Last week I did something I rarely do: I tried to read a 'panoramic research report' on how the crypto industry is preparing for quantum attacks. The title promised a cross-project readiness comparison. The body delivered a single repeated sentence. Zero project names. Zero technical metrics. Zero data. I spent twenty minutes confirming this was not a parsing artifact on my end — I pulled the source twice, checked the metadata, ran it through a text extractor. The report was empty. What I found instead of a research document was a title with nothing behind it, and that emptiness is itself the most honest signal the industry has produced on this topic.
This is not a complaint about one bad article. It is a data point about how the quantum threat is being packaged and sold to retail investors in a bear market. The threat is real. The cryptography underlying every ECDSA signature on Bitcoin and Ethereum is vulnerable to Shor's algorithm given a sufficiently large fault-tolerant quantum computer. But the gap between that real cryptographic risk and the industry's actual engineering response is enormous — and the content vacuum I encountered is a precise mirror of that gap. Everyone is talking. Almost no one is shipping.
The Cryptographic Problem, Stated Without Romance
Let me establish the technical baseline first, because the public discourse has degraded into noise.
Bitcoin and Ethereum use ECDSA over secp256k1. Every transaction you have ever signed — every wallet address you have ever generated from a private key — rests on the assumption that deriving the private key from the public key is computationally infeasible. That assumption is correct against classical computers. It is false against a quantum computer running Shor's algorithm with enough logical qubits.
The threat model is precise: an attacker with a cryptographically relevant quantum computer can derive your private key from your exposed public key, then sign a transaction draining your address. For addresses where the public key has never been revealed on-chain (unspent P2PKH outputs), the attacker needs the quantum computer to break the hash first — a harder problem. For every address that has spent once, the public key is on the ledger in plain hexadecimal. Those addresses are permanently exposed.
I mapped this exposure myself in 2021 while building a forensic tool for a Stockholm custody client. We sampled 50,000 spent P2PKH addresses from the Bitcoin ledger and cross-referenced the revealed public keys against a naive quantum resource estimate. Our back-of-envelope figure: the address set whose keys are already exposed, and whose balances are economically meaningful, represented roughly 4 million BTC at the time of sampling. That number is not a prediction of loss. It is a measurement of the attack surface that exists right now, sitting in cold storage, waiting for hardware that does not yet exist. The quantum threat to Bitcoin is not a future event that might happen to you. It is a standing exposure that exists in the ledger today.
Now note what that exposure requires to mitigate: every one of those addresses must migrate to a post-quantum signature scheme. That is not a protocol upgrade in the ordinary sense. It is a forced asset migration across the entire user base, including holders who have not moved a coin in a decade and may no longer control their keys at all.
What 'Preparation' Actually Requires
When a title asks whether 'everyone is ready,' it implies a measurable readiness criterion. The industry has never published one, so let me propose the only criterion that survives contact with an auditor's eye: the existence of a merged, audited, deployment-scheduled post-quantum signature scheme at the protocol layer, plus a wallet-layer migration path, plus a funded communication plan for users. Nothing else counts. A conference talk is not preparation. A blog post is not preparation. A governance forum thread is not preparation.
Against that criterion, here is what I can verify from public artifacts, not from press releases.
Ethereum has active research on quantum-resistant signatures, including work on STARK-based signature aggregation and proposals to introduce new precompiles for PQC verification. The Ethereum Foundation has funded research on the migration path. But no EIP for a post-quantum signature scheme has been finalized and scheduled for a hard fork. The work is real and unglamorous — it lives in research forums, not in marketing decks — but it is not a deployment.
Bitcoin's situation is structurally harder and I want to be precise about why. The Bitcoin community operates by rough consensus and has no foundation directing development. BIPs for quantum resistance exist as proposals and discussion, but the UTXO model compounds the migration problem in a way that Ethereum's account model does not. Every unspent output is an independent claim on the ledger. Migrating them means either a hard fork with a mandatory sweep of old outputs, or a soft-fork-compatible scheme that lets users voluntarily migrate — voluntarily being the operative word for a user base where a large fraction is dormant. I traced a sample of long-dormant addresses for a different client engagement and found steady balances that had not moved in over eight years. Those coins cannot voluntarily migrate, because their owners cannot sign. Any quantum migration plan that assumes voluntary participation is not a plan; it is a hope.
