Part One — The Change That Is Coming
Stage 0 — the first washes. Art by Douglas John Brownfield.
Chapter 1 — What a Signature Is, and What a Quantum Computer Breaks
Every coin you hold is controlled by a pair of keys. The private key is a secret number. The public key is derived from it by a one-way piece of mathematics: easy to compute going forward, hopeless to reverse. When you spend, your wallet uses the private key to produce a signature — a proof that the holder of the secret approved this transaction, which anyone can check against the public key without learning the secret.
The whole of self-custody rests on that one-way street. And the one-way street rests on a problem: given a public key, finding the private key means solving the discrete logarithm problem, which for a classical computer takes longer than the age of the universe at the sizes wallets use.
A quantum computer changes the problem, not by trying harder but by working differently. Shor's algorithm, published in 1994, solves exactly this family of problems efficiently. A sufficiently large, error-corrected quantum computer — the field's term is a cryptographically relevant quantum computer — could take a public key and compute the private key from it. Not guess it. Derive it.
Two clarifications separate this book from the noise around it.
First: what breaks is signatures (and key exchange), not hashes. Bitcoin's addresses and mining rest on hash functions; a quantum computer speeds up hash attacks only modestly (Grover's algorithm), and modestly is survivable. The exposed half of the design is the signature.
Second: for signatures, there is no "harvest now, decrypt later." That danger belongs to encryption — an adversary records encrypted traffic today and decrypts it when the machine arrives. Public keys on a blockchain are not intercepted secrets; they are published, permanently, by design. The signature danger is better named record now, forge later: every exposed public key is already in the adversary's hands, waiting only for the machine. Chapter 14 will show you exactly which of your keys are exposed, and when they became so.
Chapter 2 — The State of the Machine
Measured facts first. As of November 2026:
has broken RSA or any elliptic-curve key. None is close in the only currency that counts — error-corrected logical qubits — which the world's best laboratories currently field in the dozens.
fast-moving research frontier.
- No cryptographically relevant quantum computer exists. None
- What exists are noisy physical qubits in the thousands and a
Now the projections, which is all anyone has — the resource estimates researchers publish for what the attack would take:
estimated in 2017 at roughly 2,330 logical qubits — far beyond today's dozens, and a measure of the gap.
qubits running 8 hours. By May 2025 the same lead author had cut that to under 1 million qubits and under a week** — the target is not moving, but the estimate of the machine needed to hit it fell twenty-fold in six years.
elliptic-curve keys specifically: fewer than 1,200 logical qubits, under 500,000 physical qubits on their architecture, with key recovery in minutes — and, notably, they withheld the circuits themselves, publishing a zero-knowledge proof that the work is real. Google has set its own post-quantum migration target at 2029.
- Breaking a 256-bit elliptic-curve key (Bitcoin's size) was
- For RSA-2048, the famous 2019 estimate was **20 million noisy
- In March 2026, Google's quantum team published estimates for
Read those three items together and you have the honest picture: the gap between today's machines and the attack is large; the estimates of the machine required keep shrinking; and the people closest to the work behave as if the arrival is a matter of when, not if — while stating, as NIST does, that the timing is unknown and plausibly years to decades away. This book proceeds on exactly that footing. Anyone who gives you a date is guessing. Anyone who tells you there is nothing to prepare for is guessing the other way.
Chapter 3 — The Standards Are Finished
On 13 August 2024, NIST published the first three finished post-quantum standards, ending an eight-year public competition that began with 82 submissions from around the world:
a shared secret. (Not a signature standard — the distinction matters and the next chapter of the wider world's story, in Chapter 7, turns on it.)
lattice-based scheme (Module-Lattice Digital Signature Algorithm), standardised at three strengths.
stateless hash-based scheme (SPHINCS+), whose security rests on hash functions alone — the most conservative assumptions in the field, paid for in size, as the next chapter shows.
- FIPS 203 — ML-KEM. Key establishment: how two parties agree
- FIPS 204 — ML-DSA. The primary signature standard: a
- FIPS 205 — SLH-DSA. The conservative signature standard: a
Two more facts complete the picture. A fourth signature standard, FN-DSA (based on Falcon), is in preparation as FIPS 206 — prized because its signatures are the smallest of the new family — but as of this writing it is not final, and no public draft could be confirmed on NIST's own pages. And NIST's work continues: a backup key-establishment algorithm (HQC) was selected in March 2025, and nine additional signature candidates — designs unlike the lattice family, kept as insurance — advanced to a third round in May 2026.
The significance for a holder is not the alphabet. It is that the question "what will replace today's signatures?" now has official answers, with names, parameters, and finished specifications that any wallet maker on Earth can build to. The standards phase of this transition is over. What remains is adoption — and adoption, as Chapter 5's deadlines and Chapter 9's history will show, is the slow part.
