The number that should stop you is not $300 million. It is 1,200.
That is Google Quantum AI's estimate of the error-corrected — logical — qubits required to break a 256-bit elliptic curve key in polynomial time. Bitcoin signs with secp256k1. So does Ethereum. Same curve. Same hardness assumption. Same exposure. Neither chain has run a single post-quantum signature on mainnet, and neither is close.
On September 10, the U.S. Department of Commerce finalized CHIPS and Science Act awards of up to $100 million each to Rigetti, D-Wave, and Quantinuum. In exchange, the government took minority equity stakes. That structure is the anomaly. Not the dollars.
$300 million against a $52 billion semiconductor program is a rounding error. Washington does not buy equity in a science fair. It buys a position. A position implies a horizon. And the horizon is the exact variable the crypto market refuses to price.
I have audited this space since the 2017 ICO cycle. I have watched a hundred narratives rotate through their hype curves. The quantum narrative is different in one specific way: it is the only threat where the asset you hold cannot be moved after you realize you are wrong. Everything else in crypto is a pricing error. This is a physics error. Let me walk you through the chain of evidence, then show you where the actual risk sits — because it is not the quantum computer.
The grant is a bet. Read it like one.
The CHIPS award is being covered as an industrial-policy story. It is a threat-model story. Governments do not fund quantum hardware because they want faster computers. They fund it because they want to be first to break someone else's cryptography, and they want to be first to defend their own. The National Security Agency has a list of algorithms it considers quantum-safe. The Commerce Department just wrote a check that buys it positions in three of the hardware routes that could get there.
What is unusual — genuinely unprecedented — is the equity. CHIPS money was designed for fabs and manufacturing capacity. Applying it to quantum computing and taking a stake is a new instrument. It fuses industrial policy with national security and turns the companies involved into quasi-strategic assets. That has consequences nobody is discussing. A quantum hardware company with the U.S. government on its cap table is not a normal company. Its decisions about who it serves, who it exports to, and who it shares compute with are no longer purely commercial. If you are a crypto protocol wondering whether you can rent quantum cycles for testing, understand the answer is now filtered through a government equity holder.
Here is the part the press release wants you to miss. Quantinuum, the trapped-ion player, has a stated target of hundreds of logical qubits. IBM's Starling roadmap targets 200 logical qubits and 100 million operations by 2029. Google is the source of the 1,200-qubit figure itself. None of the three funded companies is the leader. The money went to the second tier, which tells you the government is not buying the winner — it is buying optionality across multiple physics routes: superconducting, annealing, and trapped ion. That is what a hedge looks like when you do not know which technology wins.
So the $300 million is not a signal that quantum is imminent. It is a signal that the state has stopped treating quantum as academic and started treating it as infrastructure. That is a change in kind, not degree.
The technical fact that every headline got wrong.
The reporting on this story consistently describes BIP-361 as a phased migration from ECDSA to Schnorr signatures, framing it as the quantum transition. That framing is wrong, and it matters more than anything else in the article.
Schnorr signatures — standardized as BIP-340 in Bitcoin — are built on secp256k1. The same secp256k1 as ECDSA. The same elliptic curve discrete logarithm problem. Shor's algorithm breaks both with equal indifference. Migrating from ECDSA to Schnorr is not a quantum defense. It is a structural upgrade that enables Taproot, key aggregation, and cleaner multi-signature construction. It prepares the ground for a post-quantum output type. It is not the post-quantum output type.
The real post-quantum work in Bitcoin lives in a different place: BIP-360, which proposes a new output type designed to be quantum-resistant. That is the actual migration target. What is happening here is a conflation of two proposals — the structural signature cleanup and the fundamentally different cryptographic replacement — presented as one story. Readers are being told Bitcoin is migrating to quantum safety when what Bitcoin is actually doing is laying track.
The distinction is not academic. Schnorr-based keys still expose a public key that can be harvested. A quantum adversary running the harvest-now-decrypt-later playbook does not care whether your exposed key was ECDSA or Schnorr. The curve is the vulnerability. The signature scheme is decoration.
