The Quantum Wind Is Already Here: Why Bitcoin's Draft and Ethereum's 2029 Are Not What You Think

Quantum computers are not the threat. Delay is. The European Union's financial supervisors have issued a warning that should have triggered a sharper response than it did. In a sideways market, where attention is split between funding rates and the next macro print, a quiet line in a regulatory notice said that quantum machines will one day 'pick crypto's locks.' That metaphor deserves more weight than a headline. It points to a vulnerability that is not theoretical, not a decade away, and not confined to obscure altcoins. It is embedded in the ownership layer of Bitcoin and Ethereum. The most revealing part of the story is not the warning itself. It is the response. Bitcoin developers are reportedly weighing migration drafts, while Ethereum has attached a date to the problem: 2029. Those two facts do not just describe progress. They describe the philosophical difference between two civilisations, and they expose why the next cycle of crypto may be determined less by liquidity than by legacy. To understand why this matters, you have to drop a common assumption. The quantum threat is not aimed at mining. Proof-of-work uses SHA-256, and against hash functions Grover's algorithm only offers a square-root speedup. That is a degradation from 256 bits to 128 bits of security, serious but not apocalyptic for the immediate future. The true fault line is the elliptic curve digital signature algorithm, ECDSA, built on the secp256k1 curve. This is the mathematical lock that binds a private key to a public address. Shor's algorithm, running on a cryptographically relevant quantum computer, can invert that binding in polynomial time. For Bitcoin and Ethereum, this is not an abstract concern. Both chains publish public keys in plain sight. ECDSA is used in every transaction signature. An attacker with a sufficiently powerful quantum computer can derive the private key from the public key, then spend the balance, or simply watch and wait before spending. The phrase 'harvest now, decrypt later' is normally used for encrypted communication. On a blockchain, the raw material is already in the open. There is no need to intercept data. The data is the chain itself. The NIST post-quantum standards are already here. In 2024, NIST finalised ML-DSA, previously known as Dilithium; SLH-DSA, previously known as SPHINCS+; and ML-KEM, for key encapsulation. The algorithms are not hypothetical. The problem is that swapping an algorithm inside a live blockchain is not a software deployment; it is a constitutional amendment. During the 2022 bear market, I spent six months mapping Federal Reserve rate decisions to stablecoin supply movements. That experience taught me that macro risk rarely arrives as a single event. It arrives as a slow repricing of assumptions. Quantum exposure feels exactly like that. The market will not gap lower the day a quantum computer is announced. It will move when the first major chain proposes a migration path, or when a regulator demands a timeline, or when an institutional custodial contract is rewritten to require post-quantum signatures. By then, the price will be reflecting something deeper than volatility. Bitcoin's exposure is ancient in the worst possible way. The earliest blocks used P2PK, pay-to-public-key, where the public key sits directly on the chain. Later address formats such as P2PKH hide the public key behind a hash until the first spend, which is why the advice for decades has been to never reuse addresses. But P2PK outputs are already naked. They include early mined supply, often cited in the range of roughly one million Bitcoin associated with the Satoshi era, though exact accounting varies. Those coins have not moved in years, perhaps never. They are the silence where value used to flow. A quantum attacker does not need to hurry. The lock is already lying on the table. Ethereum's exposure is less cinematic but more universal. In an account-based model, every transaction from an externally owned account reveals the public key. Once an address has broadcast one transaction, its cryptographic identity is part of the permanent record. That covers virtually every active user, every hot wallet, every DeFi dashboard that has ever sent a transaction. Ethereum is not worried about a single ancient hoard; it is worried about a whole population. The attack surface is broader because the chain is more alive. The migration paths are different in every meaningful way. Bitcoin would need to introduce post-quantum signatures, either through a soft fork or a hard fork. Because the protocol values minimal change, the community has not yet agreed on a proposal. The phrase 'weighing drafts' is a polite way of saying that the process has just begun. Ethereum has a target date, 2029. That is not a promise; anyone who followed The Merge knows that Ethereum dates are collective aspirations. But at least the aspiration exists. At least the consensus layer has acknowledged the problem and put a year on the record. Then there is the cost. Post-quantum signatures are bulky. ML-DSA public keys and signatures run to thousands of bytes, compared with 64 bytes for an ECDSA signature. On Bitcoin, where every byte of block space is priced at the margin, signature bloat would reopen the block size debate from a new angle. It would change the fee market, the propagation of blocks, and the economics of small payments. On Ethereum, the same bloat translates into gas costs, calldata costs, and storage costs. Every transaction becomes heavier. Every smart contract that verifies a signature needs more computation. The illusion of speed masks the weight of history: Bitcoin