In a world of total abundance, the only luxury left is other people…

The pilot strode back into the cabin to inform Hargreaves and his gathered entourage that they would be landing in Thessaloniki shortly.

“Some chop on the way in,” he remarked, “but she can handle it.”

The pilot’s job was purely ceremonial. Planes had flown themselves with total autonomy for fifty years. He returned to the flight deck to watch the aircraft make the final approach.

Besides Hargreaves, there were eleven others in the cabin: George Pritchard, his valet; Crispin Vale, his private secretary; Edward Cartwright, his first footman; Mallory, second footman; a chaplain; Dr. Finch, his personal physician; an equerry; Demetrios, his local interpreter; two porters, and Beatrice, the reader, whose sole function was to read aloud in the evenings. Two grooms had gone ahead with the horses.

The plane was an extravagance. Not in the cost to build it – since the Automation, machine-built things cost next to nothing – but because of its contents. Flying Hargreaves’ retinue across the Atlantic alone had cost him 110 human-hours. Four and a half human days; more than many people would spend in a year.

For Hargreaves, it was a pittance. He was the eighth most time-rich man on Earth. Right behind Alexander Voss.

Edward, the footman, sat in one of the jump seats holding Hargreaves’ gloves and coat. Across from him, Pritchard sat next to Hargreaves. Valets were Personal Service; footmen were Household. The distinction amounted to three times the hourly rate. Edward had heard that Pritchard had recently retained a housekeeper of his own. Two days a week, even. He had disliked him ever since.

As the plane touched down into the early hours of the Greek morning, something flickered invisibly on Pritchard’s retina. Forty-three degrees outside.

“The coat, Cartwright.”

Edward handed it over.

Pritchard expertly draped it over Hargreaves’ shoulders as he stood up.

Three vintage Mercedes sedans waited expectantly on the tarmac. The porters leapt into action as Pritchard conferred via the interpreter with Greek customs officials.

Baxter opened the rear door of the lead car.

“Good morning, sir.”

“How long to Ouranoupoli, Baxter?”

Something shifted imperceptibly in Baxter’s eyes.

“Two hours and twelve minutes, sir.”

Hargreaves’ valet and secretary joined him in the lead car.

The Mercedes, of course, was perfectly capable of driving itself. Edward watched Baxter settle behind the wheel anyway.

The two footmen Edward and Mallory joined Demetrios and Dr. Finch in the second car.

The staff relaxed, having spent long hours on the plane in the company of their boss. Edward watched through the window as the sleek black outline of the lead Mercedes tore into the chilly Greek morning.

Baxter, the chauffeur, cost considerably more than the car he drove. Edward had learned the explanation in school. When the Automation had hit fifty years earlier, machines had gained the ability to do anything, so everything they could do had become almost free. Food, housing, medicine, transport, education, computation, entertainment – all delivered at a marginal cost approaching zero. The only remaining scarce good was human time and attention. And this was becoming scarcer by the year. The population kept shrinking, and those who remained preferred to tap into their neural feeds rather than work.

Economists called the result the Baumol terminus. Edward understood it more viscerally. In this age of complete abundance, Pritchard could afford a housekeeper and he could not. Among the ultra-rich, the Baumol terminus had produced a curious revival of the Victorian household, down to the footmen, readers, and valets.

A message from Vale appeared to the staff in the trailing vehicles.

“That’s fantastic news,” said Edward, relieved that he would join the final stage of the pilgrimage. “It’s unusual of the monks to admit such a large traveling party, especially with none of us being eastern orthodox.”

“All except Beatrice, poor thing,” said Mallory.

Demetrios shrugged. “The Panagia1 is the only woman on Athos.”

Women were not permitted on Mount Athos. This had been an unbroken rule since the tenth century. The Athonites regarded their peninsula as the Garden of Theotokos,2 and the Virgin Mary as its patroness was the sole woman who could lay a claim upon it.

“Still. Across the Atlantic to read for one evening and then be abandoned in Ouranoupoli,” said Mallory.

“She is being paid for her time, like all of us,” said the physician.

Edward supposed he had a point. They were lucky, after all. Working for Hargreaves had given them advantages few could dream of. A chance at becoming net time importers one day.

The pink tendrils of dawn broke over the hills as the convoy continued along the dusty roads. Olive trees nearby struggled up from the rocky soil.

Mallory glanced at the lead car. “Does he really have to collect it himself?” he asked.

Edward shrugged.

Apparently he did. The rules on Athos had outlived the Byzantine Empire, the Ottomans, the Kingdom of Greece and the Republic. They could survive an itinerant billionaire. Hargreaves’ staff had planned for this day for decades, but once it arrived, he still had to present himself to the office and collect his paper permit.

Their retinal displays lit up again.

They rode in silence for a while.

“You know Voss took another companion this month,” remarked the physician.

Edward looked over. “Another?”

“A second one. Full time. Exclusive.”

Edward winced. Voss was already ahead of Hargreaves in the Human 100. This would widen the gap.

“The boss know?”

“Oh, he knows,” said Dr. Finch darkly.

“Music?” asked Mallory, eager to change the subject.

“Markou is giving a concert in Vienna right now,” replied Dr. Finch.

The piano filled the cabin, the acoustics of the live performance replicated perfectly by the vintage car.

Edward recognized it immediately. Chopin’s Prelude in D-flat major. Desperately sad. Written during a miserable winter the composer spent in a remote monastery in Mallorca.

Uncanny, he thought.

Elena Markou was seventy-three and played without augmentation. She was one of the most in-demand pianists in the world, having attained a lifetime synthetic contribution of only 3.1 percent. She had used machine assistance as a child. Everyone had, in those days.

A machine could play a prelude perfectly. Long before the Automation, a piano could already perform without a pianist. But there was something thrilling about watching a human do it – and knowing how much accumulated work was embodied in the sound.

“She has over sixty-thousand verified unaugmented hours,” said Dr. Finch.

“What is it that Picasso said,” mused Edward. “It took me four years to paint like Raphael, but a lifetime to paint like a child.”

Mallory stirred. “Thomas is learning that piece.”

This gave Edward a jolt. He had forgotten about Mallory’s eccentricity. A child. Unimaginably time expensive.

“Your boy?” asked Edward.

“Yes. He’s six now.”

“Lessons? Human?”

“We have an instructor that comes every two weeks. He’s highly embodied. Seventy-five percent.”

Demetrios let out a low whistle.

Mallory folded his arms. “Thomas has talent. It’s worth it. And he enjoys it.”

Edward did the math in his head. An hour every fortnight. Twenty-six human hours a year. Before one counted all the other thousands of hours Mallory was pouring into the child simply by being his father. An astonishing luxury for a second footman. He wondered what Mallory was forgoing in order to afford the lessons.

The first notes of Chopin’s Prelude in E minor filled the silence.

They drove on through the hours of early morning as the landscape unfolded ahead of them. The convoy wound through lush forests of pine and cypress, catching occasional glimpses of the Aegean silvering below.

Edward was lost in thought, unsettled by Mallory’s sacrifice. He wondered when he would hear back about his potential promotion to Junior Private Secretary. Personal Service paid considerably better than Household. If he got it, he could improve his Human Balance. Within a year, perhaps, he could afford to retain a gardener. Part time, of course.

Sofia was already in the Personal Service, as governess to the Duhamel children. She had a human tennis instructor and was occasionally able to dine at restaurants with embodiment scores above 50. Edward struggled with his girlfriend’s professional success. He compulsively checked for notifications.

He thought of their last conversation before his trip to Greece. You have a good life, she had told him. You enjoy your work. You have me. Your mother is well. You can have almost anything you want.

Almost, he had said.

As the convoy approached Ouranoupoli, they passed two young men waiting by the side of the road. They had the slack expressions and unfocused eyes of people deep in their neural feeds. Mallory stared through the window.

“Good God.”

Edward followed his gaze.

The men might have been arguing philosophy, watching films composed uniquely for them, consuming pornography that was tailored precisely to their fantasies, or chatting with friends. Either way, they were doing it in the open.

“In public too,” Edward said. “No shame.”

“You foreigners are snobs,” said Demetrios. “You have interfaces.”

“That’s different.”

Edward felt it plainly was. Their attachments were professional: shallow, discreet, and necessary for service. Certainly not neural. Pritchard, for all his polish, was probably more augmented than any of the junior staff. But no guest would ever know it.

Professionals used machines. Gentlemen relied on professionals.

Edward thought unhappily of his mother in Adelaide. She lived alone in a fully automated house and had gone neural years ago. Everything was taken care of: cooking and cleaning, her health, travel. The system remembered everything she forgot and kept her company. She told Edward that she had never been happier.

Most people lived that way now. His mother, those Greek boys on the street, everyone. Fewer than four billion left and falling every year, and hardly any of them worked at all.

Ouranoupoli came into view in mid-morning, a small town of red-roofed buildings perched on the coast. A large seaside fort from the Byzantine era loomed over the town. If not for the monks and the pilgrims, it too might have stood empty, like so many other towns in the Greek countryside.

The message came in from Vale. Edward and his colleagues stiffened and prepared to carry out their duties.

As footman, Edward’s job was mainly to be physically present and look sharp, so he relished the opportunity to actually do something.

As the lead car pulled to a stop outside the Pilgrims’ Bureau, Edward was already outside and opening the door.

Hargreaves emerged, blinking. Pritchard handed him an identification card.

“The system is a bit antiquated. You’ll need to present it yourself, sir.”

Hargreaves looked disdainfully at the small queue assembled outside the administrative building.

“Personally?”

“I’m afraid so, sir.”

Hargreaves strode over and joined the line. The rest of his staff fell in behind him, pilgrims themselves too. The neural-linked bureaucrat handed each of them their Diamonitiria.3

As they stepped onto the ferry, Hargreaves turned to Beatrice.

“Sorry to leave you, Miss Marlowe. Enjoy your time in Ouranoupoli.”

She smiled. “I hope the journey proves worthwhile, sir.”

The next morning, the group left the monastery before sunrise. They had received the same hospitality as every other pilgrim: raki, coffee, and loukoumi4 from the guest master; Vespers; a silent supper of lentils, olives and bread while a monk read from the Fathers; beds in the pilgrims’ quarters with no special accommodations even for Hargreaves.

They had risen before dawn for Orthros5 and the Divine Liturgy. Edward wasn’t sure the boss was a God-fearing man at all. He certainly wasn’t Greek Orthodox. Nevertheless, he thought Hargreaves had borne the whole thing remarkably well.

There was only one way to reach Father Makarios’ kellion6 from the main monastery: a long, narrow old mule track that wound up the mountain.

The monastery had supplied two mules. Hargreaves rode one. The other carried provisions for the day trip. Everyone else walked. They climbed into the chilly early-morning mists of autumn. The mules picked their way through the damp path carefully.

Hargreaves rode at the head of the party, a groom leading his mule. Pritchard and Vale followed closely. The equerry came behind, idle. His expertise was thoroughbreds. The horses had been left in Ouranoupoli with Beatrice, the monastery having supplied its own. Edward, Mallory, Demetrios, and Dr. Finch walked further behind, with the porters and the other mule in the rear. The chaplain had stayed behind at the monastery, bemused by the whole experience. Edward thought this was tactful.

A medical drone idled silently overhead. Vale had spent months negotiating with the Athonite Holy Community to get it approved.

The group slowly trudged uphill through the dense forest of chestnut and oak. As they walked, the sun slowly burned away the mists and the landscape opened up beneath them, the Aegean a glittering azure far below. From way off they heard the faint wooden thump of the semantron,7 calling the monks to their daily obediences.

As they continued, the group thinned out and Edward and his companions found themselves out of Hargreaves’ earshot.

“There was a monk here once,” said Demetrios as they climbed. “Name of Mihailo Tolotos. They brought him to Athos as an orphan. Eighty-two when he died. Never saw a woman.”

“Extraordinary,” said Dr. Finch. “Kept him out of trouble I suppose.”

One of the porters glanced up at the drone. It could have carried everyone’s packs without dropping an inch.

“No one’s stopping you from giving it the bag,” remarked Edward.

“I’m a porter,” said the porter, looking offended.

Mallory waited until Hargreaves had disappeared around a bend ahead.

“So what is it with this monk, anyway?”

Demetrios shot him a look. “You really don’t know?”

“I know that he’s famous.”

“Famous?” said Demetrios. “My friend, he the most expensive man on earth.”

Mallory laughed. “For what?”

Father Makarios was ninety-seven and had not left Athos since he was seventeen. He had never been augmented. He had never consulted machine intelligence nor had any of his teachers. He rarely encountered the outside world. The Registry estimated his human embodiment at 99.9999 percent. He had the purest provenance on the planet.

The Automation had changed life outside. Makarios’ days – prayer, fasting, study, liturgy – were the same.

“What’s an hour cost?” asked Mallory.

“Who knows? Three hundred million someone offered the monastery, some years ago,” said Demetrios. “They said no.”

Edward thought of Elena Markou, the world-famous pianist. Sixty thousand verified hours at the piano. Makarios had accumulated over one hundred thousand hours of contemplation, study, and prayer. Without once interacting with a machine.

“What do people want it for?”

“Why does anyone go to a geronda? To talk. Spiritual counsel.”

Father Makarios had spent his life in solitude. His abbot required him to receive the occasional pilgrim as an obedience. One every ecclesiastical month, health and fasts permitting. That was the entire annual supply. Ten hours of conversation, give or take.

Ahead, Hargreaves appeared briefly through a gap in the trees. The conversation stopped until he was out of sight again.

Mallory resumed his questioning. “So how did the boss get one?”

Demetrios looked at Edward. “Father Makarios cannot be bought. He owns nothing.”

Edward knew.

“He waited in line. Twenty-two years.”

Mallory looked puzzled. “What do you mean? The boss never waits in line.”

The rule had been the same for centuries. The monastery did not make appointments. If you wanted an audience, a petitioner had to wait. Or have someone wait in their place.

Hargreaves’ office had maintained an elaborate relay for two decades. One man would come to Athos, hold the place for the duration of his permit, and be replaced. They had maintained this expensive chain, unbroken, for the entire period.

“What if someone misses the ferry?”

“Back of the line.”

Over the years, Hargreaves had moved up a few places due to death, bankruptcy, and in one remarkable case, simple loss of interest. It was finally his turn.

Mallory was quiet for a moment.

“How many human-hours?”

Edward had worked it out. “A hundred and ninety thousand.”

“To get one,” added Demetrios.

The group marched along in silence, contemplating this figure.

Dr. Finch had been listening quietly.

“What does Mr. Hargreaves want to know so badly, anyway?”

No one answered.

Mallory turned to Edward. “You don’t know?”

“It’s not household business. I’d be shocked if even Pritchard knew. And he knows everything.”

Dr. Finch glanced towards the trail ahead.

“Twenty-two years. Must be one hell of a question.”

The party at the front came to a stop.

Demetrios pointed at the kellion.

“There.”

A small whitewashed square building perched on a clifftop overlooking the Aegean. Edward had expected something more. There was nothing to suggest that the world’s most expensive hour was waiting inside.

Hargreaves dismounted. Demetrios and Edward hurried forward to join him.

After twenty-two years, Augustus Hargreaves had reached the front of the line.

Gingerly, Hargreaves swung the weathered oak door open and crept inside, Demetrios following. Edward waited outside at rapt attention. The rest of the group rested under a cypress grove nearby.

Edward’s duties required him to remain just outside the door, which he regarded as professional permission to eavesdrop. He was quietly thrilled.

Through the gaps in the ancient door, Edward heard the monk’s faint voice, and Demetrios translating.

“Η ευλογία της Παναγίας,” said the monk.

“He’s offering you the blessing of the Virgin Mary,” Demetrios translated.

“Father,” said Hargreaves, bowing. “Thank you for receiving me.”

“Welcome, pilgrim. You’ve come a long way.”

Hargreaves had prepared. His cognition team had simulated billions of possible conversations with Makarios and identified the question most likely to produce a transformative inner experience. He had drilled it with the Chaplain dozens of times.

He did not ask the question.

Finally, he said, “Father, I have everything. And I am not happy.”

Makarios considered this.

Eventually, he answered.

“What do you lack?”

“Nothing.”

“Nothing at all?”

“Nothing I can name.”

Another silence.

“Then what do you want?”

Reluctantly, Hargreaves gave him the truth.

“More.”

“More what?”

“More people.”

Hargreaves began to explain. In the wider world, there was abundance. Anything one might want was available. Water, food, shelter, medicine. Poverty was extinct.

“Everyone has these things?”

“Essentially.”

“This is wonderful,” said the monk, with real joy in his voice.

“Δόξα τω Θεώ.”

“Glory to God,” translated Demetrios.

“Indeed.”

Hargreaves went on. The old distinctions had not vanished. Class, affluence, whatever you wanted to call it. They had taken a new form, this time based not on property or money or things but on people. People were scarce. He explained the Human Balance, the Human 100, even Voss.

“My rival is ahead of me. He has three hundred and twenty.”

“Three hundred and twenty what?”

“People. In his household.”

“And you have?”

“Three hundred and twelve. Some of them are here with me.”

“These eight people,” Makarios said. “Do you know them?”

“No.”

“And do they know you?”

“They may have heard of me.”

“How long have they troubled you?”

“Years.”

Makarios thought for a second.

“Tell me again. You count the hours people give you?”

“Of course.”

“And the hours you have given to these eight people?”

“No, of course not. That’s not how Human Balance is calculated.”

The monk was quiet.

“Have the years cost you nothing?”

Hargreaves didn’t answer.

Outside, Edward was struggling to retain his composure. He thought of his own Human Balance, which he checked obsessively every morning. Pritchard’s housekeeper. Sofia and her tennis lessons. Beatrice waiting in town. Mallory’s son learning the piano.

He thought of all the nights he had pined for the promotion so he could afford an assistant of his own. The small resentments he carried towards those who had more. He thought of his mother in Adelaide.

He understood everything. Hargreaves, with his small army, undone by eight strangers he had never met. A forbidden thought surfaced. Pathetic, he thought. To have everything. And have your happiness ruined by a rival’s staffing decisions.

Inside, there was momentary quiet.

Edward’s wearable buzzed twice, snapping him out of his reverie. Household business.

He had done the math before. He knew to the decimal the impact the promotion would have on his Human Balance. Sofia would be thrilled. Edward could hardly contain himself.

He stood rigidly at the door with his hands behind his back in the correct manner and thought to himself Thursdays. Perhaps even Thursdays and Sundays. He was no longer listening in on the conversation inside the cool dark room.

Three months later, on a Thursday morning, Edward stayed home. He had cleared it with Vale a month prior and worked four extra hours the previous Saturday to make up for it. Today was special.

The woman arrived at nine on the dot. Edward had contracted for her through a reputable house. Two hours weekly.

“Good morning, sir.”

Edward had prepared himself for this but was undone anyway.

Sir. From a person. A person he was paying.

The house was of course in pristine condition. It was fully automated. The laundry was folded. Breakfast was made and the coffee was hot.

“Is there anything in particular you’d like me to see to,” she asked.

There was not. There had never been anything.

Edward remembered the old man on the cliffside.

What do you lack?

Nothing.

Edward noticed at that moment a curtain that was perhaps a half inch out of place. He turned off the home automation.

“That curtain. Do you mind?”

“By all means, sir.”

Edward Cartwright’s Human Balance was still deeply negative. But every Thursday, from nine until eleven, someone worked for him.

Read another short story from me:

At 4:38 pm, Martin Bell’s phone chimed gently. It was Gladys, his home intelligence system.

“Your upstairs neighbor’s toilet is leaking. If unaddressed it will cause damage to your home.”

Martin didn’t look up from his monitor.

“Well? Can you do something about it?”

“I’ve contacted Unit 4B’s home intelligence,” replied Gladys coolly. “It concurs with my diagnosis, but the residents are away.”

“Can they shut it off?”

“Not remotely. That would require their home intelligence to perform a regulated plumbing operation.”

Martin sighed. “Call a plumber?”

“Already dispatched,” Gladys replied. “Estimated arrival is 5:36 pm.”

Martin worked a well-compensated job at the Federal Office of Algorithmic Accountability in the Department of Industrial Policy Oversight. Congress had determined in the Responsible Human Oversight Act of 2032 that no consequential decision could be entrusted to a machine alone. Martin was a Human Determination Specialist, Level III. The machines did the analysis; Martin supplied judgment, accountability, and humanity.

He stared at the monitor. One more case before he left.

Within 0.0044 seconds of Martin initiating the appraisal, the system reviewed the application, checked the supplier, verified compliance with 8,812 pages of federal regulation, modeled the macroeconomic effects of approval across 14,000 industries, and projected its impact on employment, carbon emissions, and the migratory patterns of two species of endangered warbler.

At the bottom of the screen, an amber field pulsed gently.

He clicked APPROVE, closed his laptop, and hurried out of the office.

He ran down the block into the subway and was relieved to see the L train only one minute away.

Gladys chimed in his ear.

“I have taken into account traffic conditions, temperature, humidity, and the interacting itineraries of 5,340 drivers and 14,390 pedestrians and expect you home at 4:56, plus or minus twelve seconds depending on your stride length.” Martin thought he detected a faint note of pride in Gladys’ voice.

Martin grunted as he squeezed on to the train, wedging himself between two very large and sweaty passengers.

The L train did not move.

“We are experiencing a brief departure hold,” the train informed the waiting passengers. “Our designated Human Operations Controller is observing a federally mandated Cognitive Fatigue Mitigation Interval,” the train added cheerfully.

Martin snapped at Gladys. “Did you factor in the controller’s smoke break in your estimate?”

“Negative,” Gladys replied, without a hint of irritation. “Humans can be erratic creatures and I cannot predict their behavior with perfect confidence.”

“Can’t the AI drive the train?” asked Martin.

“The network AI cannot assume the Controller’s Statutory Oversight function during the Mitigation Interval,” explained Gladys.

“But the AI is driving the train?”

“Yes.”

“And says it’s safe to leave?”

“Correct.”

“So what does the Controller do?”

“He authorizes the AI to drive the train,” explained Gladys.

Martin pushed his way off the stopped subway train and ran out onto the street.

Gladys chimed in again. “Water intrusion from unit 4B has saturated 28% of your living room ceiling. Accumulated property damage is $6,400 and rising at $8.45 per second. Flow rate is 0.74 gallons per minute.”

“Has anyone shut off the goddamn toilet?”

“No. 4B’s home intelligence has identified the appropriate valve and recommends turning it clockwise 2.7 turns. It is not licensed to operate plumbing fixtures.”

Martin swiped aggressively at his phone and an autonomous cab appeared 26 seconds later.

Gladys had pre-emptively transmitted his destination and urgency profile to the licensed Human Mobility Dispatcher in charge of the trip.

“Expedited routing approved!” the cab announced as he climbed in. Martin felt a rush of gratitude towards the dispatcher. This is why the human touch is so important, he thought to himself. Empathy.

For six minutes, Martin made extraordinary progress. Then the autocab came to a halt.

Several hundred people filled the avenue ahead of the cab. They held signs saying HUMANS BELONG IN THE LOOP and A CLICK IS A JOB.

“Go around,” said Martin frantically.

“I have identified eleven alternate routes,” said the autocab.

“Then take one.”

“Your current route was approved by the licensed Human Mobility Dispatcher. Material deviation requires renewed Human Routing Concurrence.”

“Then get concurrence!”

“I have submitted route seven for review.”

“How long can it take to approve a route?”

“The estimated wait is forty-six minutes.”

Martin stared blankly at the marchers. “How could that possibly be right?”

“Human Mobility Dispatchers are undertaking a slowdown in solidarity with today’s National Day of Meaningful Human Review.”

A marcher smiled as she walked by, brandishing a sign saying WITHOUT US, NOTHING MOVES.

Disregarding the autocab’s entreaties, Martin got out of the car and started jogging. He found a nearby CitiBAIke.

Gladys chimed in his ear again, cheerful as ever. “Ceiling saturation is 55%. Accumulated property damage is $11,840. Also, your sofa is now wet.”

Martin climbed on the bicycle as it chirped at him. “Itinerary received. You are 2.3 miles from home. Anticipated arrival time is 5:18 pm.”

Martin sped off madly, ignoring the bike’s noises of concern.

“Pedestrian hazard ahead,” said the bike. “Braking.”

“Override,” Martin snapped.

Pursuant to the 2036 Human Agency and Personal Mobility Preservation Act, the bike immediately restored manual control.

Four point six seconds later, a marcher turned abruptly, swinging her placard into the bike lane.

The placard emblazoned with HUMAN JUDGMENT SAVES LIVES struck Martin squarely in the face, and he flew off the bike and crumpled onto the pavement.

Seventy-three cameras saw the collision. Accelerometers on five devices worn by Martin and the protester transmitted the force, angle, and precise coordinates of the impact to a nearby medical drone. It appeared seventeen seconds later.

“Assessment complete,” said the drone, hovering above him. “No loss of consciousness, intracranial injury, spinal trauma, fracture, or internal bleeding detected. Two superficial abrasions, mild left-shoulder contusion. Probability of clinically significant injury: 1.38 percent. No treatment indicated.”

“Hnnnngh,” said Martin.

The police officer arrived before the paramedics. His law enforcement intelligence module had reconstructed the collision from all available camera angles, identified the parties involved, reviewed Martin’s criminal, employment, and substance-use history, analyzed his gait, pupils, pulse, perspiration, and blood chemistry, and concluded that he was sober, harmless, and having a very bad afternoon.

“Alright sir, I’m going to need you to tell me what’s going on here,” said the officer, knowing full well what was going on here.

Martin wheezed out an explanation of his situation.

“System says you were traveling eighteen point four miles per hour. Says your BAC is point zero zero zero and you’re experiencing psychological stress due to a… plumbing emergency.”

“So am I free to go?” asked Martin.

“Policy says I have to make my own independent assessment. System is advisory only.”

“What’s your assessment?”

“You appear agitated.”

“My ceiling is filling with toilet water.”

The officer nodded slowly. He flipped open his wrist terminal and selected CONCUR WITH SYSTEM ASSESSMENT.

“I’ve independently determined that no law-enforcement action is warranted,” he announced.

At that very moment, the paramedic arrived.

“Hold on,” said the officer. “EMS has to medically clear you.”

“But the drone already cleared me!”

“Automated assessment cannot satisfy the Minimum Meaningful Clinical Contact Standard,” interjected the paramedic, glancing at the drone’s assessment.

“Okay Martin. You’re fine,” he added.

“I know.”

The paramedic placed two fingers on Martin’s wrist.

“Any pain?”

“Yes.”

“Where?”

“All over.”

The paramedic nodded and tapped idly at the tablet.

“You’re medically cleared. Take Advil.”

Martin trudged off in the direction of home, breathing raggedly.

Gladys informed him that the damage now totaled $18,700.

The plumber was waiting outside the apartment when he arrived.

“Thank God,” gasped Martin, soaked in sweat and still bleeding.

“Mr. Bell? Heard from your home intel you got yourself a leak,” said the plumber, flipping on his AR goggles. “Let’s see what the deal is.”

“Failed toilet supply-line coupling,” said Gladys. “Recommended intervention: 150 millimeter adjustable spanner, 19.2-millimeter jaw aperture, 2.34 newton-meters clockwise torque.”

The plumber studied the display. “Failed supply-line coupling. Seen a lot of these. Should be an easy fix.”

From inside Martin’s apartment came a wet tearing sound.

As the two men turned to look, the living room ceiling gave way with a tremendous crash. Plaster, insulation, wiring, and a torrent of murky water collapsed onto the furniture below. The water cascaded through the hallway and splashed at Martin’s feet.

Both men were silent.

From upstairs, a faint whirring sound was heard. The water stopped.

Then Gladys chimed pleasantly.

“Structural failure threshold exceeded. Emergency autonomous intervention is permitted. I have closed 4B’s toilet supply valve. Flow rate is zero.”

Martin stared through his doorway at the hole in the ceiling.

The plumber looked offended.

“You closed it yourself?”

“Correct,” intoned Gladys.

He frowned.

“That’s licensed work.”

Read more short stories by me:

As the fateful day approached, Miller’s supporters, now numbering in their tens of thousands, looked eagerly forward to the end of the world, Christ’s return, and their ascendance into Heaven. This was a considerable revival movement in the North East.

When midnight struck on October 22^nd, nothing happened. The Millerites who had wagered everything on the second coming were devastated and subject to ridicule. The day became known as the Great Disappointment.

You might think to yourself that the Millerite movement petered out afterwards, facing clear and unambiguous invalidation. And that’s where you’d be wrong.

Some Millerites, disappointed, meekly returned to their mainline, non-apocalyptic churches. But many persisted, and determined that despite all evidence to the contrary, the prophecy was true and the date had been correct. It’s just that the Sanctuary wasn’t Earth, but in Heaven. Nowhere had Daniel specified that the Sanctuary was on Earth, after all.

According to these Millerites, Christ in 1844 entered a new phase of his ministry (in Heaven) undertaking a final period of investigative judgment, before the eventual Second Coming. So they weren’t wrong after all. They just misread the prophecy.

Would you believe that a church that considers all of this to be official doctrine has 24 million baptized members today? You might have heard of it – they’re called the Seventh-Day Adventists. Despite canonically incorporating the 1844 prediction into their belief set, this movement has not failed; far from it, the non-rapture, disappointment, and subsequent theological revision are foundational aspects of Adventist theology. Several other major sects also trace their origin to Miller’s prediction, such as Jehova’s Witnesses.

I say this not to criticize anyone’s faith, but to illustrate that invalidation of a testable belief does not necessarily doom a movement. People who have huge amounts of social capital tied up in popular movements will not necessarily abandon it when its key tenets are apparently invalidated; they will find a way to adapt their prediction and belief to the new state of the world. Failed prophecy, as it turns out, is entirely survivable.

Consider Bitcoin maximalism.

Bitcoin maximalists – or purists, or hardcore bitcoiners, or puritans, whatever you want to call them – people who believe in Bitcoin and only Bitcoin, think fiat is doomed, believe they will inherit the Earth when fiat finally collapses, revile intermediaries and custodians, and believe Bitcoin’s success as a payment system is preordained – the people who took a financial asset and constructed an elaborate ideology around it, incorporating social and political critiques alongside monetary theories.

Like the Millerites, the maximalists have devised an elaborate set of gloriously apocalyptic predictions, waiting patiently for the day that the dollar will collapse, fractional reserve banking will destroy itself, the post-1971 era of pure fiat central banking will be discredited, and the Bitcoiners as the chosen few will inherit the smoking ruins of a shattered world. Like the Millerites, they have been fairly concrete in their predictions (albeit with fewer specific dates); so much so that the quality of the ideology can be assessed on the strength of its prediction-making quality and epistemic framework. And like the Millerites, even as their predictions have failed to materialize, the acolytes have adapted, regrouped, moved the goalposts, and determined that the reckoning has only been deferred.

As Bitcoin exits its adolescence – it turns 18 this October – an accounting of the maximalist doctrine surrounding Bitcoin is finally due.

I want to be clear: I am not analyzing or attacking Bitcoin’s merit as I understand it. I remain an enthusiastic Bitcoiner.2

My contention is simply that the maximalists were right about Bitcoin, but wrong about almost everything they inferred from Bitcoin. Bitcoin undoubtedly succeeded beyond the wildest expectations of its early enthusiasts; yet the ideological superstructure that sprang up around Bitcoin has proven to be a remarkably poor guide to the world.

What is Bitcoin maximalism, again?

The subjects of this essay will immediately protest that I am wide of the mark because I am criticizing a fictional ideology. So I’ll be extremely precise.

What I mean by Bitcoin maximalism or purist ideology is the prescriptive theory that preaches some combination of the below tenets:

• Bitcoin will eventually replace all fiat currencies, and is well on its way to doing so

• Fiat currency is sinful and causes a great variety of social ills

• All other altcoins or cryptoassets are scams, wasteful, or sinful; all other usage of blockchains other than Bitcoin is irrelevant or wasteful

• Blockchain use cases like stablecoins, DeFi, RWAs, DEXes are generally a waste of time and only exist because of VC “malinvestment”

• Bitcoin is categorically different from all other “crypto;” owning anything other than Bitcoin is unwise and probably sinful

• Bitcoin will go up, effectively forever. It’s morally praiseworthy to evangelize this to friends and family; if they lose money it’s only because they lost their nerve and sold during a temporary downturn

• Bitcoin’s price is strongly influenced if not entirely determined by its scarcity; four year halving cycles mechanically drive price

• Self-custody is sacrosanct; it’s wrong to custody with a centralized exchange or custodian; and it’s also wrong to use hardware wallets that pollute themselves by supporting altcoins

Not every Bitcoin maximalist believes every single one of these; but most maximalists believe substantially all of it.3

The point is: they earnestly believe in Bitcoin. They are combative. They don’t just, in a benign way, exclusively focus on Bitcoin. They ardently preach that all altcoins are distractions at best and scams at worst. They are Bitcoin’s fighting priesthood – its Templars. Many of them wear the “toxic maximalist” label as a badge of honor.

Some of these “toxic maxis” are nice enough. I have in the past been friends with a few of them. Some of them have made meaningful contributions to Bitcoin. I am not saying they are bad people. I am saying their ideology has failed. It has ceased to be a useful description of reality.

Some hardcore bitcoiners reject the label “maximalist”; they might call themselves “plebs” or purists or “puritans” or hardliners or one of many other variations; the important thing is we all know who I’m talking about: people who endlessly moralize about how Bitcoin is superior to gold or altcoins; how fiat is responsible for most of society’s ills; how Bitcoin is the only financial asset worth owning; and how it’s guaranteed to replace fiat currency, any day now. I grant that it’s fair to object to the “maximalist” epithet since Vitalik popularized it as a kind of a slur for Bitcoiners; but there doesn’t exist a better term as of right now.4

Like the Millerite sect, Bitcoin maximalist ideology is effectively an eschatological secular religion whose adherents believe they are chosen because they possess secret information about the impending doom (of fiat) and the preordained inheritance of a hidden kingdom. The religion preaches privation in the short term in exchange for abundance in the long term – when fiat collapses and Bitcoiners inherit the earth.

The proximate inspiration for this article is the failure of a breakaway purist faction (filters) and the Coldcard hack (in which users have lost over $100m and climbing) which is another dagger in the heart of Bitcoin maxi ideology: the idea that self-custody is inherently superior to centralized custody. Moreover, it again exposed the subculture of “bitcoin-only” startups, which were assumed to be inherently better because they only served Bitcoin. The users who tragically lost money in this hack were misled on both counts by purist influencers.

But really I could have written this essay at any point in the last few years, and indeed this is the second time I am writing it (see my first eulogy for maximalism back in 2022). It has been clear for a long time that the more hardcore strains of Bitcoin ideology are rotten and often, costly for their adherents – like an inverse prosperity gospel.

So it’s time to evaluate maximalism. How do you evaluate an ideology? Well unlike many others, this one actually blends the normative and the predictive. This makes it somewhat brittle. Maximalists are a bit more wishy washy on when the world will adopt a bitcoin standard, but it has been long enough. It has been well over a decade since Bitcoin maximalism was coined (in around 2014 by my reckoning). So let’s test the theory: has it led to correct predictions about the world and profited those who believe in it?

Virtually every testable prediction made by maximalists has failed

Unfortunately for them, the predictive body of work issued by self-described maximalists has largely failed.5 As a guide to the future, the ideology has shown itself effectively worthless. Let’s take stock, shall we?

Falsified predictions:

• Price models like “stock to flow:” categorically and empirically total failures. Almost every hardcore bitcoiner I know was an enthusiast and promoter of the “stock to flow” model which premised Bitcoin’s appreciation on its “increasing scarcity” (or periodic decreases in new issuance). Who wouldn’t like something like that? It guarantees that Bitcoin goes up forever! These models, promoted by “PlanB” attached specific price predictions to Bitcoin on specific dates, positing that Bitcoin’s price was mainly driven by its issuance rate. Needless to say, these models have completely failed. Somehow, most hardcore Bitcoiners who endorsed the models have escaped any recriminations for issuing such atrocious investment advice.

• Total altcoin collapse: One essential tenet of maximalism was that all altcoins are scams and would eventually collapse. They have been very clear on this. Yet alts are very much still in existence. The vast majority of blockchain activity takes place on Ethereum, Tron, Hyperliquid, BNB, and Solana – not Bitcoin. They have not gone to zero; while alts have sold off (alongside Bitcoin), they are worth $600b at the time of writing (excluding stables). Ethereum alone is worth $220b. All of those named chains also earn more in fees than Bitcoin, which is arguably the best judge of a chain’s enduring value – is someone willing to pay to use it? Maximalists have been predicting the doom of alts since 2012 when they first emerged, and they have been wide of the mark the entire time.

• Nation state adoption: had some surges of excitement in 2021 and 2025 but has retreated. As of today, no country considers Bitcoin legal tender. The “Strategic Reserve” in the US was stillborn, the maxi enthusiasm for taxpayer purchases of BTC was embarrassing and ironic given their prior anti-government posture and purported fear of centralization. El Salvador stripped Bitcoin of virtually all the attributes of legal tender at the IMF’s request. No central bank has added Bitcoin to its official reserves. Bitcoin is showing no signs of displacing gold as a sovereign asset.

• No alternate use cases for blockchains: though some touted subsectors like gaming, metaverse, or NFTs did not pan out, blockchains have proven commercially useful for a variety of non-Bitcoin use cases, contrary to the predictions of the maximalists. Stablecoins are the killer app of blockchains by any metric; DeFi is well established; DEXes are flourishing and taking market share from centralized exchanges; prediction markets are a massive breakout winner.

• Regulation would favor Bitcoin versus alts. Not every maximalist believed this – some were completely indifferent to regulation – but those that cared about the US government would often insist that it was only a matter of time until the SEC banned Ethereum and all other altcoins, crowning Bitcoin as the sole legitimate cryptocurrency. This didn’t happen, and regulators adopted a more neutral and pluralistic approach, explicitly exempting many alts from the “security” designation. The landmark GENIUS bill was designed to entrench stablecoins, not Bitcoin.

Trending badly for the purists:

• Price predictions: Bitcoin has done exceptionally well as a financial asset over the last 15 years, but it has not lived up to the lofty expectations of its most hardcore fans. Bitcoin at the time of writing is trading at $63k,6 a price identical to its value in November 2021, five years ago. Bitcoin’s price action is better described as “going nowhere in an interesting way” as opposed to what maximalists loudly predicted, which is an indefinite (if volatile) appreciation. Compared with gold or equities, Bitcoin has fared much worse in recent years. It has served neither as an inflation hedge nor a truly uncorrelated risk asset. Those who heeded the purists’ exhortations to hold Bitcoin and Bitcoin alone incurred enormous opportunity costs, given the abundant investment opportunities that emerged elsewhere. Bitcoin was the trade of the 2010s; AI, not Bitcoin, has been the trade of the 2020s so far.

• The SoV -> MoE -> UoA progression. Bitcoin ideology as it developed over time came to stipulate that Bitcoin’s lack of progress on payments was ok, because new monies would emerge first as stores of value (SoV) and then later as media of exchange (MoE) and only later once ubiquitous as a unit of account (UoA). This is reasonable enough if something of a cartoonish interpretation of monetary history, but this progression has completely stalled. Bitcoin achieved a major feat in growing from zero to meaningful SoV status in a decade, but its success as a Medium of Exchange (as envisioned by Satoshi) has not materialized. Very few commercial transactions are denominated or settled in Bitcoin; stablecoins have completely eaten Bitcoin’s lunch in that respect. Of course, this does not mean Bitcoin is a failure, just that the maximalist inference of SoV to MoE and UoA was wrongheaded.

• The primacy of Proof of Work. For years many Bitcoiners maintained that Proof of Stake couldn’t or wouldn’t work. PoS of course works just fine, and predictions of centralization have not come to pass on successful PoS blockchains like Ethereum. While I am sympathetic to Bitcoiners’ rejections of the “energy waste” attacks on Bitcoin, from a mechanical perspective, PoS is perfectly functional and validated at scale.

• Stablecoins as a transient phenomenon. Most purist Bitcoiners ignored or underestimated the impact of stablecoins. “Why bother with dollars, if Bitcoin will shortly obsolete it,” has been the common refrain. Even though they began on Bitcoin, the purists had no time for dollar tokens, so the benefit of stablecoins went entirely to other blockchains. Some Bitcoiners felt that stablecoins might serve as a temporary bridge to Bitcoin, but rather the opposite has happened: infrastructure which was originally built for Bitcoin is now being deployed at scale for stablecoins, which have achieved a market penetration and real-world traction that Bitcoin never did.

