Custody mechanics, October 2026

Quantum clocks, Bitcoin boxes: who acts first

Updated 6 October 2026

That is a custody question dressed as a cryptography question. It is not a threat model you can solve with a longer key.

The runway did not move last month

For most of 2025, the credible estimates for breaking secp256k1 with a fault tolerant quantum machine drifted between ten and thirty years. The headline number came from a 2022 paper by Gidney and Ekerå, which put the run time at roughly eight hours on a twenty million qubit machine. That figure was the centre of gravity for a year, and Bitcoin writers, including this one, used it as a shorthand. The shorthand has been wrong for a while. October 2026 is a good moment to retire it, because the credible estimates have moved again, and the direction is uncomfortable.

Two updates matter. The first is the paper from a Calgary group that landed in September 2025 and put the headline number in the days, not the hours, on a machine far smaller than the one Gidney imagined. The second is the steady stream of superconducting roadmaps from IBM, Google, and a handful of Chinese labs, all of which now show error corrected qubit counts climbing on a curve that resembles the early part of a Moore's law plot. None of these are proofs. They are reasons to revise the runway, not the conclusion.

The conclusion has not changed. Bitcoin's public key is a lock, and Shor's algorithm is a skeleton key. The lock is open the moment the public key sits on chain, and it stays open until the coins move. A box on chain is a closed box, with one exception. The exception is the box whose owner has already spent from it, because the spend revealed the public key. Taproot made that exception more common, because a Taproot spend reveals the internal key at the moment of broadcast. P2PK, the old style boxes Satoshi used, is the other exception, and those boxes have been open since 2010.

What actually moved, and what stayed put

The runway is not a single number. It is a difference between two dates, neither of which is published. The first date is the day a quantum computer can break an elliptic curve public key in less time than a Bitcoin block. The second date is the day Bitcoin activates a post-quantum migration path. The difference is the window in which open boxes can be emptied by an attacker. Closing that window is the entire game.

Several things have moved since the BIP-360 draft appeared in 2024. The draft proposed a new output type, P2MR, that wraps coins in a post-quantum signature. The wrapper is ML-DSA, the algorithm NIST standardised in August 2024 after a six year process. Wrapping is fine for new coins. It does nothing for coins that already sit in open boxes. That asymmetry is the whole story, and the asymmetry got worse in October 2026 because more boxes are now open than were open a year ago.

Taproot adoption climbed through 2025 and 2026, which is good for fees and bad for this conversation. Every Taproot spend reveals the internal key. Every batched spend from the same address reveals it once per batch, but the box is still open until the coins move. The longer a holder waits, the larger the surface. A holder who received coins in 2024 and has not spent them is in a stronger position than a holder who received coins in 2024 and consolidated them in 2025, because the consolidation revealed the key for every input.

The fork cannot reach every box

Imagine a hard fork activates in 2028, and the new rules treat any coins held in a box with an exposed public key as forfeit unless the owner moves them to a post-quantum wrapper before a deadline. The deadline is the lever. A fork can burn coins; a fork cannot move them. The owner of the box has to act. If the owner is dead, or has lost the key, or is a nation state that has not logged in since 2011, the coins stay in the box and the fork takes them.

That is a feature, not a bug, in most post-quantum proposals. The threat is the attacker who runs Shor against the exposed public key and sweeps the box before the owner notices. The owner can prevent that by moving the coins. The owner cannot prevent a fork from sweeping if the owner does not act. The cost of inaction is borne by the owner, not the network, and that is the right place for the cost to land. It is also the reason a fork is politically possible at all, because a fork that only punished inactive boxes does not punish anyone who is paying attention.

The complication is that some inactive boxes are not actually inactive. They are held by people who have lost the seed, people who have died, people whose hardware wallets are in a safe deposit box in a country that no longer exists. Those boxes are, for practical purposes, abandoned. A fork that burns them is taking coins out of circulation, which is a different kind of change to the monetary base than any previous event, including the three halvings. The consensus rules can be edited; the editorial consequences cannot be predicted by reading them.

What a holder can actually do today

The actions available in October 2026 are the same actions available in October 2024, and they are not technically difficult. The first is to check which boxes are open. A box is open if its public key is on chain. A box is closed if its address has never been spent from and the address type is one that hashes the key, which is most address types including P2WPKH, P2WSH, and P2TR in its key path only state. The second is to move the coins to a fresh address. A fresh address starts as a closed box. The move costs a fee. The fee is the price of closing the lid.

