In a co-working space in Berlin last month, an engineer I've known since the 2022 bear market opened a script-budget calculator and typed one number into it: 2,420 โ the byte size of a single ML-DSA signature, one of the lattice-based schemes NIST standardized in 2024. Beside it he typed 64, the size of an ECDSA signature, and ran both against Bitcoin's four-million weight ceiling.
For a moment nobody said anything. That is the specific silence of a hypothetical becoming an invoice.
The ratio โ roughly thirty-eight to one in raw bytes, worse once witness overhead is counted โ is the part of the post-quantum conversation nobody bothers to argue about, because it cannot be argued with. Signature size is physics. Migration politics is weather. And most of the coverage that reached me this week spent its words on weather: describing how Ethereum and Bitcoin are taking "different paths" toward quantum resistance without once saying where the fork in the road actually sits.
The material itself was thin in the way that matters โ a summary with no publication date, no named developers, no proposal numbers, no on-chain or market data. What it did convey was that both ecosystems now treat public-key cryptography as a liability with an expiration date, and that Bitcoin's route, P2MR, does not add post-quantum signatures at all.
That clause is where a careless reader stops and concludes Bitcoin is doing nothing. Hold that thought.
The longer context is a narrative cycle I have watched through three iterations. SegWit took years of acrimony to activate. Taproot took four more and sailed through, because by then everyone had priced a fight and found it expensive. Account abstraction on Ethereum consumed half a decade of EIPs before wallets actually shipped it. Changes at the signature layer are not product launches; they are constitutional conventions held in public, with comment periods measured in years.
The external clock is not set by either chain. NIST finalized FIPS 203, 204 and 205 in 2024. NSA's CNSA 2.0 guidance asks national-security systems to begin migrating in the early-to-mid 2030s. Those are government cryptography-modernization deadlines, and they will push custodians and ETF administrators long before either chain feels internal pressure. Chasing the alpha through the digital fog means noticing that the forcing function here is procurement, not price.
The fork is in the stack, not the cipher
Here is the thing the "different paths" framing obscures: the divergence is not cryptographic philosophy. It is the layer at which the change must happen, and that layer determines everything downstream โ cost, timeline, political risk, who gets to decide.
Ethereum's smart contracts can already verify arbitrary signature schemes, including hash-based and lattice-based ones. That capability is in production, not on a roadmap. Supporting post-quantum signatures on Ethereum is therefore not a research problem; it is a standards-and-adoption problem, and adoption problems are solved by wallets, not by hard forks.
Bitcoin has no such escape hatch. Its UTXO validation logic is welded into the script system, so a new signature type is a consensus change: BIP discussion, rough consensus, activation mechanism, and the standing possibility of a chain split. This is not a criticism. It is simply the price of the design that makes Bitcoin what it is.
The lock nobody talks about
The most valuable sentence in the reporting was also its shortest: protecting existing accounts by adding new signers is not enough. That is technically correct, and it is the part that should worry anyone holding assets rather than trading narratives.
An Ethereum EOA address is a hash of a public key. The moment that account sends its first transaction, the public key is on-chain permanently, and an attacker with a cryptographically relevant quantum computer could work backward from it. There is no retroactive fix. Every active address has already crossed the line where its exposure began.
Contract wallets can verify post-quantum signatures, which is genuinely useful โ but the authority to swap the verification logic is typically still held by an ECDSA key. The key that changes the lock is still the old lock. In my 2017 audit of the Tezos ICO, the lesson that stuck was not about the consensus algorithm itself but about reading the admin keys before reading the whitepaper. Same instinct applies here: follow the root authority, not the feature list.
Bitcoin's P2MR makes the opposite bet, and it is far more interesting than the headlines suggest. By removing key-path spending and keeping only the script path, it eliminates the moment where a full public key is voluntarily revealed on-chain. It does not provide post-quantum signatures. It clears the ground so that a future post-quantum opcode can be dropped onto a surface that does not leak keys. One chain is defusing a mine; the other is paving a road.
Physics always sends the bill
Then there is the number my Berlin engineer typed into his calculator. Lattice signatures run to roughly 2.4 kilobytes; hash-based signatures reach tens of kilobytes; ECDSA sits at 64 bytes. Under a four-million weight ceiling, a post-quantum spend could cost an order of magnitude more block space than a classical one.
That does not merely raise fees. It reopens the block-size argument the industry supposedly settled in 2017, because the only way to absorb larger signatures without pricing ordinary users out is to change the weight policy โ and changing weight policy is exactly the kind of consensus question that turns mailing lists into battlegrounds.
Anyone who has watched blockspace markets should recognize the pattern. Cheap space is always temporary. Post-Dencun blob capacity looked infinite for about eighteen months before demand started pressing the ceiling; on current trajectory the rollups will be bidding against each other for blobs long before the next halving cycle finishes. Post-quantum signatures will do to L1 block space what blobs did to data availability: convert an abstract engineering cost into a very concrete fee line.
The overhang nobody prices
Mapping the invisible architecture of value requires looking past tokenomics to supply structure. Roughly 1.7 million BTC sit in early pay-to-public-key outputs whose keys have been exposed on-chain for over a decade โ including the coins generally attributed to Satoshi. These are not "locked" in any cryptographic sense that survives a quantum adversary.
That creates a risk profile with no analogue in conventional asset analysis: not inflation, not unlocks, but an event-driven supply overhang that could move non-linearly. If credible progress toward a cryptographically relevant quantum computer appears, the rational move for every holder of an exposed address is to move first. The rush becomes self-fulfilling. And any proposal to freeze or confiscate vulnerable coins would trigger a property-rights fight that does more damage to Bitcoin's social contract than the cryptography ever could. Hunting ghosts in the blockchain ledger is usually a metaphor; here it is literal.
The metric that would actually measure urgency โ the share of circulating supply sitting in addresses with exposed public keys โ is published by almost nobody. Until it is, we are estimating migration pressure from press releases, which is like estimating rainfall from umbrellas.
The contrarian read
The consensus interpretation of this news is that quantum risk has become an engineering problem. I think it is a coordination problem wearing engineering clothes, and that the market will monetize it in the worst possible order.
Expect quantum-safe concept tokens to front-run the infrastructure. They have no migration debt, no legacy addresses, no coordination cost โ which is precisely why they will pump first and decay fastest. Meanwhile the genuinely load-bearing work will be boring: hardware wallet firmware, key-rotation semantics, wallet UX for migration, and the unglamorous business of convincing two million users to move assets they have no reason to move until they are frightened. MiCA taught European builders that compliance is a fixed cost that scales inversely with your balance sheet; cryptographic migration will follow the same arithmetic, and it will squeeze small custodians hardest.
The subtler repricing is at the level of capability rather than economics. A network that cannot credibly demonstrate a migration path may eventually find itself outside certain institutional mandates โ not because regulators banned it, but because a trustee's risk committee asked a question nobody could answer.
Takeaway
The narrative is the new liquidity, but only when it attaches to something observable. The signal to watch is not the next proposal announcement โ it is the first migration tooling that ships to production, and the first large, publicly known addresses that move. When a whale with an exposed 2011 key starts rotating, that is information. Everything before it is atmosphere.
The clock is not ticking loudly. That is exactly what makes it easy to ignore โ and exactly why the people who start counting now will be the ones who look prescient in a decade.