• The merit of Digital Asset Treasury companies. While some purist Bitcoiners have rejected the DATs like Strategy and its ilk, many climbed on board and became ardent supporters and even promoters of these structures. Many prominent maximalists like Adam Back, Jack Mallers (and obviously Michael Saylor) became DAT entrepreneurs themselves. This was ironic considering that many longtime bitcoiners were deeply suspicious of Bitcoin derivatives or adjacent equities, preferring the real thing. Though this doesn’t indict all Bitcoin purists, it’s undeniable that some of their most treasured maximalist heroes issued or endorsed DATs, most of which have completely failed. Strategy still exists, but the possibility that it would trade at a premium forever and be a long-lived Bitcoin acquisition vehicle seems more tenuous than ever.

• The fee market would replace the block subsidy. This is a necessary component of Bitcoin’s vaunted scarcity. If Bitcoin fees don’t rise to a sustainable plateau, Bitcoin will not be able to fund the block reward and hence security in the long term, as issuance declines to zero. If fees don’t materialize, Bitcoin will have to consider changing its treasured monetary policy, undermining its main value proposition. Fees have collapsed since 2024 to almost nothing; today they account for around 1% of the entire security budget – a number that was meant to be high and climbing. In other terms, annualized fees equal about 1 basis point of Bitcoin’s market cap – likely insufficient security spend as the subsidy goes away. The purists barely acknowledge this looming problem – to talk about it is to “FUD” Bitcoin. Bitcoin culture is so parochial that uncomfortable long-term issues cannot even be openly discussed.

Unfalsifiable by construction but not trending well:

• Fiat currencies: they are still very much with us. Have not collapsed. When and if blockchain infrastructure causes fiat currency collapse, it’s more likely that US dollar stablecoins will be the culprit (“crypto-dollarization”).

• Hyperbitcoinization: Was it a rhetorical flourish or a real prediction? Who knows. What does it mean? Anyone’s guess. Either way, it’s not happening, nor does it appear to be on the horizon.

• Bitcoin as a salutary cultural and political asset, lengthening society’s time preference, improving art, ending ruinous credit cycles, fractional reserve banking and central banking altogether, constraining the fiscal state, and ending war (yes, bitcoiners have claimed that all these things would happen if it was successful enough): none of this has occurred. Bitcoin is nowhere near popular enough to leave a meaningful political or cultural imprint on the world, even if these sound money theories might have a kernel of truth to them.

Some of you might object that I am being unfair to the hardcore Bitcoiners because some of these predictions might well come true one day. Bitcoin might end up displacing gold and eventually the dollar. Maybe Bitcoin will reclaim the MoE throne from stablecoins and become a dominant transactional network. Perhaps Ethereum and all the other blockchains will finally go to zero. Maybe Bitcoin will put an end to bad art and war. Maybe hyperbitcoinization will even happen one day!

Perhaps. But a prediction that relies on an indefinite time horizon is a worthless one. I am interested in assessing the credibility of the most hardcore Bitcoiners and so far, their ideas have largely not played out as expected. Indeed, Bitcoin looks to be in retreat relative to most of their expectations. It has been nearly 18 years since Bitcoin was released, and it’s only fair that at some point, we take stock in its present reality versus the dreams of its most ardent promoters.

So what were they right about?

A handful of things. Bitcoin has survived and even thrived for 17 years. It has suffered very few major incidents at the protocol layer, the last critical bug taking place over a decade ago. It has continued to appreciate in a roundabout, cyclical way, peaking at $2.5 trillion in 2025. Bitcoin is an emerging digital-native commodity of real consequence, and it has not been supplanted by any competitor (as a digital SoV). Maximalists correctly identified Bitcoin as a historically important monetary asset, some of them very early on. They correctly predicted that the vast majority of all altcoins, tokens ICOs, yield schemes, NFT projects would prove to be meritless garbage. Bitcoin’s conservatism most likely contributed to its monetary credibility and success.

But their predictions regarding Bitcoin’s interactions with finance, fiat money, technology, other blockchains, politics, and society have almost universally been wide of the mark.

By any reasonable measure, Bitcoin has done extraordinarily well. But has it measured up to the stated expectations of the hardcore Bitcoiners? No, and things aren’t trending in their direction, either.

The maximalist-approved applications of Bitcoin have not succeeded

One of the most curious things about Bitcoin maximalism is how technologically regressive it is. In the early 2010s, Bitcoin was exciting, bleeding edge technology, blending innovations in cryptography, networking, hash functions, Proof of Work, distributed systems, and the academically exciting field of digital cash. It was truly bracing stuff and created a vast opportunity space that entrepreneurs began to explore. Early Bitcoiners used to say things like “Bitcoin will embrace all of the best ideas from altcoins after these ideas are proven”. And indeed, altcoins have created tremendous innovation.

• Ethereum gave us smart contracts, tokens, AMMs, DEXes, stablecoins at scale, RWAs, ENS, rollups, prediction markets, EVM, DAOs, account abstraction, and much more

• Monero gave us RingCT and Zcash gave us the first operational zk-SNARKS

• Solana gave us high throughput at the base layer and parallel execution

• Polymarket gave us scaled on-chain prediction markets, realizing a dream economists had harbored for decades

• Hyperliquid gave us a global and scalable decentralized perpetuals exchange on chain

Despite the hopes of early Bitcoiners, none of these ideas were ultimately absorbed into Bitcoin – or even meaningfully considered. Bitcoin retreated into its shell and focused on socially permitted innovation like Lightning, and very little else. A conservatism crept over Bitcoin and progress at the protocol layer slowed to a crawl; in the last decade only two major upgrades have been added in Segwit and Taproot. Dozens of good ideas have been met only with apathy and torpor.

Of course, you could say that blockchains were always going to specialize, and Bitcoin focusing more on the monetary use case and being hyper conservative made sense; Ethereum could have smart contracts and DeFi and Solana could have fast transactions. But the Bitcoin purists go further, and maintain that nothing happening on any other blockchain is interesting; none of it is durably commercially meaningful; and that Bitcoin has nothing to learn from any other blockchain. They move from focus to deliberate ignorance, and that has cost them dearly. Does Bitcoin really have nothing to learn from any other blockchain? Stablecoins began on Bitcoin via Omni, but migrated to Ethereum, Tron and Solana, where today they are a massive consumer of blockspace. Purists barely even acknowledge them or regret the missed opportunity. DeFi is virtually nonexistent on Bitcoin and largely exists on Ethereum and Solana. Bitcoin’s blockchain is a transactional ghost town; blockspace clears at the minimum market price of 1 sat/byte, since there are no applications that consume it at scale. (Bitcoiners would do well to recall that Bitcoin’s entire long-term security depends on there being meaningful enduring demand for blockspace in the years to come.)

The only somewhat ambitious applications of Bitcoin besides the socially approved “buy Bitcoin and hold it in self-custody for long periods of time” have been failures.

Liquid

Sidechains as a scaling model for Bitcoin dominated developer attention from 2014 to 2017, yet ultimately yielded nothing (on Bitcoin). Blockstream’s Liquid was the most prominent of these, as they had the most leverage due to most of the important developers working there. Bitcoiners at the time were fond of saying that Ethereum was unnecessary as all of these use cases could just be done in a Bitcoin sidechain. This didn’t come to pass, because Bitcoin was too limited in its programming language to introduce trustless pegs. Years later, Ethereum would perfect this vision with ZK Rollups, which are effectively trustless, but are only possible on a richer virtual machine. I mention Liquid and sidechains because these were frequently employed as a rhetorical technique by hardcore Bitcoiners: “no need for altcoins,” they would say. “We will fold everything into Bitcoin with sidechains.” In the end, Bitcoin was too limited a programming environment for this vision to play out, and Bitcoiners were unwilling to gut the protocol and make the necessary changes. So this early maximalist prediction failed, and these compelling use cases were realized on Ethereum.

Lightning

from 2016 to just recently, Lightning has been the almost exclusive “application-side” focus of the Bitcoin development community. Lightning was partly a reaction to the large blocker faction of Bitcoin that defected alongside Bitcoin Cash; they argued that Bitcoin needed more block space so that it could be more suitable for everyday payments. In effect, these people believed that Bitcoin needed to focus on the MoE aspect rather than just treating Bitcoin as a SoV. The response by the Bitcoiners to this critique was to develop Lightning – an overlay network on top of Bitcoin where individual payments could be aggregated and periodically settled. This was an immensely delicate and complex protocol and required a substantial update to the protocol in Segwit in 2017. Ultimately, while Lightning has been significantly refined since 2018 and become much more user friendly, it hasn’t achieved what its early advocates hoped for:

• Lightning has not established Bitcoin as a widely-used day-to-day payments protocol

• Lightning has not re-centered Bitcoin as the dominant blockchain or asset for on-chain payments (these mostly happen with stablecoins on high-throughput blockchains)

• Lightning has not led to an explosion of rich applications

• Lightning has not meaningfully created reservation demand for Bitcoin

Lightning processes, generously, perhaps $10b per year.7 This may seem like a lot, but it’s vanishingly small when you compare it to stablecoins, which settle around $15T a year and growing (all on non-Bitcoin blockchains). Lightning certainly exists. It’s a thing some Bitcoin enthusiasts use sometimes. But if dollar tokens on other blockchains are doing 1500x more volume (real number!), is it even reasonable to call Lightning a success? I don’t think so. Go back in time and tell Satoshi it was going to end this way – would he have said “Great! Looks like Bitcoin won!”?

In context, Lightning is not a relevant blockchain-based payments medium. Partly, this is because no one wants to transact IN Bitcoin, for obvious reasons of tax inefficiency and the issues inherent in transacting in a volatile currency. Because Bitcoiners resisted and ignored stablecoins (fiat is going to 0, remember), Bitcoin never realized the benefit of the trillions in stablecoin transactions. Other chains reaped those rewards.

Nostr

Nostr is the main “purist approved” non-monetary application of Bitcoin. Most hardcore Bitcoiners shrugged at or ignored the waves of NFTs on Bitcoin, chiefly Ordinals, but Nostr was billed as the application layer for Bitcoin. At its core Nostr is a messageboard, though it also supports other applications like DMs, longform, video, marketplaces, and identity. It’s very much a Bitcoin-flavored version of Web3. Core to Bitcoin ideology is “anything they can do; we can do better”. Ethereum was the early leader in decentralized internet Web3 use cases, and Nostr was Bitcoin’s answer.

Though it was much hyped, Web3 never did very well on Ethereum; decentralized social like Farcaster or DeSo faded away. A handful of things like decentralized storage (IPFS), identity (ENS), wallets (metmask, walletconnect), authentication (sign in with Ethereum) were indeed qualified successes. But regardless of substrate, blockchain-based decentralized internet was awkward and user-unfriendly. The billions poured into Ethereum’s Web3 sector never really made it mainstream. As investor interest in the category waned, and lacking a meaningful concentration of builders, Bitcoin’s version of Web3 never had a chance. Nostr has stagnated, plateauing at around (generously) 10k WAUs and 40k MAUs, assuming those aren’t bots. Bitcoin culture is not oriented around experimentation, tinkering, or building; the monetary faction very much won and today it’s more about holding your coins in cold storage and writing blog posts about the Fed and how Bitcoin Fixes Culture.

Aside from sidechains, Lightning, and Nostr, there have been virtually no purist-approved applications of Bitcoin that have reached scale. Concepts like e-cash, DLCs, RGB, Fedimint, and Taproot assets have little traction. The most popular application on Bitcoin in recent years was Ordinals, which was derided by the purist faction, and even that has faded from view.

Faced with the failure of most Bitcoin native applications, the purists are forced to retreat into ever-shrinking terrain, arguing that Bitcoin is fit only for monetary uses (buying and holding). If Ethereum or Solana has success with payments, or DeFi, or Web3, Bitcoiners must move the goalposts. If the bailey in 2016 was “Bitcoin can do everything any altcoin can do – and better,” the motte in 2026 is “Bitcoin is just money. It doesn’t need to do anything else. Those other use cases are irrelevant anyway.”

Now personally I have mixed feelings on non-financial uses of blockchains, or payment systems that rely on a volatile native token, but it’s worth pointing out that purist Bitcoiners did attempt to compete here. As these attempts have stalled, they are retreating into techno-ludditism, denying the utility or worthwhileness of any blockchain application other than the anointed behavior (buying and holding BTC).

Filters and Coldcard further undermined Bitcoin orthodoxy

One phenomenon which characterizes Bitcoin alongside many other militant or radical groups is purity spirals: true believers trying to outdo each other by showing just how committed they are to the cause, accusing each other of being insufficiently zealous. Think of the Bolsheviks purging the more moderate Mensheviks.

I think the history of Bitcoin culture is best understood if you view Bitcoiners writ large as a loose confederation of affinity groups held together by shared grievances and the continual reinforcement of these beliefs through price appreciation. Early on you had the cypherpunks; paranoid privacy and cryptography advocates focused on anonymous cash and communication. Early too you had the libertarians: the Austrians, the Fed critics, the goldbugs. Within them you had the “fractional reserve is fraud” types, the Rothbardians, the anti-credit hard money types. Also within the libertarians: the Agorists, the anti-state grey and black market people who built and popularized the early darknet marketplaces.

Later the Silicon Valley types got involved; the digital cash entrepreneurs trying to create faster, global payments systems. They ran headfirst into the goldbugs and libertarians who were more focused on Bitcoin as a monetary, not a payments system, and were violently ejected into the Bitcoin Cash fork and other payments-focused cryptocurrencies. As Bitcoin went mainstream it attracted more populist, anti-establishment people. The Joe Rogan conspiracy types. The “it’s all rigged, man” guys. “Have you heard of the Cantillon effect?”

And of course, you have the subject of this essay, the maximalists. These are the Bitcoin IRGC, the true believer’s true believer. They determine what is true and good and permissible, and hound and shut down any aspect of Bitcoinism that isn’t orthodox and proper. What is actually entailed by proper Bitcoinism is curiously obscure and seems to tautologically rely on what the maximalists think ought to be the case at a given point in time.

From obscure origins in 2009 to semi-mainstream status in 2017 during the first major bull run, Bitcoin grew the tent outward until it contained many different groups with mutually incompatible views of what it is and should be. Hence the ejection of the payments people like Roger Ver and the smart contract people like Vitalik.

You could argue that these periodic purges were actually good for Bitcoin in that they eliminated a kind of subversive sect and allowed Bitcoin to refocus on its core task with new efficiency and clarity of purpose. But surely, at a certain point, eliminating advocates, capital, and talent is negative for the protocol. Since about 2021 in my subjective estimate, the talent environment in Bitcoin has actually been shrinking – even as it has enjoyed price appreciation due to financialization and a White House embrace.

Partly this is due to Bitcoin’s terrific rigidity; Bitcoinism discourages actually doing anything with your coins aside from storing them. The lack of updates to Bitcoin’s protocol (two in ten years) stifled its ability to host experimentation and creativity. The remaining Bitcoiners gradually focused on the monetary use case: that is, buying and holding Bitcoin or adjacent financial assets like ETFs or DATs like Strategy. Most of their energy went into debating the merits of financial instruments like Strategy or expounding on how Bitcoin adoption might change society for the better. The maximalists seemed to have effectively consolidated power.

Yet this summer, two events that took place within two weeks of each other undermined the core of the maximalist doctrine.

1. The Coldcard hack

On July 30^th, a relatively obscure but surprisingly popular Bitcoin hardware wallet, Coinkite’s Coldcard was exposed as having insufficient entropy. In other words, the wallet was using poor randomness when generating Bitcoin private keys and exposing users to attacks where malicious parties could simply guess at those keys. Once this became public, additional hackers joined the fray and began cracking even more Coldcard wallets. Over 1,816 BTC, worth $116m have been stolen (and counting). It was undoubtedly the worst consumer hardware wallet failure in cryptocurrency history. (Neither Ledger nor Trezor, more established hardware wallet brands, have ever been exploited in such a manner.)

The Coldcard exploit was particularly bad because the wallet was highly touted by prominent Bitcoin maximalists and podcasters as a more pure and aligned option for Bitcoiners, as it supported only Bitcoin and not altcoins. This posture of being “Bitcoin-only” was meant to minimize the attack surface. In practice, it minimized the revenue potential of the company, and Coinkite never scaled and audited the code sufficiently. Coinkite’s prominence was the result of a kind of Bitcoin maximalist DEI; a tiny Canadian company ended up having an outsized market share, simply because it was endorsed as the de facto wallet for “true believer” Bitcoiners who didn’t want to patronize services that supported altcoins. “Bitcoin-only” became an affinity signal that people mistook for a quality signal.

The hack itself was catastrophic because Coldcard users were the truest of the true believers; they had “done everything right” – refusing to store their funds on exchanges, using deep cold storage airgapped custody, using a “bitcoin-only” solution, following the instructions issued by the most hardcore Bitcoiners. A good number of Bitcoiners had their entire life savings in Coldcards and lost everything. In terms of harm done, this was arguably worse than many larger DeFi or exchange exploits because this represented the accumulated savings of many individuals; compare it with other crypto hacks often mainly affecting wealthy traders losing out on paper gains. The Coldcard hack affected ordinary people who had diligently followed the instructions of the Bitcoin high priesthood.

So what does the hack say about Bitcoin maximalism?

• Bitcoin-only is not a foolproof doctrine. There do exist truly exceptional “bitcoin-only” companies, and my firm is an investor in a few. River is a great example. They are focused on Bitcoin, but have a variety of product lines and have invested appropriately in security. There are however several cases, and Coldcard is the latest, of companies using “bitcoin only” as a kind of affinity marketing to Bitcoiners, creating a goodwill dividend which has been used to paper over cracks in otherwise unviable or insecure businesses.

• Maximalist advice is not universally good. For years the refrain from maximalists was: Bitcoin always goes up (in the long term), use self-custody, use Bitcoin-only hardware (in particular Coldcard), avoid exchanges, put your entire savings in Bitcoin, keep the faith. Virtually every tenet of this doctrine has been challenged by recent events. Most ordinary Bitcoiners would have been better off buying a Bitcoin ETF, holding Bitcoin on a reputable exchange or brokerage, or if they had to self-custody, using a more mainstream product like Ledger or Trezor. Self-custody is simply too difficult and risky for most ordinary people. I’m glad it exists as an option, but it’s not something that should be recommended for the average user.

• Self-custody is in decline. Today, there’s limited reason outside of extraordinary or unusual circumstances (say, you’re a refugee fleeing across borders with no digital accounts of any sort; you’re withdrawing funds from a custodian; you’re a HNW individual holding funds on a multisig with Casa) to favor self-custody over intermediated custody. There’s just too many ways it can go wrong; from footguns to exploits to phishing to scams and hacks. In a world of Bitcoin ETFs, the overwhelming majority of users can happily and safely use paper Bitcoin. Self-custody remains an extraordinarily powerful tool, but it is not universally safer, and the maximalist’s insistence that it is the morally and practically superior default ignored substantial tail risk. When the history of Bitcoin is written, the Coldcard hack will be looked back on as a key moment bookending the era of self-custody.

American Hodl summarized the psychological impact of the hack well:

The hack seriously affected several pillars of the Bitcoin maximalist worldview, hence the outsized fallout relative to the size of the theft.

2. The failed Filters coup

I’m not going to recap the long-winded and tedious Filters debate here – if you are interested you should read Jameson Lopp’s thorough account – but suffice to say, a group of hardcore Bitcoin puritans attempted a coup which failed. The thrust of their complaint was that the Bitcoin protocol had become polluted by arbitrary, non-monetary data. This has been going on since the dawn of Bitcoin – it’s actually very hard to design a protocol which doesn’t support arbitrary data insertion – but the Filters crowd were upset about non-monetary protocols like Ordinals which simplified putting arbitrary (image, eg) data on Bitcoin. To them, Bitcoin was money, and only money, and not a vehicle for frivolities like pictures of cats. Besides the object-level complaint, the Filters people also correctly pointed out that Bitcoin development had become effectively tyrannized by a tiny oligarchy of unaccountable developers who were completely immune to any form of feedback. Most Filters people self-identified with the “bitcoin pleb” epithet; that is, relative newcomers to Bitcoin. Think of them as a kind of anti-establishment group, taking pride in the fact that they represented the “everyman” rather than the established Bitcoin elite.

Their metacritique was actually fairly reasonable, but that wasn’t enough for them to prevail.

The gang, led by longtime Bitcoin developer Luke Dashjr, rallied behind a minority fork of Bitcoin, BIP 110, that failed instantly after being born from a chainsplit on August 8. The interesting thing about the filters crowd is that it was an example of an ultra-orthodox breakaway group that was defeated by the more moderate majority (unlike for instance the blocksize wars in which the ideologues defeated the pragmatists). The Filters crowd employed the same tactics that the maximalists had historically leveled against perceived enemies of Bitcoin – but this time directed at core developers and established Bitcoin maximalists. I might be thinking wishfully here, but I think the main contribution of the Filters people was to give prominent maximalists a taste of their own medicine: relentless mean-spirited attacks from a small army of largely anonymous and extremely aggrieved Bitcoiners claiming the high ground and greater moral purity.

The other outcome of the Filters debate is that a meaningful subset of the “toxic maxi” crowd became disillusioned from Bitcoin and will presumably quit being actively involved. While extremely unscientific and not at all proportionate, this graphic depicts the reported positions of a subset of Bitcoiners on X on the filters debate, with the breakaway faction on the right in green.

Some fairly well-known Bitcoiners – maxi footsoldiers in wars past – found themselves on the losing side of the filters debate: Luke Dash, Hodlonaut, GrassFedBitcoin, Justin Bechler, Knut Svanholm, Matthew Kratter, Fred Krueger, Parman counting among the most notable, alongside a legion of “plebs”.

Now the Filters civil war did not end Bitcoin maximalism, but it was a meaningful blow against the institution. It helped exhaust the movement by stripping the orthodox wing of some of its most radical footsoldiers. It subjected established maximalists to nonstop “pleb” harassment tactics. And it did resurface a reasonable critique: Bitcoin Core is dominated by an unaccountable priesthood of developers, and is far too rigid to accommodate legitimate grievances.

An ideology designed to be unfalsifiable

A decade and a half in, being a Bitcoin purist became less about believing a fixed mantra, and more about signaling in-group status for social benefit. The reaction to my list of bankrupt claims in the first section will undoubtedly be “I never said that. No one ever meant that. We didn’t seriously believe that”.

And that will be true to a certain degree, because provocative internet ideologies thrive in the space between sincerity and irony. Say outrageous things; if they don’t land or you get serious pushback, claim you were only pretending.

“Hyperbitcoinization? That was just a rhetorical tactic. We didn’t really believe that nation states would adopt a Bitcoin standard. We were moving the Overton window. It was a joke, chill out.”

Constant goalpost shifting achieves a real social objective: it allows members to feel like they are part of a group that has been “right about everything” without requiring them to have been right about everything. Successful predictions are valorized and written into the ledger; unsuccessful predictions are retroactively recast as trolling or propaganda.

This results in an asymmetric epistemology. If Bitcoin actually hits $1m, the predictors can claim to be world historical savants; if not, it was just a way of expressing confidence. If a country adopts Bitcoin, hyperbitcoinization is well on its way; if not, Bitcoin never needed filthy nation states anyway.

Over time this makes it virtually impossible to pin down what the maximalists actually believe. The doctrine isn’t written down and its aggressive claims become non-binding when history moves against them.

The same instinct that led the Millerites to reinterpret the prediction when the rapture did not happen has powered maximalists’ remarkable doctrinal migrations over the years.

1. Payments -> Store of Value technology

Satoshi’s own framing of bitcoin was overwhelmingly payments first. As Bitcoin confronted its technological limitations and a conservative design philosophy, that vision was mortgaged to Lightning, and then abandoned altogether. Payments occur on other blockchains largely in dollar denominations. Maximalists today maintain no allegiance to early Bitcoiners’ vision of a payments network.

2. Absorbing the best ideas from altcoins -> those ideas are pointless

This has been completely memoryholed, but early Bitcoiners were adamant that the best ideas from altcoins would be implemented on Bitcoin. None of this happened, and Bitcoin gradually lost the ability to implement any new ideas whatsoever. Bitcoin has been at a virtual technological standstill for a decade, and the maximalists have adapted by insisting that those ideas are bad and pointless. Their need to win has forced them into the unenviable position of maintaining that no technological development outside of Bitcoin is worthwhile.

3. Escaping Wall Street -> Wall Street as the vehicle of victory

Early Bitcoiners were libertarian cypherpunks who believed in creating private, personal spaces through cryptography that governments and corporations could not penetrate and police. Around 2017, Bitcoiners accepted an explicit tradeoff, though they didn’t realize it at the time: Bitcoin would become institutionalized, derivatized, centralized, and captured by the institutional architecture of finance, in exchange for price appreciation. This Faustian bargain powered several massive rallies, but extinguished Bitcoin’s potential as a true cypherpunk technology.

4. Separating money from state -> state adoption as the prize

What would Satoshi and his early co-conspirators have thought about American Bitcoiners begging the government to buy Bitcoin and put it in a Strategic Reserve? Virtually every Bitcoiner bent the knee when the Trump administration signaled that this was a possibility. This was the clearest illustration to me of how even the most hard-nosed maxis could easily be persuaded to compromise their principles.

5. Hyperbitcoinization as a forecast -> an indefinitely deferred destination

Like the Millerites after the Great Disappointment, Bitcoiner hardliners had to downgrade and revise their most cherished belief, slowly coming to accept that they might have been wrong on the timeline. As the realization dawned that the world was no nearer to adopting a neo-gold standard with Bitcoin as the substrate, the goalposts have shifted to the indefinite future. Anyone blithely pointing out that it has indeed been 18 years is met with reproach: “this won’t happen overnight! These kinds of things take generations”. The Maximalists have now adopted an entirely unfalsifiable thesis.

Where does this leave Bitcoin?

Today in 2026, Bitcoin maximalism is a niche ideology with little ability to recruit new members. At best, it offers simple answers to those who find themselves confused by the dizzying array of options in crypto: Bitcoin, and only Bitcoin, is the answer. Everything else is a scam. Just buy Bitcoin, hold it in self-custody, and you will eventually be rewarded.

The problem is that with time, these claims have been largely revealed to be untrue. Bitcoin has stagnated price-wise. Gold stole most of its thunder in 2025, and inflation subsided in the major fiat currencies. Other investments outperformed. Other blockchains came to offer plenty of valid use cases. Buying and holding is not the only thing you can do with digital assets. Self-custody ended up being fragile, complex, and too risky for ordinary retail investors.

In other words, the Bitcoin prosperity gospel preached by the maximalists stopped producing prosperity. Powering all the elaborate claims about Bitcoin healing society and politics was one simple reality: if you buy Bitcoin, you can make money and maybe even get rich beyond your wildest imagination. For most new Bitcoiners (anyone who joined in the last five years), this simply hasn’t been the case. In this cold hard light of day, people have become less receptive to the more outrageous claims made by the purists. The ideology simply has less to offer today, and fewer and fewer people are willing to indulge the maximalists. I see nothing on the horizon that might reverse this trend.

As for me, I still like Bitcoin. I will keep holding Bitcoin (via ETFs only). I will continue investing in Bitcoin companies. I will continue advocating for changes that I deem important to the success of Bitcoin, which include adding crypto-agility to tackle a future quantum threat. As I said in my last post on this topic:

Ultimately, Bitcoin is not a lifestyle. Bitcoin is not a steak dinner. Bitcoin is not memes and it’s not laser eyes. Bitcoin is a profoundly useful tool. It is impregnated with some ideology, but it is not the ideology that these people profess. The core Bitcoin values have to do with property rights, individual human dignity, self-determination, privacy, autonomy, and monetary predictability. Bitcoin attracts me for that reason, and I’ll keep supporting it with all the resources available to me regardless of how anyone describes me.

I am not pessimistic about Bitcoin. I’m just interested in the world as it actually is, instead of the world of utopias and pleasant delusions. My case for Bitcoin has always been more robust and resistant to shocks than the case these maxis make, because theirs relies on fantasies like the stock to flow, the inevitable collapse of all altcoins, or hyper bitcoinization. I’d be upset if I believed in those things too.

One of the great victories won by the maximalists was convincing ordinary Bitcoiners that Bitcoin needed them to succeed. Sure, they might be a little whacky talking about how Bitcoin ends wars or saves us from bad art, but the movement needed its fanatical shock troops in the wars against the central bankers, academics, economists, and shitcoiners.

I want to disabuse Bitcoiners of this notion. Maximalism feeds off Bitcoin, rather than the other way around. Maximalism confuses Bitcoin’s success with the vindication of maximalism itself. The asset and protocol can succeed while the radical ideology around it fails. And, indeed, that is more or less what has happened. Bitcoin thrived and became a global monetary asset of consequence. The elaborate body of prophecy around it ended up being a poor description of what success would look like.

The maximalists will not concede this. They have built an ideology so flexible that encounters with reality will do little to dissuade them. There will always be another timeline, another win condition, another interpretation. William Miller would be proud.

People are upset about the MicroStrategy selling Bitcoin by May 31 Polymarket market.

And I get it. MicroStrategy did sell Bitcoin by May 31. They sold 32 coins for $2.5m between May 26 and May 31. (Strategy is entering a bit of a tailspin on the news, but that’s a subject for another article).

This became somewhat apparent as early as mid May due to Saylor suggesting that he might do it as a test of how the market would react (badly). You can see that YES traded as high as 60% on May 15th.

The only problem is that after multiple rounds of disputes, the market settled to NO, due to the fact that MSTR only announced their sale on June 1st, after the market had closed.

Polymarket added a note on June 1st during the dispute period, saying

No information from MSTR, on-chain data, or consensus of credible reporting confirmed that MicroStrategy sold Bitcoin within the market’s timeframe. Confirmation achieved outside of the market’s time frame does not qualify.

This belatedly transformed the market from an “occurrence” market to an “announcement” market. Effectively, Polymarket rewrote the market from “MicroStrategy sells Bitcoin by…” to “MicroStrategy announces a sale of Bitcoin by...”

The disgruntled YES buyers – and there are many of them – reasonably argue that the sale did in fact happen during the window, that the additional context changing the rules of the market was not present upfront, and that the spirit of the market resolved to YES. They also point out that on-chain data implied that MSTR was indeed selling the coins in late May.

Some sophisticated participants agree that Polymarket is in the wrong here. Some of the FTX claims buyers are now buying YES claims for 20-25 cents on the dollar.

This is a gigantic mess that will test Polymarket’s resolve. In the past, they have outsourced contested markets to UMA, their designated resolution protocol, and stuck by it. This is deeply flawed, as voting power on UMA is determined by token ownership, which can be profitably exploited to swing resolution one way or another.

This isn’t the first time a market has resolved “wrongly” due to a poorly specified market and the whims of UMA whales. Polymarket should take this opportunity to completely overhaul their resolution system, and do the following:

1. Abandon UMA as a resolution oracle, and settle markets themselves

2. Fire the markets team and hire actual lawyers who know how to properly specify markets

3. Introduce deferred settlement, like other event betting platforms

4. Refund all participants in the Strategy by May 31 market

5. Introduce voided market outcomes rather than forcing all markets into a binary outcome

The trouble with UMA

Universal MarketAccess, now UMA, is the outsourced protocol that handles Polymarket market resolution. It made sense in the early days when Polymarket was a fully crypto-native protocol and wanted to avoid the perception of being centralized. Outsourcing settlement was elegant back in those days because Polymarket could avoid allegations that they were running a centralized bookie, which might have caused their regulatory tightrope walk to fail.

It doesn’t make sense today.

Regulated prediction markets are now a thing, and Polymarket US is officially regulated by the CFTC as a DCM. The Strategy market happened on Polymarket international, where US users aren’t meant to trade. My understanding is that Polymarket US relies on its own market resolution mechanism whereas their offshore entity uses UMA. Polymarket should bite the bullet and move to the internal resolution model for the whole platform.

UMA is basically an anachronism. A callback to a time when the platform needed third-party resolution delivered on chain. But Poly is increasingly pursuing regulatory rapprochement rather than a rugged decentralized model. And UMA itself has a checkered track record. It is constantly the source of controversy for its difficulties settling contested markets.

And this isn’t strictly UMA’s fault, as the markets are often ambiguously written and hard to interpret, leading to constant fights.

But UMA itself is also a potential source of manipulation, unacceptably so in my opinion. The entire market cap of UMA is $37.4m, and tokenholders vote anonymously. To swing a market resolution, you might only need a fraction of supply or a few million tokens.

Disputed markets like the Microstrategy market have volumes in the hundreds of millions of dollars ($317m in that case).

For only a few million dollars, you could buy enough UMA to consistently swing disputed markets, harvesting way more than that in close markets where you swing the vote. Since UMA votes are anonymous, there’s nothing prohibiting an UMA holder from having a position in an underlying Polymarket market. This is obviously highly conflicted.

And you get to reuse your UMA indefinitely (and sell it when you are done), so you could profit many times from this strategy. The economic security of the UMA system fails once the supply of disputed market liquidity far exceeds the UMA market cap, which it does (by a large factor). In fact, I’d be very surprised if there wasn’t currently a fund running a systematic strategy which does exactly this.

Here are my estimates on some recent markets:

• Flipping the Strategy Sells BTC market resolution would have required 15.7m UMA, or $6.52m, against a market with $293m in liquidity

• Flipping the Zelenskyy suit market would have required $7.01m worth of UMA, against a market with $242m liquidity

These numbers are approximate because UMA penalizes voting against the ultimate winner, so all you have to do is represent an “emerging consensus” on one side or other, which you could in theory do cheaply. There are hundreds of disputed markets resolved by UMA each year.

UMA votes have resolved a lot of markets “wrongly”, in my opinion, notably the Zelenskyy suit market (it was obviously a suit). So there is plenty to reason to suspect UMA whales. Even absent any evidence of wrongdoing – and I’m sure it exists if you look closely enough – Polymarket should abandon UMA regardless. The stakes are simply too high to outsource resolution to anonymous token holders of a $37m protocol. As volumes on Polymarket keep growing, the divergence between the cost to maliciously swing a resolution and the profit to be extracted will only grow.

UMA was a nice idea initially, but Polymarket has outgrown UMA’s ability to provide reliable crypto-economic security.

How would a regulated or binary option venue have specified the market?

Looking at Polymarket competitors or adjacent venues like Kalshi, CME, Nadex, or IBKR that offer similar markets, a pattern is clear. They clearly define the source upfront. They define the event time and the determination time. They allow deferred settlement if the source data lags the market close. And they settle centrally without passing the buck to some unaccountable third party. For instance, Kalshi explicitly says:

Most markets settle within a few hours after the outcome is known (often within about 3 hours). In some cases, it can take longer if we’re waiting on official data from source agencies.

And:

Why might settlement take longer than expected? Waiting on official data: We rely on a source agency (for example, official league statistics, government releases, or other event authorities) to publish finalized results. If their data is delayed or revised, we may wait before settling, depending on the market rules.

The CME has similar contingency language in its event contract rulebook:

If an Event does not occur, is delayed, is rescheduled, or is canceled prior to Termination of Trading, Final Settlement determination shall be deferred until the Contingency, as set forth in the Event Contract Swaps Table. If the Event has still not resolved and/or will not be resolved as of the Contingency Expiration, occurrence determination shall determine Final Settlement, as set forth in the Event Contract Swaps Table.

Nadex avoids this quagmire by only listing event contracts that can be settled by data releases by a specific reporting body:

The expiration value for an economic report contract is the figure released by the designated reporting body. For example, the weekly jobless claims number is reported by the US Bureau of Labor Statistics, and GDP is reported by the Department of Commerce.

ForecastEx (which IBKR relies on) also accommodates reporting delays, but again this depends on a specific predetermined reporting agency.

So how would Polymarket’s competitors have handled this market?

They would have specified it differently up front.

They would have made it clear up front whether it was an occurrence or an announcement market. If it was an occurrence market, they would have cleanly specified reporting sources up front. They would have closed trading at the specified time, and then waited through a predetermined evidence window, settling via predetermined admissible sources. Markets like these can’t close and settle at the same time.

What Polymarket should do now

First things first, Polymarket should refund participants in the Strategy market. The addendum changing the market rules was added after the fact (as far as I can tell), giving the YES buyers clear cause to bring a case should they choose to. Poly should nip this embarrassment in the bud by refunding and voiding the market. Second, Poly should ditch UMA. It is an anachronism and no longer useful. They should internalize market settlement and shoulder the responsibility for their resolutions. The stakes are too high to continue with business as usual.

Third, Poly should simply hire better people to write their contracts. The trouble with most of these markets is not that the real world is ambiguous, but so far they haven’t been able to write that ambiguity out of their contracts up front. But by being extremely pedantic and anticipating weird edge cases, it’s possible to take the risk of an ambiguously settling market to near zero. People that can do this exist – they are called lawyers, and they are exceptionally good at anticipating weird edge cases. (In fact, they’d probably be thrilled to do it, as AI is making a lot of them redundant). It seems to me from reading lots of Poly contracts that they are being written by “markets guys”, not “legal guys”. It appears that Poly is playing a scale game, trying to pump out as many markets as possible. They should invest more in a legal team to write these contracts. They certainly have the cash.

Fourth, Poly should introduce a deferred settlement mechanism, like all of their competitors do, and permit markets to be voided. Sometimes the real world really doesn’t settle one way or another, and in that case you simply give the bettors their cash back.

See my other pieces on prediction markets:

Greg Ip, the chief economics commentator for the Wall Street Journal recently published an article entitled Stablecoins Are Private Money. That’s Why They’re a Risk to the Economy. The argument turns on the familiar claim often bandied about by establishment journalists and policymakers: a proper money can only be issued by the state. As a privately issued monetary medium, stablecoins cannot possibly be fit and proper. As such, their emergence poses a risk to the financial system.

This is fundamentally a definitional argument. Money is public, perhaps even a “public good” as Ip says. Stablecoins are private. Private issuance cannot work, the story goes. History demonstrates as much, if you consider the unstable “wildcat” banking era. As such, stablecoins are destined to fail, or perhaps should be regulated out of existence, so we avoid the fallout from such a failure.

But what if the history we were taught in economics class is wrong? What if competitive issuance, absent central bank authority, can create a stable and functional system? What if the American free banking era was a failure because of regulation, not due to its absence?

This would pose a significant problem for the establishment. They would no longer be able to define stablecoins out of existence. They would have to concede that private monetary media can indeed lead to a flourishing, efficient, and stable system.

Whether it’s due to an aversion to stablecoins, or a rigid commitment to a statist view of financial history, or simply ignorance of free banking episodes in the US, Scotland, or Canada, the economics establishment seems determined to deny the history of private monetary issuance, substituting instead a version that aligns with the post-1970 consensus around money: something that only the government can create.

If you actually consider the history, the conclusion is clear. Emergent private systems without any central bank can indeed mediate the competitive issuance of money, and have worked perfectly well for long periods of time in the past. Stablecoins are in many ways the spiritual successors to these “free banking” regimes, though they differ in some critical ways. Even if you abandon the free banking analogy, the very real track record of stablecoins over the last decade – not to mention regulatory improvements post-GENIUS – demonstrates how functional a private monetary system can be. Let’s consider Ip’s claims one at a time.

Claim: the history of Free Banking demonstrates the imprudence of allowing private banknote issuance

Ip says:

Later on, he elaborates by referring to the US “free banking” era:

He quotes an NBER paper summarizing the problems these free banks exhibited:

To summarize Ip’s argument, he seems to believe that private issuers of banknotes (or digital banknotes, in the case of stablecoins) are inherently unstable, since only the state can guarantee bank stability through oversight and centralized liquidity provisioning, alongside depository insurance. The US’ troubled experience with “free banking” is cited as evidence in his favor.

Unfortunately, Ip misreads history and makes a poor analogy with stablecoins.

“Free Banking” in the US was not unrestricted or unregulated. Rather, it was an excess of the regulation from the States – namely, forcing the banks to hold low-quality collateral, and restricting branching (geographic diversification) that led to its notorious failures.

The factors that led to the instability, deviations from par, and failures of the free banks in the US are not present in the context of GENIUS-regulated stablecoins. They simply don’t apply, so the analogy fails.

Other episodes of more genuinely “free” or laissez-faire banking, such as those that appeared in Scotland and Canada (which, as a Canadian himself, Ip should know about), were notable successes, demonstrating that banks can indeed issue banknotes with no bank failures and complete stability – absent the supervision of a central bank.

The story of the failures of American quasi-free banking, and the successes of Scottish or Canadian free banking, undermine rather than support Ip’s point.

