preferred on
Points of Focus
- Early scrutiny of post-quantum cryptography candidates associated with China’s standards push is exposing weaknesses before any final national standard has been selected.
- Bitcoin faces its own migration problem because ECDSA and Schnorr signatures could eventually become vulnerable to sufficiently powerful quantum computers.
- Draft BIP-361 estimates that more than 34% of all Bitcoin had already exposed public keys onchain as of March 1, 2026.
China’s race to develop quantum-safe cryptography is highlighting an uncomfortable problem for Bitcoin: Replacing today’s vulnerable cryptography may be only half the battle.
The replacement itself has to survive years of attacks.
China is developing domestic post-quantum cryptography standards as governments prepare for quantum computers capable of threatening conventional public-key systems. The country could establish national standards within three years, according to experts cited by Reuters, with Beijing exploring approaches that differ from standards already adopted in the US.
⚛️ Bitcoin does not have a quantum computer problem today. It has a migration problem, and migrations could take years to get right.
SHRINCS is the first Bitcoin-specific post-quantum proposal I have seen that makes a serious end-to-end trade-off, and it deserves to be read…
— Charles Guillemet (@P3b7_) September 16, 2026
But the broader selection process is also demonstrating why moving quickly can be dangerous.
Quantum-safe does not automatically mean safe
Post-quantum algorithms are designed around mathematical problems that researchers believe even quantum computers will struggle to solve. That does not guarantee every proposed algorithm is secure.
Candidates have to survive conventional cryptanalysis, implementation testing, and increasingly AI-assisted attacks before becoming standards.
China is not alone in discovering how quickly apparently promising designs can run into trouble.
In July, the developers of HAWK, a post-quantum digital-signature candidate being considered by the US National Institute of Standards and Technology (NIST), withdrew it after an AI-assisted attack uncovered a mathematical weakness. The NIST stressed that the finding did not affect its already-finalized post-quantum standards.
That episode provides important context for weaknesses emerging during scrutiny of Chinese candidates. Finding flaws before deployment is what a cryptographic competition is supposed to achieve. It becomes much more serious if weaknesses are discovered only after an algorithm has been embedded across financial infrastructure.
For Bitcoin, that problem could eventually involve hundreds of billions of dollars.
34% of Bitcoin has already exposed public keys
Bitcoin currently relies on elliptic-curve cryptography, including ECDSA and Schnorr signatures.
A cryptographically relevant quantum computer running Shor’s algorithm could theoretically derive private keys from exposed public keys, allowing an attacker to create valid signatures and spend Bitcoin (BTC) without knowing the original private key.
No quantum computer capable of doing that to Bitcoin exists today.
But Bitcoin developers are already discussing how a migration could work.
Draft Bitcoin Improvement Proposal (BIP) 361, titled “Post Quantum Migration and Legacy Signature Sunset,” estimates that more than 34% of all Bitcoin had revealed a public key onchain by March 1, 2026. The proposal warns that those unspent transaction outputs (UTXOs) could eventually become targets for a sufficiently powerful quantum computer.
Its proposed solution is aggressive. After Bitcoin gains a post-quantum output type, Phase A would eventually stop users from sending funds to quantum-vulnerable addresses. Phase B would later restrict spending using legacy ECDSA and Schnorr signatures through a quantum-safe rescue mechanism.
BIP-361 remains a draft, not an approved Bitcoin upgrade.
Bitcoin’s migration creates a second risk
The challenge is therefore not simply getting Bitcoin holders to move before a hypothetical “Q-Day.”
Developers also need enough confidence that whatever cryptography replaces ECDSA and Schnorr will remain secure for decades.
History offers warnings. The NIST’s SIKE candidate was previously broken during its post-quantum selection process, while HAWK was withdrawn this year after surviving earlier rounds of analysis.
That creates two competing risks for Bitcoin.
Wait too long, and quantum computing could advance, while large quantities of BTC remain protected by vulnerable signatures. Move too quickly, and Bitcoin could commit to post-quantum cryptography before researchers have sufficiently tested it.
China’s ongoing work shows why Bitcoin’s quantum problem cannot be solved simply by swapping one signature algorithm for another. The harder task is choosing the replacement without creating the vulnerability everyone was trying to escape.
Share
Most read articles