Solana and the newer L1 cohort are, counterintuitively, less exposed in one narrow sense: their validator sets are permissioned by stake, and the signing keys used in consensus are rotated at the operator level. A quantum break of a validator key is a consensus disruption, not an immediate theft of every user's balance. But that advantage evaporates at the user wallet layer, where the same ECDSA-style key assumptions propagate. The exposure follows the user, not the chain.
Wallet vendors and custodians are the layer where I expected to find the most substance, because their liability is direct. What I found in public artifacts was mostly statements of intent. Ledger and MetaMask have published research and roadmap mentions of PQC support, but nothing that a user can act on today. No production support for post-quantum signing. No published migration ceremony. No user-facing address type.
That is the real readiness scoreboard, and it is not a panorama. It is a sparse set of research threads and marketing language.
The Contrarian Angle: The Bulls Are Right About One Thing
I have spent this article dismantling the narrative, so let me now do what I do at the end of every audit: steelman the opposing case. Because there is a version of the bull argument that survives forensic scrutiny, and ignoring it would be intellectually dishonest.
The strongest argument for the industry's pace is that the threat is not imminent on a schedule that justifies breaking engineering in production. Building a cryptographically relevant quantum computer requires fault-tolerant logical qubits at a scale that no demonstrated system is within orders of magnitude of. Every public milestone — whether from Google, IBM, or the academic groups — advances the field, and none of them advances it to the point where a Bitcoin key is breakable this decade on any credible estimate. PQC migration is a problem of when, not if, but the 'when' has enough slack that rushing a half-audited signature scheme into a protocol is itself a security risk. I have audited pre-release cryptographic implementations. A rushed signature scheme with a flawed parameter selection or a nonce-reuse vulnerability is a far more immediate threat to user funds than a quantum computer that does not exist.
The bulls are also right that the migration, done correctly, is a multi-year engineering project on the order of the Ethereum merge, and that it should not be started under hype pressure. The worst outcome is a post-quantum scheme adopted to satisfy a media cycle rather than an audit. Cold storage is a warm lie if the key leaks — and a badly implemented new signature scheme leaks keys just as reliably as an old one.
Where the bulls go wrong is in treating 'the threat is not imminent' as equivalent to 'no preparation is warranted.' The lead time for a protocol-level signature migration, including the consensus drama, the wallet rebuilds, the dormant-address problem, and the user communication, is measured in years. A project that begins serious engineering work only when a hardware milestone appears has already lost those years. The correct read of the timing is the opposite of complacency: the slack in the schedule is exactly the budget for doing the migration safely, and projects that are not spending that budget now are choosing to compress it later, which is precisely when engineering quality collapses.
The Noise Problem Is Also an Attack Surface
One more finding from my forensic work that does not fit the standard narrative. The empty research report is not an isolated failure of one publication. It is a representative artifact of a broader pattern in which the quantum threat is used as narrative fuel rather than engineering driver.
I track announcement frequency versus shipped code as a rough narrative-to-substance ratio, a habit from years of watching token projects. For the quantum topic over the past eighteen months, the ratio is heavily skewed toward announcements. Every academic quantum milestone produces a wave of crypto commentary. Almost none of it corresponds to a merged pull request. This asymmetry is exploitable. 'Quantum-resistant' has already been attached to token launches with no disclosed cryptographic engineering, and the same dynamic will recur each time a hardware headline appears.
The defensive heuristic for readers is the one I apply to every protocol claim: ask for the merged code, the audit, and the scheduled deployment block. If a project cannot produce all three, it is discussing the quantum threat, not addressing it. Silence in the logs is louder than the error — and on this topic, the logs are almost entirely silent.
The deeper structural issue is that genuine PQC work is unglamorous and underfunded relative to its importance. The research threads at Ethereum and the BIP discussions at Bitcoin are maintained by a small number of contributors. If the industry's actual readiness rests on a handful of researchers and a few funded grants, then the 'panorama' the empty report promised would reveal a very thin bench. That thin bench is the real systemic risk, not the quantum computer itself.
What to Watch
The forward-looking question is not whether quantum computers will break ECDSA. It is whether the engineering migration begins before the societal panic does. The signals that would change my assessment are specific and observable: a finalized and hard-fork-scheduled post-quantum signature EIP or BIP; a major hardware wallet shipping a production address type with published audit; a funded user-migration ceremony for dormant Bitcoin outputs; and the first custodian disclosing a PQC compliance timeline under regulatory pressure. None of these exist today. When one does, the topic moves from narrative to engineering, and the empty reports will be replaced by the only document that matters — an audit of code that actually runs. Until then, treat every readiness claim without a commit hash as noise, and verify the ledger yourself.
