Research Journal

“Q-Day” is the nickname for the moment a quantum computer becomes powerful enough to run Shor’s algorithm against real keys. For Bitcoin, the danger is specific: a public key reveals enough information for a quantum attacker to compute the matching private key, and that private key controls the coins.

The good news is that a normal Bitcoin address is actually the hash of a public key, not the public key itself. As long as you have never spent from an address, your real public key is hidden behind SHA-256 and RIPEMD-160 — and Grover’s algorithm only weakens hashes a little. The risk appears the moment you broadcast a transaction, because that reveals the public key while the transaction waits to be mined.

Estimates suggest that roughly a quarter of all Bitcoin sits in addresses with exposed public keys (early pay-to-public-key coins and reused addresses). Those are the most vulnerable. The defence is a migration to post-quantum signatures such as Dilithium or SPHINCS+, almost certainly through a coordinated soft or hard fork.

“Harvest now, decrypt later” (HNDL) describes attackers who copy encrypted data today and simply wait for quantum computers to catch up. Most systems can rotate keys before that day arrives. Blockchains cannot rewrite history.

Every signature, every public key, and every transaction ever made is stored forever on a public ledger that anyone can download. If those signatures use ECC, a future quantum computer can mine the historical chain for exposed keys at its leisure.

This is why the cryptocurrency world is paying attention years before quantum computers are practical. Lattice-based schemes like Kyber and Dilithium are being prototyped in wallets and layer-2 systems now, so that the chains of tomorrow are not haunted by the keys of today.

Swapping ECDSA for a post-quantum signature scheme sounds simple, but Dilithium signatures are far larger (kilobytes instead of ~64 bytes). Bigger signatures mean bigger blocks, higher fees, and tougher scaling — a real engineering trade-off.

Then there is governance. Bitcoin has no CEO. Any change requires rough consensus among developers, miners, exchanges and users. A post-quantum upgrade would likely be a phased plan: first allow new quantum-safe address types, then encourage everyone to move funds, and finally restrict the old, vulnerable scripts.

The thorniest question is what to do with lost coins — including Satoshi’s ~1 million BTC — sitting in quantum-vulnerable addresses whose owners can never move them. Leaving them is a future bounty for a quantum attacker; freezing them breaks the promise that your keys are yours forever.

Account abstraction (ERC-4337) lets a wallet be a programmable smart contract rather than a single fixed key pair. That flexibility is a gift for the post-quantum transition: a wallet can define which signature scheme it trusts.

In principle, an account-abstraction wallet could verify a Dilithium or SPHINCS+ signature inside a contract, letting users opt into quantum resistance without a network-wide hard fork. Researchers are also exploring zero-knowledge proofs that compress big post-quantum signatures.

Ethereum’s roadmap already mentions “quantum resistance” as a long-term goal, including STARK-based proofs that rely only on hashes — a naturally quantum-friendly foundation.

Imagine a perfectly regular grid of dots stretching through 500-dimensional space. Finding the dot closest to a random point is easy in 2D but becomes astronomically hard as dimensions grow — even for quantum computers. That difficulty is the Shortest Vector Problem.

Learning With Errors (LWE) builds on this by adding a sprinkle of random noise to every equation: b = A·s + e (mod q). Without the noise, you could solve for the secret s with school algebra. With it, the problem becomes a needle-in-a-haystack lattice search.

Kyber uses this to exchange keys; Dilithium uses a cousin of it to sign messages. For cryptocurrency, lattice math is the most likely replacement for the ECC that currently guards trillions of dollars in digital assets.

Bitcoin mining is a giant search for a number (a nonce) that makes a block’s SHA-256 hash start with many zeros. Grover’s algorithm can search faster — turning an N-step search into roughly √N.

A quadratic speed-up sounds huge, but mining hardware (ASICs) is already astonishingly fast and parallel, while quantum computers are slow per operation and hard to scale. Most analyses conclude that classical miners stay competitive for the foreseeable future.

The bigger worry is never mining — it is signatures. Proof-of-work is only mildly bruised by Grover, but the ECDSA signatures protecting wallets are fully broken by Shor. That is where the real post-quantum effort belongs.