The industry keeps asking when a quantum computer will be powerful enough to crack Bitcoin. Elliptic-curve cryptography has been known to be quantum-vulnerable for more than thirty years, and crypto still has no mechanism to make everyone move off it.
Fortune put the exposure at $2 trillion in digital assets secured by elliptic-curve cryptography, against a total crypto market worth $2.8 trillion. Nearly the whole asset class rests on cryptography the industry already agrees is finished.
Developers can introduce new signature types, but moving the assets depends on custodians acting for clients and on self-custodied holders acting for themselves.
Participation stays optional, and delay stays rational until the risk changes abruptly.
The Cost of Moving First
NIST has already standardized replacement signature schemes, so post-quantum solutions are available today. Replacing ECDSA with ML-DSA requires rework, because the new signatures and public keys are much bigger.
Custody providers also depend on something they don’t control: a wallet can’t go post-quantum on its own. The underlying network has to support the new signature type before a custodian can move anything onto it.
Signatures are only one place cryptography sits in these systems. Peer-to-peer communications, consensus, zero-knowledge proving systems, bridges, and custody infrastructure each rest on their own assumptions, and hardening transaction signatures does nothing for the rest of them.
The incentive to wait is the harder obstacle. Early movers pay now for redesign, custody changes, hardware support, and new operating procedures while the threat still feels distant.
Later movers can let others absorb those costs first and adopt more mature tools. Delay therefore looks rational to each participant even as it increases the industry’s collective exposure.
Some assets may never be migrated at all, and Coinbase has flagged the unresolved problem of abandoned or unmigrated coins. Inactive holders are slow to act on voluntary upgrades, and abandoned or lost accounts never will.
Voluntary Coordination Needs Teeth
Coinbase offers a useful place to start because its distinction between Bitcoin’s core infrastructure and wallet-level exposure is technically right. Bitcoin’s hashing, mining, and historical ledger differ from the signature layer a quantum computer would attack.
Calling the immediate vulnerability wallet-level stops a real cryptographic risk from being read as a claim that all of Bitcoin fails at once.
“Wallet-level” identifies where the cryptography breaks, while the economic damage can travel far beyond that boundary.
A single wallet can hold billions of dollars, and an administrative key can carry authority over a major stablecoin. Enough value or control behind one vulnerable signature can transmit a failure through markets, counterparties, and protocols that were never attacked directly.
Custody collapses the boundary between a local technical failure and a systemic financial event. Cold storage protects a private key from theft or device compromise; it does nothing if an attacker can derive that key from an exposed public key.
Multisig still protects against operational failures, but five locks don’t help if they all share the same vulnerable mechanism.
Changing the underlying mathematics carries real costs. A raw ECDSA signature is 64 bytes. An ML-DSA-65 signature is 3,309 — fifty-two times larger — and ML-DSA-87 runs to 4,627, before counting the public keys, which also grow.
That weight lands on bandwidth and storage, on fees, on throughput assumptions made when signatures were small, and on hardware wallets and custody systems designed around the old sizes.
That incentive to wait is why a voluntary migration eventually needs consequences. Protocols can deprecate legacy signatures, while exchanges and custodians can stop supporting vulnerable address types and keys.
Insurers can price classical exposure differently, and institutional counterparties or regulators can impose requirements of their own. At some point, staying on the old cryptography has to become more costly than moving.
The First Scare Will Set the Clock
Pressure will arrive unevenly across the digital asset industry. Large custodians and exchanges will move first because they concentrate visible, high-value targets. Some custody infrastructure is already adapting.
Post-quantum signature support is integrated directly into at least one hardware wallet line, though network support still determines where that protection can be used. Smaller providers and individual holders will move more slowly.
An open-ended migration window leaves vulnerable wallets as a permanent legacy pool waiting for quantum capability, crypto’s version of unclaimed property. A cutoff forces a political decision about whether to freeze, burn, or otherwise restrict assets whose owners failed to migrate or could not migrate. Every available option carries a governance cost.
Google’s 2029 migration target is a plan for Google’s own systems. It does not determine when Q-Day arrives.
Crypto cannot treat 2029 as permission to wait because migrations across protocols, wallets, custodians, exchanges, and holders take years.
The first credible scare will force this migration. Setting a date now is the only version of this where the industry chooses the terms.
It needs a dated requirement in place before that moment, whether through protocol rules, regulated custody standards, or market-access requirements. Otherwise, the date gets set by a regulator, or by whoever runs the first successful attack.
