Douglas B. Books
Before Q-Day · read online

Part Four — The Move, When It Comes

Stage 3 — the deep field

Stage 3 — the deep field. Art by Douglas John Brownfield.

Chapter 19 — What the Migration Will Actually Be

Strip away the whitepapers and the migration, for a holder, is one of the two moves you already know from Chapter 17 — chosen by the chain, not by you:

post-quantum address type exists and your wallet supports it, you will send your coins from your old addresses to your new ones, in an ordinary transaction, signed by your old keys. That signature is the last classical signature the migration asks of you, and it must be made while classical signatures are still trustworthy — which is the entire reason the work is scheduled years ahead of any plausible machine. Your seed does not change its nature: the same words that restore your wallet today will derive your new keys then, in whatever wallet you trust at the time. Nothing about the move requires new hardware, a new system, or a new you. It requires a destination, which does not exist yet, and time inside the window, which Chapter 4's arithmetic (76 days at total block capacity; years at a realistic share) shows is scarcer than it sounds.

(Chapter 12): the account keeps its address and history, and its controlling key is exchanged for a Falcon key. The move took the form of a setting, not a journey.

program; its signature scheme becomes one of its settings, changed per account, opt-in (Chapter 10).

Around those three shapes sit the questions nobody has answered, and this book leaves them where it found them: the coins of the lost and the dead (Chapter 8's debate; Chapter 21's list); the fees a crowded migration window will charge (unmodelled, Chapter 4); and whether hybrid signatures — classical and post-quantum side by side, the pattern the web's migration used and one hardware maker already uses for its own firmware — will be offered to chain accounts at all. No chain has shipped them for holders as of this writing.

What can be said whole: the migration is a move, not a rebuild. Every practice in Part Three — fresh addresses, an offline seed, a rehearsed recovery, a wallet you chose on purpose — is precisely the posture from which the move is one transaction instead of a crisis. The meantime was the preparation. That is not a slogan; it is the mechanics.

Chapter 20 — Lightning and the Layers Above

This chapter is short because the record is short, and the book prints it anyway, because a holder with Lightning channels deserves to know the shape of what is not known.

The plain finding first: as of November 2026, none of the Lightning Network's principal development firms — Lightning Labs, ACINQ, Blockstream — has published an assessment of Lightning's quantum exposure. No roadmap, no mitigation programme, no official word. What exists around that silence:

channel funds sit in hashed (P2WSH) outputs while a channel is open — keys hidden, per Chapter 14's rule. Lightning's contracts (HTLCs) are hash-based. The exposure concentrates in the unhappy path: a force-close puts scripts and keys on chain and starts a clock — the standard delay is roughly 144 blocks, about a day — inside which a quantum adversary with the revealed keys would have to beat the honest party's claim. Shorter contract windows run to roughly 40 blocks — six or seven hours. Transport between nodes uses classical key exchange, which carries the harvest-now-decrypt-later exposure of Chapter 1 — for channel gossip, not for coins.

prototypes a hybrid post-quantum Lightning — ML-DSA and ML-KEM through the gossip, transport, invoice, and onion layers — at a measured cost (gossip traffic grows about tenfold) and with an explicit limit stated by its authors: it does not protect the on-chain funds in the channels themselves. Those wait, as everything in this chapter waits, on the base layer's own migration (Chapter 8).

(April 2026) that Lightning is "helplessly broken" against a quantum adversary, and a published rebuttal walking through the windows above. That is the whole of the record.

Verdict, stated as the book states all of them: Lightning's exposure is real but mostly windowed — measured in hours inside adversarial edge cases, rather than the standing, permanent exposure of Chapter 6 — and its defence cannot be built until Bitcoin's is. If your holdings ride Lightning, the meantime practices of Part Three apply unchanged; the layer above them is an open file, and this book will not pretend otherwise.

Chapter 21 — The Unknowns, Stated

A chapter of questions, kept on purpose. As of November 2026, the public record does not answer:

cryptographically relevant quantum computer will exist. Every date in circulation is a projection (Chapter 2).

what final parameters.

the choice survives its own governance.

will ever make un-migrated coins unspendable (Chapter 8).

a third of the supply's fate is an open question, not a detail.

never been published (Chapter 6).

well** — the secure elements inside today's hardware wallets were not sized for signatures of 2,400 bytes and up; the industry's answer is not yet public. (One maker already uses ML-DSA for device attestation; that is not the same as signing your transactions with it.)

model exists (Chapter 4).

written until the destination exists (Chapter 19).

(Chapter 20).

key that must never be reused, and must survive restores without rewinding — get solved for ordinary holders, or whether the stateless and lattice families simply carry the field.