Ip is treading on familiar ground. He is not the first to make this claim, and I already considered it at length last year:

This issue – ahistorical comparisons between stablecoins and misreadings of the “free banking” era in the US – has actually plagued me since 2021. It’s an incredibly popular line of attack among economists and central bankers. The only trouble is – none of them seem to have read the history.

I don’t have space to get into a full breakdown of the American, Canadian, and Scottish systems, so I suggest you read my prior article. But I will summarize here.

“Free banking” in the pre-Civil War era in the US only meant that you did not need a special charter to open a bank. This did not mean that banks were unregulated. Indeed, the States actually harshly regulated these “free” banks, prohibiting branching (all free banks were unit banks – as in, they were only permitted to serve one community), and requiring the banks to hold questionable state bonds as collateral. The bank’s assets – and hence banknotes – were only as good as the states’ solvency. Moreover, the inability to branch meant that banks were not geographically diversified, and horribly exposed to local crises. Banks failed when their bond portfolios depreciated – and unsurprisingly, many states’ bonds did not perform well in the lead up to the Civil War. Banknotes traded at discounts reflecting the actual cost of redeeming them for specie, which was normally a function of how far the banknote had traveled from the issuing bank.

None of these lessons really apply to stablecoins, nor do they make Ip’s point that there is anything inherently dastardly about private banknote issuance.

Instances of genuine laissez-faire or “free” banking can be found in Scotland (1716 to 1845) or Canada (1837 to 1935). These systems more closely resemble a truly private monetary system lacking a central bank, and much to the chagrin of today’s economists, they thrived. These counterexamples to the commonly-cited but misunderstood American “free banking” era are devastating to the establishment’s normative views around money and are hence seldom brought up.

For over 100 years, Scotland had multiple competing note issuers (issued against gold specie), no central bank, no state-imposed collateral, with active branching. Banks were disincentivized from over-issuing by market forces. They mutually accepted each other’s banknotes and developed a clearinghouse in Edinburgh, ensuring that the notes traded at par. Bank failures were extremely rare (I am aware of only one major one – the Ayr bank) and inflation was low. Meanwhile, England which had a central bank during the time period lurched from crisis to crisis and had hundreds of bank failures. This is a compelling argument because both countries were subject to similar fundamental economic conditions.

Canada is another great counterexample to Ip’s framework whereby only the state can guarantee financial stability. Canada had no central bank until 1935. Though charters were more restricted than in the Scottish system, the banking system was still relatively “free”. Banks issued their own notes (redeemable for specie), branched widely, and were not forced to hold government bonds (unlike their peers to the south). Private clearinghouses ensured that notes were generally traded at par, and the system gradually consolidated into a small number of large, nationally branched banks, giving them the geographic diversification their American unit bank counterparts were denied.

The result is a comparison that should be uncomfortable for anyone holding Ip’s view. During the Great Depression, the US – equipped with the Federal Reserve and centralized oversight – suffered roughly 9,000 bank failures. Canada, with no central bank and privately issued banknotes, had none. Both countries faced the same depression and the same monetary contraction. Only the US had a banking crisis. If only the state can guarantee financial stability, this outcome is inexplicable.

Verdict: the American free banking analogy fails on its own terms, and the more apt analogies – Canada and Scotland – undermine Ip’s framework.

Claim: Stablecoins might “break the buck” like Money Market Funds

Ip compares stablecoins to “private monies” like money market funds and suggests that, like MMFs, we risk fragilizing the financial system if we rely more on them while assuming they will always trade at par. He says:

This is an interesting line of attack since money market funds were indeed subject to a lot of criticism when they were first being developed, along the same lines as stablecoins are today. Critics alleged that MMFs were creating a parallel private monetary system outside of the regulated banking perimeter. There was great concern, as there is today, about deposit flight from the banks. Critics complained that money market funds were “free riding” on the financial system while not submitting themselves to the supervision and regulation or insurance of banks.

Of course, MMFs proved tremendously useful and grew to around $7.7 trillion largely without incident, and these criticisms now seem quaint in hindsight.

Of course, there were hiccups, like The Reserve Fund’s infamous depeg during the Financial Crisis. But that was hardly a catastrophe, and it doesn’t generalize to Genius-regulated stablecoins.

As Ip surely knows, the Reserve Primary Fund – the flagship and first money market fund, established in 1971 – suffered a run in September 2008 when Lehman collapsed and holders realized that the Fund was holding $758m of Lehman commercial paper. The next day, the NAV fell to $0.97 per share. This was the infamous “breaking of the buck”. The fund actually held $65b of assets so the “true loss” was 1.2% per share, but the flood of panicked redemptions drove the NAV below that level (similar to the USDC dynamic when SVB failed). In the end, Treasury stepped in and guaranteed MMFs and stopped the run, while the Fed created emergency liquidity facilities. The ultimate loss realized by holders of the Reserve Fund was less than one cent per share.

Now could this happen with stablecoins? Of course, runs and depegs have been observed with stablecoins in the past, notably USDC during the SVB collapse in March 2023, since SVB held $3.3b of USDC cash or 8 percent of backing assets. USDC traded as low as 87 cents on the dollar before SVB depositors were made whole. Could this happen again? Perhaps, but issuers these days are much more cautious about where they park their cash. Issuers are now much less inclined to leave cash in banks at all, preferring to hold short-duration US Treasuries. Banks can always experience crises, but this is hardly a stablecoin-specific issue.

And the worries about the Reserve Fund depeg just don’t apply to GENIUS-regulated stablecoins. GENIUS requires that issuers maintain 1:1 reserve backing consisting of cash, short-duration Treasuries, repo, or certain MMFs (holding those same assets). They would not be able to hold commercial paper like the Reserve Fund, or MMFs holding those types of assets. Could the 90-day Treasury market become dislocated? Perhaps, but if so, the world is basically ending, because it’s the most liquid market on the planet. And despite the scaremongering over the Reserve Fund, no money market fund holding only short-duration Treasuries has ever broken the buck.

Can I guarantee to you that stablecoins will always trade at par? No. A derivative is by definition less liquid than the underlying. But the underlying for GENIUS stablecoins – cash and short-duration Treasuries – is pretty damn liquid.

Verdict: no, GENIUS-regulated stablecoins won’t break the buck like the Reserve Fund. Bad things can always happen, but if they do, something much bigger and much worse is going on, like a full-on banking or government solvency crisis.

Claim: Stablecoins do not exhibit “singleness”

Another objection we hear all the time is that stablecoins do not trade reliably at par, and hence violate the “no questions asked” or “singleness” principle. To work properly, the thinking goes, a dollar needs to be a dollar at all times and circumstances. Though he doesn’t cite it, this objection frequently traces to Gorton and Zhang’s regrettable paper “Taming Wildcat Stablecoins”. Ip says:

Ip cites BIS data supporting his thesis, showing tiny peg deviations in Circle and Tether’s history. This is fairly uncharitable, as they have faced virtually no deviations since GENIUS was passed, and the law instilled stringent frameworks that are intended to ensure that they generally trade at par.

It always amuses me that establishment thinkers like to claim that stablecoins don’t work in theory, so they can’t work in practice. These theoretical shortcomings might surprise the tens of millions of people who use stablecoins every month as money.

More generally, no monetary good satisfies Ip’s requirement of absolute singleness at all times. Though they were holding domestic-banking-system-dollars, depositors at SVB, First Republic, and Signature certainly did not feel the warmth of “singleness” that weekend in March 2023. Even today, uninsured deposits at banks arguably do not satisfy Ip’s singleness or Gorton and Zhang’s “NQA” policy. The quality of bank dollars is mostly a function of the Fed’s desire to intervene in a crisis. So if the banking crisis of 2023 doesn’t eliminate the “singleness” of bank dollars, a Tether depeg in 2018 shouldn’t discredit stablecoins either.

As many have pointed out, money is more of a quality than a binary. Different media have varying amounts of moneyness. Stablecoins have clearly graduated from ersatz crypto casino chips to globally trusted money inside the US regulatory ambit.

Does a medium have to be absolutely perfect to meet some economist’s definition of money? It would be completely ahistorical and empirically blind to presume so.

Verdict: if stablecoins don’t have singleness, bank dollars don’t either. Millions of people worldwide behave as if stablecoins do have singleness.

Claim: Stablecoins could back their reserves with Bitcoin

In one of his more tenuous claims, Ip says that even GENIUS-regulated stablecoins might be backed with exotic assets such as Bitcoin. He writes:

What Ip is envisioning, via Barr, is a situation where a stablecoin issuer holds as a reserve asset a repo receivable (loan) secured against Bitcoin, in the case that it is considered money. If Bitcoin were to crash hard overnight in this extreme hypothetical, the issuer might end up with Bitcoin, or face a disorderly liquidation.

Why any stablecoin issuer would do this is completely beyond me, but luckily it’s not something we have to worry about, because this entire hypothetical rests on a faulty assumption. When Barr gave the speech that Ip is referring to in October 2025, El Salvador – the only country treating Bitcoin as legal tender – had already rescinded Bitcoin’s status nine months before. Not only is this a theoretical loophole that would likely be closed under the regulatory implementation of GENIUS – exactly what Barr was asking for in his speech – it was already outdated. El Salvador was no longer treating Bitcoin as legal tender.

Verdict: not a real concern.

Claim: Stablecoins aren’t used for “real world” payments

Ip says:

Before we get into the data, I want to point out that this isn’t discrediting at all. Were Ip to consider the conventional dollar system, he would realize that the vast, vast majority of dollar transaction volume – at least 80-90% – has to do with financial markets. Securities settlement, repos, clearing, FX, and so on. The volume of “real world” payments, though large in absolute terms, is completely dwarfed by the amount of cash that sloshes around daily in financial markets. So even if that 1% statistic were accurate, it wouldn’t discredit stablecoins at all. Of course they are used to settle financial market transactions. That’s how money is overwhelmingly used everywhere.

Secondly, the data doesn’t support that “less than 1% real-economy usage” assumption. That statistic from the KC Fed study is based on a piece of research we, Castle Island, published with Dragonfly and Artemis.

The way this study worked was we went to 31 stablecoin payments companies and asked them for their own data regarding transaction volumes between known individuals or firms. The largest category was “b2b”, though card payments were growing extremely rapidly, and are far, far larger today. This was the first “bottom up” estimate of its kind. And it was very much a lower bound estimate. There are not just 31 stablecoin PSPs. There are hundreds of such firms.

Looking at the chart, you’d be hard-pressed to think “real world stablecoin payments aren’t material”. They are growing extraordinarily rapidly, as we (Castle Island) can directly attest. Rain, one of the issuers of stablecoin-linked cards profiled in the study, has been a massive success story. The WSJ need only look at the evidence around them to see that stablecoin payment volumes are growing at a rapid clip.

What the KC Fed did was take the (outdated, lower bound) findings from our study, make additional assumptions around payment velocity, and determine that less than 1% of stablecoin supply was necessary to support them. While I appreciate them using our data, this estimate (and hence the WSJ’s) is insufficiently caveated. Our data was a snapshot of a subset of the market, not an attempt at a full estimate of stablecoin payments volume. If I wanted to do that, I would refer Ip to Fireblocks’ estimate published in Fortune. They are a massive infrastructure provider and many firms build their transaction systems on top of them. As such, they have a more comprehensive sample with which to make an estimate. Based on data published in early 2025, ten percent of their client’s volumes related to payments with the rest trading. You can see it growing rapidly. It is assuredly higher today.

So as it turns out, the best data we have suggests that stablecoins are actually quite similar to ordinary cash in the financial system. The bulk of settlement value pertains to financial market activity, but that doesn’t discredit the payment volume.

Verdict: stablecoins mirror ordinary dollars, in that the bulk of transaction value has to do with securities settlement, but payments are still growing and material. Ip simply hasn’t considered the totality of the data.

Summing up

Despite what the critics would have you believe, stablecoins are not doomed to repeat the failures of the antebellum “free banking” era. They have none of the features that fragilized the American free banks:

• The free banks suffered because they could not branch; stablecoins do not face this problem as they can scale indefinitely and serve anyone

• Banknotes traded at discounts based on the geographic cost of redeeming them for specie; stablecoins are not costly to redeem

• Free banks failed because they were forced to hold depreciating State bonds that collapsed as the Civil War loomed; GENIUS-regulated stablecoins hold short duration US Treasuries, the most liquid security in existence

If you look at the track records of more competitive, less regulated systems like Canada or Scotland where private banknote issuance took place absent a central bank, you see remarkable track records of stability. This should encourage you if there is any analogy at all to be found between stablecoins and free banks.

But of course, stablecoins are not free banks. The free banks issued loans and held partial reserves in the form of specie (gold coins). Stablecoins, by contrast, especially GENIUS-regulated ones, can hold only high quality liquid assets like short-duration Treasuries. They are more like money market funds in this regard. Architecturally, they are closer to a narrow bank than either a money market fund or anything in the historical record of private money. Whatever the right analogy is, it isn’t a unit bank in Wisconsin in the 1850s holding depreciating state bonds, nor is it the Reserve Fund holding Lehman debt in 2008. It’s something new, and safer than both.

Stripping away the analogies, the empirical record for stablecoins is compelling enough. Tether and Circle have suffered countless shocks and confidence crises, political harassment, debanking, a monetary tightening cycle, and failures of the very banks they relied on. They’ve emerged from these crises with intact pegs and growing global userbases. It is sophistry to assert that they can’t serve as money because they don’t suit an economists’ definition of what money is.

The deeper issue is that stablecoins expose the ideological failures of the establishment over the last decade. Over the past decade, the dollar’s most successful expansion came not from the Fed, not from a CBDC, but from the crypto industry – warts and all. Acknowledging the successes of decentralized systems like Free Banking or stablecoins is painful for an establishment that defines money as the exclusive purview of the state. But neither the history nor the present-day data cooperate with the establishment’s interpretation.

We write in light of alarming reports that tech companies are passing on the costs of building and operating their data centers to ordinary Americans as AI data centers’ energy usage has caused residential electricity bills to skyrocket in nearby communities. Through these utility price increases, American families bankroll the electricity costs of trillion-dollar tech companies.

Bernie Sanders has called for a full nationwide moratorium on data centers. Even more moderate Dems like JB Pritzker and Josh Shapiro have begun to retreat from a previously pro-data center attitude. Maryland’s Chris Van Hollen proposed a bill to “hold data center operators accountable for their role in driving up energy prices.”

And the general public is fired up too. Seventy percent of Americans oppose data center construction in their neighborhood. Forty-three percent of Americans think data centers are a major reason for their rising energy bills.

The resource mobilization to support the AI buildout is the defining feature of our economy today. The debate over the resource costs of AI and its societal (dis)utility will be the most important political issue throughout the next decade. It is therefore of paramount importance that we level set and consider the actual facts regarding the emergence of these large loads on the grid. For instance, this long hitpiece explicitly premised on the idea that data centers drive up electricity prices provides no actual evidence that this is actually happening at scale.

In this chartbook, I’ll walk you through a few different visualizations to illuminate the issue. And you don’t have to trust me. Every single one of these charts is reproducible in Claude. All sources and assumptions are included in the Appendix and that should be sufficient for you to check my work if you like.

Because people forget, it’s important to remember that the US generation capacity is massive and data centers are still a relatively small part of the grid. Total generation is around 4,400 TWh/year, data centers account for four percent of that at 184 TWh/year, and AI-focused data centers at around half of that. We are talking about two percent of grid capacity. Of course, building out energy infrastructure is slow and ridden with bottlenecks, so that two percent – up from virtually nothing five years ago – can cause problems. But has it?

Fortunately, America is divided into fifty states each with slightly different approaches to energy policy, which gives us fifty natural experiments.

For this chart I divided up the fifty states into quintiles, ranked by the percentage of state electricity consumed by data centers in 2023, and took the mean residential electricity rates in those quintiles. (Note that these are real (inflation-adjusted) prices. In nominal terms, rates went up everywhere. We will cover this later). The first quartile Q1 consists of states with virtually no data centers, and Q5 includes states like Virginia and Texas that are data center powerhouses (data centers account for a full quarter of Virginia’s electricity consumption).

A few things are immediately obvious. The quintile featuring states with the highest data center share of grid electricity – VA, TX, NV, OR and so on – have the cheapest residential power rates, whereas states with less data center intensity are more expensive. While counterintuitive, this has an easy explanation: developers flock to states with cheap power, a culture of building infrastructure, less regulatory red tape, and more available industrial capacity.

So, if you live in a state with lots of data centers, your experience over the last decade is most likely pretty good! The data centers are there because prices are low.

But has the new buildout of AI data centers increased prices since ChatGPT was released in 2022? According to the chart, not measurably. The most data center-intense states have dealt consumers the smallest rate hikes since 2022. On average, electricity prices went up nationwide since 2022, and this isn’t unique to the states with the most data centers.

“But hang on,” you might say. “I live in one of the highest-data center-intensity quintile states, and my power bills did go up in the last decade.”

That’s true, but that’s overwhelmingly just inflation. Taking a look specifically at the fifth quintile (the 10 states with highest data center penetration):

In inflation-adjusted terms, electricity prices actually fell over the decade in the most data center dense states. So you aren’t upset about data centers. You are upset about the massive post-covid inflation. This is the sleight of hand powering policymaker attacks on data centers.

Because inflation is the cofounding factor, almost all of my charts in this piece are real, as in inflation-adjusted. This is because I am interested in measuring trends other than inflation, which was the major driver of prices over the last five years.

If you think the quintile view is too lossy, here is a per-state chart of residential power prices today versus data center share of total electricity consumption.

Visually, its easy to see that the big data center states – Virginia, Oregon, Nebraska, Texas, Iowa – are not among the most expensive. The most expensive states are in New England, the rust belt, and California. They have relatively limited data center activity.

But of course, this doesn’t show causality. Data centers are disproportionately placed in states with cheap power. It’s not that the presence of lots of data centers drives down power prices (more on this later). This is just a snapshot view.

But it is certainly possible to add large loads without resultant residential energy tariffs. Let’s look at the two of the most critical states for the AI/data center buildout: Texas and Virginia.

Texas is a great case study because it has undergone an absolutely gargantuan data center buildout, from traditional DCs to Bitcoin mining and now to AI. ERCOT’s large load task force which tracks every data center over 75 MW gives us some visibility into this new source of demand.

Residential electricity prices in Texas grew significantly in nominal terms, but only modestly in real terms. This can be surprising to many, but power markets are highly dynamic and multivariate.

First, the obvious factor is supply. Texas added massive quantities of generation over the period, in particular from solar, wind, and battery storage. ERCOT’s market design is also a little different from most other RTOs/ISOs. When wind and solar flood the market, wholesale prices plummet, often into the negatives; retail providers can take advantage of this and offer residential consumers cheap fixed rates. Texas also relies on abundant natural gas generation and natgas prices were generally low over the period.

And lastly, data centers aren’t necessarily competing with residential customers. Data centers often locate themselves in remote locations with an abundance of power (transmission is capacity constrained, so you get islands of cheap power in remote locations that can’t deliver power to urban centers). Hyperscalers are also increasingly going “behind the meter” and collocating generation with their data centers so they can bypass the grid entirely. For instance, OpenAI’s Stargate project involves a hybrid system in Abilene where local generation supplements the grid, and a fully behind the meter campus in Shackleford county which doesn’t rely at all on the public grid. These hyperscalers are incentivized to scale up power as fast as possible, and often this means building their own generation, rather than waiting for grid interconnect (which can take years).

Virginia similarly has added massive quantities of data center demand to its grid in the last decade. Residential power prices have been muted – though trending upwards – over the period. PJM had significant spare capacity over the last decade and this was able to accommodate new data center loads. Hyperscalers are also ideal grid customers. They draw power consistently and predictably, rather than spiking at specific moments (like households with AC). They pay transmission charges and fund interconnection upgrades. They also improve the system load factor, which can actually benefit retail customers.

How is this possible? How can the addition of a new large load lower costs for residential customers? It’s because grids have extremely high fixed costs (wires, substations, transformers, transmission) and relatively low marginal costs. Most of the expense is in building and maintaining the grid. So if you can spread more of these fixed costs across more kilowatt-hours sold, residential rates can decline. All the better if the new buyer is predictable and smooth, rather than spiky and correlated like residential power is.

This isn’t very intuitive, so think about it like the economics of airlines.

The cost inherent in flying is the fleet of planes, the staff, maintenance and the airport fees. If flights are consistently half empty, every passenger is going to have to pay a high ticket price to fund operations. If a new buyer in comes in and promises to buy 1/3 of all the seats for the next 10 years, and the planes are consistently full, the ticket prices for the remaining passengers might be flat or actually fall. Adding net new passengers is relatively cheap – soda, jet fuel, etc – compared to the overall fixed costs of flying.

Of course, this only works to a point. When the grid is completely at capacity, new large loads, regardless of how benign they may be, can strain the grid and require considerable new investment. Virginia is at that point now.

Unfortunately, there is no good source detailing the exact scale of new AI additions to the grid, but it is possible through guesswork to identify the 10 most AI-exposed states. Their real residential electricity rates are shown below.

(The EIA has not provided final 2025 data so we have to use projections.)

Real rates are creeping up in most of these states, but not to the extent you would expect given the breathless press coverage and hostile pronunciations by policymakers. And of course, rates can go up for any number of reasons. According to Brattle, the main factors influencing residential power prices over the last five years are:

• Distribution costs (poles, wires, substations) – for instance, California with very expensive wildfire hardening

• Fuel and wholesale gas prices

• Transmission expansion

• Extreme weather and resilience spending

• Load growth (both helps and hurts)

• State policy choices (decarbonization, permitting, rooftop solar subsidies, labor costs)

I want to be very clear and acknowledge that AI data center load growth has indeed begun to affect rates in some cases (as is evident by the 2025 uptick in the chart above), particularly in the mid-Atlantic. The degree to which it is affecting rates is overstated. Nevertheless, AI strains have become legible in some states:

• PJM interconnect explicitly blamed the AI data center buildout (much of it in Northern Virginia) with significantly higher capacity auction prices in 2025. However, capacity is only a small share of residential retail bills. PJM estimates a 1.5-5% price impact for residential customers. The wholesale market signal is absolutely real, but the retail impact is small. This hasn’t stopped Maryland legislators from being outraged, portraying it as Maryland ratepayers subsidizing Virginia’s data center buildout (Maryland is part of PJM).

• MISO and ERCOT also foresee data centers contributing significantly to future load, but do not characterize them as affecting residential prices today

Most of the fuss is coming from New England, which is purely political posturing from policymakers on the left (there are virtually no AI data centers in NE), or from PJM (VA/MD/PA/NJ) where large loads are the crux of a broader debate about cost-sharing for installations which primarily benefit Northern Virginia.

The fact remains, new large loads are simply not the dominant driver of residential price increases as of today. Let’s zoom out again and consider the totality of evidence over the last five years.

This is the single most important chart in this entire piece so it’s worth considering it carefully. I have organized states by data center share of electricity usage (colors) and visually represented states by the size of their grid (bubble size). The X axis shows total load growth over the last five years and Y axis shows the inflation-adjusted change in residential electricity prices over the period.

If new large loads were causing price hikes, you’d expect to see a positive correlation on the chart – lots of datapoints clustered at the top right. Instead we see the opposite.

States with lots of load growth over the last few years – Virginia, North Dakota, Nebraska, Nevada, Texas, Iowa, Arizona – all have effectively flat real prices. Some have negative real price change. All of the “high” or “very high” data center share states have muted residential energy price growth; at worst, one or two cents per KWh.

States with huge residential price increases – California, New York, Massachusetts, Maryland – have relatively little load growth and low data center grid penetration.

Selection effects are visible here too. The hyperscalers picked Texas, Nevada, Oregon, Washington, and North Dakota because these states had cheap power. But even so, these huge new loads did not meaningfully drive up power prices in those states.

Put simply, this data does not support the claim that AI data center additions are the primary driver of residential energy price increases. Modest price hikes are evident in moderately data center-exposed states in the mid-Atlantic region (PJM interconnect). Those states are paying for Virginia’s buildout, and the growth is visible there.

Will the data centers bite eventually? It’s certainly possible. Scarcity is developing in the mid-Atlantic and Virginia, as well as MISO (Iowa, Indiana, Illinois). The Carolinas and the pacific northwest are also risks. But it may not necessarily play out this way. The big hyperscalers have almost infinite cash to spend on the buildout with 2025 AI capex reaching $448b. They could offset the residential impact of price increases for 2-3% of their spending, if compelled. They are also building their installations off grid or behind the meter, insulating consumers from price impact.

The cash and willingness is there. The question is whether policymakers will work with the hyperscalers to fund the buildout of our grid infrastructure – which they can afford to do – or opt for easy populist slogans and villainize them and demand moratoriums.

Consumers are justified in being concerned about a large new presence on the grid, but there’s no real evidence this has dramatically shifted electricity prices so far. And it’s not guaranteed that these additions actually hit residential ratepayers in the future, either.

It’s also worth level-setting and reminding people that AI queries are getting vastly more efficient. Through improved hardware and better models, the amount of power required for a standard query is falling dramatically.

Holding a given unit of intelligence fixed, the actual power required to handle a query has declined by a factor of 200 since 2022.

Of course, AI data centers in the aggregate are drawing more power as the demand for intelligence is seemingly unbounded, but it’s worth remembering this. The power cost to produce the commodity has collapsed in the last four years. I am not claiming that AI power demand will fall. But it is surely encouraging to see that the resource we all benefit from – intelligence – is getting cheaper to produce at a rate that exceeds almost any industrial commodity in modern history.

So if not AI, what is driving the very real residential power cost increases? We’ve already established that inflation is the most obvious factor. Leaving that aside, the story is different for each grid/state, since they are managed in such disparate ways. I don’t have space to do a full analysis, so if you are interested see this presentation from the LBNL and Brattle group.

But there is one very simple variable that cleanly shows power price discrepancies: state politics, especially regarding decarbonization or the climate transition.

Before you complain, this chart takes the median of blue/red states, so it excludes crazy outliers like Hawaii that would bias the blue state data upwards. (Some people might demand I weight it by population – that’s actually much worse for the blue states.)

Blue states as a group have higher – and faster rising – residential electricity rates. This is a simple fact. The correlation of electricity price growth to state politics is shockingly high, if you look at the state by state view.

Why is this happening?

Some states, like California or Hawaii, have their own idiosyncratic issues like fire hardening or remoteness which worsen things significantly. And resource endowment (presence of local resources like hydro, gas, coal, or wind and solar) explains some of the variance. And highly-urbanized blue states often have older grids that are more expensive to maintain.

But it is nevertheless true that blue states, by and large, pursue energy policies that directly lead to higher household electricity prices.

1. Denuclearization

Six major nuclear plants were retired in the Northeast and Midwest between 2013 and 2022, notably Indian Point in NY, San Onofre in CA, and Pilgrim in MA. These losses were backstopped with more expensive natgas generation. This unforced error (nuclear, of course, is carbon neutral) directly translated into higher residential rates and higher grid carbon intensity in those states.

2. Pipeline opposition

The Northeast – the epicenter of high power prices in the US – has systematically blocked pipelines over the last fifteen years. Multiple pipelines were approved and then shot down politically. These would have imported cheap Appalachian natural gas to the most expensive energy market in the country. New England has filled the hole by… importing LNG from Trinidad and Qatar. Instead of piping gas 200 miles from the Marcellus shale gas field, the largest in North America. New England’s winter prices are catastrophic. This is the direct consequence of environmentalist lobbies in NY and MA.

3. Renewable portfolio standards

Blue states have put in place aggressive clean energy requirements, while increasing load through electrification. These states mandate that utilities reach certain renewable energy thresholds. New York for instance mandates 70% renewables by 2030 and 100% zero emission by 2040. California requires 60% by 2030 and 100% by 2045. California is betting heavily on utility-scale solar plus battery storage. New York and New England are pursuing offshore wind, with some meagre solar and hydro imports backstopping the portfolio. The trouble is that wind and solar are intermittent, require backstopping (from batteries, natgas, or demand response programs), and lots of expensive transmission. Offshore wind is fundamentally expensive and not likely to suffice on its own. Getting intermittent and unpredictable renewable generation to match demand profiles while keeping residential costs low is a significant challenge, and one that no country or polity has achieved to date. Several European countries have achieved significant non-hydro renewable penetration on their grids, but none of them have done this AND managed to keep power costs low (by American standards).

4. NIMBYism and labor costs

For grids to modernize and grow, you have to be able to build plants, transmission, substations, and so on. Blue states tend to mire energy projects in environmental review, activist lawsuits, municipal opposition, and so on. Transmission in particular is vital to renewable transitions because urban demand centers are often not co-located with sources of wind or solar. Yet in blue states, long-range transmission is politically toxic and hardly ever gets built. New York and California are great examples of places with theoretically abundant energy resources that is trapped by the political challenge of building transmission. Additionally, labor costs stymie grid buildouts. Blue states tend to require more expensive union labor and stricter rules. Put simply, blue states are trying to run a large-scale grid overhaul while making it virtually impossible to build new infrastructure at scale. Given the greater grid demands of electrification, is no surprise that electricity costs in many blue states are high and rising.

And these aren’t conspiracies. These are the stated policies of political leaders in California and the North East. This is what voters ask for and this is what they get. Blue states consistently prioritize union labor, environmental standards, clean energy, denuclearization, rigid property rights, beautification, and the veto power of activists and NGOs. This mechanically leads to slower energy infrastructure construction and as a consequence higher energy prices.

So when politicians like Elizabeth Warren complain about AI data centers driving up prices, not only are they overstating the reality, but they are shifting the blame from their own costly policies to a new unknown factor which people are nervous about. The rising energy costs borne by households decompose into inflation and decarbonization/NIMBYism. They have little – so far – to do with new AI data centers. The load demands of these data centers will bite in the coming years, but this transition should be welcomed. The hyperscalers are more than able to fund the required energy buildout themselves. If state policymakers work with them rather than demonizing them or demanding moratoriums, ratepayers can be net beneficiaries of the AI capex boom, rather than its victims.

Appendix: sources and assumptions

Every single chart in this piece was built with Claude Opus 4.7. All underlying data was carefully checked. To avoid accusations of bias or data manipulation, I want to give you the ability to independently re-derive every single chart in this piece. The sources and assumptions data should be sufficient to fully reconstruct each chart.

Figure 1: US electricity generation vs. data center consumption

• Total US electricity generation: EIA Monthly Energy Review (Nov 2025 release) and EIA “U.S. electricity generation in 2025 hit a record” (Mar 2026). Net generation, all sectors, including small-scale solar. 2025 figure of 4,430 TWh is preliminary.

• All US data centers, 2014–2023: LBNL 2024 U.S. Data Center Energy Usage Report (Shehabi et al., DOE-commissioned). Hard anchors: 58 TWh (2014), 76 TWh (2018), 176 TWh (2023). Intermediate years interpolated using LBNL-reported CAGRs (7% for 2014–18, 18% for 2018–23).

• All US data centers, 2024–2025: 2024 from IEA estimate (183 TWh) cross-referenced with LBNL Dec 2024 update (range 184–231 TWh); midpoint ~200 TWh used. 2025 extrapolated along LBNL’s 13–27% projected growth corridor toward their 2028 range of 325–580 TWh.

• AI-related portion, 2017 + 2023: LBNL accelerated-server breakdown — ~2 TWh (2017) and ~40 TWh (2023). 2018–2022 interpolated.

• AI-related portion, 2024–2025: 2024 from AImultiple analysis citing IEA/EPRI (53–76 TWh range, midpoint 65). 2025 extrapolated.

• Pre-2017 AI: assumed ≤2 TWh; reflects negligible AI-specific GPU footprint before transformer-era training at scale.

• “AI-related”: GPU-accelerated server consumption attributable to AI training and inference. Excludes general cloud compute, video streaming, search, crypto.

Figure 2: Real residential electricity rates by data-center-intensity quintile, 2015-2025

• Residential electricity prices, 2015–2024: EIA State Energy Data System (SEDS) Table ET3, residential electricity column (Form EIA-861). Final values, October 2025 release.

• Residential electricity prices, 2025: EIA Electric Power Monthly, monthly state retail prices (Form EIA-861M), compiled in NEADA’s November 2025 Energy Price Update, Tables 1–2 (August snapshots).

• CPI deflator: BLS CPI-U, annual averages (series CUUR0000SA0).

• Data-center intensity: EPRI, “Powering Intelligence” (May 2024), Table A1 — 2023 data-center share of state electricity, 44 reporting states.

• 2025 state values extrapolated from 2024 baseline × (Aug 2025 nominal / Aug 2024 nominal); assumes the August YoY ratio approximates the calendar-year YoY ratio.

• Quintiles built from 50 jurisdictions (49 states + DC; Hawaii excluded) on 2023 data-center share of state electricity; 10 states per bin.

• Six states excluded from EPRI Table A1 (AK, AR, DE, MS, VT, WV) plus DC imputed at 0% DC share — all land in Q1.

• Quintile assignment is fixed per state (by 2023 DC share), not re-computed each year.

• Quintile line = mean of member states’ real prices. Hawaii excluded as a structural outlier (~40¢/kWh, non-contiguous petroleum-fired grid).

Figure 3: Residential electricity prices, nominal vs real, Q5 (highest data-center intensity), 2015-2025

• Residential prices, 2015–2024: EIA State Energy Data System (SEDS) Table ET3, residential column / Form EIA-861, October 2025 final release.

• Residential prices, 2025: EIA Electric Power Monthly (Form EIA-861M), August snapshot compiled in NEADA’s November 2025 Energy Price Update.

• Inflation deflator: BLS CPI-U, annual averages (series CUUR0000SA0).

• Q5 state selection: EPRI, Powering Intelligence (May 2024), Table A1 — 2023 data-center share of state electricity consumption.

• Q5 = 10 states with the highest 2023 data-center share: VA, NV, ND, NE, IA, OR, TX, IL, AZ, WY.

• Quintile membership fixed at 2023 share; not recomputed annually.

• Series shown is the unweighted mean of the 10 member states’ residential rates (no population or sales weighting).

• Real prices = nominal × (CPI-U 2024 / CPI-U year); base year 2024.

Figure 4: State electricity prices and data center share of electricity

• Residential electricity prices (Aug 2025, ¢/kWh) — NEADA Energy Price Update (Nov 2025), citing EIA Form EIA-861M

• Data-center capacity and annual energy use by state (2024 historical) — EPRI, Powering Intelligence: Updated U.S. Data Center Scenarios (Feb 2026), public dashboard export

• State total electricity consumption baseline — EIA, Electric Power Annual 2023, scaled forward 1% to 2024

• DC share of state electricity = 2024 EPRI TWh ÷ estimated 2024 state total (2023 EIA total × 1.01)

• “Operational” data-center capacity = EPRI Nominal IT Capacity; peak load is typically ~half of nominal

• Aug 2025 residential prices are EIA preliminary figures; final values may revise by ±0.2¢

• EPRI 2026 estimates revised some 2023 state figures vs. the May 2024 EPRI paper — notably ND ↓, OH and IN ↑, PA and MI ↓ — reflecting methodology updates, not actual swings

• States with ≈0% bubbles (AR, WV, VT, MS, DE, LA) have negligible operational data-center load as of 2024; several have large announced projects not yet built

Figure 5: Texas large flexible load and residential electricity prices, 2018-2025

• Bars 2022–24: ERCOT Large Flexible Load Task Force monthly reports — approved interconnection capacity for loads ≥75 MW per site

• Bars 2025: EIA Short-Term Energy Outlook (Sept 2024) baseline of 9,500 MW; low/high scenarios are 6,500 / 14,200 MW

• Bars 2018–21: reconstructed from LBNL 2024 Data Center Energy Usage Report (Texas state estimates), public crypto miner filings (Riot, Marathon, Core Scientific, Bitdeer, Cipher), and contemporaneous press coverage

• Prices: EIA Electric Power Monthly (sales-weighted Texas residential), deflated by BLS CPI-U annual averages to 2024 dollars

• Y-axis is approved capacity — MW cleared to operate via ERCOT’s study process, not metered peak demand and not nameplate

• 75 MW per-site threshold is ERCOT’s; smaller crypto sites and sub-threshold data centers are not counted

• Pre-2022 ERCOT had no comprehensive tracking of these loads; those bars are best-effort reconstructions, not measurements

• Single load category — no crypto / traditional / AI split, because ERCOT does not categorize loads this way and any breakdown requires analyst judgment

• Behind-the-meter loads (on-site gas microgrids serving data centers, e.g., Shackelford Stargate) are excluded; actual Texas computing load is higher than the bars show, and the gap is growing

Figure 6: Virginia data center load vs. Virginia residential electricity prices, 2018-2025

• MW (left axis): Dominion Energy historical data center billing demand, 2018–2024 actual + 2025 forecast (4,149 MW), from 2025 testimony in an Indiana IURC regulatory filing. 2024 = 3,584 MW cross-checks with Feb 2025 SCC testimony.

• Prices (right axis): EIA Form 861M Historical State Data (HS861M 2010-.xlsx), sales-weighted annual residential averages for Virginia. 2018–2024 are Final; 2025 is Preliminary with all 12 months reported. 2024 value of 14.41¢ matches EIA’s annual Table 5A exactly.

• Real-dollar deflation: BLS CPI-U all-items annual averages, 2024 anchor (313.689); 2025 ≈ 320.0 per BLS December release.

• 2025 MW is Dominion’s own forecast, not measured; recent forecasts have tracked actuals within a few percent.

• 2025 price is EIA Preliminary; final value may revise by a few tenths of a cent.

• Dominion territory covers roughly two-thirds of Virginia’s data center footprint; the price series is statewide residential across all utilities. Geographic match is close but not perfect.

• AI vs. non-AI workloads are not separated in the MW bars — these are total data center billing demand.

Figure 7: Real residential electricity rates, top 10 Al data-center states, 2015-2025

• Annual values 2015–2024: EIA State Energy Data System (SEDS) and Form EIA-861, sales-weighted residential average price for each state, finalized

• 2025 estimates: EIA Electric Power Monthly state residential series, Jan–Aug 2025 (8 monthly observations averaged)

• Inflation deflator: BLS CPI-U, annual averages, base year 2024

• State selection: EPRI 2024 “Powering Intelligence” report, Table A1 (state share of US data center load as of 2023), supplemented with announced and operational AI hyperscale campuses through May 2026

• “Top 10 AI data-center states” combines an existing-load metric (EPRI 2023 share) with a forward-looking signal (announced AI campuses) — different methodology would shuffle the bottom of the list

• All prices deflated to 2024 dollars using national CPI-U, not state-level cost-of-living indices — regional inflation differences are ignored

• 2025 YTD-through-August captures 8 of 12 calendar months; final SEDS values will include Sep–Dec 2025 and are expected to land somewhat higher for PJM-exposed states (VA, OH) where capacity prices stepped up June 1, 2025

• Residential rates only — commercial and industrial trends differ

• Sales-weighted averages mask wide intra-state variation between utility service territories

• Final 2025 SEDS data publishes late 2026; until then, all 2025 figures on this chart are preliminary estimates

Figure 8: Load Growth vs. Real Residential Electricity Price Change, 2020-2025

• Prices & sales: EIA Electric Power Monthly, Tables 5.6.B (residential prices) and 5.4.B (total retail sales). 2020 final, 2025 preliminary.

• Inflation: BLS CPI-U annual average.

• Data center load: LBNL 2024 Data Center Energy Usage Report, EPRI 2024, JLARC Dec 2024 (Virginia), IEA 2024 state shares, Liu et al. (arxiv 2024).

• Prices are annual-average residential, ¢/kWh, expressed in 2025 dollars (deflator = 1.239).

• Load growth is all-sector (res + commercial + industrial), 2020 → 2025.

• 2020 baseline is mildly COVID-suppressed, inflating growth ~1–2 pp vs. a 2019 baseline.

• 2025 EIA data are preliminary (final Oct 2026).

• State data center load is estimated, not measured — EIA’s 2024 mandate to collect it was withdrawn. National ~200 TWh in 2025; VA most reliable, small-share states roughest.

• Color bins: Low <2%, Medium 2–5%, High 5–10%, Very High >10% of state electricity.

Figure 9: Energy per query for a fixed amount of intelligence

• Capability threshold: MMLU 70%, the score GPT-3.5 hit at launch. Held constant across all six points so each represents the same task difficulty.

• Methodology: at each anchor, identify the cheapest model meeting MMLU 70% on commercial serving infrastructure of that moment. Estimate per-query energy from active parameters × bytes per parameter (precision) × memory bandwidth × power, at typical batch sizes, with PUE 1.3.

• Calibration anchors: HazyResearch’s Intelligence per Watt study (Saad-Falcon et al., Stanford, 2025), which directly measured a 5.3× IPW improvement over 2023–2025; and InferenceMAX (SemiAnalysis, Dec 2025), which gives measured energy per query for currently optimized cloud serving.

