The U.S. government just set a hard deadline for post-quantum cryptographic migration: 2031
Two executive orders signed in 2025 require all federal agencies to replace classical signature schemes with NIST-standardized post-quantum algorithms. The mandate covers every system that touches federal data. Bitcoin is not on the list. That is exactly the problem.
This post breaks down what the threat actually is at the cryptographic level, why the migration is harder than it looks, and what the developer community should be paying attention to right now.
How ECDSA Works and Why Quantum Computers Break It
Bitcoin transaction signing uses ECDSA on the secp256k1 curve. The security model is simple: deriving a private key k from a public key Q = k * G requires solving the elliptic curve discrete logarithm problem. On classical hardware, this is computationally infeasible at 256-bit key sizes.
Quantum computers running Shor's algorithm solve the discrete logarithm problem in polynomial time. The same algorithm breaks RSA. The same algorithm breaks Diffie-Hellman. Anything whose security depends on factoring or discrete log is vulnerable.
The standard objection has always been qubit count. Breaking secp256k1 requires fault-tolerant logical qubits, not the noisy physical qubits that exist today. Earlier estimates put the requirement at hundreds of millions of physical qubits. More recent work has revised that down significantly:
| Year | Paper | Physical qubits estimate |
|---|---|---|
| 2022 | Webber et al. (UCL) | ~13 million (optimistic) |
| 2023 | Banegas et al. | ~317 million (conservative) |
| 2024 | Microsoft preprint | Lower still under new error correction models |
The trajectory matters more than any single estimate. Every 12 to 18 months the estimates drop. The federal government is acting on that trajectory, not on a specific threshold.
The Signature Size Problem Is Not Solved by Switching Algorithms
When developers hear "just use a post-quantum signature scheme," the natural follow-up is: which one, and what does it cost?
NIST standardized three post-quantum signature algorithms in August 2024. Here is what the numbers actually look like:
Algorithm | Public Key | Signature | Standard
----------------|-------------|-------------|----------
ECDSA (secp256k1)| 33 bytes | 64 bytes | —
ML-DSA-44 | 1,312 bytes | 2,420 bytes | FIPS 204
ML-DSA-65 | 1,952 bytes | 3,309 bytes | FIPS 204
ML-DSA-87 | 2,592 bytes | 4,595 bytes | FIPS 204
FALCON-512 | 897 bytes | ~666 bytes | FIPS 206
FALCON-1024 | 1,793 bytes | ~1,280 bytes| FIPS 206
SLH-DSA-128s | 32 bytes | 7,856 bytes | FIPS 205
ML-DSA (formerly CRYSTALS-Dilithium) is the general-purpose recommendation. At the lowest security level, a single signature is 2,420 bytes versus ECDSA's 64 bytes. That is a 38x increase.
What This Does to Bitcoin Block Capacity
Bitcoin blocks are capped at roughly 4MB (weight units). A standard P2WPKH transaction with an ECDSA signature is around 141 vbytes. A comparable transaction with an ML-DSA-44 signature would be roughly 2,600+ vbytes, just from the signature field alone.
Run the math:
Current block capacity (approx): ~2,500 transactions
Post-quantum block capacity (ML-DSA-44): ~230 transactions
Throughput reduction: ~90%
Bolt post-quantum signatures onto Bitcoin's current architecture and you get a chain that processes one-tenth of its current transaction volume. That is not a migration. That is a different product.
FALCON has smaller signatures (~666 bytes at the 128-bit security level) and is the more bandwidth-efficient option, but it uses floating-point arithmetic internally, which creates implementation complexity and side-channel risk. Most secure implementations require constant-time floating-point, which is non-trivial.
BIP-360 Is a Start, Not a Solution
BIP-360 proposes a new output type called P2QRH (Pay to Quantum Resistant Hash). The design is sound at the cryptographic level. It supports CRYSTALS-Dilithium, FALCON, and SPHINCS+ as signature schemes. It handles address encoding for post-quantum public keys.
What BIP-360 does not solve:
1. Throughput. P2QRH does not change block size limits. It does not add compression. It does not address the 90% capacity reduction that comes with ML-DSA signatures. Those problems require separate proposals.
2. Existing address migration. Approximately 6.9 million Bitcoin (per Coinbase's 2024 quantum risk report) sits in addresses where the public key is permanently visible on-chain. P2PKH and P2WPKH expose the key only on spending. P2PK outputs, used heavily in early Bitcoin, expose the public key in the scriptPubKey itself without any transaction ever being broadcast by the owner.
There is no mechanism in BIP-360 to migrate those coins. You cannot migrate funds you cannot sign for. Satoshi's coins, lost wallets, and custodians who are unresponsive all fall into this category.
3. Governance timeline. Bitcoin consensus moves slowly by design. SegWit took three years from proposal to activation. Taproot took two years of soft signaling and a missed activation window before the Speedy Trial. BIP-360 is still in early draft. The 2031 federal deadline is six years away. The overlap between "BIP-360 activates on mainnet" and "a cryptographically relevant quantum computer exists" is genuinely uncertain.
The Harvest Now, Decrypt Later Threat Is Already Active
The most underappreciated part of the quantum threat for developers is that the attack does not require a quantum computer to exist today.