This is the first forensics point, and it is the one I would put in front of any reader: a migration to Schnorr is a migration to a better version of the same broken assumption. If you sold yourself the narrative that Schnorr equals quantum-safe, you bought the wrong asset thesis.
The supply structure is where the real body is buried.
Here is the number nobody wants to say plainly. There are millions of bitcoin sitting in addresses whose public keys are fully exposed on-chain. Not hashed. Not protected by the hash-then-sign construction that P2PKH gives you. Exposed, in plaintext, waiting.
Pay-to-Public-Key outputs are the historical form. Early Bitcoin used them almost exclusively. When you spend from a P2PK output, and even when you do not, the public key is visible. That means a quantum adversary with a functioning Shor implementation does not need to break your hash. There is no hash to break. They read the key, run the math, and take the coins.
And then there is the vault. Roughly one million bitcoin — a full 5% of the supply — is attributed to Satoshi Nakamoto, and the majority of it sits in early P2PK outputs. The public keys are visible. The private keys have never moved. Every day that passes, those million coins sit on the chain as a quantum-exposed reserve. The floor is a lie; only the exposed key tells the truth.
This is where the story stops being about computers and starts being about governance. Because any serious post-quantum migration on Bitcoin eventually collides with a question no one has an answer to: what do you do with coins whose owner is presumed dead, whose keys are presumed lost, and whose exposure is presumed permanent?
You can leave them. Then a quantum attacker can take them, and the market learns that Bitcoin's founding vault was not sacred. You can lock them. Then you have, in effect, confiscated the most famous coins in the world by protocol fiat. You can require migration to a new signature scheme and sunset the old one, as BIP-361 contemplates. Then anyone who fails to migrate — through death, lost keys, or simple ignorance — has their property permanently frozen. That last option is the one with the cleanest security logic and the worst philosophical implications.
The proposal to phase out legacy signatures after a migration window is being sold as hygiene. It is actually the largest property-rights decision in Bitcoin's history, executed through a BIP. And the market has not priced it because the market does not read BIPs.
The logical qubit gap is the elephant everyone steps around.
Now the discipline. The 1,200 number is doing a lot of work in this story, and most writers are using it wrong.
Error-corrected qubits are not physical qubits. Building one high-quality logical qubit from noisy physical qubits requires hundreds to thousands of physical qubits, depending on error rates. Current public hardware sits in the range of dozens to low hundreds of physical qubits, and error rates have not yet crossed the threshold where practical error correction becomes cheap. To reach 1,200 logical qubits, you multiply by the correction overhead, and you get a number that is not in any lab.
Which means two things can be true at once, and the article you are reading almost certainly only told you one. Q-Day may be further away than the fear implies, because logical qubits are brutally expensive to build. And Q-Day may be closer than the comfort implies, because the funding curve just bent, and government money plus equity stakes plus multi-route hedging is exactly what a Manhattan-style acceleration looks like in its first quarter.
The honest position is that the timeline is not knowable from the outside. What is knowable is the exposure. And you do not need to know when the vault breaks to know that an exposed key is a liability. You only need to know it will break before it is migrated if the migration never starts.
Harvest now, decrypt later is already running.
Here is the piece of the threat model that removes the whole "we have time" argument.
A quantum adversary does not need a quantum computer today to attack today. They need only a quantum computer tomorrow and a copy of the chain today. Every block, every transaction, every exposed public key is public data. An adversary can archive the entire historical chain, wait until the physics catches up, and then decrypt the harvested keys offline. There is no live attack required. There is no on-chain footprint to detect. There is no anomaly in my data to flag.
For hash-only addresses — P2PKH and similar — this matters less than people fear, because the public key is not revealed until spend time. You are exposed only when you transact. But for every P2PK output and every reused address, the harvest clock is already ticking. The risk window for those coins did not open at Q-Day. It opened the moment the key was published, years ago.
I have spent years building detection heuristics for anomalous wallet behavior. I can flag a wash-trade pattern, a whale accumulation, a bridge exploit in progress. I cannot flag a passive archive. The most dangerous position in this entire story generates zero on-chain signal until the moment it is spent. That is the definition of a blind spot, and it is why this risk gets ignored: it does not show up in the dashboards people watch.