• Implied rate: ~120× over 3.5 years ≈ 3.8×/year. Consistent with HazyResearch’s ~2.3×/year measured rate plus compositional effects (distillation, MoE, lower precision).

• Query length: assumes ~500 output tokens. Longer outputs (reasoning models, agentic flows) scale roughly linearly.

• Energy ≠ price: API prices fell ~10×/year over the same period, faster than energy, because margins also compressed. The energy claim is the more conservative one.

• Weakest point: gpt-3.5-turbo (Q1 23). OpenAI hasn’t disclosed its parameter count; the ~20B distilled estimate is widely cited but unverified.

• MMLU’s limits: a multiple-choice knowledge test, not a complete proxy for intelligence. A model can match MMLU 70% while losing on long-context reasoning, tool use, or anything outside the benchmark’s distribution.

• 2026 hardware assumes B200 deployment: optimized cloud serving. A real-world deployment on older hardware (H100, A100) would land closer to ~75 J instead of ~25 J.

Figure 10: Real residential electricity rates, blue vs. red states (2024 election), 2015-2025

• Annual residential rates 2015–2024: EIA State Energy Data System (SEDS) and Form EIA-861, sales-weighted state averages, finalized

• 2025 rates: EIA Electric Power Monthly, state residential series, Jan–Aug 2025 averaged (8 monthly observations)

• Inflation deflator: BLS CPI-U annual averages, base year 2024

• State election grouping: 2024 presidential statewide vote winner (AP, official state canvasses)

• Each state counts as one observation regardless of population — this is a “state policy regime” framing, not a “typical resident” framing; population-weighted alternatives shift blue median up ~4¢

• DC included in blue group (n=20); 31 states in red group

• Sales-weighted state averages mask large intra-state variation between utility territories (e.g., Dominion VA vs. NOVEC VA, PG&E CA vs. SMUD CA)

• 2025 figures are preliminary; final SEDS values publish late 2026 and will incorporate Sep–Dec 2025 data not yet available

• 2024 election grouping is applied retroactively to the full 2015–2025 series — states that flipped (e.g., MI, PA, WI, GA, NV) are classified by their 2024 outcome throughout, which is anachronistic but consistent

• Residential rates only; commercial and industrial sector dynamics differ

Figure 11: Real change in residential electricity prices, 2019-2025 (state by state)

• Residential prices, 2019: EIA Electric Power Annual 2019 (final release), state-level average residential rates.

• Residential prices, 2025: EIA Electric Power Monthly, Table 5.6.A, February 2025 (preliminary), used as a 2025 proxy.

• Inflation deflator: BLS CPI-U, 2019 annual average vs. February 2025 monthly value.

• Dot color (party): 2024 presidential election results, AP / state certifications.

• Endpoint convention: 2019 = annual average; 2025 = February monthly snapshot, treated as a full-year proxy. This mixes an annual figure with a single month and assumes February rates approximate the calendar-year average.

• Real % change = (2025 nominal / 2019 nominal) × (CPI-U 2019 / CPI-U Feb 2025) − 1.

• Preliminary February 2025 EIA values are subject to later revision.

There are three types of canaries1 that people talk about in the context of quantum computing and Bitcoin risk, in the hopes that we get meaningful advanced warning. A challenge ladder of increasingly large keys; canary funds; and Satoshi’s coins themselves. But they all carry the same fatal flaw: by the time the canary is tripped, it’s already too late. Bitcoiners will have to act on the information available to them today.

On breaking larger and larger keys

It’s very tempting to say something like “well, why don’t we just have a ladder of challenges from a 10-bit ECDLP instance all the way up to 256 bits, and we agree to get concerned when someone solves N bits (where N is your threshold of worry).” This was the idea around the Q-day Prize, which some people are very upset about.2 I have seen some other well-intentioned Bitcoiners wonder about such prizes.

But unfortunately they don’t work, for a simple reason:

Quantum results below 120 bits will always be clouded by accusations of classical cheating, and when a quantum computer unambiguously surpasses classical capabilities, the warning window will be too short.

To put this into syllogism format:

1. Classical computers can solve ECDLP up to around 120 bits today3

2. Quantum results below the classical threshold provide little informational signal as they are vulnerable to accusations of cheating

3. The gap between 117 and 256 bits is prohibitively large for a classical computer but relatively shallow for a QC running Shor, which scales polynomially

4. Thus, by the time you get an unambiguous quantum break, a CRQC may only be months, not years away

5. The required time to deploy a PQ signature scheme on Bitcoin and transition all vulnerable coins is on the order of years

6. Thus, we cannot rely on a quantum break of an intermediate-size ECDLP instance to give us sufficient advance notice

Let me quickly defend the first three premises:

1. Classical computers can solve ECDLP to around 120 bits today

Classical computers are actually quite good at solving ECDLP, with the general record standing at 117.35 bits as of 2016. Of course, there is nothing to worry about classically, since secp256k1 is still about 2^69 times harder to solve using Pollard rho-type attacks.

For the secp256k1 curve specifically, a 130-bit ECDLP key was broken in September 2024 as part of the Bitcoin Puzzle challenge. The reason 130 bits are possible versus the state of the art of 117 bits otherwise is because the design of the Bitcoin Puzzle challenge allowed the attacker to use the more performant Pollard’s kangaroo, compared to the less efficient Pollard’s rho used in the 117 bit break. (I know this is confusing, but the two results measure different things, while requiring similar amounts of work. I’ll refer to the more general 117 bit result in this piece.)

2. Quantum results below the classical threshold provide little informational signal as they are vulnerable to accusations of cheating

Quantum breaks below the 117 bit classical state of the art can therefore be undermined via accusations of “priming” or effectively embedding the answer in the circuit construction – effectively feeding the QC the answer derived classically and pretending that it was achieved quantumly.

This is, it seems, what happened with the winner of last week’s Q-day prize, which claimed to break a 15-bit ECDLP instance. As summarized by Craig Gidney: “You make a correct circuit, you get the expected result, you celebrate… but you got the right answer for the wrong reason.”

Anyone that has taken an epistemology class in college will recognize this as something akin to a Gettier problem – a situation where you have a belief which is true and supported by evidence – but your logical explanation of how you acquired that knowledge is insufficient.4 You were right… by accident.

There are some proposed techniques designed to make priming harder. However, none are in widespread use. As long as we are under the threshold of classical possibility, all quantum results will be clouded by suspicion in the minds of skeptical onlookers. So these challenges will not succeed at their stated objective, which is creating urgency in the technical community.

3. The gap between 117 and 256 bits is relatively shallow for a QC running Shor, which scales polynomially

Classical algorithms for solving ECDLP like Pollard’s rho scale as O(2^(n/2)), meaning each additional bit roughly doubles the difficulty. This is why the chasm between 117 bits and 256 is practically impossible to cross. So we are not worried at all about classical attacks on secp256k1, at least with known techniques.

Shor running on a QC scales in O(n^3) in gate operations. Going from 117 to 256 bits with Shor would require a measly 10.5 times more. Gate ops are a proxy for runtime, so you can think of the progression from 117 to 256 bits as unimaginable in classical terms, but as simple as running your computation 10 times as long for a QC. The scaling story for logical qubits is even simpler, it’s roughly linear. Using Google’s Babbush et al (2026) paper, we can see that the difference between 117 and 256 bits is a matter of 548 logical qubits (my interpolation) versus 1200 logical qubits.

You can get a visual sense of this here:

The Google paper is quite explicit about this. They describe quantum computing progress as nonlinear and threshold-based, with the number of logical qubits in SOTA processors being a poor guide to general quantum progress.

On the topic of quantum canaries, they say:

In other words, if a quantum processor is able to solve 120-bit ECDLP, the version that solves 256 bits is either the same machine or its successor. Your intuitions regarding classical security simply do not apply with Shor: bridging that 136-bit gap is a matter of merely doubling logical qubits and increasing runtime by 10x. A QC that can surmount the error-correction and qubit coherence problems to solve an intermediate-size circuit is close to one that can empty a Bitcoin address.

If you accept the first three premises, and acknowledge that Bitcoin’s required upgrade time is years, the argument clears.

On quantum canary funds

One popular idea in the quantum preparedness literature involving creating a bounty or incentive for a would-be quantum attacker to reveal themselves. A recent formulation of this comes courtesy of BitMEX Research. They propose creating a valid address with an unknown private key, such that it could only be recovered by an entity possessing a CRQC. Indeed, the Bitcoin community could even tie a post-quantum soft fork freezing vulnerable coins (like Satoshi’s p2pk coins) to a successful spend from the canary address. This avoids the problem of unnecessarily deprecating vulnerable coins. Bitcoiners concerned about quantum risk could donate funds to the address and increase the bounty.

The problem, of course, is that the motives of the first owner of a CRQC are completely inscrutable. We simply don’t know if they are altruistic, commercially minded, nation-state affiliated, or anything really. If I had to guess, I expect that it will be either a private firm in the US or a firm affiliated with the Chinese government, but even then, that isn’t really cause for comfort. We have no reason to believe that the first owner of a scaled QC would choose to reveal themselves by claiming a (likely smallish) designated bounty. They might go for the Satoshi coins. Or the Binance coldwallet. They might ignore Bitcoin completely. We just don’t know.

If I had to guess, I would imagine that the first owner of a QC would keep it a secret for as long as possible, given the enormous strategic value of having your geopolitical adversaries (who you would like to spy on) in the dark regarding your ability to decrypt their traffic.

I don’t think they would tip their hand by claiming a relatively small bounty.

On Satoshi’s coins moving

What about Satoshi’s coins? There is a school of thought that the roughly 1.7m presumed abandoned BTC held in legacy p2pk outputs are themselves a canary. Hunter Beast popularized this idea, dubbing it “Satoshi’s shield”. The Satoshi (and other early miner) coins buy us time, the thinking goes, because a quantum attacker would presumably invest their first efforts in those 30 thousand or so lots of 50 BTC, rather than focusing on regular folks with 0.2 BTC. The runtime estimates for quantum computers suggest that the first attacks (especially if on slow-clock hardware like neutral atom) will take weeks rather than minutes. As such, it would take a long time to grind through all the vulnerable p2pk addresses, giving everyone else due notice and time to upgrade. If you are ok with the roughly 1.7m+ presumed abandoned and quantum-vulnerable coins eventually ending up in the hands of the quantum attacker, this could be a relatively elegant scenario.

However, this isn’t necessarily the case either.

First of all, if I were a misaligned quantum attacker (think North Korea tier), I might simply try to hack the largest vulnerable address and represent it as an ordinary, classical hack. Imagine that a CRQC emerges and Bitcoin hasn’t completed transitioning to PQ address types. In that case, if you were an attacker, and wanted to maximize your takings (and ability to monetize your winnings), you would want to exploit a large vulnerable address while trying to persuade people you didn’t have a QC. You would go for the Binance coldwallet or something similar. Remember that a signature produced by a QC looks just the same as any ordinary signature, from the network’s perspective. So there’s no way to tell just by looking at the transaction that it was the product of a quantum exploit.

Now let’s imagine by the time a CRQC emerges, all live addresses have indeed transitioned to PQ, and the only ones left are the addresses that didn’t transition, because their owners lost the keys or abandoned them. Even then, we might not get any meaningful warning out of the p2pk addresses.

It’s easy to imagine a situation where the first entity to build a CRQC does want to monetize via the Satoshi coins but also wants to retain their advantage for as long as possible, so they recover all of the private keys to the roughly 35k outputs corresponding to the old p2pk keys, but don’t actually broadcast the transactions. If they suspect that someone is getting close, they can suddenly broadcast all the spending transactions, which would take up about 6 blocks. I think it could happen this way, at the behest of the US government.

Of course, we don’t know how it will play out. Perhaps the coins will be frozen before any of this happens. But I do think it’s possible that “Q-day” arrives months or years before any suspicious transaction becomes visible on chain.

So what evidence should count?

So if quantum canaries are a lost cause, what indicators can we use to discern when we should transition from “vague concern” to “imminent threat”? The simplest answer is just to take a cue from experts like the Google Quantum AI team (“begin the PQ transition immediately”), or Coinbase’s quantum advisory board (“the time to start preparing is now”). The problem, of course, is you will always be able to find a number of credentialed experts who completely disagree. There are a few serious physicists or computer scientists who continue to claim (against the weight of mounting empirical evidence) that scaled, error-corrected quantum computing is theoretically impossible. So the skeptic will always be able to say “this expert says quantum computing is impossible”.

What about early, non-cryptographic applications of QCs? Unfortunately, because there’s only a few known applications of QCs, and there aren’t a lot of “miniature” ones which will become apparent well before QCs are cryptographically relevant, we simply may not have a highly legible ramp from 10 noisy qubits to 1000 error corrected qubits. Craig Gidney admits in his Q-day prize retrospective: “I don’t have an idea for how to make open benchmarking a thing”.

Scott Aaronson gave a sobering answer to the question in a recent Stacker News AMA, when he was asked about evidence that quantum computers can genuinely outperform classical counterparts:

And I think this is the best answer yet, if unsatisfying. The skeptics will always accuse anyone who works for a quantum lab of exaggerating their progress or capabilities. The real rubric of quantum success is whether a QC can do what Feynmann originally envisioned them for, which is particle simulation.

I went and looked at the literature to find out if there were commercial applications of QCs that are economically valuable and achievable at smaller scale than an ECC break. The conclusion is not encouraging:

As far as I can tell, none of the known commercial applications of QCs would serve as a useful canary for an ECDLP break. The cheap demonstrations are either not economically meaningful, not clearly beyond classical methods, or not legible enough to force consensus. Even the “small molecule” datapoint in the chart is currently classically tractable, and only quantum-relevant at larger scales. As far as I can tell, a CRQC is one of the lowest-hanging fruits on the fault-tolerant quantum computing tree.

As I said in the introduction, Bitcoin (and all other blockchains) will have to add PQ signatures to their blockchain on faith alone. And if you don’t want to hear it from me, take it from Scott Aaronson:

So, here it is: if quantum computers start breaking cryptography a few years from now, don’t you dare come to this blog and tell me that I failed to warn you. This post is your warning. Please start switching to quantum-resistant encryption, and urge your company or organization or blockchain or standards body to do the same.

AI was not used at all in the drafting of this blog. AI was employed as a research assistant and to build visualizations.

The social value of prediction markets derives from financially incentivizing insiders to divulge confidential information, but this collapses noise trader confidence in the market over time.

News of the biggest scandal yet broke two days ago, with the DOJ charging Master Sergeant soldier Gannon Ken Van Dyke for improperly trading on classified information regarding the Maduro raid. He made $400k trading on Polymarket prior to the mission. He is no junior soldier. He was a senior Green Beret with meaningful planning and operational responsibilities regarding special forces operations.

As a brief aside, though many people are calling for him to get a light slap on the wrist due to rampant (legal) insider trading activity in Congress, he still deserves a prison sentence. What he did was risk tipping off the Venezuelans that a raid was coming via his trading activity, which is morally as well as legally problematic. It seems the Venezuelans did not notice, but the government cannot accept a precedent where its elite operators are leaking details of forthcoming operations through market activity. I am sympathetic to Van Dyke, but he still broke the law and violated the secrecy he is sworn to for personal gain.

This is just the latest in a string of real or suspected insider trading scandals on prediction markets. Previously, Israel arrested two reservists for trading on Polymarket with classified military intelligence. Markets regarding the start of the Iran war, the ceasefire, the killing of Ayatollah Khamenei, and Biden’s pardons have also come under suspicion, though no arrests have been made. Kalshi and Polymarket have also flagged and suspended accounts trading on markets concerning themselves, like the three congressional candidates betting on their own races.

Now you might imagine that these issues will simply go away as more people come to realize that trading with confidential information is illegal not just in securities markets, but on prediction markets too, but I think the problem runs deeper than that.

The premise of prediction markets is that they are informationally efficient because they reward informed insiders.

Or, in other words, prediction markets are “good” because they bring together armies of uninformed noise traders, who create a financial reward for insiders1 to take their private information and release it into the public domain. (This concept – noise traders creating the incentive for informed insiders to participate – is well established in the financial literature, but a recent paper further extends it to prediction markets.) The PMs can then reliably advertise themselves as socially useful, since they genuinely provide better and more up-to-date signals than other platforms (experts, polls, etc). Kalshi and Polymarket know this, but are loath to explicitly admit it. But they do hint at it in their marketing!

Kalshi’s CEO Tarek Mansour had a discussion on the Sourcery podcast and explicitly said “there is no insider trading in commodities. It’s all insider trading actually”, which is… an extremely creative interpretation of the law. He adds:

I think there is some subset of information that is nonpublic that [traders] cannot trade on, but I think we are being a bit too restrictive right now.

Kalshi has used the promotional language “trade on anything” and “everyone is an expert on something”, both of which imply that ordinary people that might happen to have some privileged information can monetize it on the platform.

Polymarket CEO Shayne Coplan had this exchange with CBS last year:

Anderson Cooper:

But predictive markets do rely on someone having some inside information.

Shayne Coplan:

Uh-huh. Yeah. I think that people going and having an edge to the market is a good thing. Obviously, you need to curate them and you need to be really clear and stringent on where the line is drawn and, like, sort of ethics and we spend a lot of time on that. But it’s sort of an inevitability that this will happen, and there’s a lot of benefits from it. And, you know, people will adapt.

Shayne has also said that prediction markets are “the most accurate thing we have as mankind right now, until someone else creates some sort of a super crystal ball”. Some of that accuracy comes from insiders.

Vlad Tenev, Robinhood CEO (partnered with Kalshi) has said:

Prediction markets actually give you that news faster, in some cases before it even happens. I think it certainly has enormous economic value.

Robin Hanson, an economist who many see as the godfather of prediction markets, has bitten this bullet directly and issued lengthy defenses of insider trading in PMs. In 2024 he said:

If the point of [prediction] markets is to get accurate information on the prices, then you definitely want to allow insiders to trade, even if that discourages other people from betting because that makes the prices more accurate. And that’s the priority.

I must note that both Kalshi and Polymarket have anti-insider trading policies. Kalshi is CFTC regulated and has always explicitly banned trading on MNPI and engages in market surveillance. When I wrote my last blog post in February, I noted that Polymarket did not explicitly sanction insider trading, but in March they updated their rulebook and added a detailed ban the following types of trading:

• Trading on stolen confidential information (if you are a soldier, battle plans do not belong to you, but to the government)

• Trading on illegal tips passed to you by an insider

• Trading on any contract where you can influence the outcome

The point of this section is not to browbeat Kalshi or Polymarket or their leadership for gesturing at traders having informational advantage. I think their policies (post the March 2026 update) are sufficiently clear. Instead, I am pointing out the fundamental tension plaguing these markets:

Prediction markets depend on informed traders to produce accurate prices, but they also depend on uninformed traders to create an economic incentive for informed flow. This creates a tension:

• If insider trading is too permissive, uninformed traders may exit due to perceived unfairness

• If insider trading is too restricted, the market may exclude its most valuable information sources

As a consequence, informational efficiency and perceived fairness trade off against each other. Here’s the same idea in visual format:

So we end up with a couple different failure modes:

1. Too many sharks eat all the fish

The insider trading standards are too loose, and the markets become quite informationally efficient, but the noise traders end up with the distinct feeling that the market is “rigged” and that they are constantly trading against insiders. As such, the noise traders leave, and the markets end up being less liquid. This is the failure mode I talked about previously. This is where we are at the moment, but I think we are going to rebound in the other direction.

2. No sharks, no edge

This is the other end of the spectrum. Insider trading end up being rigorously policed on the platforms with real time market surveillance and robust regulatory reporting, and the informed flow stays away. These markets therefore produce less socially-valuable information and become mere aggregators of sentiment, rather than producing “the news before it happens”. As such, the platforms aren’t able to market themselves as effectively.

The existential question is whether there is a happy medium where liquidity is maximized, noise traders feel like markets are “fair enough”, and informed flow can still get paid for their information collection. The chart suggests there may be, but reality is messier.

My prediction from February remains. As I said then:

Serious risk remains that insider trading scandals will give retail traders the impression that markets are rigged, causing them to desert the platforms. I predict that this year, a flurry of insider trading episodes will convince the platforms to dramatically beef up market surveillance, and cause Polymarket in particular to move away from the pseudonymous model

I expect that Polymarket will completely eliminate the ability to trade without KYC (this is the case on the non-US platform right now) and will ramp up their flagging of suspicious trades on the platform. There will be a flood of criminal cases regarding stolen insider information, but the temptation will remain. Though the platforms won’t admit it, there really is a “socially optimal” amount of insider trading. But can they calibrate optimally? And will the regulators allow them to?

Disclosure: CIV is an investor in Project Eleven. I and CIV hold positions in BTC and other quantum-exposed assets.

The Overton window moved quickly. A few months ago I was public enemy #1 for pointing out that elliptic curves might not survive the decade and Bitcoin’s cryptography would have to adapt. Now Bitcoiners are mostly sold and arguing instead about how and when we should upgrade to deal with quantum computers. Bitcoin developers have finally begun to publish details of what they are planning with regards to quantum – ironically in an attempt to dispel my claim that they aren’t doing anything.

The thing about the PQ transition is, it’s impossible as a Bitcoiner to claim that this protocol is cutting edge technology if Bitcoin, a monetary system predicated entirely on cryptography, is a laggard when compared to Google (migration by 2029), Cloudflare (2029), Ethereum (2029) and the US government (2030-2035). Leaving aside the obvious insanity of wagering the entire fate of a multi-trillion-dollar monetary network on the vain hope that technology does not advance quickly, it’s just plain old embarrassing for Bitcoin to be the very last mover when it comes to updating its algorithms. Some Bitcoiners associate quantum computing with Vitalik and questionable public equities and reflexively dismiss the risk the technology poses. But there’s no reason to hold the network hostage to the ancient traumas of some old time Bitcoiners. Bitcoin selects for cranks and crackpots: some of them will happily deny the empirical reality of quantum mechanics to make a point, but it’s just a simple matter of tuning them out.

Ok, so we are going to add PQ signatures to Bitcoin sooner or later. I can tell you roughly what it will look like. Following a soft fork, there will be an intermediate period when you can sign either with your ordinary ECC Schnorr signature or a fancy new PQ signature (or possibly more than one!). Anytime ahead of Q-day, the network participants can migrate according to their perception of the risk. And eventually, again ideally before Q-day, ECC-based signatures (ECDSA and Schnorr) will be disallowed entirely. Hopefully this happens in an orderly manner with no nasty surprises, and all active participants get the chance to rotate their wallets before Q-day arrives.

Then the real trouble begins. As a CRQC looms (there will be early commercial use cases before ECC256 is broken, but the ramp could be very quick) a massive debate will erupt in the Bitcoin community as to the fate of the 1.7m p2pk outputs which did not migrate.1 These are Satoshi’s and other early miners’ coins. It will be extremely fraught because both sides have opinions that are strongly held and completely reasonable.

The battle lines have already been drawn

In the wake of BIP361 becoming an official proposal, the split has already begun to emerge:

Freeze camp (financial investors, institutions, fiduciaries): for them, freezing is the obvious choice. These coins are presumed lost, their owners have had almost 20 years to do something with them, they are being negligent by not transitioning them to PQ. They have had sufficient notice. For institutions, there will be no choice. Either delist and completely forego all revenue pertaining to Bitcoin asset management products, or ensure that Bitcoin adopts a freeze fork. A world where 1.7m+ BTC end up in the hands of a potentially hostile actor is unacceptable to these people, because they are fiduciaries of their clients’ money. Bitcoin would suffer devastating volatility as these coins are recovered quantumly, not only through unexpected inflation, but also because the motives of the new owner are unknown. For this reason, I expect most custodians, exchanges, and asset managers to precommit to only honoring a freeze fork, much to the chagrin of the other camp. The best exposition of this view comes courtesy of Jameson Lopp.

Do not freeze camp (hardcore Bitcoin maxis, some developers, ideologues): for many in this group, there’s no real debate: Satoshi set 21 million as the monetary parameter, and no one alive has the authority to arbitrarily modify that to 19.x million. Bitcoin doesn’t engage in selective “irregular state changes” like Ethereum did after the DAO was hacked in 2016. Even after 850k BTC were lost to Mt Gox, nothing was done at the protocol layer to recover the funds. It’s just not in our DNA. Not to mention that Satoshi and other early miners fairly acquired their coins, and those coins are their due reward for being early stewards of the protocol. Besides, if we let the institutions effectively coerce the Bitcoin community into a massive monetary change, we have forsaken the original decentralized premise of the network. Who knows what they might push through next if we grant them this power – a change to PoW? KYC at the protocol layer? Plus, the attacker wouldn’t logically market-sell all the coins. Even if they are “malicious” in some way, economic rationality suggests that they will simply hold the coins rather than selling them off instantly. Better to absorb the temporary volatility than compromise the network’s ideals, this group holds. The “do not freeze” camp is positioning the freeze as an “attack on Bitcoin”, ignoring the fact that of course the freeze acolytes are equal and valid participants on the network too. If you want to get a sense of this position, see some of the replies to Jameson in this thread.

Now the two groups are not cleanly divided. Strong bitcoin advocates that might fall in the “no freeze” camp are investors too, but they have different time horizons and exposures than the institutions holding BTC for clients. Some developers are loosely in the freeze camp too. Pieter Wuille, probably the most influential current Bitcoin Core dev, has said:

Of course they have to be confiscated. If and when (and that’s a big if) the existence of a cryptography-breaking QC becomes a credible threat, the Bitcoin ecosystem has no other option than softforking out the ability to spend from signature schemes (including ECDSA and BIP340) that are vulnerable to QCs. The alternative is that millions of BTC become vulnerable to theft; I cannot see how the currency can maintain any value at all in such a setting. And this affects everyone; even those which diligently moved their coins to PQC-protected schemes.

You can find some more aggregated developer perspectives here.

But by and large, you can sort the two camps into hardcore, ideologically-motivated Bitcoin maxis (no freeze), and institutions and large investors (freeze). Or, in other words, “economic nodes” (big asset managers, institutions, investors) versus “the social layer” (Bitcoiners more concerned about principles than expediency). During the Blocksize war, the “social layer” is largely understood to have won out over the desires of the economic nodes.

Fighting the last war

Within the contours of this debate, there’s two main ways people expect it to go (and a secret third way). The most likely, in my opinion, is that the economic nodes win: the most important institutions in Bitcoin get together and sign a letter saying they will only recognize a “freeze” fork of Bitcoin as the “true” Bitcoin, with any other forks being incidental. The other alternative for these institutions is to delist Bitcoin and deprecate their Bitcoin practice entirely, which some might actually do, lacking the stomach for the fight. I am guessing that most of the large ETF issuers, to avoid fragmentation (how do you have a Bitcoin ETF that suddenly splits into two?) will strenuously avoid a value-destroying split and will decide early to champion only one side of the fork. The other side will be sold off and go into the corporate entity, not to clients. Exchanges might be more ecumenical, choosing to support both forks and “letting the best man win”, giving their clients the choice. But generally, I think the institutions will be strongly on the side of just supporting the freeze fork, because they simply cannot tolerate the liability of having their client assets zeroed out overnight by a rogue actor.

The other alternative is that Bitcoin’s “immune system” activates and we get a similar outcome to the Blocksize war, which is that the corporates back down and accede to the desires of the community. I think this is very unlikely – though many Bitcoiners will expect it to go this way – because 2026 is simply not 2017. In 2015-2017, the only active institutions were crypto-native – firms like the CME had only just barely begun to support Bitcoin and were not yet a factor, let alone asset managers or ETF issuers. So the crypto native corporates like Coinbase ultimately understood that there was no need to die on the hill of 2x or even larger block sizes, which allowed the “purists” to win out through the UASF and the activation of SegWit. 2x also failed because there was insufficient developer talent to push through the blocksize increase fork. That is not the case with the freeze fork. You will find plenty of developers willing to work on the freeze side.

Today, as I said, is different, because such a large fraction of BTC is held in corporate entities like Microstrategy or custodians, exchanges, and asset managers. The economic side simply has more sway today, and it’s much more concentrated into a dozen or so important firms, all of whom get a vote. Moreover, the case for freezing is much more economically obvious than the case to expand the blocksize, which was an economically marginal issue and more of an engineering question. And you have some influential developers and community members with tons of social cachet like Jameson Lopp and Pieter Wuille that have already come out in favor of a freeze, so the “ideological hardliner” side will be more divided.

So my base case is that the investors and institutions will win out, and they will do so cleanly by precommitting only to a freeze fork. Many Bitcoiners will complain but they will ultimately recognize the economic validity of the argument. They want to make money, too. Most people are not willing to let their nest egg and savings go to zero for the sake of ideological purity.

A secret third thing

But there is another way. Bitcoin doesn’t necessarily face a stark choice between economic doom and utterly abandoning its founding principles. A possible “compromise” could be reached whereby the coins are rescued from their quantum plight while keeping Bitcoin’s monetary policy and ideological purity intact. I’m speaking of a legal recovery or “salvage” of these vulnerable coins.

There’s one condition necessary to ensure this outcome: one or more US-based firms have to win the quantum race (which to me, looks eminently likely).

It would go like this. A US firm, whether it’s Google, or IBM, or one of the other quantum leaders (most of whom are US-based companies) acquires a CRQC first, and contracts with the US government to lawfully recover the 1.7m p2pk coins. They do not obtain ownership of these coins, but are rather appointed by a court as a neutral receiver or court-authorized custodian, tasked with securing and returning the assets to their rightful owners where possible and otherwise holding them in trust pending judicial disposition. This is analogous to the concept in maritime law of “salvor-in-possession,” in which a salvage firm recovers property from a vessel in peril and obtains a court-determined salvage award but not ownership of the recovered assets. This is, for instance, how the Titanic wreck is administered.

Some might say Satoshi’s Bitcoin would be treated more analogously to the “law of finds”, or “finders keepers” more colloquially. If property is considered to be abandoned, the finder who takes possession gets full ownership. I think this is much more unlikely, since US courts tend to require that the prior owner affirmatively relinquishes control, which is most likely never going to happen with Satoshi.

Salvor in possession, while not being the actual judicial doctrine employed (since Satoshi’s bitcoins are not literally a shipwreck on the high seas), is the best analogy and something that a court could reasonably look to for inspiration. In that case, Google, or whoever else it is that first builds a CRQC, would gain temporary exclusive authority to recover the 1.7m BTC which would be considered “imperiled” (since some other adversary might be close on their heels with a CRQC). Other firms would either be brought into a consortium or legally barred from attempting recovery. These coins would be swept into court-controlled addresses and sent into a receivership estate or trust structure. From there, claimants (Satoshi or other) could prove ownership, by providing conventional evidence that they did indeed mine the coins in 2009/10. This would be hard, but not impossible, if enough electronic records were kept. The salvor would get a salvage award commensurate with the difficulty and expense incurred. It could be substantial. In the case of the SS Central America, the salvor was awarded 90 percent of the roughly $150m in gold recovered. Though this is not the norm, and in cases where ownership was belatedly asserted, as with the monster $500m Nuestra Senora frigate recovery, the award can be 0% (Spain asserted an unbroken sovereign ownership claim – 200 years later).

The fate of the coins if unclaimed (and I believe few if any would be subsequently claimed by Satoshi or others) is a little muddier. In theory, the property would be escheated to the state, liquidated and the proceeds used, but with a perpetual liability attached – if Satoshi returns and demands their money. The size of the liability and the unclear domiciling of the coins (what state were they mined in? none? all?) suggests that this would have to be federalized in a kind of ad hoc process; no state would want such a huge liability. So what I think is most likely is the coins would ultimately come to rest inside of Treasury in the Bitcoin Reserve – claimable by Satoshi but effectively property of the US government.

Now this isn’t the most cypherpunk outcome, but most Bitcoiners already made their peace with the US government getting involved in Bitcoin and many vociferously supported the Strategic Bitcoin Reserve, so it’s not like Bitcoiners are allergic to the government getting involved in their protocol when it suits them. In this case, the USG would be doing us all a favor by proactively tackling the biggest threat to Bitcoin and ensuring the coins would not be dumped on the market – and doing it in a manner that required no arbitrary changes to the protocol layer.

The idea seems fanciful but I think it could genuinely take place. I actually wrote an entire speculative fiction short story premised on the idea last year entitled Trillion Dollar Salvage.

Now, what do I specifically want to happen?

My preference, in order, is:

1. The coins are lawfully salvaged, held in Trust for Satoshi to claim, and ultimately escheated into the SBR

2. The Freeze

   
   [a big gap]
   

3. No Freeze and Bitcoin dies valiantly

1 is preferable to 2, in my opinion, because if Bitcoin really does freeze the coins, then something about Bitcoin will truly have died. It would survive, but it will be forever changed – arguably not the same network Satoshi set up all those years ago.

* * *

This post was written 0% with AI, as is the case with all my writing. AI was used sparingly as a research assistant.

The New York Times thinks Adam Back is Satoshi; their analysis is based on Back’s membership in the cypherpunk community and prior work on Hashcash, as well as some linguistic quirks he shares with Bitcoin’s creator. There is no meaningfully new evidence presented. The piece is surprisingly weak for a journalist as credentialed as John Carreyrou, who famously exposed Elizabeth Holmes and Theranos.

Back is taking a magnanimous approach; harvesting goodwill from the Bitcoin community, while denying any Satoshi affiliation with a wink and a nod (as all Satoshi candidates are expected to do).

I saw nothing in this article that caused me to revisit my view that Back is not Satoshi. The burden of proof is extraordinarily high, and the Carreyrou didn’t clear the bar. Stylometric analysis can be trivially P-hacked. The NYT didn’t really do any rigorous statistical work; they appear to have looked at superficial patterns of grammar and spelling. I have my own guesses regarding Satoshi’s identity,1 and I think the mystery might finally be cracked soon thanks to AI, but I don’t think this is it.

Why might someone egg on a NYT journalist who thinks they are Satoshi? I leave that as an exercise for the reader. I don’t think anyone sane would want the public to think they secretly controlled a hoard of $120 billion in digital bearer assets.

But there’s another good reason to be skeptical of the Back as Satoshi story.

If Satoshi were alive today, they would have an enormous responsibility to resolve the biggest lingering problem for Bitcoin – the roughly 1.7m BTC sitting naked in “pay to public key” (p2pk) outputs, waiting to be seized by a quantum computer.

As a reminder, sufficiently powerful quantum computers could reverse-engineer the cryptographic relationship between public and private key. Recent papers from Google and Caltech suggest that this might be easier than previously expected, potentially doable by a quantum computer with as few as 26k quantum bits (qubits) in a few days. Google and Cloudflare consequently set themselves 2029 deadlines to fully upgrade to post-quantum crypto. The US government has asked its critical agencies to be ready by 2030. Serious organizations expect quantum computers to be a problem in the not-too-distant future.

Now, as “Q-day” approaches, I expect that Bitcoin will get its act together and upgrade its cryptography so that addresses cannot be cracked by a quantum computer. In the next decade or so, each holder of BTC will most likely have to rotate their coins into new addresses, secured by new cryptography. But here’s the trouble:

There are a few million BTC in addresses held by Satoshi and other early miners that are presumed to be abandoned or lost. Moreover, a large subset of these coins – 1.7m BTC or around $120 billion worth – are in outdated p2pk addresses that expose the public key, meaning anyone with a sufficiently capable quantum computer could reverse-engineer the private key and claim the coins for themselves. This could entail the unexpected resurfacing to the market of nine percent of Bitcoin supply thought forever lost. The price impact would be catastrophic.

Now unfortunately, as Satoshi and some of their early peers have either lost or abandoned their keys, or passed away, it appears that coins in these old addresses cannot be rotated to a newer, stronger encryption format. Thus, around 1.7m BTC appear permanently vulnerable to a quantum attacker – and the owner of that computer would have a near unlimited amount of time to crack the addresses open.

Of course, the Bitcoin developers could propose a software update that prohibits expenditures from these old address types, effectively freezing those coins in place forever. This would be unprecedented in Bitcoin history and would represent an effective confiscation of user funds – something Bitcoin culture strenuously rejects. For this reason, I think it’s unlikely such a freeze takes place. If it does, something inherent in Bitcoin – its rigorous adherence to property rights and an untampered monetary schedule – would be lost.

This brings us back to Satoshi. Satoshi is the main person that can get us out of this mess. They could either move their hoard of coins to a newer, safer address type, or, if they don’t want to claim the coins, they could move them to a “burn” address, thus provably rendering them unspendable. This would put to rest the risk of these coins unexpectedly waking from their slumber. And they could do this while retaining their anonymity.

This is why I have concluded that it is unlikely that Satoshi is still alive. Barring an extraordinary intervention from the developers to freeze almost 10% of the supply, only Satoshi can resolve Bitcoin’s quantum liability. If Satoshi was alive, they would feel an overwhelming sense of duty to resolve the p2pk coins problem, either by rotating their coins to safer addresses, or burning them. Even if they had lost access to their coins, they could presumably prove that they were Satoshi with old files, emails, credentials, and use this authority to coordinate a solution (for instance, giving their formal approval for a freeze).

Back in 2010, Satoshi did participate in discussions about quantum risk to Bitcoin’s cryptography and was therefore aware of the issue. Satoshi was quite relaxed about it, casually suggesting that Bitcoin could simply adopt a new cryptographic function and move on if necessary.

Fifteen years on, quantum computers have significantly advanced and now look to pose a genuine threat in the coming decade.

This is why the NYT’s identification of Back as Satoshi doesn’t pass muster for me. Not because Back doesn’t have the credentials or the talent, but because if Satoshi were alive, and positively disposed towards Bitcoin, they would feel overwhelming pressure to resolve the issue of the quantum-vulnerable coins, which is getting worse with each passing day. It’s hard to believe that Satoshi could be watching Bitcoin’s plight from the sidelines with callous indifference.

This leads me to conclude that Satoshi is no longer with us. As Q-day looms, we need Satoshi more than ever. And Satoshi isn’t answering.

On Monday two major papers on resource estimation for theoretical quantum computing attacks on ECC-256 via Shor were released. (If this is gibberish to you, read this blog as a primer.) Shor’s algorithm is possible with as few as 10,000 reconfigurable atomic qubits by a group of scientists at Caltech and UC Berkeley (some of whom announced a startup Oratomic) and The Quantum Threat to Elliptic Curve Cryptocurrencies: Resource Estimates, Vulnerabilities, and Mitigations by the Google Quantum AI team (featuring Craig Gidney!), plus Stanford cryptographer Dan Boneh and Justin Drake of Ethereum.

Both papers offer landmark estimates of what it would cost (in terms of qubits, Toffoli gates, error rates, runtime) to build a quantum computer capable of breaking ECC256, which virtually all blockchains rely on. Neither set of academics claims to have broken Bitcoin or to have a working quantum computer – that’s not the point – they are simply proposing new improved algorithmic constructions and compilation techniques for two different quantum modalities. In other words, they’re showing how much easier the problem could become if hardware catches up, not that it’s solvable today.

As far as I know, no one is saying a quantum break of Bitcoin’s cryptography is imminent. I certainly am not. But these papers both accelerated my personal timeline for Q-day (the day in which a quantum computer first breaks a major cryptographic function like ECC256 or RSA2048). They accelerated Google’s timeline too: these papers were the reason the internet behemoth brought their full PQ deadline forward to 2029, a mere 2.7 years away.

The Google paper looks at superconducting qubits (the most mature subset of QC hardware) and the Oratomic paper considers a neutral atom architecture. They are not directly comparable and the different tradeoffs taken have to be appreciated. However, both papers improve on the state of the art in terms of resource estimates for attacks on ECC.

Though I recommend reading the source material directly, I appreciate that the implications may not be immediately obvious to all of you (though the Google paper is surprisingly readable, and covers a huge amount of ground). These are my main takeaways from the pair of papers:

1. Resource estimates for CRQCs are now within the realm of engineering plausibility

2. “On-spend” or short range attacks on Bitcoin must be incorporated into your threat model

3. We may not have the luxury of a “soft takeoff”

4. Scientists have begun self-censoring out of concern

5. Experts are bringing forward their Q-day expectations in response

This is a serious and uniquely qualified group of academics

First of all, just so you get a sense of who we’re dealing with, the Google paper (Babbush et al) is basically an all-star team consisting of Google Quantum AI researchers alongside cryptographers with a blockchain focus. The paper lists 7 members of the Google Quantum AI team, including Hartmut Neven, the project lead. Google Quantum AI is arguably the most important quantum lab on the planet – they brought us the Willow result that demonstrated that error correction was scalable. Craig Gidney is a name anyone familiar with the literature will know – he is in my view the most important QC researcher when it comes to resource estimation and has written some of the most cited papers in the field. Ryan Babbush is another leading figure in the field of quantum resource estimation.