and Ethereum were designed for efficiency when signatures were small. They now inherit the consequences of that design. Backward compatibility is the quiet nightmare. When a chain changes its signature scheme, it cannot simply discard the old one. Historical blocks must remain verifiable. Unspent balances from old addresses must remain spendable, or an enormous social controversy erupts over frozen property. Most likely any migration will involve hybrid signatures, where a transaction carries both an ECDSA signature and a post-quantum signature for a transition period. That doubles the data burden. Then the old scheme is phased out, but not before every wallet, exchange, custodian, bridge, and hardware device has updated its code. I have seen similar dynamics in my audit work around vault strategies and stablecoin processes. The code is always the easy part. The coordination is the hard part. A dozen ideas fail not because they are invalid but because the stakeholders cannot agree on what happens to users who do not move. Quantum migration is that same problem, raised to the level of property rights. The downstream industry is where the migration will be felt first. Hardware wallets are the most urgent case. A hardware wallet keeps its signing private key in secure firmware, but the firmware itself is built around ECDSA. Upgrading to post-quantum signatures means changing the secure enclave, the user interface, the file format, and the recovery process. Users with old devices cannot simply update an app. Some will need to buy new hardware. Exchanges face a different burden: they must update deposit address generation, withdrawal signing, and cold storage procedures. A cold wallet stack that has been carefully isolated for years suddenly becomes an exposed legacy surface if it supports old address types. Bridges and multisig vaults are the silent weak points. Most bridge contracts, custody solutions, and DeFi governance modules rely on ECDSA signatures. A quantum attacker does not need to attack the base layer directly if a bridge holds a large pile of keys in a predictable configuration. The dependence chain runs from cryptographic primitives to L1 consensus to wallet software to exchange infrastructure to cross-chain messaging. Any one break in the chain can become the point of extraction. Code is law, but liquidity is breath. The code's authority comes from the mathematical irreversibility of ownership. If that irreversibility is suddenly conditional, the liquidity that depends on it will not vanish in a day. It will migrate slowly, toward whatever asset or network can credibly claim post-quantum readiness. That migration will not be visible in order books or funding rates. It will be visible in due diligence documents, in RWA pilot programs quietly cancelled, in custody agreements rewritten with quantum clauses, in insurance premiums for digital asset custodians. The contrarian view is that the market has been asking the wrong question. The question is not whether a quantum computer will arrive by 2030 or 2040. The question is whether the raw material for an attack is already public. For every address that has ever transacted, the answer is yes. This transforms the threat from a future event into a standing condition. A state-level actor does not need to announce its quantum capability. It can accumulate private keys in silence, then decide when to spend them. That is the ultimate bear case for chain security, and it cannot be priced because it has no date. Some macro watchers argue that crypto will decouple from equities in the next liquidity cycle. I think the more interesting decoupling will happen between chains based on quantum readiness. Ethereum's 2029 target is a differentiating story, even if it slips. Bitcoin's draft-weighing is an honest expression of difficulty, but in narrative markets, honesty is not always rewarded. The chain that can show a concrete BIP or EIP proposing post-quantum signatures will command a premium that has nothing to do with yield, emission, or throughput. It will command it simply by proving that the question of ownership can survive the answering machine. There will also be new entrants. A chain designed from genesis with post-quantum signatures avoids the backward-compatibility trap entirely. It is not hard to imagine a 'quantum-safe L1' attempting to position itself as the only network whose ownership model is not rooted in ECDSA. Whether that chain achieves liquidity is another matter. But the narrative space is real. The regulatory pressure from the EU is likely to keep feeding it. MiCA and its successors may one day include quantum readiness as a factor in how custodial services are authorised. That is speculation, but the direction is clear. In a sideways market, chop is for positioning. The position that matters is not a bet on BTC or ETH direction. It is a bet on which ecosystem can manage the transition from a 64-byte world to a thousand-byte world without losing the trust that gives those bytes meaning. Ethereum has a date. Bitcoin has a culture that resists dates. We should not mistake the difference for a lack of skill. Bitcoin's conservatism is a feature until it becomes a liability. The signal to track is not the next quantum computing headline. It is the moment when a proposal moves from a mailing list into formal protocol channels. That is the moment quantum risk stops being a ghost and becomes a roadmap. Until then, treat every 'quantum panic' with healthy skepticism. But do not confuse skepticism with safety. The silence where value used to flow is not empty. It is waiting for a consensus harder to build than any chip. When that consensus arrives, the market will finally have to listen.