> ## Content Index > Fetch the complete content index at: https://www.murrayrudd.pro/llms.txt > Use this file to discover other available public pages before exploring further. # Bitcoin’s Post-Quantum Migration Problem - URL: https://www.murrayrudd.pro/bitcoins-post-quantum-migration-problem/ - Published: 2026-08-26T23:33:55.000Z - Updated: 2026-08-26T23:33:55.000Z - Description: Explore how Bitcoin could adopt post-quantum signatures while managing wallet state, custody, block-space costs, and dormant-coin recovery. - Author: Murray Rudd - Tags: Quantum computing, #briefing note, a16z, Security, Dan Boneh ### Summary On August 22, 2026, *a16z crypto podcast* guest Dan Boneh argued that Bitcoin can survive quantum computers but only through a deliberate migration from elliptic-curve signatures to post-quantum signing systems. The leading path described combines hash-based signatures for conservative on-chain verification with stateful short-term keys for efficiency and, potentially, lattice-based mechanisms for private threshold custody. The transition shifts critical risk from cryptographic theory alone toward wallet state management, blockspace economics, custody architecture, protocol governance, and the treatment of dormant Bitcoin. ### Take-Home Messages 1. **Migration timing**: Bitcoin needs post-quantum spending paths in place early enough for active holders to move before legacy elliptic-curve signatures become unsafe. 2. **Hash-based security**: Hash-based signatures can minimize new consensus-layer cryptographic assumptions but they impose larger signatures and remove some algebraic wallet functions. 3. **Wallet state**: Stateful few-time signatures can reduce signature size but wallets must prevent counter rollback and key reuse through reliable local state management and recovery design. 4. **Threshold custody**: Institutional signers may be able to use lattice-based threshold mechanisms privately while presenting ordinary hash-based signatures to Bitcoin. 5. **Dormant coins**: Bitcoin still needs a credible policy for proving ownership and recovering coins that remain under legacy signatures when quantum attack eventually makes those signatures forgeable. ### Overview Bitcoin currently relies on elliptic-curve signatures that would become vulnerable to sufficiently capable [quantum computers](https://www.murrayrudd.pro/tag/quantum-computing/), so the network requires a post-quantum transaction path before such attacks are practical. Boneh describes hash-based signatures as the most likely direction because Bitcoin developers can avoid placing new lattice assumptions directly into consensus validation. The resulting migration is therefore shaped as much by the community’s preference for conservative cryptographic assumptions as by raw algorithmic performance (see my [draft chapter 6 on quantum computing in by forthcoming book for more on values and preferences in the migration](https://www.murrayrudd.pro/when-evidence-falls-behind/)). Stateless hash-based schemes such as SLH-DSA offer strong security but generate signatures far larger than current Bitcoin signatures and can require very expensive signing operations. Shorter stateful one-time or few-time signatures reduce that burden by rotating keys but the wallet must reliably remember which state has already been used. This converts state synchronization, counter freshness, secure storage, and recovery from implementation details into core elements of transaction security. The proposed architecture separates a long-term stateless recovery key from a short-term stateful key used for routine transactions, with the short-term key updated as transactions occur. If a wallet loses confidence in its state, the long-term key can reinitialize the short-term chain rather than risking accidental key reuse. Hardware wallets must therefore support persistent state across devices, accounts, and possibly chains while protecting against stale state restored from external storage. Post-quantum migration also affects advanced custody and protocol economics because hash-based signatures lack algebraic properties used by current key-derivation and threshold-signing systems. Boneh’s proposed threshold method keeps the final signature hash-based while using a lattice-based context-aware threshold mechanism privately among signers, allowing the blockchain to remain unaware of the custody structure. Even with such constructions, Bitcoin must still decide how to handle larger signatures, distributed key generation, changing signer sets, and coins that never migrate away from vulnerable legacy outputs. ### Implications and Future Outlook Wallet and custody providers must treat post-quantum migration as a systems-engineering program rather than a simple cryptographic library update. They will need secure state persistence, rollback protection, recovery procedures, hardware acceleration, and testing for multi-device and multi-account failure modes. The operational maturity of these components may determine whether stateful hash-based