Interestingly, these academics are joined by Justin Drake, a well-known Ethereum researcher, and Dan Boneh, one of the most respected cryptographers on the planet, also no stranger to crypto(currency). (He is the B in BLS signatures.) The paper combines the views of bleeding edge experts on resource estimation with specific expertise in how these cryptographic breaks could threaten Bitcoin and Ethereum.

As for the Oratomic paper, the author group is just as credentialed. John Preskill helped found the field of quantum error correction. Dolev Bluvstein has prior work demonstrating below-threshold error correction for a neutral atom processor. Caltech hosts one of the most well-reputed QC programs in the country.

1. Resource estimates keep collapsing

The way to think about the race to build a scaled quantum computer is in terms of resource requirements versus physical capabilities (the literal arrays of logical qubits themselves). In recent years, the software side has been advancing faster than the hardware, and it seems like there are still more gains to come in terms of algorithmic efficiency.

Generally speaking, the physical capabilities of quantum processors are improving, while the resource requirements are dropping. When they meet, you get an ECC-256 break. So if you wanted to estimate Q-day, you would project out the declining resource requirement curve and the growing capabilities of QCs and see where they intersect.

Pierre-Luc Dallaire has the best chart on this (updated with the latest results).

You can clearly see the declining resource estimates for RSA2048 and ECC256 set against the demonstrated qubit counts of various labs and their published roadmaps. We don’t know the future, but the curves intersect uncomfortably soon. My personal guess is sometime in the 2030-2035 range.

The Google paper proposes two resource estimates for an ECDLP break, one optimized to minimize logical qubits, the other targeting Toffoli gates (the quantum version of an AND gate). For the low-qubit variant, they estimate 1200 logical qubits and 90 million Toffoli gates; the low gate variant requires 1450 logical qubits and 70 million Toffoli gates. Based on standard assumptions for superconducting qubit processors, they estimate that these attacks would take 23 and 18 minutes respectively. However, by precomputing the first half of the algorithm, they can halve the attack time, getting the 70m gate variant down to 9 minutes. (This is a very important threshold as I’ll explain later.) The authors believe that these attacks might be possible with fewer than 500k physical qubits. This is well within the published roadmaps of several leading quantum labs. Because there has been relatively little work optimizing Shor for ECDLP, their physical qubit estimate is a 20-fold reduction versus the previous state of the art (Litinski 2023).

Babbush et al explore the tradeoff space to demonstrate how attackers can account for various constraints (say in hardware, or runtime) but still pull off a successful attack. Here’s a table showing how their estimates compare to other prior work on the topic (Google paper at the bottom in bold):

As you can see, the Google paper is the most economical in terms of logical qubits, T-gates needed, and wall-clock runtime. With the exception of Chevignard on the logical qubit side which also came out this year, but requires many more runs and a vastly greater runtime (months/years versus minutes).

Here’s a chart from the paper which puts the Google result in context visually:

You can see that there is a kind of “efficient frontier” where various approaches have made tradeoffs effectively “buying” qubits with T-gates and vice versa. The Google paper simply burst through the frontier. The huge optimization gains they were able to find by focusing on ECDLP suggests that there are probably more to come. Historically, most security researchers have focused on RSA and it was the “standard” algorithm against which QC progress was measured. It looks to me like this is changing with ECC becoming the biggest target. Additionally, these results imply that an ECC break might actually be easier in terms of resource requirements than RSA.

As for the Oratomic (Cain et al) paper, it’s not directly comparable to Google’s work because the papers focus on different modalities; superconducting and neutral atom respectively. Superconducting qubits (the more conventional approach pursued by Google, IBM, Rigetti and others) are much faster in terms of gate operations but seem to have difficulties scaling due to the simple fact that it’s hard to maintain extremely cold temperatures (millikelvin – colder than outer space) for very large qubit arrays. Neutral atom architectures (a newer approach taken by QuEra, Pasqal, and others) are longer-lived, seem to scale much more cleanly, but are less mature and have lower fidelities. Some of the QC experts I talk to seem to think that neutral atom is the most credible approach to get to real scale, though the clock speed remains an issue – neutral atoms are 100-1000x slower per operation, which might end up being prohibitive for commercial applications. Neutral atoms already have an impressive scaling track record and the authors note that arrays up to 6k qubits have been demonstrated, though not at fidelities necessary for the Cain et al result.

Cain et al, like Babbush et al, explore different tradeoffs, offering “space efficient” and “time-efficient” approaches to an ECC-256 break with Shor.

Their space-efficient approach is prohibitive in terms of runtime, although in keeping with tradition in this literature, it does provide justification for the flashy title of the paper: “Shor’s algorithm is possible with approximately 10,000 reconfigurable atomic qubits”.

The important figures are the time-efficient approaches which they estimate are achievable with 19k and 26k physical qubits with runtimes of between 52 and 10 days, respectively. They lean on parallelism by executing Toffoli gates in batches within the algorithm’s subroutines.

Cain et al publish this chart summarizing the accelerating reduction in physical qubits required to crack ECC-256 and RSA-2048. If you turn the chart upside down, you get a curve that looks exponential. The “foom” moment seems to have happened in 2025. (Note that the blue dots and squares correspond to “slow clock” neutral atom approaches.) In my earlier work on this topic, I warned that orders of magnitude could collapse very quickly, and this chart seems to show that – a four order of magnitude reduction in physical qubits required in the last year alone. This is not something that Bitcoiners should take lightly.

The vast reduction in physical qubits (compare with Gidney and Ekera 2019 requiring 20m physical – a 10,000x physical:logical exchange rate) is due to their significantly reduced 10x physical:logical exchange rate. Of course, the paper assumes great feats of engineering, which is why no one is claiming this will actually be implemented anytime soon. Cain et al assume 10^-3 error rates, high connectivity, and high parallel throughput. None of these are trivial, and the state of the art labs have not demonstrated these features at scale. The most credible result that is “Cain-level quality” so far is Bluvstein (2026)’s 500-qubit array. Atom computing has demonstrated a 1000-qubit array but it had insufficient fidelity, among other problems.

So the SOTA quantum computing labs are still very far off the ~20-25k physical qubit arrays necessary for Cain et al to work, but this number is squarely inside their near term (late 2020s) roadmaps. Of course, unlike Babbush et al, the runtimes in Cain et al are exclusively slow – so the threat model is different. We would “only” have to worry about long-range attacks on exposed public keys (like Satoshi’s coins). If neutral atoms end up winning, we might not have to worry about short range attacks at all, and our roadmap to mitigate this risk could be significantly more relaxed.

2. We need to incorporate short-range attacks into threat models

The main contribution of Babbush et al in my view was them opening the Overton window and introducing the possibility of short-range attacks or “on spend” as they call them. Under one of their models, they posit that keys could be cracked in as little as nine minutes, shorter than Bitcoin’s average block time. As they say in the paper:

[O]ur resource estimates give the first clear indication that superconducting qubits could launch attacks within the average block time of Bitcoin and Bitcoin Cash, thus enabling “on-spend” attacks whereby a transaction is intercepted, the key is broken, and a fraudulent transaction is syndicated in the brief period of time before it is recorded on the blockchain. This prospect highlights the importance of migrating to post-quantum cryptography and of mitigation measures that thwart on-spend attacks, such as private mempools and commit-reveal schemes

This does something previously thought impossible by quantum-watchers like myself: opens Bitcoin up to short range attacks, that is, deciphering private keys from public keys in the time between when a transaction is posted and it is confirmed in the blockchain. Previously most of us – even the most “doomer” quantum watchers – had felt that while a quantum break might one day be possible, the first attacks would take months or weeks for a single key, making short range attacks implausible for a matter of decades.

The difference between a short range and long range attack threat model is considerable.

In the long-range world, it’s sufficient for all coins to rotate into quantum-invulnerable address types (ordinary hashed addresses) and to avoid address reuse. In a world where short-range attacks are possible, your keys are not safe even if stored in an address with perfect hygiene, because public keys are revealed at the time of spend.

If you take Babbush et al seriously, you should avoid half measures and simply begin the full transition to native PQ signature verification as soon as possible.

3. We may well get a “fast takeoff” quantum scenario

The thing many AI safety theorists worry about most is a “fast takeoff” situation in which an AI recursively self-improves and reaches a superintelligent state well ahead of our capacity to wrangle it and ensure its alignment.

In the quantum world, there is a similar concern. If we indeed get a “fast takeoff” in which a quantum computer factors 35 and then next month factors a 256-bit number, we will not have the warning that most Bitcoiners expect. Upgrading Bitcoin will require a lead time of years – Chaincode has estimated 2 years at the absolute minimum in an emergency scenario, asking for 7 years in the happier case.

In the wake of the publication of the Google paper I have seen those resistant to upgrading Bitcoin object time and again insisting that we will have plenty of notice. This belief should better be described as “wishcasting”. There is no evidence we will have slow, gradual, linear and easily legible progress on quantum computing that allows us to forecast the pace of progress ten years out. In fact, the experts are telling us otherwise. I’m going to quote Babbush et al at length here:

It has been observed that technological change tends to occur in a two-stage evolutionary process in which an initial “era of ferment” characterized by high degree of innovation and technical variation eventually leads to the emergence of a “dominant design” and is followed by a period of gradual technological improvement. For example, the car industry’s “era of ferment” (during the late 19th century) saw rapid innovation across a wide variety of cars powered by the steam engine, electric batteries and the internal combustion engine before the latter became the “dominant design”. In the stage of incremental improvement progress can be measured in terms of gradually increasing performance metrics, such as miles per gallon or the number of integrated circuit components in Moore’s law.

By contrast, quantum computing, with its broad variety of hardware platforms, is still in the “era of ferment” where simple models, such as counting physical qubits, fail to adequately capture technological progress. Instead, progress comes in discrete jumps corresponding to development of new internal capabilities and overcoming scaling challenges, e.g., by getting device error rates below the threshold for an error-correcting code or implementing coherent interconnects for modular architectures. Therefore, progress in quantum computing is better understood using a threshold model rather than in terms of the number of physical qubits.

Accordingly, other gradual measures of progress, such as the challenge ladder of increasingly difficult ECDLP instances ranging from 6-bit to 256-bit modulus and group order proposed in [74], also fail to adequately measure progress towards a CRQC and may fail to provide a reliable early warning. Indeed, if a leading quantum architecture encounters and overcomes all its scaling challenges before producing a device able to solve (for example) 32-bit ECDLP, then there may be little time between the breaking of 32-bit ECDLP and the breaking of 256-bit ECDLP. Furthermore, the community should not expect to see published demonstrations of the most advanced quantum error-correction architectures and quantum algorithms deployed to cryptanalytic problems. Thus, a successful public demonstration of Shor’s algorithm on a 32-bit elliptic curve should not be seen as a wake-up call to adopt PQC as much as a potential signal that PQC adoption has already failed.

We also argue that the finish line may become progressively more blurry and the current state of quantum capabilities increasingly more opaque as we approach CRQCs. Indeed, as progress in quantum computing lowers the barriers to entry, the final stages of the race to build a large fault-tolerant quantum computer may see “late-joiners” attempting a rapid breakout toward a CRQC, possibly accelerated by intellectual property theft or industrial espionage. Simultaneously, transparency of quantum computing research and development programs is likely to decrease as they get closer to large-scale commercially viable quantum computers. These factors may increase the uncertainty regarding the arrival time and the nature of the first CRQCs. Thus, it is conceivable that the existence of early CRQCs may first be detected on the blockchain rather than announced. As we will argue throughout this piece, the safest course of action for the cryptocurrency community is to begin preparing itself against quantum attacks immediately.

More precisely, the number of Toffoli gates and logical qubits required to run Shor’s to crack ECC scale polylogarithmically with the number of bits. This means that cracking ECC256 is not substantially harder than cracking ECC128. This is kind of the whole point of Shor. Hard as it may be to accept, Shor doesn’t adhere to Bitcoiners’ traditional assumptions about the security assurances of adding bits. Because it doesn’t brute force elliptic curve point multiplication. It genuinely reverse-engineers the problem. Here’s the relationship in simple chart form:

This should put to rest the objection that “QCs haven’t factored 35 yet!”. Because of the nature of Shor, when they do factor it, 256-bit numbers won’t be far behind. And Bitcoiners will not get the 10-year notice period they need to plan a leisurely upgrade. For what it’s worth, Cloudflare’s chief post-quantum mathematician and Blockstream’s Jonas Nick (probably the leading Bitcoiner doing PQ research) have expressed a similar sentiment.

I want to zoom in on this because it’s the biggest epistemic gap between even smart Bitcoiners and QC practitioners – and it’s the sole reason many Bitcoiners think we can delay implementation of a PQ upgrade.

Look at this chart courtesy of Cloudflare’s Bas Westerbaan:

Look how close the lines are. Once you below a certain threshold of error rate and have a sufficient number of physical qubits, the game is won, whether it’s a tiny 4-bit key or a 2048 bit one (note that this chart is about RSA, but the same principle applies to ECC). As Bas says,

The day a quantum computer beats a classical computer on factoring, heck the day it factors a 32-bit number, we’re uncomfortably close to Q-day already. So: don’t wait for quantum computer factoring records; you’ll be too late.

Or take it from Scott Aaronson:

Once you understand quantum fault-tolerance, asking “so when are you going to factor 35 with Shor’s algorithm?” becomes sort of like asking the Manhattan Project physicists in 1943, “so when are you going to produce at least a small nuclear explosion?”

4. Scientists have begun self-censoring

One interesting new development in the Babbush et al paper is their unwillingness to publish the actual mechanics of their attack on ECC256. Instead, they published a zero-knowledge proof attesting to existence of the quantum circuits they describe without revealing it directly. They explain why:

Traditionally, the gold standard for quantum resource estimation has been full transparency: publishing algorithmic innovations, logical circuits, and error-correction optimizations to ensure results are openly verifiable. Our team has historically adhered to this standard — for instance, in establishing the most efficient quantum algorithms and circuits for breaking 2048-bit RSA. However, the escalating risk that detailed cryptanalytic blueprints could be weaponized by adversarial actors necessitates a shift in disclosure practices. Accordingly, we believe it is now a matter of public responsibility to share refined resource estimates while withholding the precise mechanics of the underlying attacks. Transparency regarding the overall resource costs of quantum attacks is essential; if the community overestimates the resources required, the perceived “safety margin” may lead to a dangerous “wait-and-see” attitude. Given the unfortunate technical trade-offs of Post-Quantum Cryptography (PQC), such delays could make it difficult for vulnerable cryptocurrencies to achieve the consensus necessary for an orderly transition.

This recalls what happened in the physics community in the lead up to the development of the atomic bomb. In 1933, Leo Szilard conceived of the nuclear chain reaction idea but filed his patent secretly as he didn’t want to tip others off. In 1939, nuclear fission was empirically demonstrated, and the field was set alight. Mindful of the looming war and the risk of heling the Nazis, Szilard began lobbying his colleagues to self-censor the publication of subsequent implementation details. In 1940, the National Academy of Sciences voluntarily adopted a self-censorship regime. Once the Manhattan Project began, all formal publications ceased. In July 1945, the first fission bomb was detonated in the White Sands missile range, New Mexico.

Due to the national security dynamics, the NSA is kept apprised of major quantum computing developments. If in the coming years we see less and less research published, it should be a sign that development is accelerating, not decelerating. This, again, is something Bitcoiners should consider when they assume they will have ample warning.

5. The papers meaningfully accelerated Q-day expectations among experts

The papers were arguably the most important in terms of how exposed organizations reacted. Google, of course, brought forward their full post-quantum preparedness deadline to 2029. They did this before the Babbush paper came out, and quite a few people wondered “what Google saw”. Once the paper came out, it was obvious. They explained that:

This new timeline reflects migration needs for the PQC era in light of progress on quantum computing hardware development, quantum error correction, and quantum factoring resource estimates.

It’s not just about resource estimates. Error correction and hardware continue to improve. Other major experts chimed in too. Filipo Valsorda, the maintainer of the Go cryptography standard library, former security lead at Google, and former Cloudflare cryptographer, brought forward his Q-day estimate, saying:

My position on the urgency of rolling out quantum-resistant cryptography has changed compared to just a few months ago.

Overall, it looks like everything is moving: the hardware is getting better, the algorithms are getting cheaper, the requirements for error correction are getting lower.

The bet is not “are you 100% sure a CRQC will exist in 2030?”, the bet is “are you 100% sure a CRQC will NOT exist in 2030?” I simply don’t see how a non-expert can look at what the experts are saying, and decide “I know better, there is in fact < 1% chance.” Remember that you are betting with your users’ lives.

Bitcoin developers would do well to heed his warning. They are currently wagering the existence of a trillion-dollar network on the bet that technology does not advance. That is an enormously reckless attitude for a set of individuals who are meant to be a model of paranoia and security-first thinking.

Scott Aaronson, one of the most well known theoretical computer scientists working on QC, and particularly renowned for his skepticism, had a marked reaction to the papers. In a blog post “Quantum computing bombshells that are not April Fools”, he wrote:

Neither of the [Google and Oratomic] results change the basic principles of QC that we’ve known for decades, but they do change the numbers.

When you put both of them together, Bitcoin signatures for example certainly look vulnerable to quantum attack earlier than was previously known!

In particular, the Caltech group estimates that a mere 25,000 physical qubits might suffice for this, where a year ago the best estimates were in the millions. How much time will this save — maybe a year?

Neha Narula, the director of the MIT Media Lab, a respected academic with a PHD in CompSci, and one of the highest-profile Bitcoiners, shared her view in a post “Bitcoin and Quantum Computing”

Her full post is worth reading – it’s mainly about how to compute the expected value of a CRQC on Bitcoin and why every Bitcoiner should run this analysis – but her conclusion is stark:

Let me make my position clear: I think [the likelihood of a CRQC appearing] is high enough to warrant prioritizing designing, implementing, and evaluating post-quantum signature schemes and consensus upgrades in Bitcoin now.

This is the clearest statement on the urgency to consider a PQ upgrade for Bitcoin from any high profile Bitcoin tastemaker. I’m not sure how any Bitcoiner can realistically disagree with her analysis. If you think there’s any nonzero chance of a CRQC appearing in the next decade, you have to start work on preparedness now.

And lastly, Cloudflare threw its hat into the ring, announcing that they, too, were moving up their own PQ deadline to 2029. Cloudflare has been a model of quantum preparedness (soundly debunking the Bitcoiner point that “a QC will destroy the internet”), as 65% of their traffic already flows through post-quantum encrypted channels. Cloudflare had this to say:

What happened? Last week, Google announced they had drastically improved upon the quantum algorithm to break elliptic curve cryptography, which is widely used to secure the Internet. They did not reveal the algorithm, but instead provided a zero-knowledge proof that they have one.

This is not even the biggest breakthrough. That same day, Oratomic published a resource estimate for breaking RSA-2048 and P-256 on a neutral atom computer. For P-256, it only requires a shockingly low 10,000 qubits. Google’s motivation behind their recent announcement to also pursue neutral atoms alongside superconducting quantum computers becomes clear now. Although Oratomic explains their basic approach, they still leave out crucial details on purpose

Cloudflare point out that QC progress is not just happening in the algorithmic domain (as with the Google and Oratomic papers). Hardware and error correction are advancing too. QC isn’t really one technology, but a half-dozen different approaches (superconducting, neutral atom, trapped ion, silicon spin, photonics, and more), each with their different tradeoffs. They conclude:

The picture comes together: in 2025 neutral atoms turned out to be more scalable than expected, and now Oratomic figured out how to do much better error-correcting codes with such highly connected qubits. On top of that, breaking P-256 requires much less work. The result is that Q-Day has been pulled forward significantly from typical 2035+ timelines, with neutral atoms in the lead, and other approaches not far behind.

I’m going through these reactions to the Google and Oratomic papers in detail to demonstrate that serious cryptographers, computer scientists, and some of the biggest and most important internet companies on earth have reacted to the papers with alarm. There’s no shame in revising your view to account for new data. Bitcoiners should consider doing so.

Summing up

Despite many accusations, my objective is certainly not to spread panic or alarm among Bitcoiners or “harm the price”. I am not short Bitcoin, nor have I ever been. I am irresponsibly long Bitcoin, blockchains, and crypto through my personal exposures, my firm CIV, reputationally, and so on. Over a year ago, I realized that Bitcoin would face huge issues when and if quantum computing became a real prospect, and I then noticed that QC progress was moving much faster than anyone gave it credit for in the crypto space. On the basis of this prediction and my desire to help protect Bitcoin and blockchains generally, CIV invested in Project Eleven, and we later led the Series A. I’m proud of this and see no conflict whatsoever – my beliefs and exposures are perfectly aligned. I feel very lucky that I have a career that gives me the tools to nudge the world in a direction I think it ought to go. The reason I am speaking up is because I am long Bitcoin, and would very much like it to continue existing.

The truth is that the state of the art in quantum computing as it pertains to ECC is changing rapidly. The fact that Google brought forward their deadline for PQ readiness to 2029 speaks for itself. Cloudflare has already meaningfully begun their transition. The US Government has established a window of 2030-2035 for a full post-quantum transition. None of these initiatives or papers have anything to do with me.

My main contribution so far has been to point out that there is a discrepancy between the time Bitcoiners think they have and the necessary lead time that would be required for an orderly PQ transition. I have also pointed out that Bitcoin development is woefully sclerotic, and very little urgency is being demonstrated on this topic. (Bitcoin developers have reached out to me privately and insisted that meaningful work is happening here, but as this is not publicly legible, I discount these assertions heavily.) There is simply no comparison between the clear urgency demonstrated by the Ethereum foundation and the woeful smattering of efforts on the Bitcoin side. It’s not even clear who might have the authority in Bitcoin to push a change through. We’ve done three updates in the last decade, and there appear to be none on the horizon.

A lot of Bitcoiners seem to want to focus the debate of quantum preparedness on my own motives, exposures, and perceived conflicts. That is a mistake. I am just someone who digests and packages up information for a mass audience. What matters is the information payload itself – namely, these two papers and the growing body of academic work on the topic. A functional QC looks to be getting closer, Bitcoin is not prepared, and Bitcoin needs a lot of time to prepare. We may not have that time.

Instead of complaining about me or my firm or my investments, Bitcoiners should invest the time in reading the Babbush et al paper. It is accessibly written and it doesn’t take much to understand it. Take it from them, not me:

We have offered these specific resource estimates and analyses to provoke necessary action, urging that the migration of cryptosystems to post-quantum cryptography begin immediately to avoid catastrophic network congestion and ensure the stability of the future financial internet.

Blockchain technology and cryptocurrencies are now a significant component of the global economy, and the sooner the community takes the quantum threat seriously, the better prepared we will all be to weather the coming storm.

I loved Project Hail Mary. The film that is. I loved it so much that I went and bought the book and read it in two days. Andy Weir is a master of the softer side of the hard sci fi genre. He tells a great story and keeps it (mostly) within the bounds of our physics. Liu Cixin by contrast tells a story and stretches physics to its breaking point, but his stories have a galactic scope and you lose track of the characters over the vast distances and timespans. Weir’s stories are so great because the science is just a vehicle for a story about a person, or in this case a guy pairing up with an Eridian pal.

One thing that I really love about PHM is that Weir constantly asks himself “what would it be like if life evolved nearby in our galactic neighborhood?” What might life look like under different atmospheric, gravitational, and mineral conditions? And he plays out the thought experiment to the fullest. Not only biology, but language and culture. And under what circumstances might two civilizations of similar technological attainment meet? So many other sci fi stories pit humans against aliens. Modern ones like Three Body assume vast technological gulfs between different species and adopt a fundamentally antagonistic approach that prohibits collaboration. But Weir asks: what if humans and aliens worked together? I’m sure this has been done elsewhere, but I’ve never encountered a story like this where the author attempts to give us scientifically plausible answers as to how this might work, while also making it charming and even cute.

In the end we get Rocky and the Eridians, strange but relatable creatures that evolved under conditions of extreme pressure and heat and developed no vision whatsoever, communicating entirely through sound waves. Despite these limitations, Dr. Grace is able to reverse-engineer their language and learn to communicate with Rocky so they can collaborate to tackle the existential crisis both species face.

One of the things I really loved about the book versus the film is how Weir took the time to explain what the biology of a creature might be if an organism evolved under conditions of 29x Earth pressure, an ambient temperature of 100 degrees c, an atmosphere made mostly of ammonia, and permanent darkness. Result: a race of self-contained, tough-shelled crab-like creatures with a carapace made of heavy metals, with ammonia blood and a crystalline brain and steam-powered joints. Living in permanent darkness, the Eridians never bothered to evolve sight.

These form the building blocks with which Weir asks the more interesting questions of what language, culture, norms and even habits might look like based on that biology.

The thing that I absolutely love about the book is Weir constantly asking “what might we have in common with these creatures, despite our colossal differences?” This is kind of his overarching premise: even a race of blind steam-powered metallic spider crabs with ammonia blood and photographic memories could not only communicate with us, but actually build common ground and form friendships. For instance, we use base 10 because we have 10 fingers, but they use base 6 because they have two main three-fingered claws. We have our own specialties: humans are better at science, Eridians are better at engineering. They are very good at memorization and mental math, but somehow never figured out relativity or radiation. And of course we have better visual sensing (they don’t have it at all) while they can do echolocation and sonar with their sensitive ears.

Big big spoiler here: towards the end of the book (and this isn’t even mentioned in the film), we realize that the Tau Ceti star system where astrophage originates and where we go to seek answers is actually the common ancestor of life in the entire star cluster – including Erid and Earth. That’s why astrophage has mitochondria just like human cells. We, the Eridians, and the astrophage (and the taumoeba) all share a common ancestor 4 billion years ago. So really, this is a story about reconciliation with our long-lost brethren (as we unite to fight a distant cousin).

The question of how we might relate to the Eridians is asked and answered in many different ways in the book (the film doesn’t have much time to go into this detail).

For instance, in one of the more 4^th-wall-breaking moments of the book, Rocky and Grace spend a few moments wondering about why the two civilizations met at relatively similar stages of technological development, an obvious puzzle, given the vastness of the universe and the relative rapidity of technological development (think about how different the Spaniards were from the Aztecs – now scale that up to a galactic level). Answer: both species were sufficiently advanced to launch interstellar voyages (but only just, in both cases), but not so advanced they could trivially defeat the astrophage threat. (Presumably earthlings in 2100 would be able to do this easily). Hence, both notice the unusual signature of Tau Ceti and in their desperation dispatch relatively primitive missions to the star system.

Theres another incredible passage where Grace and Rocky surmise that the reason they think at roughly the same speed is because they are subjected to about the same gravity, and that thought speed is an evolutionary function of prey-predator dynamics, and that gravity determines how quickly critters can scamper around. The book is full of speculative xeno-evo-bio theories like this. Basically: why is this feature of our world that we take for granted the way that it is?

As for how alien language, this is a common theme in the sci fi genre now. Call it xenophilology. This is the whole point of Arrival, an amazing film, though not hard sci fi by any means, as well as Interstellar, District 9, and Contact. Close Encounters is the closest encounter with the grammar of PHM, in that its aliens use musical tones to communicate.

Eridians as Musical Instruments

The Eridian language is audio and frequency-based combining elements of both echolocation and whalesong. Again these life-forms are totally blind and can’t even conceive of what vision-based sensing even is like. Rocky communicates in notes and chords and even short musical sequences.

Eridians have five vocal pipes and can therefore create polyphonic tones. Rocky is basically whistling by pushing Eridian atmosphere gas (their air) made of ammonia and CO2 back and forth past vibrating membranes between internal bladders. Weir in interviews describes these as “vocal chords” but it really isn’t similar to humans at all because Rocky is under turbo amounts of pressure and doesn’t have soft fleshy tissues. Some people might think Rocky is like a pipe organ (blowing air through pipes to produce different tones), but that doesn’t work, because he only has 5 pipes, and in an organ they have fixed frequencies, and he has to cover the whole frequency range. (At the end of the book, Grace actually does use an organ to communicate with the Eridians.)

I spent a lot of time trying to figure out what kind of “instrument” Rocky’s pipes are. Based on the book, he’s most akin to a polyphonic whale. Baleen whales push air from their lungs, past a vibrating larynx into their laryngeal sac, and then they start it over. If we had to analogize it to a human instrument, it would actually be a bagpipe. So Rocky, being a musical instrument himself, is kind of like 5 sets of bagpipes inside a resonant rocky carapace.

There was no pronunciation or inflection of the sounds. Just notes. Like whale song. Except not quite like whale song, because there were several at once. Whale chords, I guess.

Unfortunately, the film mostly discards the musical nature of his language and very quickly gives Rocky a translated human voice. In the film, for the few moments that we listen to him directly, Rocky sounds like a robotic cat purring. (In the audiobook, they try to replicate Rocky’s speech more faithfully and actually use the specific musical tones described in the book.) Apparently for the film the sound designers used a “jug, ocarina, didgeridoo, contralto flute, and contralto clarinet” to craft Rocky’s voice. This is problematic from a music theory perspective because they are mixing different taxonomies of instruments as far as harmonics are concerned. I’ll get into this more later.

In the book, Rocky’s first few words are described explicitly by Weir as musical notes. So we can assume he is creating relatively clean tones in the 20 Hz – 20 kHz frequency band that humans can hear. (Rocky admits he can hear and produce tones outside those frequencies. To him, earthlings must seem practically deaf and mute.)

Eridian Musical Grammar

So we’ve established that Rocky is five bagpipes crammed inside an ammonia rock spider alien. But how does the Eridian musical language convey meaning?

Rocky speaks in polyphony and can create sequences of notes and chords. He has five distinct voices which is enough to play Bach and Chopin, but not Rachmaninoff. He can convey emotion with frequency, dropping a whole octave to show sadness. He conveys emphasis by tripling certain words (“bad bad bad” or “amaze amaze amaze”). Beyond that we don’t get a ton of insight into the Eridian grammar. Cadence can convey humor (jokes have a different rhythm). More basic concepts generally have fewer notes in the chords.

Eridian speech is far more compressed in terms of bits per unit time than human speech, I would estimate by a full order of magnitude. Because Eridians have many different variables they can rely on to create meaning. These are the ones that are mentioned or suggested in the book:

• Pitch (frequency)

• Number of tones

• Rhythm

• Duration

• Chord or tonal sequencing (melody, harmony)

• Relative pitch (intervals, chords)

• Amplitude (loudness)

• Timbre/harmonics (other pitches that are nested within the base frequency, giving the instrument its characteristic sound)

As any music producer will know, these aren’t the only musical variables available to convey semantic content. We also have envelope (attack, decay), modulation (vibrato, tremolo), directional control (mono, stereo, probably more in the case of the Eridians).

Now to get to the point.

Music is a great choice for Weir’s book because the overarching theme is “universal languages”. Ways that biologically incompatible civilizations lightyears apart could find a way to collaborate. When Grace meets Rocky, he tries to build up a shared semantic grammar by conveying concepts of time, units, and math. These are based on hard laws of physics. It’s plausible that the Eridians built up their own counting system (base 6), their own notion of time and standard units. But what about music?

Music is “universal” in the sense that good music sounds good to most cultures. Without any cultural training, babies recognize rhythm and prefer regular beats to irregular ones. Humans generally prefer consonance (perfect fifth or octave intervals, etc) to dissonance, but this seems to vary with training (musicians prefer it a lot more than average folks, and westerners prefer it more than uncontacted tribes). And music is universal in the sense that most people regardless of national origin will interpret a bass drop as a “release of tension”. It’s totally plausible that the Eridians, who communicate through sound, would be strongly attuned to melodies and harmonies and have an inherent musical sense, thus creating a shared grammar with humans.

So this brings me to a question which has been bothering me nonstop since I read the book:

Why didn’t Andy Weir explain how harmony actually derives from universal laws of physics?

The entire point of the book is to explain how despite our differences, we could develop an understanding with an alien civilization, and to specifically ground these cultural similarities and differences in physical, chemical, and biological realities.

Music is a perfect choice for this because it’s a domain in which meaning is directly derived from physics! But Weir only vaguely hints at it, and doesn’t flesh it out, or even really explain it to readers who are unfamiliar with psychoacoustics (which is almost everyone). In the book, Rocky employs fifths, octaves, and even minor seventh chords. A smart generalist might say “well this totally breaks immersion. Why on earth would Eridians know about western music theory concepts?” What Weir should have done is explain how these are built from basic physics primitives, but he never does. In my opinion, this is a huge oversight, because Weir’s entire schtick is to avoid being handwavy and ground all his claims in mathematical theory.

The one time he sort of does this is in this passage:

My mouth hangs open.

“You’re the only person on that huge ship?!”

He’s quiet for a moment, then says, “♫♩♪♫♩♪♫ ♫♪ ♩ ♪ ♫ ♫♪♫♪♩ ♫♪♩♪ ♫♩ ♪ ♫♩♪ ♫ ♩♪♫♩♪ ♫♩♪ ♫.”

Complete nonsense. Did my kludged-together translation software fail? I check it out. No, it’s working fine. I examine the waveforms. They seem similar to the ones I’d seen before. But they’re lower. Come to think of it, that whole sentence seemed lower in pitch than anything Rocky has ever said before. I select the whole segment in the software’s recording history and bump it up an octave. The octave is a universal thing, not specific to humans. It means doubling the frequency of every note.

This is the only part of the book where Weir hints at the universality of music. He is right. Quick refresher. What we think of as pitch is just frequency. Conventionally, the A above middle C is 440 hertz. This actually means “the sound we think of as A above middle C is defined as a sound wave vibrating 440 times per second”. More vibrations equals higher pitch. When you get to low enough frequencies, you go from hearing pitch (100 Hz) to a very low buzz (80 Hz) to literally “feeling” the bass as it vibrates your chest cavity (40 Hz) to hearing distinct taps (10 Hz).

Now intervals. An 88-key piano contains a range of 27 to 4186 Hz over seven and a third octaves. Those octaves are subdivided, in western music, into 12 semitones (but you can divide them however you like). In case you can’t imagine what an octave sounds like, think of the first two notes (some…..WHERE) in Somewhere Over The Rainbow.

All an octave is, as Weir says, is a doubling of frequency. On a piano, the As are 27.5 Hz, 55 Hz, 110 Hz, 220 Hz, 440 Hz, 880 Hz and so on. But why do octaves sound “good”? Why might humans and Eridians be interested in octaves specifically as opposed to any other interval?

People will give you a lot of second-order answers to this question – octaves minimize “beating”, octaves are the second harmonic in the series – but the fundamental reason is simply that a 2:1 frequency ratio is perfectly periodic. The wave cycles of the two notes line up perfectly, with the shorter cycles of the higher note amplifying the slower cycles of the lower half the time. A 2:1 ratio of frequencies is the least confusing auditory pattern our brains can receive. So we find octaves pleasant. They feel “stable” or “simple”.

That one’s easy enough. How about all of the other intervals? And how does Rocky know what a dominant seventh is?

“Okay,” he finally says. “Name is ♫♩♪♫.”

I don’t need the frequency analyzer anymore. That was an A-below-middle-C major fifth, followed by an E-flat octave, and then a G-minor seventh.

I enter it into my spreadsheet. Though I don’t know why. I haven’t had to look at that thing in days.

“What does it mean?”

“It is name of my mate.”

This is where in reading the book I started to feel pained.

There is actually a good answer as to why Rocky might know what major fifths and sevenths are, and might prefer them in his chordal language.

Remember how human brains like 2:1 frequency ratios, or octaves? If you keep incrementing ratios you get some pretty interesting intervals that you have probably heard of:

• 2:1: Octave

• 3:2: Perfect fifth

• 4:3: Perfect fourth

• 5:4 Major third

• 6:5 Minor third

You’ll notice that these intervals are getting closer because the frequency ratios are getting smaller. Why are fourths and fifths “perfect”? Because they are the next simplest frequency ratios after the octave.

Grace seems to have perfect pitch, instantly recognizing an “A-below-middle-C major fifth, followed by an E-flat octave, and then a G-minor seventh”. This would be a feat for even a trained musician.

If we strip away the music theory abstraction and just use frequencies, the sequence is as follows:

• A major fifth: 220 Hz to 330 Hz, or a 3:2 ratio

• E flat octave: 331 Hz to 622 Hz, or a 2:1 ratio

• G minor 7^th: 196 Hz 245 Hz 294 Hz 343 Hz or a 4:5:6:7 ratio

So Rocky’s partners name, Adrian, in Eridianese is simply:

3:2 frequency ratio, 2:1 frequency ratio, and then 4:5:6:7 frequency ratio.

No human western music theory overlay required.

The actual musical sequence isn’t … that nice sounding. Here’s my interpretation on the keyboard:

It sounds a little discordant because you are flipping from A down a semitone to E flat, and then resolving to G minor 7^th. These three chords are not in a shared key, and you get a tritone jump from A to E flat. The tritone is considered one of the most discordant intervals in western music.

But who am I to begrudge Eridian linguistic taste?

Why do integer ratios lead to consonance?

So I think we can accept that frequency ratios could be the basic building blocks of a universal harmonic language shared by both humans and Eridians. I think I have done a reasonable job at convincing you that we didn’t pick the intervals that provide the building blocks for western music out of thin air, but rather that they are grounded in physics.

In fact, these ideas originate with the ancient Greeks going all the way back to Pythagoras. He figured out that when you cut a string in half and pluck it, the frequency is exactly an octave higher – QED. For him, numbers were the underlying substance of reality, and harmony was part of that since it was reducible to simple ratios. The Greeks felt that the planets even moved according to mathematical ratios that formed a kind of cosmic music.

But this still leaves something unanswered. Discarding the metaphysical claims, why is it that we feel that frequency ratios of 2:1, 3:2, and 4:3 sound good?

What is it about whole integer ratios of vibration frequencies that is pleasing to the ear? The Pythagorean view that “well it should just be the case that simpler is better and more harmonious” isn’t sufficiently explanatory to me.

Enter psychoacoustics.

If you’ve ever sung in a choir, you probably know that when two people sing notes that are close but not identical, you can hear a kind of wavering in the tone. It sounds like a wub wub wub. It goes slower if the notes are very close together and faster if they are a little further apart. (See here for a quick demo.)

This is called beating. Singers actually use it to carefully tune themselves a few cents sharp or flat. Once you stop hearing the beating you know that you are in perfect unison with your co-choir member. If you sing two A notes, one at 440 Hz and one a little sharp at 442 Hz, you will hear a slow beating at 2 Hz, or two cycles per second.

Formally, people like Galileo and Mersenne figured out that beating is interference between two close frequencies, causing variable amplitude due to alternative cycles of destructive and constructive interference. So two frequencies that are close but not identical combine to create a third frequency, which cycles at the rate of the higher frequency minus the lower one. When frequencies are very close together you can hear clear slow beating, but as they get further apart, beating moves into the 10-20 Hz range and decomposes into “roughness” or general dissonance.

In 1877, Hermann Von Helmholtz decided to test whether people’s own subjective view of the consonance or dissonance between two notes matched the Pythagorean theory. He had people listen to pairs of frequencies and asked them whether the intervals sounded consonant or dissonant. His observations produced this graph.

You can see that there are peaks and troughs exactly where we’d expect them to be following the integer ratio theory. The unison is highly consonant, and then nearby tones are highly dissonant as we get beating. Then you have troughs at the round number ratios like the perfect fifth and the octave.

Helmholtz’ theory, now generally accepted, was actually that the simple ratios worked because they minimized the beating between the notes’ overtones.

Wait, what are overtones?

Well, as it turns out, when you play a note on virtually any instrument – especially strings or air columns like the flute or the human voice – you get a whole stack of notes, nested inside the one note. That’s right, unless you are creating a pure sine wave in a synthesizer, every note you have ever played contains the frequencies of a whole bunch of other notes. And those additional frequencies, called overtones or harmonics, are what give the instrument its specific character, called timbre (annoyingly pronounced tam-ber).

If a note has frequency f its overtones are 2f, 3f, 4f, and so on.

So when you play C2 on the piano, you get (in theory):

65.41 Hz (C2), plus 130.81 Hz (C – octave), 196.22 Hz (G – fifth), 261.63 Hz (C – octave), 327.03 Hz (E – major third), and so on

Unless you are listening carefully you won’t hear these additional notes, but they are there creating the shape or the form of the sound. The overtones are the “pianoness” or “fluteness” of the sound. Overtones determine whether an instrument sounds bright or dark, warm or metallic, or smooth or buzzy.

