When the signature layer can no longer be trusted, what fails first in the Bitcoin stack?
The cryptographic assumption fails at the base layer, but the first observable failures may appear in the infrastructure built around it: bridges, wrapped assets, custodial reserves, and peg mechanisms. They can begin repricing the risk before a cryptographically relevant quantum computer exists. Governance latency, not cryptographic difficulty, is the binding constraint. A competent person can disagree: the post-quantum primitives are standardized, BIP 360 is written, and the base layer is where the value sits.
The usual framing is structurally wrong, not just early. "When will quantum computers break Bitcoin" treats this as one event against one signature scheme. There are two vectors. At-rest exposure targets addresses whose public key is already visible on-chain: the attacker works offline, with no time pressure, against roughly 6 million BTC on Glassnode's May 2026 count, a total sensitive to how the edge cases are counted. On-spend exposure targets the moment a key first appears in witness data. A March 2026 whitepaper led by Google Quantum AI models a primed attack in which the computation remaining after key exposure takes roughly nine minutes against a ten-minute average block time, with attacker success probability around 41%. Those are its figures, under an idealized primed superconducting CRQC and its own assumptions about mempool behavior and fees. My architectural reading, as interpretation rather than result: at-rest exposure has a concrete draft mitigation in BIP 360, which is explicit that it addresses long-exposure attacks and that short-exposure protection may require post-quantum signatures of its own. On-spend exposure therefore stays open for every existing transaction type until consensus supports those signatures, which makes the second vector systemic rather than historical.
The mistake compounds because optimizing for today's threat model is rational and still expands tomorrow's surface. Unused P2WPKH and P2WSH outputs can conceal vulnerable key material until spend, provided the relevant keys, scripts, and extended public keys have not been exposed elsewhere. Taproot embeds the output public key directly in the output per BIP 341, an excellent trade under the pre-quantum model and a reopening of at-rest exposure under the post-quantum one. Its authors considered that objection and rejected it: the spec calls hash-based protection "very weak at best," since coins are unprotected while confirming and much of the supply already sits on exposed keys. That is a fair argument about the pre-quantum baseline; my reading is that it describes where the exposure moves rather than showing that it disappears. Nobody erred; the ecosystem is doing what the current threat model rewards.
The assumption propagates outward. Wrapped BTC locks real coins in custodian addresses whose key hygiene the holder cannot audit, and every rebalance between cold and hot is an on-spend event. Bridge signing infrastructure does not need to be hacked; the key material only needs to become derivable, and a reserve goes in one pass. A wrapped asset can begin trading at a discount before a CRQC exists if holders lose confidence that the reserve can migrate safely and remain redeemable. Nor does the destination help: Ethereum uses the same secp256k1 curve, and every account that has ever transacted has its public key permanently visible.
Against that, the clock. SegWit took roughly three years including a community war, Taproot about two, the block size debate four-plus years and a chain split. Ethan Heilman, a BIP 360 co-author, puts full quantum resilience at roughly seven years if work started tomorrow and everyone agreed on the roadmap: about two and a half years to finish and test the BIPs, half a year to activate, and years more for wallets, custodians and Lightning nodes to migrate. He calls it spitballing. BIP 360 is step one, an output type; adopting a post-quantum signature algorithm is a separate step two, and he attaches no timeline to it at all. Published CRQC forecasts remain widely dispersed. The material fact is not which date wins, but that the forecast range already overlaps the multi-year period required for proposal, consensus, implementation, wallet support, and asset migration. Decentralized governance is a feature in normal times and a structural vulnerability under time pressure, because pressure creates disagreement rather than resolving it.
Meanwhile harvest now, derive later has already crystallized. The exposure data is permanent. The migration window stays open only until an attacker can derive those keys faster than their owners can move the coins.
That combination is why I work on intermediate architecture. Quantum parking is my attempt: a Bitcoin-side P2WSH address that never spends, so the key never appears, with a wrapped representation on a STARK-based environment whose proof layer rests on collision-resistant hashes rather than curve pairings. The one-way constraint is the defense, not a limitation: redemption requires spending the reserve, and spending is the exposure. What it does not fix is the operator set, still a trust anchor under the same ECDSA assumptions, and a STARK proof system is not a post-quantum operational stack. This is a design proposal, not a custody recommendation. Without a consensus-supported exit, quantum parking exchanges one exposure for another and risks making permanent wrapped representation the default by attrition.
What would change my mind
The claim worth testing is not that quantum computing threatens ECDSA; everyone shares that premise. It is the ranking: coordination speed binds harder than cryptography, and the wrappers reprice before the base asset. Falsify it on both halves. First, measure consensus velocity on changes addressing on-spend exposure, proposal to mainnet activation. Two consecutive changes of that class shipping materially inside Bitcoin's own base rate, under real disagreement rather than uncontested cleanup, and coordination is not the binding constraint I claim. Second, survey the major wrapped BTC issuers and bridge operators. If they publish reserve address formats, non-reuse policies, and dated PQC migration plans ahead of protocol support, and their pegs hold through two publicized quantum hardware milestones without persistent discount, the infrastructure is not the weak link I take it to be.