Why Institutions Are Asking This Now
Post-quantum readiness has moved onto the agenda for allocators evaluating bitcoin. Firms such as BlackRock have added expanded quantum-computing risk disclosures to their spot bitcoin ETF prospectuses, and VanEck's research team has published on Bitcoin's quantum adaptation window. The question is increasingly part of standard custody diligence. Treating it as a normal item on a risk checklist, the same way a counterparty would ask about cold storage, insurance, or audit posture, is the appropriate response.
The question has surfaced now because of timing. Standards bodies have begun publishing deadlines for retiring the cryptography that quantum computers could eventually threaten. When a public body sets a deprecation target, every institution holding assets secured by that cryptography inherits a planning question. Bitcoin is no exception, and a fiduciary with a long horizon has a duty to understand where the asset sits relative to those deadlines.
A Risk-Management Frame, Not a Headline
Most coverage of quantum computing and Bitcoin is written for a general audience and pitched at a threat level beyond what the evidence currently supports. For an institution, the useful frame is sober and specific: what exactly is exposed, on what timeline, and what controls reduce the exposure. The rest of this article works through that frame so a treasury team, fund operator, or custody buyer can form an independent view and ask the right questions of any provider.
What Is Actually at Risk
Bitcoin uses two kinds of cryptography, and quantum progress affects them very differently. Getting this distinction right is the foundation of any sound institutional assessment.
Signatures Are the Exposure; Hashing Is Largely Not
Ownership of bitcoin is proven with digital signatures built on elliptic curve cryptography. Bitcoin uses two schemes: ECDSA for legacy and SegWit version 0 outputs, and Schnorr for Taproot outputs. A large, error-corrected quantum computer running Shor's algorithm could in principle recover a private key from an exposed public key, which would let an attacker move funds protected by that key. This is the real exposure, and it is specific to signatures.
The SHA-256 hashing behind mining and block structure is far less affected. The relevant quantum method there, Grover's algorithm, offers only a quadratic speedup, leaving roughly 128-bit security intact, which remains well beyond practical brute force for the foreseeable future. For an institution, this means the asset's monetary properties and the integrity of the ledger are not the concern. The concern is the spending authority over specific holdings whose public keys are exposed on-chain.
Address Posture Determines Exposure
Whether a holding is exposed depends on whether its public key is visible. Taproot (P2TR) addresses expose a version of the public key as soon as they are funded, before any spend, and stay exposed until a quantum-safe spending path activates. The older formats (P2PKH, P2SH, P2WPKH, P2WSH) keep the public key hidden behind a hash until the first spend, at which point the key appears in the mempool before being recorded on-chain. Address reuse erodes this protection: any balance left behind on an address that has already been spent from sits behind a revealed key.
The operational implication for custodians is concrete. Address management practices, specifically avoiding reuse and limiting how many holdings sit behind exposed public keys, are part of a custodian's quantum posture, not an unrelated hygiene detail. A provider that reuses addresses or consolidates funds into long-lived exposed outputs carries more of this specific risk than one that does not.
| Bitcoin component | Cryptography | Quantum exposure | Institutional relevance |
|---|---|---|---|
| Spending authority (signatures) | ECDSA and Schnorr | Recoverable by Shor's algorithm on a large machine, where the public key is exposed | The asset to manage: exposure depends on address posture and migration readiness |
| Ledger and mining (hashing) | SHA-256 | Only a quadratic speedup from Grover's algorithm; roughly 128-bit security remains | Not a material concern for holdings under current understanding |
The Time-Horizon Question
The defining feature of the institutional case is duration. A retail holder who can move funds in minutes has a different risk profile from a treasury or fund that holds bitcoin for years under layered controls and may face notice periods, board approvals, or operational windows before assets can be moved.
When Holding Horizon Meets Migration Horizon
Expert consensus places a cryptographically relevant quantum computer at least a decade away, with wide uncertainty and progress in error correction lagging progress in qubit count. Demonstrated qubit counts measure hardware, not functional cryptographic capability, and the two should not be conflated. That uncertainty is why standards bodies have set deprecation targets rather than waiting for proof of a threat.
The U.S. National Institute of Standards and Technology (NIST) has published deprecation targets for the affected cryptography, including ECDSA, that begin near the end of this decade, and Google's security team has recommended similar migration horizons for sensitive systems. For an institution with a ten-year-plus horizon, the holding period can overlap those deadlines. That overlap is the substance of the institutional question. It gives a fiduciary a reason to ensure the custody arrangement is ready to migrate within the holding period, without being a reason to avoid the asset.
Why Planning Beats Panic
Nothing about the current state of quantum hardware justifies selling holdings, moving in haste, or paying for products that promise protection against a threat that does not yet exist. Be skeptical of any vendor that frames quantum as an emergency requiring an immediate purchase. The fiduciary failure mode here is not under-reacting today; it is having no plan when migration paths arrive. Planning costs little and preserves optionality, whereas reacting in haste tends to destroy value without reducing the underlying risk.
Due Diligence on a Custodian's Quantum Posture
Because quantum is a planning question, it belongs in custody diligence as a set of evaluation criteria the institution applies itself, the same way it would assess any provider. The following questions let a buyer judge a provider's readiness without relying on marketing claims.
Questions to Ask Any Provider
- Does the provider track post-quantum standards? A credible custodian can describe, in plain terms, how it monitors NIST timelines and Bitcoin protocol developments, and who owns that responsibility internally.
- Does the provider's address management limit exposure? Ask whether the provider avoids address reuse and limits how many holdings sit behind exposed public keys. This is a concrete, checkable practice, not an aspiration.
- Is there a documented migration plan tied to external timelines? A provider should be able to state what it would do, and roughly when, if and when a quantum-safe Bitcoin spending path activates. A plan referenced to NIST deprecation targets is stronger than a vague assurance.