signatures are acceptable at scale. Bitcoin protocol developers must decide how to price and accommodate signatures that may be many times larger than current signatures. Options discussed indirectly through the tradeoff include accepting higher transaction weight, changing block-space rules, or reconsidering block-size constraints, each of which carries network resource and governance consequences. The cryptographic transition can therefore reopen long-standing questions about validation costs and decentralization even if transaction throughput remains unchanged. A separate governance framework will be required for legacy coins whose owners fail to migrate before elliptic-curve signatures become forgeable. One proposed direction is to disable vulnerable signatures after an observable quantum break and route affected coins through a distinct recovery process supported by pre-quantum evidence of control. Designing that process [demands advance agreement on admissible evidence, ownership claims, attack resistance, and the limits of protocol discretion](https://www.murrayrudd.pro/when-evidence-falls-behind/). ### Some Key Information Gaps 1. **What technical indicators or governance triggers should determine when Bitcoin moves from optional post-quantum support to restrictions on legacy signatures?** A defensible trigger framework would connect uncertain technological progress to predictable protocol action and reduce both premature intervention and delayed migration. 2. **What wallet-state architectures can make accidental reuse of stateful one-time or few-time signing keys practically negligible?** This determines whether the most space-efficient hash-based approaches can meet the operational reliability expected of production wallets and custody systems. 3. **How would larger post-quantum signatures affect Bitcoin block propagation, validation costs, fee markets, and node resource requirements?** Quantifying these effects is necessary to evaluate protocol changes without treating signature expansion as a purely cryptographic issue. 4. **Can threshold hash-based signing provide institutional custody with signatures indistinguishable from ordinary single-key signatures at acceptable latency and computational cost?** The answer will shape whether post-quantum custody can preserve distributed control while keeping internal governance private and on-chain verification simple. 5. **What recovery evidence could legitimately establish ownership of dormant Bitcoin after elliptic-curve signatures no longer prove historical control?** This is central to designing a recovery regime that protects legitimate owners without converting quantum migration into an open-ended discretionary claims process. --- ## Broader Implications ### Cryptographic migration becomes institutional migration Replacing a foundational signature scheme changes operating procedures, custody standards, hardware requirements, recovery rules, and governance expectations at the same time. Security therefore depends on coordinated institutional adoption rather than on the existence of a mathematically secure replacement alone. Technologies with long-lived assets or credentials should treat cryptographic agility as an organizational capability that must be developed before the incumbent primitive fails. ### Conservative protocols can externalize complexity A protocol can minimize consensus-layer assumptions by choosing simple or conservative verification rules while allowing users and service providers to adopt more complex cryptography privately. This separation can preserve a narrow trusted base, but it transfers engineering and assumption risk to wallets, custodians, and other edge institutions. Governance should therefore evaluate not only what complexity is removed from the protocol, but where that complexity reappears and who bears its failure costs. ### Security transitions can alter infrastructure economics Larger signatures and more demanding signing procedures can change storage, bandwidth, hardware, and fee requirements even when the underlying application remains unchanged. Cryptographic upgrades may therefore redistribute costs across users, validators, service providers, and specialized hardware vendors. Infrastructure planning should incorporate these economic effects before migration choices become urgent. ### Legacy ownership requires evidence beyond current authentication When a signature scheme becomes forgeable, possession of a valid signature can cease to distinguish a legitimate historical owner from an attacker. Long-lived systems may therefore need time-stamped commitments, migration records, or other evidence that survives the failure of the original authentication primitive. Designing such evidence in advance reduces the need for discretionary recovery after the security transition has already occurred. --- ## Sign up for Futures Insight Research Evidence-driven insights on emerging technologies & their impacts Subscribe Email sent! Check your inbox to complete your signup. No spam. Unsubscribe anytime.