Post-Quantum Cryptography Migration: Bitcoin’s Threat Threshold, NIST Deadlines, and Network Security Implications

The post-quantum cryptography (PQC) transition has moved from academic discourse to operational planning across global infrastructure. For Bitcoin, the migration presents a distinct set of technical and governance challenges. Unlike centralized systems that can execute coordinated cryptographic upgrades, Bitcoin’s decentralized architecture requires consensus-driven protocol changes.

The convergence of reduced quantum resource estimates, regulatory deadlines, and on-chain exposure metrics has established 2026 as the year when quantum migration became a practical engineering priority.

The Quantum Threat Threshold: Revised Estimates

Bitcoin’s security model rests on two cryptographic pillars: SHA-256 for mining and address generation, and the Elliptic Curve Digital Signature Algorithm (ECDSA) using the secp256k1 curve for transaction authorization. Quantum computers threaten these systems through different mechanisms. SHA-256 requires approximately 10²³ qubits to attack effectively—a figure approaching stellar energy outputs, making mining quantum-safe for all practical purposes. ECDSA, however, is vulnerable to Shor’s algorithm, which can derive private keys from exposed public keys.

The Google Quantum AI whitepaper, published March 30, 2026, revised the quantum resource estimates for breaking secp256k1. The research demonstrated that Shor’s algorithm could execute with no more than 1,200 logical qubits and fewer than 500,000 physical qubits—approximately 20 times lower than previous estimates. Under these parameters, a quantum computer could derive a private key in roughly nine minutes, approaching Bitcoin’s block confirmation time.

Hardware roadmaps indicate this threshold is within projected timelines. IonQ targets 1,600 logical qubits by 2028 and up to 80,000 by 2030. IBM projects its Blue Jay system at 2,000 logical qubits by 2033. Multiple quantum architectures are converging on this capability, establishing a threat window within the next decade.

NIST Standards and Regulatory Deadlines

The National Institute of Standards and Technology (NIST) finalized the first three PQC standards on August 13, 2024: FIPS 203 (ML-KEM) for key encapsulation, FIPS 204 (ML-DSA) for digital signatures, and FIPS 205 (SLH-DSA) for hash-based signatures. In March 2025, NIST selected HQC as a mathematically diverse backup to ML-KEM, with finalization expected in 2027. FIPS 206 (FN-DSA), based on FALCON, is anticipated in late 2026 or early 2027.

NIST IR 8547, the transition framework published as an initial public draft in November 2024, establishes a two-stage retirement schedule:

• Deprecated after 2030: RSA-2048 and ECC-256 remain permitted but are discouraged and no longer acceptable for new federal system deployments.

The CNSA 2.0 framework requires new National Security System acquisitions to support quantum-resistant cryptography from January 1, 2027. Software and firmware signing must use quantum-resistant signatures by 2030. The European Union’s coordinated implementation roadmap, published in June 2025, calls for member states to publish national PQC strategies and initiate cryptographic inventories by the end of 2026, with critical infrastructure transition for high-risk use cases by 2030.

On June 22, 2026, the U.S. executive order accelerated migration targets, requiring federal agencies to complete quantum-resistant key establishment for high-value assets by December 31, 2030, and digital signature transitions by December 31, 2031.

Post-Quantum Cryptography: performance and Infrastructure Impact

The transition to PQC algorithms imposes significant performance costs on blockchain infrastructure. Current Bitcoin ECDSA signatures measure approximately 64–72 bytes. ML-DSA signatures range from 2.4 KB to 4.6 KB, representing a 37x to 72x increase. SLH-DSA signatures range from 7 KB to 49 KB, depending on the parameter set.

At the ML-DSA-87 security level (NIST Level 5), the signature size is 4,627 bytes with a 2,592-byte public key. For comparison, Bitcoin’s current Schnorr signatures are approximately 64 bytes.

These size increases produce systemic effects:

• Block capacity reduction: Larger signatures reduce the number of transactions per block.

• Transaction fee increases: Higher data volume directly elevates fees.

• Node storage and bandwidth demands: The UTXO set and validation requirements expand substantially.

• Hardware wallet constraints: Storage and computational limitations on constrained devices present implementation barriers.

Samson Mow has warned that PQC signatures could be 10 to 125 times larger than current signatures, massively reducing throughput. Simply increasing block size remains contentious, as demonstrated by the Bitcoin block size debates of 2015–2017.

On-Chain Exposure: The 30 Percent Problem

A May 2026 report from Glassnode quantified the quantum exposure of Bitcoin’s circulating supply. The analysis identified 6.04 million BTC (30.2% of issued supply) in a state of at-rest public-key exposure. This exposure divides into two categories:

• Structural exposure (1.92 million BTC / 9.6%): Coins in Pay-to-Public-Key (P2PK) outputs from Bitcoin’s earliest blocks, where the public key is embedded directly in the UTXO without hash protection.

• Operational exposure (4.12 million BTC / 20.6%): Funds where public keys became visible through address reuse, partial UTXO spending, or custodial practices.

Centralized exchanges represent the largest operational exposure hotspot, holding approximately 1.66 million BTC of the exposed quantum supply. Wallets following best practices of single-use addresses and complete UTXO spending show zero operational quantum exposure under Glassnode’s methodology.

The exposure also includes lost Bitcoin wallets, estimated between 2.3 million and 3.7 million BTC, including coins attributed to Satoshi Nakamoto. These wallets cannot be migrated by their owners, making them permanent targets once quantum attacks become practical. The “Harvest Now, Decrypt Later” (HNDL) strategy compounds this risk. State-level actors can record encrypted blockchain data now and decrypt it once quantum hardware matures.

Protocol Response: BIP-360 and BIP-361

Bitcoin developers have initiated protocol-level responses to the quantum threat. On February 11, 2026, BIP-360 was published and merged into Bitcoin’s official repository, introducing the network’s first quantum-resistant address type. The proposal introduces Pay-to-Merkle-Root (P2MR) outputs that minimize public key exposure and enable spending through post-quantum signature schemes based on NIST-approved algorithms like ML-DSA.

On April 14, 2026, BIP-361 was proposed as a companion measure. Titled “Post Quantum Migration and Legacy Signature Sunset” BIP-361 establishes a three-stage process:

1. Phase A (three years): Prohibits sending new Bitcoin to quantum-vulnerable address formats.

2. Phase B: Tightens legacy spending rules through a quantum-safe recovery process.

3. Final stage: Potential freezing of coins remaining in vulnerable addresses.

BIP-361 would affect approximately 6.5 to 6.9 million Bitcoin in vulnerable addresses, including an estimated 1.7 million coins in ancient addresses attributed to Satoshi Nakamoto. The proposal has generated significant debate regarding the balance between quantum defense and property rights.

Bitcoin’s migration to post-quantum cryptography presents governance challenges that distinguish it from centralized system upgrades. The network lacks a central authority to mandate cryptographic transitions. Any protocol change requires broad community consensus across developers, miners, exchanges, custodians, and hardware wallet manufacturers.

Proposed middle-ground approaches include legacy sunset mechanisms that gradually increase relay friction for old output spending through coordinated soft forks. However, implementing such measures requires resolving disputes over the legitimacy of declaring assets quantum-unsafe.

Adam Back has urged developers to provide users with approximately a decade to migrate keys to quantum-resistant formats. The Bitcoin community is converging on a roadmap that introduces PQC through multiple soft forks, gradually upgrading the address system while maintaining long-term security assurance.

FAQ