The migration bottleneck is not the base layer. It is the long tail.
The Ethereum roadmap sets a hard deadline of December 2029 across the execution, consensus, and data layers. That is a real project plan with a real date and a real team. It is the most credible quantum-migration commitment in the industry.
And it will still almost certainly slip.
Not because the Ethereum Foundation cannot write the code. Because the code is the easy part. The hard part is the coordination surface: every wallet that custodies keys, every exchange that runs deposit addresses, every bridge that holds locked value, every DeFi contract that assumes a signature format, every institutional custodian, every spot ETF that holds coins through a settlement layer that has to be upgraded in lockstep. The base layer can ship a new output type in a fork. The ecosystem cannot ship a new assumption in a fork.
Ethereum accounts are hash-of-public-key constructions, which means proactively exposed keys are less of a problem than on Bitcoin — most accounts only reveal public keys when they sign. But that advantage is exactly what makes the migration coordination-heavy: every account that has ever signed is exposed, and every contract that has to accept a new signature format has to be touched. The number of things that must move is enormous, and each one is a potential migration failure that leaves an asset stranded.
Bitcoin has the opposite problem and a worse version of it. There is no foundation to set a date. There is no project manager. Coordination happens through rough consensus, which means a change as heavy as sunsetting legacy signatures will be argued for years before it is either implemented or abandoned. The BIP process is healthy and open. That is not the same as fast.
Put the two together and the picture is uncomfortable. Ethereum can promise a date it may not hit. Bitcoin cannot promise a date at all. And the attacker only needs one exposed key that never migrated.
The economics of the lock.
Let me price the BIP-361 scenario properly, because the bull case and the bear case are both wrong in the same way.
If the protocol sunsets legacy signatures after a migration window, and some fraction of holders fail to migrate, those coins become permanently unspendable. The bull case says this is deflationary: circulating supply shrinks, so the remaining coins are worth more. The bear case says it is a governance disaster that proves Bitcoin can confiscate property by consensus.
Both miss the point. The coins are only locked if the protocol enforces it. And enforcing it triggers the most consequential fork question in Bitcoin history: do you split the network over the right to freeze dead keys? The Bitcoin philosophy of unconfiscatable property is not a marketing line; it is a load-bearing wall. BIP-361 as currently contemplated leans hard on that wall. Whether the wall cracks is a governance question, and governance questions resolve at the speed of community consensus, which is not the speed of security.
There is a second-order effect nobody models. Once a migration window opens, old and new signature formats coexist. That coexistence period is itself an attack surface — replay risk, confusion between formats, governance manipulation during the transition. The most dangerous moment in a cryptographic migration is not before it starts. It is during it, when the system is half-old and half-new and nobody agrees on which half is canonical.
I have seen this pattern at smaller scale. In 2020, I watched a mechanical arb in a Compound-linked pool because the market was mispricing a mechanical relationship the crowd could not see. The edge existed because the crowd did not model the plumbing. The quantum migration is the same shape at civilizational scale: the crowd models the dramatic headline and ignores the plumbing, and the plumbing is where the money dies.
The quantum tax is real, and it is already being levied.
Here is my core claim, and it is the one I will be judged on. The quantum threat does not need Q-Day to affect price. It affects price now, through a discount that institutions are quietly applying to the terminal-value assumption of any asset whose keys cannot be migrated on demand.
Call it the quantum tax. It is not a line item. It is a discount rate adjustment. An institution allocating to Bitcoin on a ten-year-plus horizon now has to model a nonzero probability that a portion of the supply becomes unspendable or contested. That probability is small today. It is not zero. And because the exposure is concentrated in the oldest, most symbolic coins — including the founding vault — the tax lands hardest on exactly the coins that anchor the "digital gold" narrative.
You will not see this in a funding rate. You will not see it in an ETF filing. You will see it in the willingness of long-horizon capital to pay the same multiple it paid two years ago. Slow, structural, and invisible to anyone watching the four-hour chart.