- Does the client retain the control needed to migrate? Confirm that the custody arrangement lets the client move funds to a new output type when the time comes, rather than leaving that entirely to the provider's discretion or schedule.
- Can the provider verify holdings independently? On-chain verifiable reserves and a clear audit trail make it possible to confirm what is held and where, which is a prerequisite for any orderly migration.
Treat vague, deflecting, or absent answers as a finding to weigh, not necessarily a disqualifier. The point of the exercise is an informed comparison across providers, applied by the institution against its own risk tolerance.
Control and the Migration Path
A recurring theme in these questions is control. An institution that depends entirely on a third party's timeline inherits that party's risk appetite and operational pace. Custody models that keep the client in control of when and how funds move preserve the ability to migrate on the institution's own schedule. For an asset whose protection may need to change within the holding period, retaining that control is itself a risk-management feature. The related questions of how institutions structure custody and what a qualified custodian provides are covered in what is a qualified custodian and how businesses and institutions take custody of bitcoin.
The Migration Path and Its Uncertainty
A clear-eyed institutional view has to hold two facts at once. Bitcoin has a credible route to quantum resistance, and the specifics of that route remain open.
How a Quantum-Safe Upgrade Would Reach Bitcoin
Changes to Bitcoin begin as Bitcoin Improvement Proposals (BIPs), reviewed openly and adopted only on broad consensus across developers, miners, node operators, and the economic network. A quantum-resistant upgrade would follow that path: a proposed spending path using post-quantum signatures, vetted in public. The BIP 360 proposal is one published effort toward a quantum-resistant output type. The building blocks are available: in August 2024 NIST finalized two post-quantum signature schemes, ML-DSA and SLH-DSA, alongside one key encapsulation mechanism, ML-KEM. Several earlier candidates were broken during standardization, which is the open process working as intended.
The Honest Uncertainty
The migration path carries genuine open questions. The community has not settled on a single design, post-quantum signatures are larger than current ones and carry different trade-offs, and the timing of any Bitcoin upgrade depends on a deliberate consensus process that does not run to a fixed schedule. That deliberate pace is a strength for an asset whose value rests on getting security right, but it means an institution cannot treat the exact upgrade or its date as fixed. The responsible position is to plan around a path that exists in research and proposal form, while acknowledging that its final shape may change.
Blockstream Research and Liquid as a Proving Venue
Blockstream Research, working with external co-authors, is among the groups studying how post-quantum signatures could fit Bitcoin's constraints. One line of that work is a hash-based design whose only cryptographic assumption is the security of SHA-256, the hash function Bitcoin already relies on; reusing a trusted assumption rather than introducing a new primitive is a deliberate feature. One exploration of that direction is a proposed concept named SHRINCS, under active research with open questions. It is a research effort, not a finished proposal or a scheduled release.
Blockstream cannot merge changes into Bitcoin unilaterally; no party can. What Blockstream can do is propose BIPs, collaborate with the wider community, and ship new cryptography as a smart contract on the Liquid Network, a Bitcoin layer-2, without a network-wide consensus change on Bitcoin itself. Some post-quantum primitives may exceed the computational limits of Liquid's contract environment, so not every design ports cleanly, but Liquid still offers a venue to prove out approaches ahead of any Bitcoin upgrade. For an institution assessing providers, this is the practical signal to look for: a custody and infrastructure provider whose research arm actively studies the problem and whose enterprise infrastructure sits on a network where post-quantum designs can be tested. The deeper technical resource is blockstream.com/quantum.
Frequently Asked Questions
Is quantum computing an immediate risk to institutional bitcoin holdings?
No. No quantum computer today can break the cryptography that secures bitcoin, and reaching that point requires several major engineering breakthroughs rather than steady progress. For institutions, quantum is a planning question over a multi-year horizon, not an immediate operational threat. The prudent posture is to track the field and confirm a custodian's migration readiness, and to be skeptical of any vendor framing quantum as an emergency that requires an immediate purchase.
Why does quantum computing matter for long-term bitcoin holders?
Because the holding horizon can overlap the migration horizon. An asset held ten or more years may still be in custody when standards bodies expect the affected cryptography to be deprecated, with NIST targets beginning near the end of this decade. That overlap makes quantum a governance item for treasuries and funds: a reason to confirm the custody arrangement can migrate to a quantum-safe path within the holding period, rather than a reason to sell.
What should due diligence on a custodian's quantum posture cover?
Ask whether the custodian tracks post-quantum standards and who owns that internally, whether its address management avoids reuse and limits exposed public keys, whether it has a documented migration plan tied to NIST timelines, and whether the client retains the control needed to move funds to a quantum-safe path. On-chain verifiable reserves support an orderly migration. Treat vague or absent answers as a finding to weigh against your own risk tolerance.
Can Bitcoin adopt post-quantum cryptography without selling holdings?
Yes, if the network adopts a quantum-resistant spending path. Holders would move existing bitcoin to the new output type through ordinary transactions once such a path activates. The asset does not change; the cryptography protecting it does. This is why retaining the ability to transact on the institution's own schedule, rather than depending entirely on a third party's timeline, matters for long-term holders.
How is Blockstream positioned on post-quantum readiness?
Blockstream Research, with external co-authors, studies post-quantum signature designs for Bitcoin, including hash-based approaches whose only cryptographic assumption is the security of SHA-256, which Bitcoin already uses. Blockstream can propose upgrades through the BIP process and ship new cryptography on the Liquid Network without a network-wide consensus change on Bitcoin, which makes Liquid a venue for proving out designs ahead of any Bitcoin upgrade. The deeper resource is blockstream.com/quantum.