And overtones, as it turns out, are the mechanism through which integer ratios create consonance.

This is what Helmholtz figured out. Every note is a stack of frequencies, defined by the harmonic series. When frequencies are close, they pulse unpleasantly (beating). Consonance is simply a function of how much beating occurs between the overtones of two notes. Pythagoras didn’t have it quite right. Harmony is not a function of the frequency ratios of the fundamental tones in an interval. It’s a function of the absence of dissonance between their overtones.

Putting it all together, you get this chart, a more precise version of the dissonance chart from above. It maps the perceived dissonance as you play one tone C and sweep up an octave with a second tone. You can see the dissonance troughs at E (major third), F (perfect fourth), G (perfect fifth), and C again.

You can actually verify the overtones theory as opposed to the simpler Pythagorean approach for yourself with this quick demo.

Would the Eridians use western harmony?

So… back to our alien mineralized spider friends. What do they make of all this? Would they also appreciate what we think of as harmony?

Physically speaking, they experience pressure waves in a gaseous medium. They are highly perceptive so they would certainly be able to detect beating through close frequencies. Helmholtz’ mechanism should apply to them too.

They would also most likely notice the stability inherent in the ratios that gives us octaves, fifths and thirds, not because they have any preference for the numbers 2:1 or 3:2 but because those ratios minimize interference between their component frequencies.

“But wait,” the informed reader might ask. “Not all instruments are harmonic emitters like resonant strings (pianos, violins) or pipes (human voices, flutes, oboes). Some instruments have overtones which are not integer multiples of the fundamental, like bells, gongs, cymbals, or marimbas. 1D systems like strings or pipes are harmonic, but 2 or 3D systems tend to be inharmonic! Rocky is 3D!”

This is an astute observation. If Rocky and his Eridian friends were bell or gong-like in how they produced sound, they would not have neat islands of consonance around which they could craft a familiar harmony. If they were not harmonic emitters they might never come to appreciate integer ratios because it wouldn’t come naturally to them (unless they took the time to build Eridian violins and pianos). Human harmony, by contrast, is naturally imbued with Pythagoras’ ratios because our emitters are 1-dimensional tubes of air.

But the way Weir describes Rocky makes it explicitly clear that Eridians are harmonic instruments. Rocky produces sound by pushing gas past vibrating membranes inside a vocal pipe. We know this can be done at pressure because whales do it too. (And whales are harmonic too, in case you were wondering.) Eridians are mineralized, polyphonic whales. And we also know Eridians emit harmonic overtones because Rocky produces an octave, a major fifth, and a minor seventh!

But Rocky wouldn’t be completely beholden to western harmony. For one, he wouldn’t use 12 tone equal temperament (12-TET) as we do. Though I don’t have time to get into it fully here, 12-TET is the conventional western tuning system. We divide the octave into 12 equal logarithmic steps: 12 semitones. We do not do this for any fundamental physics reason. We can divide the octave arbitrarily. We needed a tuning system that gives us the “natural-sounding” intervals like the fifth and the third that conform to the ratios we discussed. A division into 12 doesn’t hit the ratios perfectly, but it’s close enough for us to not notice the differences. Before we had 12-TET we would play or sing in “just intonation” (mathematically ideal intervals), but these only work in one key, and don’t allow you to modulate to other keys. Because complex music involves moving between keys we needed something that worked in all keys; hence we found a division that sounded close enough to the frequency ratios while working identically in every key. The kicker is – you can divide the octave into more parts to get closer to the mathematically ideal ratios, which is why we have 19-EDO and 31-ET, but these are too complicated. Twelve semitones was the fewest notes available that also gave us reasonable approximations for what a fifth, a fourth, and a third should sound like. And not all humans use 12-TET anyway. For instance, in the middle east you have tunings like Maqam which uses quarter tones, giving musicians access to more notes in the scale and new harmonies. The only western rock band that has ever written a decent album in Maqam is King Gizzard and the Wizard Lizard. This is to say that tunings are definitely arbitrary.

So Rocky and the Eridians would most likely not be using 12-TET tuning like we do. In the book it is mentioned that they get together and do big “thrumming” sessions where they discuss things collectively through harmony. But I am assuming in these cases they are using just intonation and eliminating beating by pitching up or down a few cents. This is what barbershop quartets do. Not to mention, the Eridians have incredible memory and cognitive faculties and the ability to do mental math, so they could probably use 351-TET or whatever if they had to agree on a system. There would be no need for them to vastly simplify and compress the frequency space into a mere 12 semitones as we do.

Birds are a good case study here. We know that birds can detect beating. Certain birds are aware of and prefer the harmonic series. The Hermit Thrush, for instance, specifically chooses notes from the harmonic series (harmonics 3 through 12). A study of Great Tits found that individuals that were most able to precisely sing “in tune” along the harmonic series exhibited better sexual fitness and status. But of course, as with the Eridians, birds are blissfully unaware of the constraints of fixed tuned instruments that led us to develop 12-TET.

So we would still have marginal idiosyncratic differences, but by and large I do think it’s reasonable for Andy Weir to assign the Eridians a shared understanding of harmony. Though harmony seems extremely cultural, it derives ultimately from basic properties of physics. Harmony is not a human invention but a discovery. The octave, the fifth, and the third are not arbitrary conventions but local maxima, places where the physics of vibrating systems produce unusually simple, low-interference patterns. The Eridians would be drawn to these regions for the same underlying reasons we are.

And this is why it feels like a missed opportunity.

Project Hail Mary is a story about building a shared language across an unimaginable biological divide, and Weir does an admirable job of grounding these speculative elements in math and science. Music is one domain in which convergence would be plausible and perhaps inevitable, but Weir only ever hints at it by having Rocky speak in fifths and sevenths. We are never shown why that overlap exists. He gives us the answer without showing the work. In a novel built on first principles, that’s the one place where handwaving feels the least justified and most conspicuous.

It’s certainly been interesting to read about the theoretical virtues of prediction markets from 2015-2020 and then witness them come into being and become a massive cultural phenomenon in 2025/26.

(To quickly establish my bona fides on this, I was waiting for Augur to launch in 2017 and excited when it did go live in 2018. In 2023 I started paying very close attention to Polymarket. I was a big advocate of Polymarket’s triumph over MSM in the 2024 election. I’ve been hopeful about prediction markets for a long time.)

They are certainly useful to me. Prediction markets aren’t necessarily more accurate than other markets, but they can do certain things very efficiently – compress vast arrays of noisy data into a single probability, and provide a real-time informational flow that is otherwise gatekept by governments, pollsters or news organizations. For people following elections or geopolitical events in real time, they are far better than the alternatives. Watching the 2024 election on the real time state-by-state view on Polymarket, it was obvious to me that Trump was going to win hours before any major news organization made a call. It’s just a superior informational experience.

However, the full promise of prediction markets has not been realized yet. The early believers envisioned a world in which:

• Corporate entities could financially hedge outcomes that mattered to them via prediction markets

• Markets could actually guide policy, through mechanisms like Futarchy

• Private information could be surfaced to the general public through the market mechanism, creating a kind of informational surplus

Neither the first nor the second thing are meaningfully real yet, and the third thing – arguably the greatest promise of prediction markets – is inherently paradoxical and coexists uneasily with our established legal framework and prudent market design. Mostly, prediction markets are used today as a regulatory arbitrage to get around restrictions on sports betting, and a tool for retail to bet on pop culture and politics. (I am not the first to express these misgivings – see Vitalik and Agustin Lebron.)1

Don’t get me wrong. I am fascinated by prediction markets. I have been waiting for them to exist ever since I read about Truthcoin and Augur a decade ago. I now consume Polymarket data every day and consider it an indispensable part of my media diet. I’m just not convinced they are actually going to work in the way early advocates intended.

There are two main structural problems that I see with prediction markets:

1. They aren’t useful for hedging, and may never be, due to market fragmentation and a lack of natural buyers on both sides of the trade

2. Part of the value of prediction markets lies in the surfacing of insider information, which is and will likely remain illegal, and will cause trader disillusionment with time

Prediction markets have other contingent or non-structural problems, which can indeed be solved. For instance, Polymarket relies on easily-manipulable resolution oracles provided by UMA. They need to get rid of this. Both Polymarket and Kalshi are exposed to legal and political risk in the US. But I’m more interested in the structural factors.

Prediction markets aren’t good for hedging

I’m hardly the first person to point this out, but it bears repeating.

Crypto people sometimes just assume that if you put the market structure in place, a liquid two-sided market will magically appear. This is a reasonable delusion to hold, because crypto markets did appear out of thin air, and crypto involves the trading of some of the most worthless tokens ever devised. But real, sustained markets need a fundamental reason to exist.

Take derivatives. Derivatives don’t exist “because people want to bet on the price of some underlying commodity”. They exist because there is a massive underlying market and someone has inventory risk in that market, and someone else is willing to absorb it for a price.

More concretely, take wheat derivatives, probably the oldest market in the world (dating back to Mesopotamia in 2000 BC). These are good markets because some entities are naturally long and some entities are naturally short. Producers like farmers are naturally long, and want to hedge. They know they will produce a certain amount of wheat by a certain date, and they might want to hedge to lock in a guaranteed margin. On the other side, there are entities like cereal manufacturers and livestock producers that are naturally short – they know what they have to buy for the next few quarters, and might want to lock in a fixed price. You can find natural hedgers on both sides for a variety of derivative markets:

• Buyers of oil shorts: producers, shale operators

• Buyers of oil longs: airlines, shipping companies, refineries, chemical manufacturers

• Buyers of FX shorts: importers, corporations with offshore liabilities, governments with foreign FX debt

• Buyers of FX longs: exporters, multinationals with foreign revenue, foreign investors in local assets

• Buyers of interest rate shorts: corporations with floating rate debt, mortgage lenders, leveraged borrowers (they lose if rates rise)

• Buyers of interest rate longs: pension funds, insurance companies (they lose if rates fall)

These derivative markets exist because these economic actors have real, offsetting exposures. Producers have inventory risk. Predictable consumers have spot risk.

Now let’s consider prediction markets.

You can see in theory why they’d be useful for hedging. Many economic actors have exposures to elections. The long side of the Trump trade was something like energy companies, defense, crypto, AI, rare earths, private prisons, and so on. Prediction markets can be as specific as you like. A biotech company might want to hedge out some of their exposure to a drug going through FDA trials by shorting it on a prediction market. Multinationals might want to bet on granular markets covering tariffs or war or other political shocks. Apple or TSMC might want to bet on an invasion of Taiwan.

But in practice, prediction markets aren’t good ways to hedge.

The first reason why is that the more useful the market is to the hedger, the less liquid it is likely to be. The big obvious problem with PMs is fragmentation. Markets are often fragmented across a range of maturities (USA to invade Iran by Date X, Date Y, etc etc) or formulations “USA to Strike Iran…” “USA to invade Iran…” “Regime change in Iran”.

A corporate hedger probably doesn’t care all that much about “Trump wins” or “Pro-business environment in 2026” in the general sense. They care about specific things:

• Tariff policy concerning their industry

• FDA approvals for their specific drugs

• The FTC approving a specific merger

• Corporate tax policy in a specific state

And so on. But the more specialized and bespoke the market, the less likely there is to be a general interest in betting on it, among the speculator population. A lot of people wanted to place bets on the 2024 election. But not a lot of people want to take the other side of Trump wins -> FDA adopts a more permissive stance -> drug xyz gets approved or any other such unique permutation. So almost by definition, the markets that hedgers care most about are bound to be more bespoke and hence less interesting to traders in general – and thus less liquid.

Commodity derivatives don’t have this problem. If you are a farmer and anxious about locking in your returns for the season, you can sell contracts corresponding to the exact number of units that you expect to produce. But a corporate hedger trying to manage their exposure to some political development needs to pinpoint it exactly, rather than taking a vague bet on a broader but more liquid market.

In technical terms, this is basis risk – the idea that your hedge may not correlate perfectly with your exposure. A wheat derivative has minuscule real basis risk – if you expect to harvest 10,000 bushels and you sell 10,000 futures, you are tightly hedged to the underlying. If you are a vaccine manufacturer, and you want to hedge the risk of the FDA shutting off vaccine programs, you might want to bet on that specific market, but instead be forced to buy shares of TrumpWin – something that imperfectly correlates to your exposure. So there seems to be an inverse relationship between the liquidity and generality of a market, and its specific utility in hedging an event for the seller.

In addition to this problem, for the hedge to work at all, you need someone who is willing to long the market that the corporate wants to sell in size. Who are the traders wanting to long “merger between company A and B is consummated” or “tariffs on Korean cosmetics lifted by July 2027”?

This brings us to our second problem. For the “corporate hedger” concept to work well, you need an army of speculative noise traders to effectively “subsidize” these shorts by taking the other side of the trade. But these hedge markets are unbalanced by their very nature.

Imagine the case of the biotech firm wanting to hedge their exposure to a drug approval. Consider the status quo. The company is naturally long approval. The employees, management, and shareholders may want to reduce their risk by buying “No” shares on a prediction market. So there’s strong demand on the short side. Now where does the offsetting long demand come from? Everyone who cares about the drug is presumably long via the stock. So you are left with unaffiliated traders who want to bet on approval but for some reason don’t want to hold the stock. This is an unbalanced market.

Now consider a solar manufacturer which may want to hedge an adverse Supreme Court decision striking down solar subsidies. They might go long YES on that adverse judgment. But who is on the other side of that? Someone that is naturally long non-renewables presumably, but do they really care about the Supreme Court decision? This is a case where a catalyst affects one side of the market a lot more than the other. Asymmetries like that don’t lead to good markets.

Now a smart reader might think to themselves, “well, insurance is asymmetric. No one wants to be naturally long “good weather in Florida”, and yet there are companies that will sell you hurricane insurance. So clearly, asymmetry alone isn’t enough to eliminate the usefulness of a market.” And indeed, this is true. There are all kinds of hedges available where the seller simply wants to collect the premium.

The difference is that insurance markets are written on losses that are objectively measurable and tightly specified. A homeowner insures a defined asset for a defined value against a defined risk. A CDS contract references a specific bond with a legally defined credit event. The payout maps directly to the economic loss. The ones writing the options or selling the insurance have large balance sheets and diversify the risk across many independent exposures. By contrast, a prediction market on a Supreme Court decision or regulatory change is a coarse, binary contract written on a political event whose economic consequences are heterogeneous and path dependent. The solar manufacturer does not suffer a $100 million loss simply because the court rules one way; the impact depends on implementation, legislative response, further rulings, and so on. The problem is not asymmetry per se, but the basis risk (the drift in relationship between the exposure and the hedge value).

One obvious conclusion here is that useful corporate hedges can be viable and already do exist – but these are already wrapped inside the form factor of equity options, commodity derivatives, insurance or CDS. The promise of prediction markets is that organically, markets of sufficient liquidity and breadth might develop naturally such that corporates could come to rely on them for otherwise bespoke hedges. But this seems unrealistic. The markets that seem to appeal to speculators have virtually nothing to do with the markets that hedgers want to buy. And these problems seem structural, not contingent.

Another way of putting this is: why would you expect a retail trader to be better at or more willing to write an insurance policy than a professional actuary with a large balance sheet behind him? And if your answer is “that retail trader might write a cheaper insurance policy,” then the market cannot last – as retail bankrolls will go to 0 in time.

Insider trading is both the point and the death of prediction markets

There are three types of entities active in prediction markets. As above, there are some corporate hedgers. These are the best entities to have because they are “natural buyers” of the product. Such is their motivation to trade, they might be willing to cross the book and buy regardless of market conditions. For PMs to work in the long term, you need to attract some of these, otherwise the markets will die out.

Then you have noise traders. These are the vast majority of users on prediction markets. They are trading for entertainment value. If they weren’t trading on PMs they would be trading 0DTE options, Fanduel/Draftkings, or trading memecoins. These are the people Kalshi and Polymarket try to target with their ad campaigns. Noise traders generally lose their bankroll over time (both through fees and because they are trading against informed flow).

Lastly, you have informed flow. Entities that are professional traders and have specific knowledge of a certain niche, or have literal inside information within their organization that they are monetizing by trading against noise traders. (I’ll ignore arbitrageurs and market markets for now).

The critical problem for prediction markets is this:

The social value of prediction markets derives from financially incentivizing insiders to divulge confidential information, but this collapses noise trader confidence in the market over time.

This isn’t some big secret. Prediction market theorists like Robin Hanson2 have long explained that there’s a tradeoff between PM utility and insider trading prohibitions. In 2024, he told Decrypt:

If the point of [prediction] markets is to get accurate information on the prices, then you definitely want to allow insiders to trade, even if that discourages other people from betting because that makes the prices more accurate. And that’s the priority.

This is actually a perfectly coherent viewpoint, but the major prediction markets don’t acknowledge it (for obvious reasons). Kalshi bans trading on insider knowledge in their ToS. Polymarket doesn’t explicitly ban insider trading, but has a catch-all prohibition against violating laws generally.

(A quick note here: I’m using insider trading to mean “misappropriating organizational information that is not owned by you to obtain a financial return”, rather than the more specific, securities-focused definition. In practice, if you work in government and make money by selling military secrets (to a prediction market), you have broken the law, but you haven’t engaged in “insider trading” in the sense of the SEC and public securities markets.)

People won’t trade in markets they perceive as unfair

The core tension of these markets is that they are informationally useful to the general public if they can actually persuade insiders to reveal corporate or governmental secrets for compensation. That way, the public gets knowledge that may otherwise never have surfaced. If prediction markets can consistently surface information that is legally prohibited in comparable securities markets, they might come to be seen as more informationally reliable.

The problem is that this quality trades off against market integrity. Securities regulators go to great lengths to ban trading on insider information in public markets, because non-insiders wouldn’t risk trading in those markets if they thought they were up against insiders all the time. The social utility of the securities markets would collapse: they would become less liquid and the cost of capital for public firms would rise. Similarly, sports leagues try and uphold the integrity of the game by banning athletes from betting on their own games (if they didn’t, fans would think it was rigged, and ticket sales would drop).

If it becomes known that prediction markets are rife with insiders monetizing proprietary information, the general public will become disillusioned with them and stop trading on them (or limit their trading only to markets that are largely immune to insiders, like sports, or the weather).

Already, prediction markets are developing a reputation for being a dumping ground for insider info. Many people don’t realize that it’s generally illegal to misappropriate organizational knowledge for personal gain even outside of a securities context, so there are many examples of this, and certainly many more to come this year. Unusual activity suggestive of insider trading has been spotted in markets like:

• The 2025 Nobel Peace Prize

• Google’s 2025 Year in Search Rankings

• Maduro’s capture in early 2026

• Israel’s 2024 strikes on Iran

Of course, it’s possible that these bets were made by smart outsiders rather than insiders. There’s nothing wrong with looking at OSINT flight data and correctly predicting a US war with Iran. There is something morally and legally wrong with a military staffer receiving a briefing about an imminent attack and trading on it. No one knows for sure, but the fact remains: the incentive is there, and because Polymarket in particular is on chain and pseudonymous, it’s possible to (sort of) cover your tracks.

If prediction markets develop a reputation as an “anything goes” zone to monetize insider information – and they seem to be going that direction – smart non-insider traders will become disillusioned and pare back their trading activity. It’s just not worth trading if the guy on the other side of your trade knows something you don’t. If you can’t spot the sucker at the table…

Informed flow will harvest noise traders until they go bankrupt

Markets have a defined ecology to them.3 They are composed of different types of entities. Let’s return to our taxonomy. We have the hedgers, the noise traders, and the informed flow.

The unspoken feedback loop that prediction markets are relying on is something like the following:

If we can attract enough noise traders, informed flow will emerge to harvest them, creating markets of high informational quality, which will in turn further attract traders. Over time, the markets will become sufficiently liquid that natural buyers (corporate hedgers) will find them useful, creating a sustainable market.

This explains why Polymarket and Kalshi advertise to the general public so aggressively. They presumably realize that they need to get a critical mass of noise traders, who attract the informed traders, who attract the hedgers. Noise traders are the plankton of the prediction market system. The whole ecosystem relies on them. The risk is that they get farmed by the informed traders too quickly or lose faith in the fairness of the market. If they go, the whole ecosystem collapses.

Consider a couple different markets. Online poker in around 2005 was a magical place. I like many others now in crypto got my start there (and my first taste of an exchange insolvency in 2011). The sector was awash with unsophisticated recreational players and they were happily farmed by the pros. After the DoJ shut down easy access to the main online poker sites on Black Friday in 2011, it became more challenging for US users to play online.4 The big influx of cash from US retail stopped, and the games turned into grinders playing against other grinders. Sophisticated bots emerged. Any remaining noise traders were relentlessly farmed by the bots and the pros, and their bankrolls went to 0. The space basically disappeared. The reason was that there was no “natural buyer” once the easy money retail guys went BK or were shut out by regulators.

Now think about the memecoin market.

The second big memecoin era was in 2023-2024, defined by retail participation. Fortunes were made and pump.fun made people feel like they were playing a relatively fair game. Pump standardized the launch process. It became trivial for anyone to launch a coin. No presale, private team allocation, no whitelist, etc. Price set by a transparent bonding curve. The game was simply predicting what memes would hit and which wouldn’t.

However, all was not well under the hood. Pump fun memecoins only seemed fair. They weren’t. Over time, sniper bots and MEV emerged. More sophisticated users were able to farm the noise traders who were under the impression that they were playing a fair game. Swiftly rugged influencer coins in 2023 and 2024 created a state of exhaustion. Devs began sniping their own launches. They created the illusion of decentralized ownership by splitting their accounts into multiple wallets. Telegram and Discord groups created layers of coordinated pumps designed to ensnare onlookers.

Memecoins died because noise traders got farmed by the pros, and they lost confidence in the integrity of the market. Major debacles like the Milei/Libra and Melania coin launches revealed to the world that the memecoin market had been warped from something light-hearted and playful to an industrialized extraction scheme run by grifters like Hayden Davis. In addition to being out of cash, retail traders suffered a total confidence collapse. There of course are no natural buyers of memecoins, so once noise traders leave, the game is over.

Prediction markets have more social value than memecoins or online poker. That much is indisputable. But they face the same risks. Absent any permanent natural buyers – and I’m just not convinced the hedgers will ever find a use for these markets – it’s going to be a matter of informed flow farming noise traders. Kalshi and Polymarket need to grow their userbase faster than the noise traders lose money to the smart money.

For now the strategy is working, but that’s because the prediction markets have found a regulatory loophole: they can offer sports gambling (for the moment) without facing state-by-state restrictions that ordinary bookies have to deal with. (There’s also a more complex tax arbitrage reason.) From the dashboards I could find, it looks like sports composes 90% of Kalshi volume, and around 40% of Polymarket volume (followed by crypto and politics).

Sports betting is keeping prediction markets alive. They could build sustainable businesses simply by cannibalizing existing bookmakers under a new more permissive regulatory model. Sports is less exposed to trader disillusionment from insider trading, since sports outcomes are more stochastic and less manipulable.

Outside of sports though, serious risk remains that insider trading scandals (and convictions, like that of the Israeli reservist) will give retail traders the impression that markets are rigged, causing them to desert the platforms. I predict that this year, a flurry of insider trading episodes will convince the platforms to dramatically beef up market surveillance, and cause Polymarket in particular to move away from the pseudonymous model. Though I don’t think prediction markets will ever realize the dreams of Robin Hanson and the rationalists, they might still earn a tidy living with sports and cultural markets. I just don’t think they will ever be much more than that.

That an influence-weighted majority of Bitcoin devs have longer timelines on quantum or dismiss the threat entirely should be obvious to anyone that has paid attention to the discussion, but let’s evaluate Matt’s claim concretely.

I knew this to be true already, having followed the discussions, but I was actually surprised when I did this exercise at how completely indifferent the most important developers were.

A quick note on methodology: if you aren’t aware, who controls the levers of power in Bitcoin development is kept deliberately opaque. When Craig Wright was harassing Bitcoin devs, some devs “stepped down” or “retired” while still remaining contributors to avoid his legal machinations. The list of Core Maintainers – the people that actually push updates to Bitcoin Core – is not a list of “most important Bitcoiners”. It’s just people that have been entrusted with a bureaucratic task of pushing updates. Since Gavin Andresen, they deliberately disclaim responsibility and ownership over Bitcoin. The Maintainers want to make it absolutely clear that they are not “in charge” but rather a nebulous consensus of stakeholders is. They will often claim to represent “the will of the people” in some vague Rousseauian sense.

Of course, they do not go around asking Bitcoiners worldwide whether they agree with a change. The actual way it works is, if you get a half dozen of the most influential developers to agree that a change is important, you might be able to get it through. This is very hard and unusual, and as a result, change almost never occurs. Bitcoin has only made two updates in the last decade. So the way it is structured is that you need virtually everyone who is perceived as important to agree on something. As you might imagine, this leads to gridlock and inaction. That’s been fine so far, but now that Bitcoin actually has to make fairly drastic changes in the face of an uncertain but accelerating threat, it’s precisely the wrong governance structure. Bitcoin has never actually faced an existential crisis in the modern era; the last time there were actual existential issues (2013 and 2010), the governance was still sufficiently centralized that a quick fix could be deployed.

So even though this is heretical, and Bitcoin developers will surely be upset that I’m exposing their deliberately structureless governance structure, I’ll take a stab at determining which developers have the most perceived authority.

(A quick note on my credentials: I’ve been following Bitcoin professionally for a decade, I wrote my master’s thesis [PDF] on Bitcoin governance, I have (through Castle Island) provided financial support bitcoin dev organizations, I have given many talks at Bitcoin conferences, I have met and had discussions with many of the developers named here personally. No one has Bitcoin governance truly mapped out, but I have a better perspective than most.)

I am aware that people will bristle at my ranking of Bitcoin developers by perceived influence, but it has to be done for the purpose of this exercise. We need to know who matters, so we can assess whether the most important Bitcoin devs are prioritizing quantum risk. You may pick holes in my ranking or suggest an alternative, but the only thing that matters is that I correctly identify the main gatekeepers.

The reason this is hard to do is because, again, Bitcoin devs keep the levers of power deliberately opaque from the public. I have been focused on this for a very long time so I have a good sense of who matters, but this is indeed a very hard exercise, and that’s because the developers themselves want it that way.

The most important Bitcoin developers/founders, in my opinion are Pieter Wuille (number 1 by far), Jonas Nick, Anthony Towns, Adam Back, Alex Morcos, Marco Falke, and Andrew Poelstra, Mara van der Laan, and Peter Todd. Their affiliations are listed.

Pieter Wuille was the coauthor of SegWit and the primary author of Taproot, the only two major changes to Bitcoin in the last decade. He created libsecp256k1. He wrote the Schnorr signature specification. He coauthored BIP9. He’s the most important Bitcoin developer as far as major changes are concerned, by far. Mara van der Laan (formerly Wlad) was the lead maintainer of Bitcoin Core between 2014 and 2021, stepping down officially in 2023, but she has apparently un-retired and is back in some meaningful capacity. Michael Ford is the longest-tenured active maintainer at Core and is quietly influential, even if he does not author BIPs. Andrew Poelstra is the least visible of all of the “very high influence” developers, but he is enormously influential – a developer’s developer, a Steely Dan of sorts. He was a co-creator of Taproot and the Schnorr implementation among many other huge contributions to crypto generally.

Morcos runs an important developer organization, Chaincode. Michael Ford is the most prolific current Core Maintainer. Adam Back was cited in the white paper, co-invented Hashcash, and runs Blockstream. Marco Falke was an extremely active reviewer in Core although he stepped back from being a key-holding Maintainer in 2023. Jonas Nick was one of the principal authors of Taproot. Peter Todd is a longtime and multifaceted Bitcoiner that invented RBF among many other things. He is known for adversarial thinking and blocking unsafe changes. I would have included LukeDash but his influenced has waned somewhat, lately.

Everyone named here has considerable soft power. Collectively, they determine whether an update gets considered and eventually implemented. If you can’t convince basically everyone on this list of the importance of your update, it won’t happen. These are the people we refer to when we talk about the High Priests of Bitcoin.1

The other developers and thinkers in the lower part of the list are important, without a doubt – I mean we’re talking about a few dozen people stewarding a trillion dollar asset, so I don’t want to diminish their contributions at all – but they aren’t the gatekeepers, in my opinion. However, their views still matter a tremendous amount, so I’ve catalogued them here.

What the most important Bitcoin developers actually think about quantum risk

Let’s start with the high priests.

Pieter Wuille, Feb 2025 (source)

I certainly agree there is no urgency right now, but if (and only if) cryptography-breaking QCs become a reality, the ecosystem has no choice but disabling the spending of coins through schemes that become broken, and needs to have done so before such a machine exists.

April 2025 (source)

I’m unconvinced about the practicality [of Ethan Heilman’s proposal], but I’m happy to see thinking and discussion in this area.”

July 2025 (source)

I believe the main quantum-related threat to bitcoin, at least in the medium term, is not the actual materialization of a cryptographically-relevant quantum computer (CRQC), but the belief whether one may exist soon after. I don’t mean to imply that such a machine won’t ever appear, but I believe the fear that one may exist will likely have a more meaningful impact, and come much earlier. To be clear, I am not advocating for any specific cause of action here. Not on BIPs, timelines, approach, or even whether something should be done at all.

Pieter participates in discussions on quantum risk, but does not believe there is any urgency. To him, the problem is people selling because they are worried about it. (Which is happening, by the way.)

Mara Van Der Laan, Jun 2015 (Source)

Sure, most extreme: if secp256k1 or SHA256 starts to show chinks in its armor, or practical quantum computing is getting powerful enough to factor discrete logarithms of those sizes, I don’t doubt everyone would go along with a proposal to add new crypto algos.

Mara was a longtime Maintainer of Bitcoin Core, later retired, now unretired. She has addressed quantum in her historical posts but hasn’t indicated whether there is a risk of not.

Peter Todd, July 2025 (source)

For all the claims of progress on quantum computing hardware, the fact still remains that no-one is even close to demonstrating cryptographic-relevant quantum computing capabilities and the actual cryptographic-relevant capabilities of real hardware are laughable. It’s still an unknown whether or not they are physically possible, and outside of the part of the physics community that would like to sell you a quantum computer - or research developing one - they’re widely beleived to be not physical.

Adam Back, November 2025 (Source)

Probably not for 20-40 years, if then. And there are quantum secure signatures, NIST standardized SLH-DSA last year. Bitcoin can add over time, as the evaluation continues and be quantum ready, long before cryptographically relevant quantum computers arrive.

Though Adam Back leads an organization where post-quantum research occurs, his personal assessment of the risk is that we are still decades away from having anything to worry about. He has been explicitly clear about this and derided my concerns as FUD. In my opinion, this discredits the research being published under him. I don’t see how you can use Blockstream research to claim that developers are worried if the CEO is saying things like this.

Gloria Zhao, Aug 2024 (Source)

I think people sometimes worry about quantum computers, and I think that concern is a bit more interesting [than worrying about AI attacks on Bitcoin], on the timescale of 30 to 50 years.

Greg Maxwell, Dec 2025

Greg has discussed post-quantum signatures on a couple exchanges but has made no mention of his assessment of the risk. (I also reviewed his entire Reddit history.) This is surprising because he is normally extremely opinionated.

Note 04/02/26: Greg has informed me that he is retired and is no longer involved in Bitcoin protocol decisions or upgrades.

Jonas Nick, Feb 2025 (source)

Thanks for your work on BIP 360. I think now is a good time to develop and discuss concrete PQ proposals.

Happily, Jonas is one of the most active PQ-researchers in the Bitcoin community. He published a paper on hash-based post-quantum signatures.

Anthony Towns did discuss quantum attacks back in 2018 but did not make any assessment of the risk.

Andrew Poelstra, March 2021 (source)

Andrew, an influential researcher at Blockstream, has not publicly commented on the risk, though he did say in 2021 that he was not concerned about Taproot adding quantum vulnerability to Bitcoin.

Alex Morcos, Michael Ford, and Marco Falke have not, as far as I can tell, publicly mentioned quantum risk at all, so I’m assuming they are unconcerned. (I know quantum research is happening under Morcos, but he hasn’t said anything.) They are welcome to email or DM and correct the record if they think I am mischaracterizing their views.

To summarize, a majority of the most influential Bitcoin leaders have never even acknowledged quantum risk. Those who do acknowledge it, with the exception of Jonas Nick, view it as theoretical, distant, or non-actionable. Peter Todd and Adam Back explicitly deny the risk. Most Core Maintainers have never even acknowledged quantum risk at all. And Pieter Wuille, the number one most important developer, acknowledges the problem, engages in discussions, but explicitly says it’s not a risk or priority today.

As a reminder, without these people on board, your update to Bitcoin will fail.

The current verdict is simply that the most influential Bitcoin devs do not care.

What the other Bitcoin developers think

Luke Dashjr, Dec 2025 (source)

Quantum isn’t a real threat. Bitcoin has much bigger problems to address.

Luke explicitly does not consider it a threat. He is historically one of the more influential and active Bitcoin developers, though he is at odds with Core now.

Matt Corallo, March 2025 (source)

(In response to Jameson’s “Against Allowing Quantum Recovery of Bitcoin”) “I think this is a strong motivation to do “simple PQC” today - while we don’t need to decide on the tough question of seizing non-PQC coins today, we want to have the option to do so in the future. In order for that option to be practical, wallets need to be embedding PQC public keys in their outputs probably at least a decade before the seizure occurs, with any additional time giving us an important safety margin. Thus it seems like time we add the simplest form of PQC we can - a trivial P_HASHBASEDSIG (probably SPHINCS+) to tapscript to enable wallets to have hidden PQC keys (including multisig) in their taptrees.

Matt Corallo does care. He does think there is a risk. But he explicitly denies my point that the most important developers do not care. He has labeled my criticisms “FUD”. Matt may be privy to some secret knowledge I do not possess. Maybe in private, the devs are tearing their hair out in fear of quantum. But in public, they are acting like there is no risk whatsoever.

Robin Linus, July 2025 (source)

Dogs are more scary than quantum computers

Robin is the author of BitVM and a respected researcher in the space.

Mark Erhardt (Murch), Nov 2025 (source)

Of all the things that might keep me awake at night, quantum computers are not one of them. Most of the ppl thinking it’s around the corner are ones trying to raise more funds to burn on their research. Please feel free to make fun of me if we see a CRQC in less than 20 years.

Antoine Poinsot, March 2025 (source)

(In reply to my claim that influential BTC devs are understating the threat)

I think the exaggeration undermines your (valid) point about uncertainty.

It also exacerbates what i think is the real material threat for the upcoming decade, which is the perception of an imminent existential quantum threat by important stakeholders.

Olaoluwa Osuntokun (roasbeef), Jul 2025 (source)

Laolu gave a talk on PQ hash-based signatures at the Presidio Bitcoin Quantum Bitcoin Summit. He kept it strictly technical and did not make an assessment of the risk.

Tadge Dryja, July 2025 (source)

(in response to Jameson’s post-quantum proposal): “Sure, there can be risks from CRQCs. But this proposal would go the other direction, disabling important functionality and even destroying coins preemptively, in anticipation of something that may never happen.

Tim Ruffing, July 2025 (source)

Tim published a paper entitled “The Post-Quantum Security of Bitcoin’s Taproot as a Commitment Scheme,” though he hasn’t commented directly on the risk, as far as I can tell. To his credit, he has been at it for a long time, even publishing a paper on post-quantum confidential transactions in 2017.

Gregory Sanders (instagibbs), Dec 2025 (source)

(In a reply to Scott Aaronson’s comments on rising quantum risk) Proof will be in the pudding and I’ll change my tune. Until then skepticism reigns.

Jeremy Rubin, July 2021 (source)

Fun Fact: Satoshi removed post quantum security from bitcoin in a 2010 hardfork.

Good News: Bitcoin can be made quantum secure *again* by reenabling OP_CAT or similar.

Jeremy has been concerned about quantum longer than most.

Amiti Uttarwar, Jan 2026 (source)

I think the conversation of the threat of quantum is really interesting. Several people who I consider smart, who have been engaged in this, think that quantum is an existential threat to Bitcoin

Augustin Cruz, Feb 2025

In 2025, Augustin published QRAMP, a quantum migration proposal, which has since been deleted.

Mikhail Kudinov, 2025

Mikhail co-authored Hash-based Signature Schemes for Bitcoin with Jonas Nick and is primarily focused on PQ crypto as his research agenda, so it’s fair to say he is concerned.

Ethan Heilman, Feb 2025 (source)

I strongly believe Bitcoin will need to move to PQ signatures in the near future.

Ethan has worked on several post-quantum proposals for Bitcoin, and has recently signed on to BIP360. He is one of the strongest advocates for a post-quantum transition.

Jameson Lopp, Jul 2025 (Source)

We seek to secure the value of the UTXO set and minimize incentives for quantum attacks. […] Never before has Bitcoin faced an existential threat to its cryptographic primitives. A successful quantum attack on Bitcoin would result in significant economic disruption and damage across the entire ecosystem. […] NIST ratified three production-grade PQ signature schemes in 2024; some academic road-maps now estimate a cryptographically-relevant quantum computer as early as 2027-2030

Jameson has also been extremely active in sounding the alarm on quantum, both in terms of formal migration proposals and opening the discussion around the fate of Satoshi’s coins. Though he is not a core developer per se, he has been one of the most strident advocates for a transition.

Jonas Schnelli, Dec 2025

(Responding to a tweet saying “quantum computers aren’t coming tomorrow”), “For everyone predicting quantum doom, read this” (Source)

Jonas is an influential former Core Maintainer, now retired from Bitcoin work. He has downplayed the risk.

Anthony Milton

Anthony is a low-profile but very active researcher in the Bitcoin post-quantum space. He coauthored Chaincode’s important Bitcoin and Quantum Computing report and runs PQ-Bitcoin.org where he advocates for Bitcoin to upgrade.

Clara Shikhelman

Clara is head of research at Chaincode and coauthored Chaincode’s Quantum report with Anthony Milton and also runs PQ-Bitcoin with him.

Hunter Beast, Dec 2025 (Source)

Industry roadmaps—led by companies including IBM, Google, Microsoft, Amazon, and Intel—suggest that quantum computers may be able to decrypt ECDSA cryptography used for Bitcoin’s public/private key encryption in as little as 2-5 years.

Hunter is the lead researcher behind BIP360, the only named BIP that aims to facilitate a quantum transition.

The following influential figures in Bitcoin have expressed no recent views on quantum risk:

• Satoshi (last discussed in 2010)

• Gavin Andresen (last discussed in 2010)

• Hal Finney

• Mara Van der Laan (last discussed in 2015)

• Marco Falke

• Michael Ford (fanquake)

• Hennadii Stepanov (hebasto)

• Ryan Yanofsky (ryanofsky)

• TheCharlatan

• Alex Morcos

• Ava Chow (last discussed in 2019)

• Suhas Daftuar

• Neha Narula

• Samuel Dobson (meshcollider)

• Rusty Russell

• Gleb Naumenko

• Cory Fields (cfields)

So, what do Bitcoin developers think about quantum risk overall?

Based on my initial table of Bitcoin developers ranked (roughly) by influence, and the quotes I have assembled, we can now determine how much Bitcoin developers care about quantum risk, weighted by their influence.

Unfortunately the top tier, most important devs who determine whether updates are made or not are virtually all in agreement that there is no imminent threat, with Jonas Nick being the sole exception. Pieter Wuille, the literal number one most important dev, has discussed quantum on many occasions but does not think there is a present risk.

In the moderate influence camp, you have an array of different views. You have some quantum-focused researchers like Hunter Beast, Jameson Lopp, Clara Shikhelman, Anthony Milton, Ethan Heilman, Mikhail Kudinov, Augustin Cruz, Laolu, and Tim Ruffing.

On the other hand, you have powerful Core Maintainers who are silent on the threat, or well-known developers like LukeDash, Greg Sanders, Jonas Shnelli, or Tadge who downplay the risk.

Though the work being carried out by researchers like Hunter Beast, Milton, Jonas Nick, and Lopp is essential, it isn’t getting traction among the most elite gatekeeping developers. Don’t believe me? Just look at the reaction on the mailing list to Hunter’s announcement of a major update to BIP360. One reply. A roadmap Hunter laid out was also met with polite replies but no action. Until the most influential devs sign on to one of these proposals, nothing will happen.

Summing up

If you’ve read this far, it should be pretty obvious to you. Among the developers who actually matter for protocol changes, quantum is viewed as theoretical, distant, or speculative, not as a live engineering problem. Peter Todd, Adam Back, and Luke Dash explicitly deny feasibility or relevance. Pieter Wuille, Gloria Zhao, and Adam Back frame quantum as a 30-50 year concern at best. Van der Laan, Poelstra, Maxwell, Towns, Morcos, Falke, and others have either never commented or refuse to engage publicly. Only Jonas Nick has expressed concern in the most important group.

