must therefore race to migrate before Q-Day. Both halves deserve resistance.
Funding is not capability. Three hundred million dollars against a $52 billion semiconductor program is a symbolic allocation. The binding constraint on quantum hardware is not capital. It is materials, fab capacity, cryogenics, and the brutal engineering of error correction — all of which private capital and hyperscaler R&D budgets already address at larger scale. What the government stake buys is procurement optionality and a defense-lab pipeline. It does not buy a qubit.
The second half is worse. That framing treats the quantum threat as the primary risk to Bitcoin and Ethereum. I do not think it is, on any horizon shorter than a decade. The near-term risk is self-inflicted: a controversial signature restriction, a fork, locked coins, and years of governance litigation over assets nobody can move.
And the third-order effect nobody has flagged. A quantum-resistant narrative sector is forming. Post-quantum L1s, PQ wallets, PQ-themed tokens. Some of it is real engineering. Much of it is a token wrapper on a whitepaper. The people most eager to tell you the quantum clock is running out are often the ones selling the clock.
Takeaway
Watch four signals. Quantinuum's published logical qubit count — the fastest-moving honest metric in the sector. IBM's Starling deliveries against the 2029 target of 200 logical qubits and 100 million operations. The BIP-361 comment period, specifically any language restricting legacy signature validity and the resulting disposition of unmigrated coins. And whether the largest custodians and exchanges publicly commit to supporting post-quantum output types before Ethereum's December 2029 window opens.
If Ethereum misses that deadline, the miss will be more informative than any quantum milestone.
The question worth holding is not whether a quantum computer will eventually break secp256k1. It is whether, when the migration finally lands, the community can execute it without confiscating a single coin it never intended to touch.