What happened
BeInCrypto reported Monday that Jameson Lopp, co-founder of self-custody firm Casa, and Stefano Gogioso, a quantum computing researcher at Oxford, laid out overlapping but non-identical timelines for Bitcoin's Q-Day. Lopp has previously pegged a cryptographically relevant quantum computer at roughly ten years out. Gogioso, writing from the research side, agrees the ten-year horizon is defensible as a planning assumption but insists the tail risk sits well inside that window.
Both frame the threat as a question of when the industry starts migrating, not whether the physics eventually gets there. Neither is calling for panic. Both are saying the clock has been running for a while and the response has been slow.
Why it matters
Bitcoin's security rests on ECDSA and Schnorr signatures, both built on the discrete-log problem that Shor's algorithm, running on a sufficiently large fault-tolerant quantum machine, would unwind. The exposure isn't even. Coins sitting in old pay-to-public-key (P2PK) outputs - including a large block of early Satoshi-era wallets, estimated by researchers at close to 1.
72 million BTC - expose the raw public key on-chain and would fall first. Modern P2PKH and taproot addresses are better protected until the key is revealed in a spend, but 'better' is not 'safe' in a world where quantum capability is improving in public benchmarks every year. The headline reads reassuring.
The migration picture doesn't. There is no merged BIP for a post-quantum signature scheme, no consensus proposal with meaningful review, and no coordinated plan for moving dormant coins whose owners may be dead or lost. A decade sounds like a long runway.