The flip side is the part that will get capitalized first. Post-quantum signature schemes are bigger and more expensive than ECDSA. Lattice-based constructions like the Dilithium family, hash-based schemes like SPHINCS+, and one-time constructs like Lamport signatures all carry signature bloat and verification cost that dwarf the current assumption. That bloats on-chain footprint, raises per-transaction cost, and restructures the data-availability cost model for the rollups that settle on these chains. A migration that improves security worsens throughput. Nobody is pricing that trade.
And the beneficiary of all this confusion is not the chains. It is the theme. Every time a quantum hardware milestone hits the tape, capital will rotate into "quantum-resistant" tokens, post-quantum wallets, and anti-quantum L1s. Most of those projects will hold no more quantum security than a Schnorr key holds against Shor. The narrative will be sold harder than the cryptography. That is the concept bubble forming in real time, and it is the one place in this story where short-term money is genuinely at stake.
The contrarian angle: correlation is not causation, and the headline is not the threat.
The instinct is to read the $300 million as bad news for Bitcoin and Ethereum. More quantum money equals closer Q-Day equals danger. That chain of reasoning is a correlation dressed as a causation, and it inverts the actual risk.
The government funding quantum hardware does not make quantum computing arrive faster in any way you can trade. The $300 million is symbolic against the real driver, which remains private capital and big-tech R&D budgets. What the funding does is reveal the state's belief about the timeline. That belief is a forecast, not a fact, and forecasts about quantum are historically wrong in both directions.
The real danger is not the computer. It is the migration. A rushed cryptographic migration, executed under panic, with a sunset clause for legacy signatures, coordinated across a long tail that will not coordinate, is how you turn a manageable future threat into an immediate self-inflicted wound. Lock the wrong keys and you have destroyed value faster than any quantum adversary could. Fork the community over the right to freeze a dead man's coins and you have done more damage than the physics ever will. The base layer is not the risk. The humans are.
And here is the sharpest inversion of all. The most exposed asset is not the one with the weakest cryptography. It is the one with the strongest ideology and the longest coordination chain. Bitcoin's commitment to unconfiscatable property is precisely what makes any fix for exposed keys so politically poisonous. Ethereum's centralized foundation is precisely what makes its migration dated and credible. The chain with the better governance is the chain that can move. The chain with the better philosophy is the chain that will argue until it is too late. That is the trade nobody has priced: you are not buying security, you are buying a coordination mechanism, and Bitcoin is betting its vault on the slow one.
Where the smart money has already moved.
I do not trade narratives. I trace flows. And the flow to watch here is not crypto-native at all — it is the flow of institutional custody mandates being quietly rewired to demand quantum-migration roadmaps from custodians before onboarding. That has not hit the tape. It is happening in diligence rooms. When it surfaces, it will surface as a valuation multiple, not a headline.
On the safe side of the trade, the producers sit: Rigetti, D-Wave, Quantinuum, and the unfunded leaders IBM and Google. Their commercial logic is independent of crypto. The government equity only adds a defense-procurement tailwind and a layer of strategic optionality. They are quantum companies first and crypto-adjacent not at all. Between them and the crypto market there is no dependency — only a shared origin point called the threat.
The exposure that genuinely needs watching is the concentrated, public, slow-decision custody: spot ETF vaults, exchange cold storage, and any large holder whose addresses are known and whose migration will require a committee. These are the positions that are hardest to move and easiest to identify. In a harvest-now-decrypt-later world, they are the most valuable archive on the chain.
Takeaway.
Stop watching the quantum computer. Watch the exposed keys and the sunset clause.
The next signal is not a Google breakthrough or an IBM milestone. It is the first time a major custodian publicly confirms a post-quantum migration plan, or the first time BIP-361 moves from draft toward activation with a sunset date attached. Whichever comes first tells you which chain has learned to move, and which one is still arguing while its oldest coins sit in plain sight.
The floor is a lie. Only the exposed key and the migration schedule tell the truth. And right now, the schedule has no date.
Follow the outflow, not the hype.