  1. 1. When — or, strictly, whether on any plannable horizon — a
  2. 2. When FN-DSA (Falcon) becomes a finished standard, and with
  3. 3. Which post-quantum scheme Bitcoin will choose, or whether
  4. 4. Whether the freeze happens — whether Bitcoin's consensus
  5. 5. What becomes of the lost and dead coins if it doesn't —
  6. 6. How much Ethereum is exposed, in aggregate — the count has
  7. 7. **Whether mainstream hardware signers can run the new schemes
  8. 8. What the migration will cost a holder in fees — no honest
  9. 9. What the migration instructions will say — they cannot be
  10. 10. What Lightning's builders intend — unpublished
  11. 11. Whether stateful hash-based schemes' hazards — a signing

This list is the book's promise kept in the other direction: the same standard that made the certain chapters certain makes this one a list of questions. When any of them is answered, the answer will be dated, and this list will shrink by one.

Chapter 22 — The Counter-Case, Fairly

The strongest version of "you are preparing for nothing" deserves its own chapter, in its proponents' own terms.

Adam Back — cryptographer, inventor of Hashcash (the proof-of-work Bitcoin adopted), CEO of Blockstream — puts the timeline at "probably not for 20–40 years, if then," and the preparedness case in the same breath: preparation is "the prudent thing to do," and Bitcoin has "a decade in which to migrate" and can "be quantum ready, long before cryptographically relevant quantum computers arrive." Read whole, his position is not denial; it is scheduling: the threat is real, distant, and slower than the fix.

The Bernstein research note (April 2026) tells its investor readers the quantum question is "neither existential, nor novel" — a "medium to long term system upgrade cycle," with three to five years needed to prepare against an expert-consensus machine timeline of roughly ten — and locates the genuine risk narrowly, in about 1.7 million early-format coins.

Charles Hoskinson adds the engineer's caution from the other side: done prematurely, post-quantum cryptography could slow a chain roughly tenfold — the migration itself has a cost, and paying it too early is also a way to be wrong.

And then there is the canary question — how would we know? Three forms of it circulate, and they do not agree:

sizes and watch who breaks them. Nic Carter's warning gives the argument its title — "If the Quantum Canary Sings, It's Too Late": small breaks prove nothing (classical machines can fake them), and because Shor's algorithm scales smoothly, the first unambiguous break may arrive only months before the real one.

park a bounty behind a calibrated challenge — a spend from it would prove the capability exists, publicly and undeniably, and could trigger a pre-agreed defensive fork.

in some 30,000 identical lots of 50 BTC, keys exposed since 2009 — the most attractive target in the system and, on this argument, a slow one: weeks of machine time per key at the projected rates, so the theft of the creator's era would be noticed long before it finished — if the field accepts those coins falling as the price of the warning.

Now weigh both cases against the same scale. The preparation case says: the standards are finished, the deadlines are set by institutions with no product to sell, the exposed third of the supply is measured, and the estimates of the machine keep shrinking. The counter-case says: the machine is decades out if ever, the migration has its own real costs, and the system has a decade in hand. Notice what they agree on. Not one voice in this chapter — not one — argues against the meantime: fresh addresses, an offline seed, knowing which of your keys are exposed, understanding that your wallet is your words. The argument between the camps is entirely about a date. The practices cost nothing under either timeline, and pay under both.

That is where this book leaves it: prepared for the early date, unharmed by the late one, and honest about which parts of the future are still unwritten.

Back Matter

The State of This Book

Written November 2026. Facts are stated as of that date; the chapters that will age first are 2 (the machine), 8 and 11 (the drafts and programmes), and 21 (the unknowns) — by design, in that order. Standards, deadlines, sizes, and counts are cited to their sources in the research record kept with this book's files.

Sources

Primary records consulted include: NIST FIPS 203/204/205 and IR 8547; NSA CNSA 2.0; the EU PQC roadmap; UK NCSC migration guidance; ASD (Australia) and CCCS (Canada) roadmaps; BIPs 16, 32, 39, 141, 173, 174, 340–342, 360, 361 (drafts as marked); Chaincode's post-quantum research report; Blockstream's and Blockstream-adjacent throughput modelling; ChainQuery's and Project Eleven's exposure datasets; Algorand's official post-quantum documentation; Signal's and Apple's engineering blogs; OpenSSH's post-quantum page; Cloudflare's 2025 state-of-the-post-quantum-internet report; and the wallet documentation of Electrum, AirGap, Coldcard, and SeedSigner. The full dated research record — three feasibility reports and the appendix verification log — is kept with this book's project files.

← Part Three — The MeantimeContentsAppendix — Go Deeper →