Harvest now, decrypt later (HNDL): an attacker records public keys, signed transactions, and other cryptographic material today and stores it. When quantum hardware matures, they decrypt the stored data.
For most application data, the value of HNDL is limited by data freshness. A harvested TLS session from 2025 is not worth much in 2035.
For Bitcoin UTXOs sitting in exposed addresses, the calculus is different. The funds do not expire. A P2PK output containing 50 BTC from a 2010 block will still contain 50 BTC (or its quantum-era equivalent) in 2031. The incentive to harvest and hold is exactly proportional to the balance, indexed to the eventual BTC price.
If you are building wallets, exchanges, or any application that handles Bitcoin addresses, the question of key exposure is not theoretical. It is a design decision your users' future funds depend on.
What Quantum-Native Blockchain Architectures Are Doing Differently
There is a meaningful difference between chains that add post-quantum signatures and chains that build for post-quantum from the start.
The key insight is that the throughput and key exposure problems are not separate from the cryptography problem. They are the same problem. Any architecture that treats them separately will end up with a 90% capacity reduction, persistent key exposure, or both.
The approaches that actually solve the full problem tend to combine:
- Post-quantum signatures at the base layer (ML-DSA or FALCON, not as an optional output type)
- Data compression to absorb the signature size overhead without sacrificing throughput
- Key rotation mechanisms that ensure public keys are never reused or left exposed on-chain (analogous to BIP-32 HD wallet derivation but at the protocol level)
- Migration paths for existing address types built into the consensus rules
QuanChain is an example of a chain that has built all four components into a single integrated architecture: Dilithium-5 signatures, 70% compression of on-chain data, a SpendAndRotate mechanism that rotates keys on every spend, and a three-channel design that maintains 200,000 TPS under full post-quantum signature overhead.
That is the relevant benchmark for evaluating any post-quantum blockchain claim: not which signature scheme they use, but whether they have solved the throughput and key exposure problems alongside it.
Practical Checklist for Developers Working with Bitcoin or Blockchain
If you are building anything that touches cryptographic key management or blockchain transactions, here is what to audit:
[ ] Are you generating fresh addresses per transaction, or reusing addresses?
[ ] Do any of your wallets or contracts use P2PK outputs?
[ ] Is your key derivation scheme compatible with post-quantum key types?
[ ] Have you read FIPS 203, 204, and 205? (NIST published them August 2024)
[ ] Does your dependency chain include any library pinned to ECDSA-only?
[ ] Do you have a migration path documented for when BIP-360 or equivalent activates?
None of these require you to act today. All of them require you to have thought about it before the window closes.
What the 2031 Deadline Actually Signals
Developers tend to be skeptical of policy documents. That skepticism is healthy. But the two executive orders matter less as policy and more as a revealed preference.
The U.S. federal government has access to classified intelligence about quantum hardware progress that no public research lab publishes. When that government mandates a six-year migration across all civilian systems, the signal is: people with better information than we have believe this is real, proximate, and requires lead time to address.
The crypto ecosystem does not have an equivalent mandate. It has a Bitcoin Improvement Proposal in early draft, a small number of quantum-native chains in testnet or early mainnet, and approximately 6.9 million BTC in addresses that cannot be migrated without owner action.
The engineering problems are solvable. The coordination problems are harder. Both require the developer community to treat this as a real constraint rather than a future concern.
For a deeper breakdown of the specific executive order timelines and what the 2031 deadline stages require, this analysis covers both orders in detail.
FAQ
Is SHA-256 also vulnerable to quantum attacks?
SHA-256 is significantly more resilient than ECDSA against quantum attack. Grover's algorithm provides a quadratic speedup for brute-force search, which effectively halves the security level. SHA-256's 256-bit output provides 128 bits of quantum security, which remains above the threshold considered secure. Bitcoin's proof-of-work is not the primary concern. The signature scheme is.
Why not just use larger ECDSA keys?
Quantum attacks on elliptic curve discrete log scale better than brute force, so simply doubling key size does not proportionally increase quantum resistance. A 521-bit curve provides roughly 260 bits of classical security but only around 130 bits of quantum security under optimistic assumptions. The NIST-standardized post-quantum algorithms are based on mathematical problems (lattice problems, hash-based constructions) for which no efficient quantum algorithm is known. That is a categorical difference, not a parameter difference.
What is the status of BIP-360 right now?
As of mid-2026, BIP-360 is in draft status. It has received technical review but has not been assigned a BIP number indicating it is ready for implementation. The proposal requires a soft fork with broad miner and node signaling. There is no activation timeline announced.
Can I use FALCON instead of Dilithium in a production wallet today?
FALCON (FIPS 206) is standardized and suitable for production use. The implementation complexity is higher than Dilithium because correct FALCON signing requires careful handling of floating-point arithmetic to avoid side-channel leakage. If you are implementing it yourself, use an audited library. If you are evaluating libraries, check whether they use constant-time floating-point operations.
What is SpendAndRotate?
SpendAndRotate is a key rotation mechanism where every spend transaction automatically rotates the signing key, so a used public key is never reused. It prevents the address reuse vulnerability that puts 6.9 million Bitcoin at elevated quantum risk. It is conceptually similar to how modern HD wallets generate new addresses per transaction, but enforced at the protocol layer rather than the application layer.