Chapter 4 — The Size Jump
Here is the transition reduced to one table — public key and signature sizes, in bytes, for what you use today and what replaces it:
| Scheme | Public key | Signature |
|---|---|---|
| ECDSA (secp256k1, Bitcoin today) | 33 | ~64–71 |
| Ed25519 (Solana, Algorand standard) | 32 | 64 |
| RSA-2048 (for contrast) | 256 | 256 |
| ML-DSA-44 | 1,312 | 2,420 |
| ML-DSA-65 | 1,952 | 3,309 |
| ML-DSA-87 | 2,592 | 4,627 |
| SLH-DSA (range across parameters) | 32–64 | 7,856 – 49,856 |
| Falcon-512 (FN-DSA, not yet final) | 897 | ~666 |
A signature grows by a factor of roughly 40 to 700. On a blockchain, signatures are not an abstraction — they are block space, the scarcest resource the system has. The published modelling of what that means (Blockstream's, the most concrete to date) holds Bitcoin's throughput at the current block weight roughly as follows: today's Schnorr signatures sustain about 6.5 transactions per second; ML-DSA at mid-strength, about 0.5; SLH-DSA, about 0.36; a compact hash-based design (SHRINCS, from the draft literature) recovers about 3. And the migration itself must fit through the same pipe: Chaincode's research estimates that moving every one of Bitcoin's ~190 million unspent outputs would take 76 days if it had the entire block space to itself — 305 to 568 days at a realistic quarter share, and roughly seven years for a comprehensive migration (five at best, fifteen at worst).
What no one has published, as of this writing, is honest modelling of the fees a holder would pay to migrate in a crowded market. That number does not exist yet, and this book will not invent it. What the arithmetic already proves is the strategic fact: the migration cannot be done in a hurry, by everyone, at the last minute. Which is why it is being scheduled a decade out — the subject of the next chapter.
Chapter 5 — The Deadlines
Governments have begun converting "someday" into dates. They are not all the same kind of date, and this chapter grades them as it goes: binding (a mandate on the systems named) versus guidance (official direction others are expected to follow).
for the algorithms themselves: quantum-vulnerable public-key algorithms are deprecated after 2030 and disallowed after 2035 in the federal standards framework.
phases the change by use: software and firmware signing prefers the new algorithms from 2025 and requires them exclusively by 2030; web and cloud services by 2033; from 1 January 2027, new equipment purchases for national-security use must support the new standards — and for signatures, only the strongest parameter sets qualify (ML-DSA-87).
inventories and migration plans were due in autumn 2026, with key establishment for high-value assets to complete by 31 December 2030 and signatures by 31 December 2031.
2025): begin by end of 2026, high-risk systems migrated by end of 2030, everything feasible by end of 2035.
2028, priority migrations by 2031, completion by 2035.
and elliptic-curve cryptography by end of 2030 — among the earliest hard dates in the world.
April 2026, high-priority systems by end of 2031, the rest by end of 2035. Germany's BSI and France's ANSSI run comparable programmes in the same window, with hybrid (classical + post-quantum together) required or expected in the early phases.
- NIST IR 8547 (finalised October 2026) sets the anchor dates
- NSA's CNSA 2.0 (binding on US national-security systems)
- US federal orders (2026) make it operational: cryptographic
- The European Union's coordinated roadmap (guidance, June
- The United Kingdom's NCSC (guidance, "indicative"): plans by
- Australia's ASD (official recommendation): stop using RSA
- Canada's CCCS roadmap (policy-backed): migration plans by
Stand back and the pattern is unmistakable: independent institutions, on several continents, none of them selling anything, have converged on the same decade — the work of the late 2020s, the deadlines of the early 2030s, completion by 2035. Your wallet's signature scheme is a tiny part of what they are moving. But it is being moved on their schedule, not the market's — and the chains in Part Two will have to fit inside it.
Chapter 6 — Exposure — How Much, and Whose
Chapter 1 named the mechanism; this chapter counts it. A coin is exposed if its public key is visible on the chain — either because it always was (the earliest format, P2PK; and Taproot outputs, whose key is visible at rest), or because the address was spent from once and then reused, which publishes the key at the spend.
The counters do not agree, because they do not count the same thing the same way. Here are the published totals for Bitcoin, with their counters and dates, in the open:
million BTC, roughly 25%** of supply.
walk): 7,126,359 BTC — 35.4% of supply — split into 1,934,735 BTC always exposed and 5,191,624 BTC exposed by reuse. Its own revisions moved its headline from 25.3% to 35.4% within months as its method was corrected — the counters themselves will tell you the figure is methodology, all the way down.
near 6.7 million BTC on its method.
- Deloitte (the earliest widely cited study): **over 4
- Chaincode (2025): 6.26 million BTC.
- Glassnode (May 2026): 6.04 million BTC, roughly 30%.
- ARK Invest / Unchained (March 2026): 34.6%.
- ChainQuery (snapshot 1 November 2026, weekly full-chain
- Project Eleven's Risq List tracks the same ground and lands
Inside every total sits the most famous slice: roughly 1.1 million BTC in the earliest P2PK format, attributed to Bitcoin's creator — keys public since 2009, unmoved since, and (Chapter 22 will argue the point properly) possibly the world's most-watched tripwire.
For Ethereum's externally owned accounts, no sourced aggregate figure exists as of this writing — the exposure there runs through a different mechanism (an account's key is revealed by its first outgoing transaction, and active accounts have all made one), and nobody has published the count. This book notes the absence rather than filling it.
What a holder should take from this chapter is not a percentage. It is that the exposed share is measured in millions of coins and a third of the supply on every serious count — large enough that the question of Part Four, what happens to coins that never move, is not a corner case. It is a third of the system.