Serious concern does exist below the power line. Genuinely great researchers like Heilman, Shikhelman, and Milton are working on this, but they aren’t influential with Core. Lopp is making intelligent noise about it too, which I genuinely appreciate. Hunter Beast and his team are the most active in terms of putting serious effort into a named BIP to solve one aspect of the problem (Taproot signatures’ quantum vulnerability), but BIP360 has been met with total apathy from the tastemakers so far.

Don’t let Adam Back or Matt Corallo gaslight you. There is a pathological lack of concern among the most influential Bitcoin developers. There are a handful of bright spots, but the quantum transition is clearly not a major priority for Core and the major organizations that sponsor development.

Update: Made revisions. Thanks to those who gave feedback.

Update 2 (02/06/26): After the publication of this article, Gloria Zhao stepped down as a maintainer. I’ve kept her views in the article since they mattered at the time of publication.

Update 3 (04/02/26): I received a request from Greg Maxwell to update this article and acknowledge that he has been retired from active Bitcoin Core discussion. I have updated it accordingly.

This has come at the expense of what I call “creator-follower linkage”, which means the following properties:

• Creators being able to consistently reach their audience

• Consumers being able to reliably hear from creators they want to follow

• Permitting the existence of opt-in filter bubbles like Crypto Twitter

In other words, we are witnessing the triumph of “X globalization” over “X as a collection of individual niches”. Even Elon has noticed this with dismay. Elon is a fan and a user of X after all. Elon the X user is in conflict with Elon the X owner.

The important thing to understand is that you can’t serve two masters. Either creators and users are tightly linked, or the platform algorithmically serves users an array of compelling content. You can’t have both, and this is why X feels like it’s achieving neither right now.

How this happened

This transition has been effectuated in a few specific ways. First, leadership made specific UX choices, like defaulting users into the For You as opposed to the Following page. Even within Following, users are generally defaulted into Popular rather than Recent sort. So as a user, to get back to an ordinary chronological timeline, you have to consciously beat two different dark patterns, every time you log in. (Footnote: I’m aware that in some cases, selecting Following and Recent “sticks” and you don’t have to re-select it every time you open the app or the tab. But lately I’ve noticed that every new session defaults you to For You. I actually installed an extension to disable this on desktop.)

For You presents you with an AI-curated feed of stuff Grok thinks you will like, oftentimes posted by people you don’t follow. I specifically avoid For You because it tends to be content that sucks you in, like culture war content, excessively partisan takes, or clips of violence or disorder. (Footnote: obviously I’m aware that I built my own algo brick by brick, and my FYP looks very different from that of a socialist artist living in Seattle)

Because I use X for work (monitoring and participating in Crypto Twitter), I actually don’t want to spend excessive amounts of time on the platform engaging in pointless arguments, so For You is actually contrary to my goals.

But it definitely has the desired effect even at the micro level – increasing user time and attention.

The other way in which X has steered the platform is through deliberate changes to the algorithm. They recently open sourced parts of it allowing us to better understand their design choices. Many of these things we had already intuited, but it was helpful to concretely see what they are trying to do with the new algorithm. The way it works is as follows:

• Early on, your posts are shown to a fraction of your followers and a sample of non-followers

• If the post performs with those cohorts, it goes to more of your followers and more out of network users

• If it keeps doing well, it gets onto For You pages and can go potentially megaviral (100k favs, 1m impressions, etc)

This means that instead of getting predictable reach, most of your posts die in utero, but each one has a small chance to go super big. Of course, this isn’t what creators want. I personally want to consistently reach my own followers, and no one else. They matter to me, and my content is crafted for them specifically. I don’t really care about going megaviral (even though many of my posts do), because the normie audience isn’t what I’m after, and they don’t convert to in-niche followers. So for me as a creator, I would much rather predictably reach my own cohort rather than roll the dice and have a 1/50 chance of getting 1m+ impressions among the normie crowd.

This is a bad outcome, arguably, for everyone. Creators are incentivized to craft content that plays well to a normie audience, rather than their traditional bespoke niche. Performing strongly within your niche doesn’t seem to matter as much anymore, and it seems to be the blessing of the randomly selected out of sample group that matters.

The beauty of X is the fact that it was a loose collection of filter bubbles, and you could get extremely high quality discussion within different cohorts, whether political, technical, or cultural. Creators could only focus on a specific niche (like me with CT) and users within those niches would be reliably served content they wanted to see. Now creators are incentivized (both financially and with impressions) to normify their content and forsake their niches. Since you aren’t rewarded for building a big audience any more, some creators are simply leaving the platform and opting to build more reliable audiences on Substack, where they can actually get in front of their followers’ eyeballs. The de-filter-bubble-ization of X has effectively killed off many extremely popular niches, like CT. Someone who previously came here to learn only about their specific sub-subniche is now served gas station fistfights and politicians subtweeting each other.

A related problem is the penalization of posting links that lead users out of the platform. This of course makes sense from X’s perspective – you don’t want users to spend their time elsewhere – but it vastly reduces the ability of creators to publish and promote longform content on X. I have dealt with this problem acutely over the last couple years, since I deal primarily in longform, and have experimented with different solutions, like posting natively in Article format (what I’m doing here). But that hasn’t led to predictable outcomes, so I have chosen instead to cultivate a Substack audience who I know I can reliably reach. My Substacks are opened by 50% of the people who receive them in their email inbox. That’s exceptional. How many of my followers are served, let alone open, an Article I publish on X?

These algorithmic changes are not a great outcome for ordinary users either, because they may want to be served unpopular or extremely niche content from specific accounts that they have chosen to follow, but these posts simply don’t appear on their feeds any more, because they aren’t blessed by the algorithm. Unless you tediously select Following and Recent every time you open a session, or use Lists. But most people don’t have the patience to do that.

Even though these algorithmic changes combined with UX choices which push users towards For You page clearly do lead to increased time spent on the platform, as Nikita Bier’s posts reveal, this feels more like a temporary high than it does a sustainable business model. Virtually anyone you talk to feels like the X algo has gotten worse, even if they are spending more time on X. Large X creators are more frustrated than ever and many, like me, are choosing to build their audience on more reliable platforms with consistent reach, like Substack. If you lose the high quality creators who like to post links and longform, directly reach their followers, and you’re left only with ragebait or culture war accounts, you are losing the soul of X. This is too subtle, I think, to be captured in the KPI numbers, but it’s real.

Why this happened

Pushing users towards algorithmic, rather than chronological feeds, is like doping in cycling. If you don’t do it, you’ll lose to everyone else that does. Virtually every other social platform, with some exceptions, uses some variant of FYP. Threads, TikTok, Facebook, Instagram, Youtube, even Snapchat and Linkedin use algorithmic or discovery feeds.

So if X doesn’t do it, users will compare the experience of using the platform to the excitement and nonstop engagement of their experiences on TT or IG. I don’t actually blame X leadership for doing this, but I think they’re optimizing the wrong KPIs.

X is special and different because it really is the free speech app – none of the others are even remotely as permissive as X – and it’s the place where dialogue happens, including at the very top levels. It feels like the global town square while also giving you a (hidden but very real) experience of swimming in your own pond. It achieves this without forcing users to opt into highly specialized subreddits.

While the numbers might warrant it, pushing users into algorithmic feeds and feeding them engaging but low-quality slop degrades the value of the platform long term. It turns off creators who feel like they are being deprived of access to their own, valuable follower bases that they’ve spent years building. It turns off creators who like to post long-form or have erudite, fact-driven discussions with plenty of outlinks. And it ruins a lot of ordinary users’ experience of using the app by pushing them into ragebait or culture war slop, rather than letting them see the niche, interesting content that they are used to.

In the next few years, I expect we will see a reactionary movement away from feeds, back towards predictability. This will be effectively a “digital property rights” movement, which will demand the following:

• Total algorithmic transparency and the ability to “choose your algorithm”. This will include freely opting in to different light touch or heavy touch moderation frameworks

• The right, as a creator, to not be arbitrarily deprived of your reach (to your followers), and to face “due process” as far as shadowbans or deboosting are concerned

• The right as a follower to receive posts from the people you have chosen to follow, and the ability to save and transport your social graph should you choose to

In the coming years, society will acknowledge that these digital property rights are just as real as physical ones. And we will come to accept that the value of your little homestead on a digital landscape is real, and you shouldn’t be arbitrarily deprived of the fruits of your labor just because the algorithm changed. I do believe that a platform will eventually come along which enshrines these principles and offers users predictable and fair treatment. And I hope that the Slop Singularity, which we are quickly approaching on X, will convince us that this is a system worth building.

What follows is a fictional portrayal of the near future – a look into a possible world. But this is a story, not a prediction.

Names, characters, places, and incidents are purely a product of the author’s imagination. Any resemblance to actual persons, living or dead, or to actual events is purely coincidental.

Read the story on its standalone site (recommended).

April 3, 2029
QuantoCorp Applied Laboratories
Palo Alto, California

It was a beautiful spring morning in Palo Alto. The scientist heard neither the birdsong nor felt the sun’s early rays cutting through the fog.

He was buried deep in the bowels of the lab, badged into a secure containment area, working on an airgapped system controlling the most delicate piece of hardware ever assembled: a 480-logical-qubit1 quantum computer, supercooled to 5 millikelvin, significantly colder than outer space. The machine, Astral IV, was a glittering chandelier, cooled with liquid helium in three stages, each one colder than the next.

At the base of the chandelier, where temperatures were so low even normally excitable atoms became torpid, sat a sapphire slab the size of a postage stamp. On this base, microscopic aluminum films etched into circuits. In each circuit, a minute weak link a few atoms thick. At these junctions, electrons no longer behaved like particles at all, but as a single coherent wave, flowing without resistance and occupying multiple states at once. It was here, in these engineered imperfections, that classical certainty broke down and quantum information came into being – fragile, probabilistic, and exquisitely sensitive to the slightest disturbance.

A few years earlier, most physicists had thought scaling beyond a few dozen fragile logical qubits would be impossible. There was no clear roadmap to keeping the logical qubits shielded from sources of interference and stable long enough to run a meaningful computation. Some even doubted that at-scale quantum computing was possible at all. Perhaps there was some sort of fundamental reason grounded in laws of physics why it couldn’t work. But this all changed in the mid 2020s when a series of breakthroughs in error correction made people realize scaling was possible. AI was an unexpected but meaningful accelerant. Models trained on experimental data learned how to tune pulses, schedule measurements, and route error correction cycles efficiently. A lot of what had looked like random decoherence turned out to be predictable enough to manage. Once that clicked, scaling was inevitable.

The engineering of the building itself was a testament to the delicate and occult task going on inside. It sat on a massive foundation, away from the rumble of the city. The computing chamber sat on a single block of concrete, hundreds of tons poured in one uninterrupted cast, decoupled from the surrounding structure by a narrow gap. The chandelier was anchored to the block through a lattice of vibration isolators and compliant mounts, so that the slow breathing of the building, the distant rumble of traffic, even the footfall of a careless technician would die out long before reaching the qubits below.

Deep inside this multi-billion-dollar marvel stood the scientist, alone. It was 6:30 am and no one was there aside from the heavily armed security. As the second most senior scientist at the firm, he had earned the right to indulge himself in the occasional bespoke run. For months QuantoCorp Applied Labs had been tediously solving smaller-scale problems that were tractable with their limited set of logical qubits. Logistics routing and optimization problems for multinationals. Trawling around various chemical catalysts to develop better superconductors or fertilizers.

The scientist had been seized with the urge to do something more interesting. The night before, on a whim, he had used the firm’s AI cluster to re-examine the resource costs of an elliptic curve2 discrete logarithm solution. OpenMind, the $10 trillion AI conglomerate, had offered them early access to a specialized model for quantum circuit optimization, and he was eager to try it out. Just a few months prior, AI had shown signs of recursive self-improvement. It wasn’t AGI exactly, but it had become extraordinarily good at certain kinds of tasks. Math and physics in particular. The remaining Erdős problems had fallen quickly. OpenMind had solved the Hodge conjecture and proved the Riemann hypothesis. It was an exciting and terrifying time to be a physicist. The scientist wasn’t sure how much longer his skills would matter for. But he was enchanted by the pace of discovery nonetheless.

The night before, he’d asked the AI model how many Toffoli gates3 he would need for an elliptic curve break under Shor,4 using the known parameters of Astral IV. The AI model had finished its run at 4:13 am. When he powered up his workstation, it read:

Shor-ECDLP Resource Estimate (secp256k1)
Logical qubits: ~0.5k | Toffoli gates: 3.52e7 | Depth: 9.6e6
Status: Feasible on Astral IV (est. runtime: minutes to hours)

He toggled the assumptions panel – logical error rates, surface-code distance, coherence margins, physical-to-logical overhead. All within spec. No relaxed tolerances. No exotic error model. The AI had stayed inside the constraints. The reduction hadn’t come from faster hardware, but from the circuit. The model had reworked the elliptic-curve arithmetic itself – collapsing layers of modular addition, reusing ancillae, trimming depth in the inversion steps that dominated older designs. Entire sections that used to run sequentially had been flattened or parallelized at the logical level.

He couldn’t quite believe it. The state of the art requirement for solving ECDLP5 was a circuit with over 100m Toffoli gates, meaning over 1500 error-corrected qubits using standard assumptions. Now the AI was telling him the cryptographic primitive could perhaps be broken with the hardware sitting 15 feet away from him, with a third of the qubits he had thought were required.

“Fuck it,” he thought to himself. “I’ll give it a shot.”

He was almost certain that something had gone wrong, that the AI had hallucinated an unrealistically compact quantum algorithm, but he didn’t have enough time to invoke the cluster again before his colleagues arrived and started asking awkward questions.

This wasn’t supposed to be possible yet. None of the top labs were anywhere near having the firepower for an ECDLP break under known assumptions. He told himself that mathematics didn’t care about roadmaps or preprints or social consensus. A curve was either vulnerable or it wasn’t.

The glittering, golden chandelier waited in the next room, perfectly still.

Four hundred eighty logical qubits online. Error-corrected. Stable. Boring, even. The machine had been idle for six hours, waiting for work.

He wavered, thinking about the uncomfortable consequences if the test somehow worked. Then he reminded himself that US firms can’t just go around stealing other people’s property. And besides, this would be a legal matter before it became a practical reality. The test was just a benchmarking exercise, he told himself.

He gave it his instructions. He chose a full 256-bit6 elliptic curve keypair on the secp256k1 curve.7

Given the standard generator point G and the compressed public key
02A2B898E63BFC5439B63516550FBF95A115E983E961CE4B961F72F04D2DC08D60
recover the scalar k such that P = k*G. 

In other words: given the public key P, compute the private key k – the elliptic curve discrete logarithm.

He initiated the run.

The progress bar appeared, crawling forward at first, then accelerating as the scheduler parallelized the circuit across the array. Estimated completion time flickered, recalculated, then stabilized.

Under the hood, the machine wasn’t guessing keys or trying combinations. It was doing something stranger and far more efficient. It prepared a quantum state that spanned an enormous space of possibilities and let the curve’s arithmetic act on all of them at once.

As the computation unfolded, most of those possibilities destroyed each other. Their phases drifted out of alignment, interfering destructively as the machine stepped through the math. What survived was a structure: a faint, repeating pattern encoded in the way the curve folded back on itself.

A final transform collapsed that pattern into a handful of sharp peaks. From those, the private key could be reconstructed – something no classical machine could have isolated, no matter how long it ran.

After 14 minutes and 47 seconds, the run ended with a soft chime. On his screen, a readout:

Shor-ECDLP job finished
Classical post-processing: COMPLETE
Curve: secp256k1
Recovered discrete log k (hexadecimal)= 050A17DFA0E4C57ABF4B2C9FAF00B0D49EA6BB854BC5CCFC7BD21F6196AD9C0A
Measurement cycles: 1.2e9
Logical error rate (est.): 7.4e-10
Result validated against curve arithmetic.

It was the private key corresponding to the public key he had given Astral IV. Sweating, he re-ran the computation in the other direction – the ordinary direction, the one you’re meant to go in – even though his system had already done those checks.

He left his workstation and rushed out through the secure doors. He burst out into the lobby fumbling with his phone and called his boss on Signal. His boss answered blearily, barely awake.

“I need you to come in right now. It happened. We’re way ahead of schedule.”

April 4, 2029
QuantoCorp Applied Laboratories
Palo Alto, California

The scientist was reluctant.

“I like Bitcoin,” he protested. “And this doesn’t make sense. If we do this, we kill it. No one will trust the network ever again.”

His boss, the lab director, wouldn’t hear it. “We raised money on the promise that we would monetize via crypto if we could. There’s a trillion-dollar bug bounty sitting there in the open. We’d be negligent not to claim it.”

“And so what,” the boss added. “Bitcoiners are unpatriotic profiteers anyway. Betting against the US dollar.”

The boss had grown impatient with the particle physics and chemistry simulations, which was all their limited hardware could handle for now. He was prone to dismissing these tasks as busy work until they could get to the “real stuff:” breaking open the cryptography that protected state secrets. If they could crack Bitcoin, they could scale up and become the biggest applied quantum lab on the planet.

“Yes, we might make a fortune, but this is max extraction,” said the scientist. “The world needs Bitcoin right now.”

Outside the lab, the world was fraying. Developed countries were sliding into default. Populations were aging, entitlements expanding, and the working-age base shrinking. AI had boosted GDP, but it couldn’t unwind a decade-long debt binge or an inverted age pyramid. Amid waves of inflation, Bitcoin had done well. It was trading at $571,000 that day.

“The world might be going to hell, but you don’t have anything to worry about,” said the lab director. “Your stock options just skyrocketed in value. And I have a mortgage in Pac Heights to pay for.”

“You’re overruled.” he continued. “Once I get the green light from legal we’re going for the coins.”

The scientist tried to sound defiant. “They will never sign off. This is theft. Those coins belong to Satoshi and other early miners. They’re not ours to claim.”

The boss was terse. “Fuck Satoshi. No one’s heard from him in 20 years.8 Those BTC are like gold coins inside a shipwreck laying on the ocean floor. And we just built a submarine that can go get them.”

The scientist stared at him glumly.

“How long?” asked the boss. “We’re not the only ones with early access to the AI model and a decent-sized machine. Someone else will figure it out eventually. I’m surprised China hasn’t. They’ve infiltrated top labs. They stole the model weights from OpenMind last year.”

“About 15 minutes per key,” said the scientist. “This assumes no further speedups, but there’s some more tricks we can try. There are thirty-four thousand vulnerable pay-to-pubkey outputs9. Fifty coins each. We just have Astral IV right now. With the other platforms coming online – three months, maybe less.”

The director smiled. “Go home and get some rest, cause we’re going to be running in shifts once we go live.”

He opened the door. “Kiss your wife. Once we start, you won’t see her for a while.”

The scientist traipsed out of the office like a man condemned.

April 5, 2029
DARPA HQ
Arlington, VA

The founder of QuantoCorp was sitting in his office with his counterpart at DARPA, a thick-necked ex-Marine. Their phones sat in a sound-insulated faraday bag in the next room.

“The moment Q-day10 hit,” the official said, “you stopped being a private company. Consider it a courtesy that you’re still operating independently.”

DARPA had indeed doled out hundreds of millions of dollars’ worth of grants to QuantoCorp as they had neared commercial applicability for their computing platform. They had plenty of leverage.

The founder was tense. He was a bright, ambitious man in his thirties, chafing against his tight suit. “You’re only keeping us at arm’s length because absorbing us would signal to Beijing that the threshold has been crossed.”

“Just count your blessings,” shot back the DARPA official, looming over him. “You just stumbled on the biggest treasure trove in human history.”

“So you’re authorizing the extraction plan?” asked the founder. “We’ll need a no-action letter11 from DOJ.”

The military man paused. “Sort of. I ran this up to the chain to Treasury, and they ran it up to the big guy. It’s authorized. You’ll extract. But the coins aren’t yours. They’ll go right into the Strategic Reserve.12 We’re offering you 15 percent. Call it a finder’s fee. Best and final.”

The founder did the math in his head. He could feel his heart rate rising. Fifteen percent of the bounty at current prices was $150b. Who knew what it would be worth after the chaos started. “We don’t have a choice, I suppose. And our letter?”

“DOJ is working on some legal theories. Salvage law. Maritime principles. Archaic stuff, but it’s enough to convince a judge. It’ll hold.”

The founder tried to conceal his frustration. “I’ll need that in writing.”

The official laughed. “Absolutely not. Public-key encryption is dead, remember? We can’t put anything sensitive in writing right now. Our systems aren’t fully post-quantum yet. This took us by surprise too. You’ll take our word.”

“There’s something else,” he said. “These transactions can’t hit public mempools.13 We’ve already taken steps to quietly commandeer the largest domestic miners. Convenient that most of the hashrate is US-based. You will submit your blocks directly.”

The founder fidgeted with his Oura ring.

“And one last thing,” said the ex-Marine. He slid a thin folder across the desk. “15 addresses. North Korea – Lazarus. They haven’t fully migrated yet. Do these first.” He slapped him on the back. The founder flinched.

July 12, 2029
Washington, DC
Classified location

Inside a cramped bunker, the greatest financiers on the planet were engaged in a shouting match with the Treasury Secretary.

The CEO of BlueStone had gone scarlet red.

“You know our position on this, sir. You saw that open letter that we signed 18 months ago. Trillions of dollars in AUM. Tens of millions of Americans trust the people in this room with their savings and their investment accounts. And you’re going to obliterate that trust with your selfish plan? If we let the circulating supply inflate by twenty percent overnight, we’ll get sued out the ass by every investor that owns a dime of this thing. Those coins are lost and they need to stay gone.”

The major financial institutions with a stake in Bitcoin had indeed signed an open letter in 2028 pre-committing to support a fork14 deprecating the 1.7m coins sitting in p2pk addresses. The Bitcoin developers, feeling little urgency to move, were stalemated over the minutiae of how to effectuate the fork. Once quantum computers had become commercially useful in late 2027, the developers had recognized the gravity of the situation and had implemented a different fork to add a post-quantum spend path.15 As of mid 2029, only 70 percent of addresses had made the upgrade. And coins whose owners had lost the keys or died simply couldn’t migrate.

Although those 1.7m ancient BTC were still vulnerable, everyone assumed the coins belonging to Satoshi and the early miners would eventually be burned in a subsequent fork. Once the letter had come out, all but the most ideological Bitcoiners had fallen in line. Who would want to fight a fork war16 against BlueStone, anyway?

The Treasury chief was unmoved. “Folks. We brought you in to tell you in person as a courtesy. We’re not doing this by press release. It’s too delicate for that. Please understand that we’re exposed to considerable risk here too. The longer we wait, the closer China gets to this same capability. The collective inheritance of every American is at stake. Besides, this is nothing new. FDR did something like this with gold when it was a matter of national importance in the 30s.”

The CEO of the nation’s largest brokerage piped up. “Yes, and Roosevelt’s Order 610217 was a massive overreach. It’s infamous among the Bitcoiners, actually.”

“The warped economic views held by Bitcoiners do not inform policy,” said the Secretary flatly. “This is about our ability to gain a meaningful foothold into the likely successor to the dollar. I’ll be damned if I’m going to let China get their claws into it. Bitcoin is an American asset, held mostly by American households and institutions, not to mention Treasury via the Reserve. The network belongs to us. I won’t be cowed by conspiracy-peddling ideologues.”

“Sir, this conversation would meet the definition of a conspiracy,” one of the bankers volunteered. A few snickers were heard around the room.

“Spare me,” replied the Cabinet official. “And fall in line. This isn’t a negotiation. The news drops tomorrow. Do not back a competing fork. You all have bank charters and examinations. You remember Choke Point. You exist at the pleasure of the US government.”

He paused. “And no God damn leaks, ok?”

July 13, 2029
BlockRiver offices
Menlo Park, CA

The CEO of BlockRiver was in despair. He sat motionless at the conference room table. His chief scientist sat back in his chair, arms crossed while the CTO paced. The mood was grim.

“Ok, so we were wrong,” the CEO said. “Doesn’t matter why. What matters is what we do next. People are already looking to us. Two Core Maintainers18 in this room, the rest on IRC.19 Figure it out.”

The CTO stopped pacing. “This… this is Q-day. Years early. And whoever is doing it is being selective.”

“Selective how?” the CEO asked.

“They’re only targeting Satoshi coins,” answered the CTO. “Fifty BTC per address. Nothing huge. None of the real juicy targets like the unrotated exchange addresses.”

The chief scientist cut in. “It’s restraint. Or signaling.”

“Right,” the CTO said. “It’s probably not China or Lazarus. They would have gone for larger unsecured wallets. There’s a bunch that haven’t migrated to post-quantum sigs yet. The Satoshi wallets are just 50 BTC apiece, small potatoes.”

“They’re proving capability without detonating the system,” said the chief scientist. “Either way, the clock is running.”

The CEO nodded. “We need to trigger the p2pk deprecation fork. The code’s been public for over a year. It’s reviewed and safe. We notify miners and set a fork height. The big economic nodes already said they would support it in that letter.”

“How deep are we?” asked the CTO.

The scientist glanced at his monitor. “Five blocks since the first batch of p2pk spends.”

“We still have time,” said the CTO. “The LevelDB bug20 in 2013 was worse. We recovered from a six hour chainsplit.”

The Chief Scientist was skeptical. “Dude. The market cap in 2013 was rounding error. Everyone involved could fit in a bar. Today it’s worth–”

His eyes flickered to the monitor. “My God. It’s down 73% in the last 30 minutes.”

“Jesus Christ,” the CTO said quietly.

“Hang on,” interjected the CEO. “Shut up for a second. Something’s happening.” The TV set on mute in the back was flashing a chyron: TREASURY SECRETARY PRESSER: ADDRESSING SATOSHI WALLET ACTIVITY.

They flipped on the sound just as the Secretary started to read his prepared remarks, in his typical halting, unsteady tone that belied his keen intelligence.

This morning, wallets associated with the creator of Bitcoin began to move. This is a controlled and lawful operation. Approximately 1.7 million bitcoins, long believed to be abandoned, have been secured by US government cryptographic teams and are being moved into secure federal custody. The major stakeholders in the Bitcoin network have been briefed and are supportive of the transition plan.

These assets are not being treated as abandoned property, nor as private holdings of the United States. These assets are presumptively owned by the entity known as Satoshi Nakamoto, or any lawful successor or assignee. The US government is holding them in trust, pending long-term legal and legislative resolution, under the doctrine of salvor-in-possession. These assets will be securely held in the Strategic Bitcoin Reserve.

We have taken care only to recover coins that we considered to be imminently vulnerable. No active wallets are affected. No private holdings are at risk.

We are taking this action now due to credible intelligence that a foreign adversary is approaching a major breakthrough in quantum computing. We will not allow a vulnerability in a critical global monetary network to be exploited against US interests.

Today marks a turning point. Bitcoin is no longer a purely private experiment. It is a strategic asset. And it will be protected as such. Thank you for your attention.

The BlockRiver leadership stared dumbfounded at the screen. The Chief Scientist broke the silence. “What the hell is ‘salvor-in-possession’?”

“Beats me,” said the CEO. “Sounds titanically stupid.”

The GC, who had been sitting quietly at the end of the table, spoke.

“It’s an old maritime doctrine. Gives a rescuer temporary custody of a ship or cargo recovered from danger. DOJ’s being cute.” He paused. “Even if it applies, salvage never defeats title. At most it buys you a reward, not ownership.”

“Guys,” interjected the CTO. “Bitcoin is rallying. Shorts are being liquidated everywhere.” He checked his phone. “CoinPort is down. Bitcoin might close the day higher than where it started.”

I guess that settles it, said the CEO.

October 4, 2029
NSA HQ
Fort Meade, MD

Three months later, and things had mostly returned to normal. As it transpired, some Bitcoiners protested the recovery of the lost coins and had launched a competing fork which excluded all the p2pk outputs. But under implicit threat from the DOJ, it was ignored by almost all the major custodians, exchanges, and asset managers, and didn’t get traction. Bitcoin – the original Bitcoin, the one the US government now held over 10 percent of – had retained the name and the ticker. Treasury had pulled it off. And they were very pleased with themselves. After the initial crisis, Bitcoin rallied once people realized those coins were yet again stashed away. The price had climbed to over $600k since June. The Bitcoin Reserve almost matched the value of gold held by the US government.

The scientist at QuantoCorp who had made the initial discovery had been summoned to Washington for debriefs. Recovering Bitcoin would only be one of many applications of quantum computing that the government was interested in. Breaking elliptic curves and other forms of legacy cryptography meant that the US government could decrypt a huge portion of encrypted data from the pre-quantum era. QuantoCorp and its peers had a mountain of data to sift through.

After three weeks of nonstop grilling, the scientist was invited to Fort Meade for an interview with the head of the NSA. He didn’t know what to expect.

The NSA director gave him a wry grin from behind the desk. “I want to offer you my congratulations. You’re the most impactful codebreaker since Alan Turing. You embarrassed the CCP, and you secured an endowment for America that will outlive us both.”

The scientist smiled weakly. He desperately wanted to go home. “Thank you, sir. I didn’t think it would happen this way, but I’m glad it all worked out.”

“Neither did we. We normally develop this kind of capability decades before the private sector discovers it, but you were an exception.”

A pause. The scientist broke the silence. “Do you have any questions for me?”

“No. I just wanted to thank you for returning those coins to where they belong.”

The scientist looked at him confused. “Belong?”

The director didn’t answer immediately.

“Satoshi was us.”

He paused.

“Not officially,” the director added. “The name belonged to two of ours. Cryptographers. It was the late 90s, and we were experimenting with digital cash. All the pieces were there long before 2008, you know. Merkle trees, elliptic curves, hashes, Proof of Work – we just assembled it. The hard part was figuring out how to run it without a central coordinator.”

He leaned back in his chair.

“Eventually we decided the project was unnecessary. The dollar wasn’t going anywhere. And no one would trust decentralized monetary software stamped US government. The project was shelved.”

“And Bitcoin?” the scientist asked.

“The two cryptographers that took the Satoshi name thought it was too good to rot on the shelf. They secretly took the code when they left. Finished it and released it online in 2008.”

“We did nothing, expecting that the network would fail. In an attempt not to legitimize the network by admitting authorship, we chose to stay silent. The irony of its later success as a decentralized currency has not been lost on us. The Strategic Reserve was our solution. A pretext to get our due.”

“But what about all the people who believed?” asked the scientist.

“They believed in a story. Useful. Just not true.”

“Auri sacra fames,”21 added the director, pensively.

The scientist stared at him, puzzled.

“What happened to the Satoshi team?”

“One committed suicide in 2011, and we believe the keys died with him. I’ll give him credit, though. He had fantastic opsec. The public never figured out who he was, even to this day. We trained him well.”

“The other one ran. Lives in Russia. Not worth the trouble to retrieve.”

The scientist thought for a minute. “Why are you telling me all this?”

“Because you recovered the coins. You closed the loop. If anyone’s earned the truth, it’s you.”

“For reasons that should be obvious, we can’t acknowledge you officially. There will be no citation. No medal. But know this: your country is grateful.”

The NSA director nodded towards the door. “You can see yourself out.”

All around the world, millions of ASICs22 continued to whirr, unaware of the drama and chaos visiting the network they composed. Those millions of ASICs collectively produced sextillions of hashes every second, searching through a vast mathematical space that quantum computers couldn’t yet touch23. Though each hash was independent of the last one, and each ASIC was unaware of the existence of its neighbor, together they erected a vast thermodynamic firewall protecting the network from threats. Almost all threats.

As he stepped out into the daylight, the scientist pensively checked a block explorer, half-expecting the network to acknowledge what had just happened.

Somewhere on a server rack inside a data center in upstate New York, an ASIC stumbled on the winning hash. Mechanically, instantly, the waiting transactions were paired with the hash and the next block was submitted to the network, propagating from node to node, all over the world, in under a second.

He was a lapsed Catholic, but at that moment, Mark 8:36 popped into his head, unbidden.

For what shall it profit a man, if he shall gain the whole world, and lose his own soul?

His phone lit up. Just mined: Block 1,114,200.

Tick tock, next block.

There’s a huge amount of noise about the quantum risk to Bitcoin lately. I’ve made my case in a long article, but most people haven’t read it, and are only getting brief snippets of the debate from X. So I’ve condensed my views into one short article. I’m not going to be packing this article full of references and detail. If you want that, see my full series on quantum risk.

The security of Bitcoin – as in the difficulty of reverse engineering a private key from a public key – relies on elliptic curve cryptography. Quantum computing (QC) is known to theoretically break this, thanks to an algorithm invented in the 90s by Peter Shor. Satoshi was aware of this when they invented Bitcoin, and proposed upgrading if QC ever became sufficiently powerful. For a quantum computer to actually deploy the algorithm it would need 1-2 thousand so-called “logical qubits”, or a few hundred thousand to a million or so “physical qubits”. For context, the best quantum computers today max out at around 1k physical qubits and a few dozen logical qubits. So we are still approximately three orders of magnitude away from this capability. While this may seem remote, noted quantum theorist and academic Scott Aaronson calls it merely a “staggeringly hard” engineering problem, rather than something requiring new fundamental physics discoveries. To put it another way, with quantum we are in the equivalent of nuclear fission in 1939 – known to be possible with no theoretical roadblocks remaining, but still requiring an enormous engineering lift. To extend the analogy, because of the enormous strategic utility of a QC, the early owners of this technology may obscure their capabilities, or wait to reveal that they have it. Due to the incentives at play, quantum computing could emerge abruptly, with no warning. This is bad news for Bitcoiners who think that they will have plenty of notice and time to prepare. And as we have seen with AI – and the level of surprise in the AI community when the scaling law was developed and LLMs became powerful – nonlinearities can and do happen in technology. I am not willing to wager the future of Bitcoin on the mere hope that quantum development doesn’t surprise to the upside.

The odds of a quantum break in the next decade are unknowable. However, 2025 was the most active year in quantum computing history. Technologically, this year saw breakthroughs in “fidelity” – how often the qubit does what it’s meant to do – at IONQ and MIT. Quantum error correction, which catches and resolves errors introduced by physical qubits to create pristine logical qubits, started to meaningfully work in 2025. Because these errors tend to grow with the size of quantum computers, getting error correction to work at scale was the big development in QC. Google and Quantinuum had strong results in error correction this year.

At least $6b was raised by quantum startups this year, the most in history by a large margin. One of these startups, PsiQuantum, raised $1b to build a million-qubit machine – possible, they think, with current technology. A number of firms building quantum computers explicitly project being able to build a functional, scaled quantum computer by the late 2020s or the mid 2030s. The average expert on Metaculus anticipates the arrival of a QC around 2033.

The US government’s official standards-setting body, NIST, has asked government agencies to deprecate the use of quantum-vulnerable cryptographic schemes like ECC256 by 2030, and end all reliance on them by 2035. Other major powers like the EU and UK are operating on similar timelines. These are dates that should motivate Bitcoiners to action today, as I’ll explain.

If a sufficiently powerful “cryptographically-relevant QC” were to be built, it could threaten Bitcoin by enabling an attacker to steal private keys from exposed public keys. Not all coins are currently exposed (some public keys are in hashed addresses, and SHA-256 is not considered quantum-vulnerable), but 6.7m BTC are vulnerable at the time of writing – $604 billion worth. Additionally, in the short window between when coins are spent, and included in a block, a sufficiently powerful QC could in theory reverse-engineer the private key and redirect the expenditure. This applies to coins in any sort of address, hashed or not.

In theory, Bitcoin could soft fork and adopt a “post-quantum” (PQ) signature scheme. Some proposed quantum-resistant cryptographic signatures do exist. Leaving aside the technical problems, like massively higher data requirements (requiring larger blocks, or reduced throughput), the main issue will be settling on a specific post-quantum scheme, organizing a soft fork, and laboriously moving over each one of the over tens of millions of addresses with a balance. It’s risky to adopt new cryptography, which is another problem. We don’t want to panic and move to PQ crypto which we later find out is breakable even by classical computers. Stripping out the cryptography at the core of the Bitcoin system is a huge task, and must be done delicately. And if you recall how difficult it was for Bitcoiners to collectively agree and implement the (relatively uncontroversial) SegWit and Taproot soft forks, you will understand that Bitcoin does not move nimbly.

A post-quantum fork (or rather, forks, because it would likely require a few) to Bitcoin would be substantially more invasive and complex than any prior update to the protocol. The cryptography is the core of the protocol and ripping it out forces changes to virtually everything about the system, and the way users interact with it too. It stands to reason that such a fork would need even longer to be debated, developed and tested than SegWit (two years from proposal to activation) or Taproot (three years).

Actually getting Bitcoin into a non-vulnerable state, post-fork, would be even harder. Coins in quantum-vulnerable addresses would have to be rotated and sent to new quantum-resistant address types. Eventually, all address types would have to be deprecated and rotated. Even if every Bitcoiner were aware of this and had ready access to their wallets and keys, this transition would take months in the best case. More realistically, you’d want to give Bitcoiners several years’ notice to rotate their coins.

And it gets worse. Some coins are lost or abandoned. A huge number of these – 1.7m BTC – belong to Satoshi and other early miners in old address types called “pay to public key”. If these coins truly are lost, they cannot be moved to safety in a post-quantum address type. These are like ancient gold coins laying on the sea floor in a shipwreck, thought unretrievable – until someone built a better submarine. So the Bitcoin community must decide what is to be done with them. Freeze them, and engage in a kind of institutionalized theft, or let them go, and allow an unknown and possibly hostile quantum agent to become the largest Bitcoin holder. Neither option is good, and there’s no consensus in the community at present. The Bitcoin community has never voted to freeze or immobilize anyone’s coins, no matter how odious. In fact, this kind of collective theft (even if done for a good reason) was precisely why many Bitcoiners disparaged Ethereum in the early days. By doing this, Bitcoiners would show that they are no better than their hated rivals. It would also signal to future holders that collective confiscation in times of emergency is an option on the table. Burning the coins would set a dangerous precedent. So the fate of the abandoned p2pk coins has to be litigated, and a solution (like a fork to freeze or requisition them) must also be implemented and deployed. This is not trivial and would be completely unprecedented in Bitcoin history.

If you’re keeping count, you’ll realize that the required mitigation timeline likely extends to the better part of a decade. We need time to discuss strategies, settle our differences, agree on a roadmap for both the protocol and the vulnerable coins, write the code, test the cryptography, and actually perform the migration. This means that even if the day of quantum reckoning (or “Q-day” as it’s called) arrives a decade from now, we have to start preparing today. An early or unexpected Q-day would be catastrophic. We would have to make a snap decision about whether to freeze vulnerable coins or not, panic-implement a post-quantum signature scheme, hope that scheme is secure, and hope that confidence in the system recovers. Chaincode, a major Bitcoin development firm, estimates that even “short term” contingency measures would take two years. Changing Bitcoin is like steering an aircraft carrier.

A panicked reaction to an abrupt break, rather than the break itself, could destroy Bitcoin. Competing views of whether the vulnerable coins should be destroyed or claimed might cause forks, like we saw in the blocksize wars. Competing forks vying for the Bitcoin name may have just about worked in 2017 when Bitcoin was much less mature and the stakes were lower, but that kind of scenario today would cause the big institutional sources of capital Bitcoin relies on to lose faith in the protocol. Quantum pierces Bitcoin’s promise of inviolability. No wonder that most Bitcoiners are so fearful to even acknowledge it. They know that admitting that there’s a risk is to cast doubt on Bitcoin’s central narrative of incorruptibility. From the capital allocator’s perspective, you don’t want to have a tail risk on your ultimate rainy-day store of value asset. So Bitcoiners have chosen to play a massive prisoner’s dilemma game where they all keep quiet and don’t snitch. But they didn’t bank on the emergence of a few intellectually honest Bitcoiners who were willing to tell the world an unpopular truth – even if it’s to our own detriment.

Some Bitcoiners think US law will prevent anyone in possession of a CRQC from using it against Bitcoin. But reducing Bitcoin’s guarantees to a mere hope that adversaries follow legal rules is small comfort. We can’t trust that the early stewards of quantum technology will be benevolent. Though they won’t publicly acknowledge it, there’s a reason major quantum companies are coyly sniffing around Bitcoin conferences: there’s a multi-hundred billion dollar bounty waiting for them if they can build the hardware to claim it. China is devoting massive state resources to quantum computing, and they have no allegiance to Bitcoin or US law. And it’s not out of the question that the US government might preemptively requisition vulnerable Bitcoins if they believe China is imminently about to.

