Coinbase's recent note on quantum risk contained no numbers. No block heights. No UTXO counts. No signature-size tables. No timeline denominated in months. For a document that will eventually shape how several hundred billion dollars of custodied bitcoin gets re-architected, that absence is the most informative thing in it.
Here is a number instead. Estimates in the research literature cluster around 1.7 million BTC held in pay-to-public-key outputs — coins mined in 2009 and 2010, when the public key was written directly into the locking script by default. Those keys are not secret. They have been sitting in plaintext on a public database for sixteen years. Each one is a cheque with the signature already attached, waiting for hardware that does not yet exist.
That asymmetry — public keys now, quantum hardware later — is the whole technical substance of this debate. It is also the part the industry keeps compressing into a single clause about "old wallets" and moving on.
BIP-360, in the form currently under review, does not rewrite Bitcoin's consensus. It adds an output type. The spend condition for that output is not an elliptic-curve discrete-log problem but a hash preimage plus a post-quantum signature, most likely from the NIST-standardized families: ML-DSA (Dilithium) or SLH-DSA (SPHINCS+). Existing P2PKH, P2WPKH and P2TR outputs keep behaving exactly as they do today. The proposal deprecates nothing. It remains a draft under discussion — no merged consensus rule, no production reference implementation, no independent cryptographic audit.
That design choice is deliberate, and it is also where the trouble starts. An opt-in output type protects future coins. It cannot touch the vulnerable set, which by definition is historical and already recorded.
Governance is harder than the cryptography. Bitcoin changes through rough consensus across roles that each hold an independent veto: wallet vendors, node operators, miners, and the custodians holding client assets. SegWit took from 2015 to 2017 and still split the chain. Taproot consumed another four years of design and activation argument for a change that carried no security downside whatsoever. A post-quantum migration is larger than both combined, and unlike Taproot it imposes measurable cost on every participant while delivering no benefit anyone can observe today.
This is a debt swap, not an upgrade.
BIP-360 closes a door before someone walks through it. It improves no user experience, adds no throughput, produces no new capability. What it produces is a deterministic efficiency loss, and the loss is not small. A Schnorr signature is 64 bytes. ML-DSA signatures run around 2.4KB against public keys near 1.3KB; SLH-DSA ranges from 8KB to 50KB depending on parameter set. That is a 40x to 800x expansion in the data every transaction must carry. Add address-format fragmentation — a fourth encoding for users, indexers and block explorers to support indefinitely — and the maintenance surface grows while the security guarantee stays flat.
Under a fixed block weight, that expansion is an implicit tax on on-chain settlement. Fee revenue rises for miners. The "Bitcoin as a high-frequency settlement layer" thesis gets more expensive to defend. Truth is found in the gas, not the press release, and here the gas is measured in witness bytes.
Nobody gains from this change on day one. Everyone pays to close a risk that has not materialized. Certain cost, uncertain benefit, distributed across four independent veto holders: that is the hardest class of change in Bitcoin's history, and I say so having spent 2024 inside a far simpler one.
The clock is not the quantum computer.
In 2024 my team mapped the OP Stack sequencer's state-commitment path and found the throughput ceiling in a place nobody was looking. The lesson generalizes. The binding constraint is rarely the component under discussion. Here it is the inequality between preparation time and arrival time. Preparation is measured in years, not quarters: protocol design, activation, wallet firmware, hardware certification, custodian HSM upgrades, Lightning channel migration. Arrival is measured in a headline about error-corrected qubits.
The threat model is also mis-stated in most coverage. A quantum adversary does not need to break ECDSA in real time. The chain is public, replicated, and permanent. Every exposed public key has already been copied by everyone. This is record-now-forge-later: collect today, compute later. The vulnerable set is therefore a static, enumerable list rather than a live race condition. We are not waiting for a breakthrough. We are waiting for a decision, and the decision carries a deadline we did not set.
The bottleneck sits downstream.
When I audited Compound's interest-rate model in 2020, the failure mode I documented lived in a composability edge case, not in the core math. Same pattern applies here. Even a successful soft fork leaves three downstream systems unsynchronized. Secure elements inside hardware wallets carry 12–24 month certification cycles. Custodian key-management HSMs move on procurement schedules. Lightning channel state depends on 2-of-2 MuSig2, where a signature change requires both peers to upgrade in lockstep or the channel becomes unusable. Lightning's migration is structurally harder than L1's, and almost nobody says so in public.
There is a second-order risk the proposal cannot price. NIST's post-quantum process already produced casualties — Rainbow and SIKE were both broken inside the 2022–2024 window. Locking one signature scheme into consensus now creates fresh technical debt with a ten-year maturity. Simplicity is the final form of security, but premature simplicity is just a different attack surface.
The only part that touches wealth.
Dormant-coin disposal is where this stops being cryptography. Freeze, burn, or forced migration under deadline are all, economically, a one-time expropriation of a specific holder cohort. That triggers property-rights arguments — taking, due process, notice — with no precedent in any major jurisdiction. It is also the only plausible trigger for a chain split anywhere in this discussion. Code does not lie, only the architecture of intent, and the intent behind a freeze rule is legible to anyone who reads it.
The contrarian read is uncomfortable for maximalists. Bitcoin's immutability is normally its premium; in a mandatory-migration scenario it converts into a discount. If quantum resistance ever becomes an institutional allocation criterion, chains with account abstraction carry a structurally lower governance cost of migration than a chain whose every change needs four-party consensus. That pressure is slow, low-intensity, and directionally clear.
The hardware layer holds the quieter veto. A soft fork that no shipping device can sign for is a soft fork that exists only on paper. Wallet vendors have never been seated at the table, and their certification calendars, not Bitcoin Core's release cadence, will set the real timeline.
Coinbase's posture reads as expectation management rather than alarm. A listed custodian needs a compliance narrative years before an auditor asks for one, and it needs the address-format conversation to feel normal by the time institutional clients demand it. The signal worth tracking is not another research note. It is the first ETF custodian writing "quantum-resistant control" into a service agreement.
Watch the custody contracts, not the BIPs. When a regulated custodian makes quantum-resistant address support a contractual requirement, migration stops being a mailing-list argument and becomes an engineering backlog with a date attached. Until then, treat this as a schedule, not a signal; nothing in it changes cash flows this quarter. Hedging is not fear; it is mathematical discipline. The open question is narrower and nastier than "can Bitcoin migrate." It is whether the coins that cannot opt in get abandoned, frozen, or fought over — and who is authorized to sign that answer.