The third action, and the one that does the most work, is to stop consolidating. Consolidation is the practice of sweeping many boxes into one box to reduce future fees. It is rational under fee pressure and irrational under quantum pressure, because consolidation reveals the key for every input in a single transaction. A holder with fifty boxes and a hardware wallet is safer leaving the boxes alone than combining them, until the network offers a post-quantum wrapper and a way to migrate without the migration itself being the move that opens the new box.

The fourth action is to write down the date. The runway is not a calendar entry. It is the difference between two events, and neither event has a date. The honest thing to do is to pick a conservative bound and act before it. The dishonest thing to do is to wait for a paper, a press release, or a fork activation date that will not arrive on schedule. Bitcoin's schedule is blocks, not announcements.

The exchange question, again

Exchanges hold boxes on behalf of customers. The boxes are closed in the cryptographic sense, because the exchange has not spent from the customer's deposit address, and the customer has not spent from it either. The customer has a password, a 2FA code, and a balance. The exchange has the key. If the box is opened by a quantum attacker, the attacker drains the exchange, and the customer learns about it from a withdrawal error. The customer cannot move the coins because the customer does not have the key.

This is not a new problem. It is the same problem that existed before quantum, and exchanges handle it with hot and cold wallet segregation, insurance funds, and proof of reserves. The post-quantum version is worse because the cold wallet boxes are, in many cases, open. Consolidation across deposits is normal. Sweeping the entire cold wallet into a single SegWit address was the standard practice for most of 2018 to 2024. The boxes are open. The keys are on hardware in a vault. The attacker, if and when one exists, will not need to enter the vault.

Self custody sidesteps the exchange problem and inherits the same shape of risk. A self custody holder with a hardware wallet, a seed phrase, and a single SegWit address has one box. The box is closed until the holder spends from it. The holder can keep the box closed by not spending from it. The cost of that choice is that the holder cannot spend from it. The holder can move the coins to a new box, which costs a fee and closes the old box by emptying it. That is the entire menu, and it has been the entire menu since SegWit activated in 2017.

What BIP-360 actually changes

BIP-360 proposes a new output type, P2MR, that uses ML-DSA for the signature. ML-DSA is a lattice based scheme, which is to say it is a family of algorithms that depend on a different hard problem than integer factorisation. The signature is large, roughly two and a half kilobytes for the parameter set that NIST recommends, and the public key is roughly the same size. A P2MR output is, by weight, a much heavier box than a P2WPKH output, and the cost of moving a P2MR box is correspondingly higher.

Activation requires a fork, soft or hard, and the fork has not happened. The draft has not changed substantially since 2024, which is a sign that the technical work is settled and the political work is not. The political work is the question of what to do with the open boxes, and the draft is silent on that, because the draft is a technical document and the answer is a social one.

For a holder thinking about the next twelve months, the relevant fact is that P2MR, if it activates, will not rescue open boxes. It will give new boxes a stronger lock. The migration window is the period between activation and the moment a quantum attacker can run Shor in less time than a block. The migration is not automatic. The holder has to move the coins. The holder has to do it before the attacker can act. The holder has to do it before the network forces the holder's hand.

What October 2026 actually adds

Two things are new this month. The first is a paper from a Chinese group, currently in preprint, that pushes the fault tolerant qubit count down by a factor of three compared with the Calgary estimate. The paper is not yet peer reviewed, and the estimate is for a specific kind of machine, and the caveats are real. The number is also consistent with a trend, and the trend has been moving in the same direction for three years.

The second is a quiet change in tone at the NIST post-quantum programme. The August 2024 standards were the end of the selection process, and the work since has been on migration. NIST's migration guidance for federal systems, updated in 2025, treats 2035 as the deadline for deprecating classical public key algorithms in vulnerable contexts. That deadline is not Bitcoin's deadline, because Bitcoin is not a federal system, but it is a marker. The marker has been used by some commentators, including a few who write for this site, as a rough upper bound. The upper bound has not changed. The lower bound has.

The combination is the news. The credible upper bound is the same. The credible lower bound is shorter. The difference is the window, and the window is what a holder is betting against. A holder who bets that the lower bound is still a decade away has the same evidence as a holder who bets that it is five years away, and the cost of being wrong is asymmetric. The cost of moving coins once is a fee. The cost of not moving them, and being wrong, is the coins.