Last week a research result crossed my desk that looked like a rounding error. A roughly 20x reduction in the estimated quantum resources required to execute a key-recovery attack against a 256-bit elliptic curve.
No machine broke Bitcoin. No private key moved. The number sat in a resource-estimate table, third column, buried beneath a discussion of error-corrected circuit depth.
That is the kind of line item the market never prices. Alpha hides in the margins. Price action responds to headlines; there was no headline here โ only the quiet lowering of a cost ceiling that every ECDSA and Schnorr signature on Earth currently sits beneath.
In a bear market this matters differently than it would in a bull market. Nobody is hunting upside. People are asking whether their assets are structurally safe. That is a structural question, not a sentiment question.
What secp256k1 actually rests on
Every signature that moves BTC or ETH depends on one computational assumption: that recovering a private key from a public key requires solving the elliptic curve discrete logarithm problem faster than is physically possible.
For a 256-bit curve, classical algorithms need roughly 2^128 operations. Shor's algorithm collapses that to polynomial time โ but only on a fault-tolerant quantum computer with enough logical qubits and gate operations to run the circuit. The resource estimate is that cost. Logical qubits. Gate count. Circuit depth. It is an engineering budget, not a law of nature.
That budget has been shrinking for four years. Each new paper applies better arithmetic โ windowed scalar multiplication, optimized modular reduction, improved fault-tolerant layouts โ and the ceiling drops again. A 20x reduction in one step is not a marginal optimization. Compounded across several more cycles, it moves the threat from decades into a window that overlaps with the planning horizon of any institution allocating capital today.
I spent two months in 2019 reverse-engineering early Uniswap v2 pricing logic with graph-theoretic token-flow analysis. The lesson was not about Uniswap. It was that code is a dynamic mathematical system, and systems have cost functions that can be attacked from below. A cost function that falls 20x is a system whose security margin just got thinner.
The exposure map nobody has priced
Follow the gas, not the hype. Here is where the exposure actually sits.
Bitcoin's earliest outputs are pay-to-public-key. They publish the public key directly in the locking script. Approximately 1.7 to 2 million BTC sit in these outputs, including the earliest coinbase rewards. Those keys are exposed today, permanently, with no migration path that does not first reveal them.
Pay-to-public-key-hash addresses are safer โ until the first spend. The moment a UTXO is spent, the public key hits the mempool and stays in the chain forever. Address reuse is therefore not a hygiene issue. It is a standing liability.
Ethereum looks better on this metric and is not. EOA addresses are keccak(pubkey)[12:], so the public key stays hidden until the first outgoing transaction. But the consensus layer is a different story. Every validator publishes a BLS public key โ roughly a million of them โ into the deposit contract and into every attestation. BLS12-381 relies on pairing-based cryptography. Shor's algorithm applies to pairings.
So the consensus layer already has a fully public, fully exposed key set. About a million signatures produced every epoch, on keys that cannot be rotated without exiting and re-entering the validator set. That is the margin almost nobody is looking at.
The same curve sits under EIP-4844. Every blob's KZG commitment is a pairing-based commitment. A quantum adversary does not need to forge a signature to break it. The binding property collapses, and with it the cryptographic assumption that data availability sampling rests on. That is not theft. It is the quiet failure of a security model developers are currently building on top of.
Then there is migration cost, which the market has not modeled at all. Post-quantum signatures are large. Dilithium runs around 2.4 kilobytes. Falcon is smaller. SPHINCS+ is enormous. Compare that to 64 bytes for a Schnorr signature. On a chain where block space is the scarce resource โ and where fee revenue is the business model โ a 40x signature size increase is not an upgrade. It is a structural tax on every transaction.
Watch the custodial layer too. Exchanges control the largest single clusters of UTXOs and the largest validator operations. Their migration timelines are set by internal risk committees, not by protocol governance. Every major exchange running a shared cold-storage architecture behind a single key ceremony is a single point of failure that no on-chain metric will reveal until it resolves.
Layer 2s add a second-order problem. Dozens of rollups now anchor to the same base layer with their own bridge contracts, their own signature schemes, and their own upgrade paths. A post-quantum migration on Ethereum forces each of them to re-derive its security assumptions independently. There is no coordinated schedule. There is no shared standard. That is not scaling. It is the same handful of cryptographic decisions duplicated dozens of times, with nobody accountable for the aggregate.
Correlation is not causation
Now the corrective. A lower resource estimate is not a lower resource requirement in practice.
The estimates assume a fault-tolerant machine with perfect error correction. Current hardware sits three to five orders of magnitude away from that, measured in physical qubits and gate fidelity. The threat horizon compressed. It did not arrive. Anyone telling you Bitcoin is breakable this cycle is selling something.
There is also a narrative error worth correcting. Harvest-now-decrypt-later does not apply cleanly to blockchains. There is no ciphertext to store. The data is already public. What an adversary harvests is a public key, not an encrypted secret โ which means there is no silent compromise phase. Any attack is observable in real time.
That cuts both ways. You cannot be secretly broken. You also cannot be secretly migrated. Every step of a post-quantum transition would be public, contested, and slow โ which is precisely why coordination risk is larger than cryptographic risk. A rushed hard fork to fix a theoretical break is how you get a real one.
I built a stress model for UST in April 2022 that flagged Anchor's yield curve three weeks before the depeg. The lesson was not that I predicted it. The lesson was that the anomaly was visible in the data long before it was visible in price.
What to watch
Three signals, in order of importance. Logical qubit counts crossing into the four-digit range on reproducible hardware. The day Bitcoin Core or the Ethereum Foundation moves post-quantum address migration from a research post to a consensus agenda item. And the first demonstrated recovery of a testnet private key โ even a slow one.
None of those have happened. All three are now plausible within the planning horizon of a fund.
Code does not lie; people do. The math is not the risk. The schedule is. And the schedule just got 20x cheaper to run.