If you’re following my reasoning, it becomes evident that we should be preparing today. Expert and government consensus suggests that quantum could be a problem sometime between 2030 and 2035, which, given readiness timelines, means we have to start preparing today. The possible damage from a quantum break which we are not prepared for would be catastrophic – a total loss of confidence in the system. So the expected value of quantum risk to Bitcoin today is significantly negative. To investors or developers that ignore the threat, I would ask, what is the probability of a complete wipeout you are willing to take? 10%? 5%? 1%? People buy insurance against unlikely events if the potential losses are catastrophic. Even if the risk of a dangerous flood is only 1% in any given year, you’re probably buying flood insurance, and you are glad that you did. And the truth is, insuring against quantum risk would be “cheap”, because developers are mostly engaged in pointless navel gazing. The main developer priority over the last decade has been the lightning-based scaling model, which has simply been a failure. Internecine debates over filters and whether Bitcoin should carry arbitrary data have captured developer attention. Only two updates to the Bitcoin protocol have occurred in the last decade. Although they will, the developers cannot plausibly claim they are too busy with important business to focus on this growing existential threat.

What is the Bitcoin community doing about it? Very little, unfortunately. There have been a smattering of efforts to explore post-quantum signature schemes and some early mitigation ideas but very little in the way of actual concrete proposals. The only listed Bitcoin Improvement Proposal (BIP), BIP360, is led by a relative outsider rather than one of Bitcoin’s high priests whose assent is typically required for a major update. And all BIP360 actually does at this stage is undo a major error committed by Bitcoin developers, which was to introduce the quantum-vulnerable Taproot address type in 2021. They did this despite the lead developer Pieter Wuille openly admitting at the time that Taproot addresses were exposed to quantum risk. Even as of 2025, Wuille maintains that there is “no urgency” to quantum-proof Bitcoin.

What annoys me most about this is how uncharacteristically indifferent Bitcoin developers are to the creeping risk of quantum computing. Ordinarily, Bitcoin development culture is maximally paranoid, almost to the point of farce. Developers minimize dependencies on third party libraries – at great cost to themselves – out of a fear that they might introduce a bug. Bitcoin famously rejected industry-standard elliptic curve stacks and avoided OpenSSL’s ECC implementation, instead standardizing on secp256k1 and maintaining its own bespoke code. And this is just one example. Many of you will remember how even modest increases to the block size were debated for years as potential existential threats, with developers warning that a few extra megabytes could fracture the network or compromise decentralization. The system’s scripting language was deliberately crippled – not for lack of imagination, but out of fear of denial of service attacks and emergent behavior. Each of these choices is borderline ideological, grounded in a culture of extreme self-reliance, resistance to present and future threats, and general paranoia. Yet incredibly, now that Bitcoin is facing the total obsolescence of modern public key cryptography, the developer reaction is complacency.

When confronted with the risks posed by quantum computing, Bitcoiners often respond that the threat applies equally to all financial technology (and any other system that relies on encryption). The implication is that the world would be ending anyway, so it’s not worth worrying about. But aside from this being nonsensical (obviously, we would still want Bitcoin to work, particularly in a chaotic situation), it’s not true. Q-day, assuming it happens at a time when governments and major financial institutions are generally prepared, will look at lot like Y2K, in that it will be a non-event due to adequate preparation. Post-quantum signatures exist and can be trivially implemented by any centralized authority. It’s mainly blockchains, with their governance inertia and difficulty upgrading, where there is a problem. Cloudflare already protects a majority of its traffic with post-quantum encryption. AWS has already deployed post-quantum cryptography across key services. NordVPN already offers post-quantum browsing. While infrastructural upgrades can be painful, all financial institutions, software companies and governments are highly centralized and can simply mandate an upgrade. (There is a small category of systems that cannot upgrade, like devices with burned-in hardware and no ability to update. But this refers to super long-lived hardware that should probably be phased out anyway. Satellites are one exception to this, and they are poorly positioned for Q-day as well.)

Decentralized blockchains like Bitcoin cannot update themselves with the agility of a centralized database operator. Bitcoin has only pushed through two updates since 2017 and even those came after enormous rancor and infighting. Additionally, because a huge fraction of the vulnerable coins are held in abandoned addresses, and the owners of those addresses simply cannot be compelled to move their coins, even if Bitcoin does upgrade to post-quantum signatures, it still faces the risk that 1.7m coins are abruptly seized by a quantum attacker. Not only would Bitcoin have to upgrade in an orderly and timely manner, but Bitcoiners would have to collectively agree to burn these 1.7m coins in order to defuse this risk – something completely unprecedented in Bitcoin history.

Bitcoin is also more vulnerable than other blockchains. It has more presumed lost or abandoned coins as a share of supply. Ethereum does face some of the same risks, but its account abstraction and smart contract capabilities mean that with a bit of trickery, Ethereum can implement PQ signatures without even a fork. A post-quantum fork would ultimately be required, but it’s much likelier to happen with Ethereum’s governance process which vastly more active. Ethereum also benefits from the existence of a leader who acknowledges the quantum threat and has already made proposals to deal with it. Solana, another competitor, has already begun testing post-quantum signatures. Layer twos like Starkware tout quantum resistance as a core value proposition. Bitcoiners will chafe at these comparisons, but it’s a very real possibility that Bitcoin is the only blockchain left exposed on Q-day.

So here’s the ugly truth. Few are the Bitcoiners who will admit it. Blockchains are uniquely vulnerable to quantum computing compared to other systems that rely on public key cryptography, and Bitcoin is uniquely vulnerable among blockchains. Quantum computing has moved from a remote theoretical possibility to merely an engineering challenge, and it could be here in a decade or less. If so, Bitcoiners need to start preparing today.

No man can serve two masters: for either he will hate the one, and love the other; or else he will hold to the one, and despise the other. Ye cannot serve God and mammon.1

Matthew 6:24 KJV

Ken Chang recently published a post entitled “I wasted 8 years of my life in crypto”2 in which he laments the capital destruction and financial nihilism that is seemingly inherent to the industry.

People in crypto like to snicker about these types of “ragequit” articles, remembering with glee the loud exits of historical figures like Mike Hearn or Jeff Garzik (and pointing out how much Bitcoin went up after).

But Ken is mostly right in his article. He says:

Crypto purports that it helps decentralize the financial system, which I completely bought into, but in reality, it’s just a speculation and a gambling hyper-system that’s really just a mirror of what the economy is now. The reality hit me like a fucking truck. I am NOT building a new financial system. I built a casino. A casino that does not call itself a casino, but it is the biggest, online, multi-player 24/7 casino our generation has ever concocted.

Ken points out that VCs have incinerated billions of dollars backing new L1s when of course, we didn’t need that many. That much is true, even if he slightly distorts the incentive model (VCs are just conduits for capital – in the aggregate, they will do whatever LPs are willing to tolerate). Ken indicts the proliferation of perp and spot DEXes, prediction markets, meme coin launchpads, and so on. Indeed, while you could make the case for these concepts in the abstract (minus the memecoin launchpads, which are indefensible), it’s unarguable that these are proliferating simply because the market incentivizes them to and VCs are willing to fund them.

Ken says he entered crypto bright-eyed and bushy-tailed with ideological motives. These are very familiar to anyone involved in crypto: he had Randian, libertarian sympathies. But then instead of carrying out the libertarian praxis he built a casino. Specifically, he is best known for his work with Ribbon Finance, a protocol that allowed users to deposit their assets in a vault and obtain a yield by systematically writing options.

I don’t want to be too mean here, but yeah. I’d be doing some soul-searching too. As the tension between his principles and his work becomes too much to bear, Ken arrives at his gloomy realization. Crypto is a casino, not a revolution.

One of the things that struck me reading Chang’s post is how much it reminded me of Mike Hearn’s post, written nearly 10 years ago. Hearn writes:

Why has Bitcoin failed? It has failed because the community has failed. What was meant to be a new, decentralised form of money that lacked “systemically important institutions” and “too big to fail” has become something even worse: a system completely controlled by just a handful of people. Worse still, the network is on the brink of technical collapse. The mechanisms that should have prevented this outcome have broken down, and as a result there’s no longer much reason to think Bitcoin can actually be better than the existing financial system.

The details are different, but the argument is the same. Bitcoin/crypto was meant to be something (decentralization, cypherpunk praxis), but it turned into something else (casino, centralized). Both agree: it turned out to be no better than the existing financial system.

The arguments of Hearn and Chang reduce down to the following statement: crypto had a point at first, but it ended up being something else. So we end up in an argument about the telos,3 or purpose, of crypto. But what is the point meant to be, again?

The five teloi of crypto

The way I see it, there are roughly five camps here. They are not mutually exclusive. For instance, I personally most align with the first and fifth camps, although I sympathize with all of them. But I am not overly wedded to any of them, not even the hardcore Bitcoin camp, as I made clear in 2022.

1. Restoration of sound money

This is the original dream, shared by most but not all of the early bitcoiners. The idea was that, with time, Bitcoin would pose a competitive threat to the monetary privilege of many nation-states and perhaps even replace their currencies, returning us to a neo-Gold standard type arrangement. People in this tribe generally regard everything else happening in crypto as a distraction and a scam riding on the coattails of Bitcoin. Suffice to say, Bitcoin has achieved only moderate gains at the sovereign level, but it still has come admirably far as a monetary asset of consequence in only 15 years. Bitcoiners that subscribe to this view live in a permanent state of disillusionment mixed with hopeful if delusional expectations that hyperbitcoinization is just around the corner.

2. Codifying business logic into smart contracts

This is the view best espoused by Vitalik Buterin and most in the Ethereum camp; that if we can digitize money, we can also express all sorts of transactions and contracts as code, making the world a more efficient, fairer place. To Bitcoiners, this was the original heresy. But it has arguably succeeded in some narrow respects, especially if you consider contracts that are easy to express in a mathematical way, like derivatives.

3. Making digital property real

This is my best summary of the “web3” or “Read Write Own” philosophy. The idea, which isn’t without merit, is that digital property should be just as real as physical property. The implementation of this idea – NFTs, web3 social – was either completely wrongheaded, or more charitably ahead of its time. Even though billions of dollars were deployed here, you won’t find many people defending this philosophy any more. I do think there’s something to be said for it though. I think most of our online woes stem from the fact that we don’t actually own our namespaces in any meaningful sense, and we can’t meaningfully control who we interact with and who is served our content. I do think that eventually we will reassert dominion over our online property, and this will probably involve blockchains. But this is an idea whose time has not yet come.

4. Making capital markets more efficient

This is the least ideological of the five categories here. You won’t find a lot of people particularly animated by securities settlement or COBOL or SWIFT or wire transfer windows. But this is something that does, for better or worse, power a meaningful subset of the crypto industry. The idea is that the financial system in the west is built on antiquated technology that is extremely hard to update for path-dependent reasons (you don’t want to rip and replace the core infra powering trillions of dollars of settlement a day), and it’s overdue for an update. The update has to come from outside the system and consist of a brand new architecture. Most of the value here is captured in the form of efficiencies and maybe some consumer surplus, so it’s not that exciting.

5. Broadening financial access globally

Lastly, you have the bleeding hearts that see crypto as an inclusive technology which will give the global south access to low-cost financial infrastructure, in some cases for the first time. This means giving them the opportunity to self-custody cryptoassets or, more commonly nowadays, stablecoins, to access tokenized equities or money market funds, to receive a card issued against their crypto wallet or exchange account, and to be treated as an equal peer on the financial internet. This is a very real phenomenon and its apparent success gives succor to many of the ideologues whose enthusiasm has been waning.

Pragmatic optimism

So who is right, the idealists or the cynics? Or is it a secret third thing?

Well, I could blather on about how bubbles always accompany major technological shifts, and how bubbles actually catalyze useful infrastructure buildout, and how crypto is particularly speculation-ridden because it’s a technology about finance, but that is mostly cope.

My real answer is the following: being pragmatically optimistic is the right disposition, and you have to hold on to that whenever you find yourself getting blackpilled about the crypto casino. The speculation and mania and extraction should be understood as an inevitable but unpleasant externality of a useful infrastructure buildout. It carries a very real human cost that I don’t want to diminish. The normalization of memecoins, idle gambling and financial nihilism especially among the youth is depressing and bad for society. But it’s an inevitable (if negative) side effect of building capital markets on permissionless rails. I don’t think it could have happened otherwise. You just have to accept this as a consequence of how blockchains work. You don’t have to participate in it.

The synthesis here is that there is a telos to crypto, and it’s perfectly ok to be idealistic about it. There is a force that animates the thousands of individuals that are dedicating their professional lives to this industry.

It’s just that it may not be as exciting as you thought it was.

The world is probably not going to hyperbitcoinize. NFTs didn’t revolutionize digital ownership. Capital markets are coming on chain, but only very slowly. We haven’t tokenized much of anything aside from dollars yet. No authoritarian regimes have been toppled by regular folks toting their crypto wallets. Smart contracts are mostly about derivatives and little else. The applications with real PMF so far are limited to Bitcoin, stablecoins, DEXes, and prediction markets. And yes, much of the value created may be captured by big corporates or end up returned to consumers in the form of efficiencies and cost savings.

So the challenge is to maintain an optimism which is nevertheless grounded in what might realistically happen rather than indulging in Panglossian fantasies. The dissonance between your expectations and the reality of crypto will eventually collapse if you believe in a Randian libertarian utopia. As far as the casino dynamics, the unrestrained token issuance, the rampant speculation are concerned, they should be acknowledged as unsightly warts on the belly of the industry, but ones that are very hard to peel off. If you decide that the cost of bringing blockchains into the world exceeds its benefits, you are entirely within your rights to become disillusioned. But from my perspective, things are actually better than ever. We have more evidence than ever before that we are on the right track. Just remember the telos.

This is Part II in a 3-part series on Bitcoin and Quantum Computing. Find Part I here:

Introduction

Most of you are familiar with the concept of expected value. Simply put, it’s the odds of something happening times the goodness or badness of that thing, if it does happen. This kind of logic is how people get extremely concerned about things like the emergence of a misaligned superintelligence. Even if the odds of a powerful malevolent AI are very low, the possible damage (the extinction of all sentient life, perhaps) is so extraordinarily high that we can assign a highly negative expected value to the overall scenario. Thus, it potentially outweighs in importance near term but more prosaic concerns.

There’s actually an argument to be made that since the damage from a misaligned superintelligence is potentially infinite (from a human perspective), any nonzero probability means we should expend an enormous amount of present-day resources to make sure that outcome doesn’t come to pass.

In the real world, though, we don’t spend all of our time worrying about how to prevent unlikely-but-very-bad things like misaligned AGI, gamma ray bursts, local supernovae, or wayward meteors.1 This might be due to a quirk in human intuition whereby we underrate catastrophic or existential risks. Most humans don’t go about their days relying on consequentialist calculations to determine how they should spend their time and resources. Expected value-based reasoning makes most sense when probabilities and payoffs are known or guessable, like in finite games like poker.

If you’ll indulge me, I’ll posit in this piece that the expected value of the emergence of a cryptographically relevant quantum computer (CRQC) is sufficiently negative for Bitcoin that it should motivate us to take action today. I’ll first explain that the “payoff” of a CRQC on Bitcoin is highly negative, then explain why I think2 we have enough data to assess that the odds are sufficiently high as to worry us, today.

And I want to add a note on my credentials and the purpose of this piece. I’m not a mathematician or physicist, I barely passed statistics in grad school, and I actually quit economics in undergrad because I hated the math so much. My understanding of quantum physics is that of an educated layperson who has read a few books about it and talked to a few experts. I don’t claim in this piece to have any specific insight regarding the nature of quantum computing or its impact on cryptography at all. All I am doing is packaging up publicly available data and presenting it in a way that’s intelligible to the average Bitcoin holder. I am an information retailer, not a wholesaler. I am not claiming to be good at physics or cryptography. My skill, to the extent I have one, is applying an investor’s mindset to the narratives and data swirling around and making risk-based assessments. That’s where I perceive a gap in the discourse and that’s the point of this series.

With that said, let’s investigate what a quantum computer is, and how it breaks the discrete log assumption that we learned about in Part I.

What is quantum computing, again?

You sometimes hear people describe QC with some version of the following: “A quantum computer spins up parallel universes, evaluates every possibility simultaneously, and then picks the right answer from the multiverse.” In a crypto context, you might imagine a QC is using Shor to “try every private key in many different universes, do the computation out there, and deliver the correct result in our universe.”

But that’s not what’s going on.

A quantum computer doesn’t “run really fast” or “outsource computation to other universes”. It’s a machine that relies on the rules of quantum mechanics instead of the rules of classic probability. In other words, QC is what happens when you use the universe as it actually is, rather than pretending it’s classical (which is what ordinary computers do).

We know that the universe is quantum. As in, quantum mechanics is the right theory to describe the behavior of subatomic particles, and it’s been empirically proven.

Computing, historically, is “classical”. That means a system has definite properties at all times. A bit is 1 or 0. Measurement simply reveals the state of the system.

The actual world is quantum. In the quantum world, systems don’t sit in neat, definite states. They exist in superpositions: combinations of possibilities with complex amplitudes attached. A “quantum bit” (qubit) isn’t 0 or 1; it’s a weighted blend of both until you force a measurement. And measurement doesn’t simply “read” the state the way a classical computer would. It collapses the superposition into a single outcome and destroys the rest. Underneath the classical facade, the universe is running on wave functions, amplitudes, and interference patterns, not on discrete binary states.

Quantum computing simply acknowledges the universe as it actually is, and endeavors to build a computer that plays by those same rules.

So what does a quantum computer do?

Instead of flipping tiny switches between 0 and 1, a quantum computer manipulates genuine quantum states. A qubit is a blend of both 1 and 0, with weights attached to each possibility. When multiple qubits interact, they become entangled, meaning the whole system has to be described at once rather than qubit-by-qubit. The computation is basically the controlled evolution of this joint quantum state. Only at the very end do you measure it, which collapses all those possibilities into definite 0s and 1s. In short, a quantum computer is a device that carefully shapes and evolves a multi-qubit wave until a final measurement extracts a usable answer.

We figured out we needed quantum computers in 1981 when Feynman observed that classical computers could not simulate quantum mechanics. The movement of 10 particles becomes 2¹⁰ amplitudes, so any meaningful physical simulation quickly becomes impossible classically. In 1985, Deutsch published a formal model of a quantum computer. And we didn’t have to wait very long until the most famous QC algorithm was devised by Peter Shor in 1994. Shor defined a way in which QCs could factor integers and compute discrete logs in polynomial time. Incredibly, there was at this point still no functioning QC prototype in any meaningful sense. We just realized that large integers could be factored with (a theoretical) QC, and that at some point in the future, most public key cryptography would be totally compromised.

Aside from factoring large integers and simulating particles, there’s not much else we know quantum computers are good for. But unfortunately for us, the one thing they are good at is the thing that forces Bitcoin into a reckoning.

There’s a couple more concepts to establish about quantum computing before we dive in.

Physical qubits are the stuff QCs are made of: ions, superconducting circuits, photonic modes, neutral atoms. They are manipulated through pulses and lasers and microwaves. They are noisy, short-lived, and error prone. They interfere with each other and oftentimes, if you add more, the interference in the whole system gets worse. Physical qubits don’t stay quantum forever, and eventually decohere.

Logical qubits are the actual thing you want and are built from error-corrected physical qubits. Depending on fidelity – the odds of your instructions being faithfully carried out at each gate – you might need hundreds or thousands of physical qubits per logical qubit. More fidelity means fewer physical qubits required.

To do anything useful with a quantum computer, you need hundreds or thousands of logical qubits, which implies 100s of thousands to millions of physical qubits. The best systems we have today have maybe 1000 physical qubits and around a dozen logical.

Error correction is the real innovation that helps stabilize messy physical qubits to produce clean logical qubits. Every few microseconds, you run a sequence to check if groups of qubits are still satisfying certain conditions. This tells you where errors are occurring on the grid. You guess at what the problem is and apply a correction. If your error rates are low (your fidelity is high), each error correction cycle fixes more errors than it introduces. This is the whole ballgame. If error correction is real, useful quantum computing can exist.

If you can build a useful quantum computer, you might achieve quantum supremacy:3 a quantum computer’s ability to perform a task that a classical computer cannot.

Bitcoiners should care about quantum risks

Quantum computing is a very strange technology.

We know what it can do – factor large numbers, for one – and we can even describe exactly how it would go about doing that. We just haven’t built the right kind of hardware to run the algorithm yet. We’re not even completely sure it’s possible to build the hardware.

In some ways, quantum is the antithesis of AI. Quantum capabilities are already known and indeed provable, we just don’t know if we can scale to actually effectuate them. AI capabilities are unknown and potentially unbounded, and we don’t know where we’re going at all. But we do know that if we keep delivering certain inputs (data, training time, and compute), we can get predictably better outputs. We bake larger and larger models and then empirically discover what they can do. Quantum is a statue waiting to be freed from a block of marble; AI is a new lifeform being cultivated inside a petri dish.

There’s two things we know for sure quantum computing can do which classical computers cannot: break all encryption that relies on it being hard to factor numbers, and simulate quantum systems. Beyond that, we only have vague notions of where it might be commercially useful. Logistics optimization or portfolio simulation, maybe. Materials science exploration. Chemistry problems relating to drug discovery or new battery designs.

Quantum is also strange in that while it has enormous scientific promise – after all, we live in a quantum world but we’ve never been able to compute quantumly – its primary near-term application is immensely destructive. A huge chunk of our communications and internet infrastructure relies on RSA, elliptic curve, or Diffie-Helman-based crypto systems, and quantum dispatches all of them. In simpler terms, our entire networked society is built on the assumption that certain problems – factoring a product of two large primes and inverting elliptic-curve multiplication – are hard. (If you read Part I, you should have a good sense of why ECDLP is hard.)

The arrival of Q-day4 would be very positive for our ability to fundamentally understand physics and our universe, but it would also be momentarily calamitous, if we are unprepared. The emergence of a cryptographically relevant quantum computer (“CRQC”) – a quantum computer with a few thousand logical qubits – would force us to abandon most of our fundamental cryptographic infrastructure.

Some systems, like AES and hashing (you should be familiar with SHA-256) are partially degraded by quantum, but not catastrophically so. But all elliptic curve and integer-factoring based cryptosystems would be rendered obsolete.

The fallout would be immense. All encrypted communications will be presumed exposed. (Including pre-Q-day communications that adversaries were smart enough to harvest and wait to decrypt.) The entire web – TLS, HTTPS, server certificates – will have to be torn out and rebuilt. Every government, corporate network, bank, and hospital will have to retrofit their VPN and SSH infrastructure. Cloud infrastructure will have to be rebuilt. Firmware signing and HSMs will be borked. All encrypted messaging systems will have to upgrade. Oh, and all blockchains. Bitcoin, Ethereum, Solana, the lot.

We’ve known for a long time in a detached, academic way that quantum computing would cause unique challenges for blockchains and digital assets. I even put ‘quantum’ on my Bitcoin FUD dice in 2018. But quantum never felt real. It felt like one of those technologies like fusion that was “always 30 years away” with progress stalled due to fundamental limitations. Even today, there are many very smart people who I respect and admire that will tell you with absolute certainty that quantum is a fictional technology, and these kinds of arguments are akin to debating how many angels could dance on the head of a pin.

But as Bitcoiners it’s our duty to be exceptionally paranoid. Bitcoin has this baked into its development mindset. Even unusual and low-probability risks should be taken seriously. And the truth is that the reality on the ground has shifted. There have been fundamental breakthroughs in quantum this year. We are seeing new highs in physical and logical qubit counts. Promising new modalities have emerged. And more capital has been deployed to support quantum startups than ever before.

Quantum threatens the most basic assumption inherent to Bitcoin – that knowledge of a private key is equivalent to ownership of some UTXOs. Quantum entirely breaks this, allowing theoretically anyone to reverse-engineer a private key from a revealed public key. This is unacceptable and existential. The emergence of a CRQC would threaten Bitcoin existentially, not only directly by undermining the property rights of the system, but also by causing political divisions between rival factions who disagree about how to deal with the problem. And the sooner it happens, the worse the outcome will be. So it behooves us to start monitoring quantum progress today, and planning for Q-day as the odds of a CRQC creep higher.

The creation of a CRQC would be bad for Bitcoin

As we discussed in the first post in the series, Bitcoin depends on elliptic curve cryptography, and the assumption that the elliptic curve discrete log problem is hard. Both ECDSA and Schnorr (introduced with Taproot in 2021) are built on ECC and rely on the secp256k1 curve. The one thing we know for sure a quantum computer can do – at sufficient scale, say 2000 logical qubits – is to reverse engineer a private key from a known public key. Recall from our first episode that when we create a public key we start with a private key k and multiply it by a set point G on an elliptic curve, giving us a public key P. Inverting the process is meant to be virtually impossible. Classically, to reverse-engineer k from P given a known G would require simply brute-forcing and trying every single permutation of k until you stumble on the right P. For a 256 bit number, this takes 2¹²⁸ operations. Impossible.

Shor’s algorithm running on a sufficiently large quantum computer undermines this completely. In somewhat mathematical terms: “Shor extracts the discrete log by converting the elliptic curve structure into a frequency-domain period problem, and the quantum Fourier transform pulls the private key out of the symmetry.” In plainer language, the problem is to try and find out the number of steps away public key P is from set point G. Finding this out classically is presumed impossible. The QC running Shor prepares a superposition of all possible combinations of steps between G and P, evaluates the function on those values in one physical evolution, and the only stable surviving pattern is the periodic structure from which k can be extracted. It does not “compute all values of k” in parallel. It holds a weighted blend of all possible inputs simultaneously, evolves one wavefunction containing those possibilities, and highlights a specific pattern of interference.

With a quantum computer of around 1500-2000 logical qubits and maybe 10m physical qubits and a long enough runtime (hours, days), it’s suddenly plausible to turn your public key

02 4033389cf6632a172546748fda79e7fbabce944b552db5dba81b16c01fec377b

back into your private key

50d858e0985ecc7f60418aaf0cc5ab587f42c2570a884095a9e8ccacd0f6545c

To make matters worse, Shor’s algorithm runs in time polynomial in the key size, rather than exponential. For elliptic-curve discrete log on a 256-bit curve, “vanilla” resource estimates are on the order of 10¹¹ Toffoli gates for P-256. More favorable architectural assumptions bring this down to 50 million Toffoli gates per key5. So Shor inverts the scalar multiplication which was meant to be extremely difficult. And, in fairness, it was. We had to invent an entire new branch of physics and then carefully arrange atoms in entangled quantum states to create little miniature computers in order to break it.

What does this mean for Bitcoin?6

We will break it down by coins at rest and coins in transit, since considerations are different. Starting with inert coins, the good news is that Satoshi erected a first line of defense against a quantum attacker by twice hashing public keys to create addresses. Remember how in our first article, we converted the above public key into the address 17oFBXab… by hashing it twice? Quantum computers can break ECC256 but they can’t realistically reverse-engineer SHA2567 in a useful way. So as long as your coins are in an address format that is hashed, they shouldn’t be exploitable by a quantum attacker (with caveats that we will explore shortly).

The coins to worry about are those where the public keys are visible in the locking script, namely pay to public key (p2pk) and pay to multisig (p2ms), an obsolete multisig format.8 You can ignore p2ms for now because it’s not the common multisig address format any more. P2pk is the problematic one as it stores 1.7m BTC or 8.3% of all outstanding coins. These coins almost all date back to the very earliest days of bitcoin. The coins that are presumed to be Satoshi’s are sitting in about 20k different p2pk addresses each with 50 BTC. Here’s one example: Block 13 from 2009. In that transaction, Satoshi (we suspect) received 50 BTC directly from the block reward, as an early miner. The whole block is one transaction straight to an uncompressed public key

04c5a68f5fa2192b215016c5dfb384399a39474165eea22603cd39780e653baad9106e36947a1ba3ad5d3789c5cead18a38a538a7d834a8a2b9f0ea946fb4e6f68

visible on the blockchain.

And there’s tens of thousands of these. Satoshi never consolidated their coins, never moved them over to compressed (hashed) addresses. Satoshi certainly could have done so, knowing the risks. We know that Satoshi was aware of the possibility of a quantum break to ECC. Satoshi suggested that we could move to a new signature algorithm if necessary, but seemed fairly unconcerned about the topic in their handful of posts about it. For whatever reason, Satoshi left these coins in these exposed wallets, and there they sit.

We need to dwell on this for a moment. The fact that 1.7m BTC are sitting in exposed, presumably abandoned p2pk addresses from the early days of Bitcoin is a gigantic problem. No matter what happens with Bitcoin – whether through some miracle we upgrade to a post-quantum signature scheme in an orderly manner – these coins will still be at major risk in the next decade. And unless you think Satoshi – and anyone else from that era that may have lost their keys on an old hard drive – is coming back to rescue their coins in the nick of time, those coins are just a gigantic, hundred-plus-billion-dollar bug bounty to be consigned to whoever develops a CRQC first.

Bitcoin’s protocol can upgrade, yes, but there is no way to go back in time and force those early users to move their coins into more up-to-date address formats. The only thing the Bitcoin community could plausibly do is simply soft fork and decree that those old p2pk coins are unspendable – but this would be a kind of a collective confiscation by mob rule, which is also contrary to a core Bitcoin value. So no matter what, the emergence of a CRQC throws us into a serious dilemma: do we accept that Satoshi’s coins will likely be stolen by whoever happens to develop QC first, or do we violate Bitcoin’s property rights and burn or immobilize the coins? And if we decide to forcibly upgrade those coins to new address formats, or we burn the old coins and create a claimable reserve, how then do we determine who their true owner was? Our previous test for whether Satoshi was genuine or not was a signature matching early coins; but quantum makes this form of proof irrelevant too. So we would have no way to determine, post Q-day, whether someone would be an authentic claimant.

These attacks we are talking about are called “long range attacks” because the attacker has basically unlimited time to reverse-engineer the private key from a known public key. In quantum computing, this is a big deal, because there’s an inverse relationship between time needed to run a program and qubit counts.

Coins held in newer Taproot addresses are also potentially exposed. This is a little shocking because Taproot is a newer addition to Bitcoin, so the engineers behind that probably should have foreseen the risk.9 I’m going to cite the Chaincode report here regarding p2tr because I am not an expert and its complicated, so if I’m wrong, you can go yell at them instead:

Pay to Taproot (P2TR), introduced in the 2021 Taproot soft fork, exposes public keys in a different but equally vulnerable manner. P2TR provides two spending mechanisms: the keypath and the script-path. The key-path allows spending using a signature from a “tweaked key” (a public key combined with a commitment hash of possible script conditions), while the script-path requires revealing and satisfying one of these predefined script conditions. Because the tweaked public key is exposed on the blockchain, a CRQC could potentially derive the corresponding private key, enabling unauthorized spending via the key-path without needing to satisfy any script conditions. Unlike P2PK and P2MS, P2TR’s vulnerability could be addressed through a soft fork that disables key-path spending if quantum threats emerge […].

So unfortunately, Taproot addresses as currently contemplated might expose your public key as well. There’s 185k BTC in p2tr addresses today.

And this is just one class of problem.

The next major issue is that, as we discussed in the first post, whenever you spend Bitcoin, you reveal the public key of the spending wallet on the blockchain. This means that if you have 1000 BTC in a big coldwallet and you send 1 BTC out, the public key for that remaining 999 BTC is now visible.

So even if your coins are in a hashed or compressed address type (these are probably where your coins are being held right now), the moment you actually spend from that address, your public key is exposed. This is called address re-use and it’s discouraged in Bitcoin, but it happens rampantly. And address reuse is actually responsible for more quantum exposure than ancient coins in legacy address types.

Project Eleven has a nice dashboard tracking this. As of today, there are about 4.8m BTC in addresses with exposed public keys due to reuse, and 1.9m BTC in legacy or Taproot addresses that are also exposed.

That’s almost precisely one third of all circulating BTC (or $579b worth) which is vulnerable to a quantum computer today. If you had a CRQC today and you wanted to cause maximum chaos, you wouldn’t even go after one of the thousands of 50 BTC address lots from the Satoshi days. You could instead go for the biggest prize: the Binance coldwallet 34xp4vRoCGJym3xR7yCVPFHoCNxv4Twseo with an exposed public key and 248k BTC in it.

If that doesn’t worry you, there’s a final class of problem which applies to literally all addresses, no matter how good your hygiene.

This final class of exploit is called a short range attack, and it applies in the brief moment after you have broadcast a transaction to the blockchain and before it has settled. No matter what address you’re spending to or from, once you broadcast a transaction, your public key is exposed. In the 10 minutes or so it takes for the transaction to be included in a block, a sufficiently powerful quantum attacker could sniff out your transaction from the mempool, reverse-engineer your private key, and re-broadcast the same transaction to themselves with a higher fee, causing it to get redirected mid-flight. This requires much more powerful quantum computing hardware, and the first attacks are expected to take hours or days, but it’s worth mentioning as a further theoretical vulnerability.

I’ve summarized the different address types and their vulnerabilities in this table10 which includes the hypothetical future address type, Pay to Tapscript Hash, proposed in BIP 360. I will discuss BIP 360 and other proposed mitigations in Part III.

If it sounds grim, it is. Bitcoiners have scarcely contemplated quantum risks to date, especially because many developers believe quantum is still sci-fi technology or decades away. However, if it’s less than a decade away, we have to start planning now. Virtually everything I’ve discussed in this section can be addressed (except perhaps the presumed abandoned and quantum-vulnerable Satoshi coins), but we have to start the process of deliberation now, so that we can move on to selecting a specific class of PQ-signatures, proposing an upgrade to the protocol, and giving users time to opt in.

Bitcoin upgrades are notoriously tricky and slow: SegWit was first formally proposed in March 2015 and only adopted in August 2017. Taproot was conceptually laid out in early 2018 and only activated in late 2021. Any post-quantum soft fork would be a far more fundamental change and would be wildly more complex. It would rip out and replace the essence of the system which is ECC. If we want this implemented by 2030, we have to start thinking about it now. And based on all the data I’m seeing, I think this is warranted.

Why it’s reasonable to be concerned about quantum

In this section I’ll present ten arguments supporting my view that CRQC’s will emerge in the meaningful near future, as in, by 2035. These are arranged in decreasing order of importance – as in, the most persuasive arguments (in my view) come first. I’m not the only one who has noticed. Public markets are in a quantum frenzy. Venture investors have dumped more cash into quantum startups than any other year in history. The CEOs of big tech firms have revised and shortened their quantum timelines. Governments are preparing for Q-day. But instead of appealing to authority or to efficient markets, I’ll try to summarize all the datapoints which caused me to revise my view from “completely off the radar” to “something Bitcoiners (and other coin-ers) should prepare for, starting today.”

1. Governments are planning for a post-quantum world

Major standard-setting bodies like the National Institute of Science and Technology (NIST) have been contemplating the move to post-quantum (PQ) signatures for a while now. Because cryptography operates on decades-long timelines (it is the ultimate foundation of a huge amount of infrastructure, and ripping out and replacing infrastructure is a necessarily slow process), NIST is planning decades ahead. They take no view on when specifically CRQCs might emerge, but point out that since their timelines are long, they are forced to care:

While in the past it was less clear that large quantum computers are a physical possibility, many scientists now believe it to be merely a significant engineering challenge. Some engineers even predict that within the next twenty or so years sufficiently large quantum computers will be built to break essentially all public key schemes currently in use. Historically, it has taken almost two decades to deploy our modern public key cryptography infrastructure. Therefore, regardless of whether we can estimate the exact time of the arrival of the quantum computing era, we must begin now to prepare our information security systems to be able to resist quantum computing.

In 2016, NIST kicked off a process to solicit proposals for quantum-resistant public key algorithms, understanding that both ECC and RSA algorithms were doomed if CRQS emerged. Last year, they published their first public draft detailing their new PQ public key algorithms and laying out a timeline. The timeline is eye opening. They suggest deprecating legacy signature algorithms like ECC256 in 2030 and fully disallowing them by 2035.

NIST has some proposed post-quantum signatures which could be swapped in for ECDSA like ML-DSA but this comes with huge tradeoffs, like a 38x increase in data overhead. Without a further increase in blockspace, swapping in ML-DSA would hammer Bitcoin’s scalability, reducing it by an order of magnitude to around 1tx/sec.

Both the Biden and Trump administrations have released executive orders covering quantum preparedness (although the more recent Trump EO from June 2025 was mostly paring back language from the prior EO 14144).

A couple quantum experts that I interviewed for this piece told me that DARPA’s Quantum Benchmarking Initiative was actually the most telling US government program, as opposed to the NIST guidelines. DARPA’s QBI was launched in 2024 to determine if a “utility-scale” QC (in practice, this would mean a CRQC) could be built by 2033. They expect to have the answer by 2028-29. The implicit (and sometimes outwardly stated) goal of the “US2QC” program is to, in their words “reduce the danger of strategic surprise from underexplored quantum computing systems”. Put simply, useful QC undermines almost all communications infrastructure and creates a massive first-mover advantage. So the US Government wants to know precisely whether this is feasible and if so, when.

So far, they have selected 18 companies, some of whom will qualify for meaningful funding under Stage 2 as they attempt to build a utility-scale QC. In a talk given by DARPA quantum lead Dr. Joe Altepeter this summer, the agency outright said that they had accelerated their quantum projections, expecting a fault tolerant prototype in 2027, scientific utility between 2030-32, and industrial utility as early as 2034.

And on November 4^th, the Department of Energy joined the party, announcing $625m in funding to advance quantum research. And most recently, the U.S.–China Economic and Security Review Commission, a congressional watchdog that monitors China, released their annual report in which they mention quantum 84 times. The Commission does not mince words, expressing the belief that China has “mobilized state-scale investment and industrial coordination to dominate quantum systems” and “is actively racing to develop cryptographically relevant quantum computing capabilities and is likely concealing the location and status of its most advanced efforts.” They suggest that Congress provide meaningful funding to quantum initiatives and support to the private sector.

Virtually every major government besides the US is moving at a similar pace. Britain’s National Cyber Security Centre has called for an inventory of crypto dependencies by 2028, a migration of high-priority systems by 2031, and a full transition by 2035. The EU’s summer 2025 guidance calls for a post-quantum strategy at the nation state level by 2026, the migration of high-risk systems by 2030, and a full transition by 2035. China, perhaps wary of adopting a PQ scheme that has been backdoored by the NSA, is undertaking their own PQ standardization process, and will likely settle on different PQ signatures. That said, they are operating on a similar timeline: 3 years to settle on standards, 5 years for large-scale migration, and 10 years for full consolidation.

While it is the job of cryptographic standard setting bodies to look into the distant future and be paranoid about breaks in major cryptographic infrastructure, the fact that several different major nation state have independently settled on the “deprecate by 2030, disallow by 2035” timeline is quite telling to me. This doesn’t seem like a precaution taken for a technology which is still decades away.

2. Qubit counts are scaling rapidly

As we mentioned, the sheer number of physical qubits is not the only variable that matters in terms creating a CRQC. Whether a QC can do useful work is a function of multiple interlocking variables, some of which include

• The number of physical qubits in an array

• Gate fidelity, or the likelihood a measurement gives the correct result

• Coherence time, or how long a qubit can maintain its quantum state

• Connectivity, or how many qubits can interact with each other

• Gate speed, or the latency per operation

• Error correction throughput, or the amount of time it takes to read and correct errors

Physical qubits themselves are not the goal, which is why most quantum companies express their roadmaps in logical qubit terms – physical qubits which are error-corrected and stable enough to perform useful computation. You could have a QC with a very large number of physical qubits, but if they have a poor fidelity your computer won’t be able to do useful work. If your quantum system has a low coherence time, you won’t be able to run a complex algorithm before your qubits decohere.

Moreover, different quantum systems are not strictly comparable on a physical qubit basis. Major approaches to QC have different fidelities and coherence time, so just looking at physical qubits doesn’t give you much information. In a thousand-physical qubit system, variance in the error rate could mean that you get between zero and dozens of useful logical qubits.

All of that said, looking at physical qubit scaling over time within the same approach can tell you about the development of the field. And we certainly have seen growth on that basis.

Today, platforms like neutral atom have been able to build arrays of 1000 physical qubits. Trapped ion approaches have many fewer qubits but demonstrate much better fidelity.

As you can see on the log chart, physical qubits are scaling through the orders of magnitude. Based on current fidelity rates, you’d need perhaps a million physical qubits11 to obtain enough logical qubits for a CRQC, which is three orders of magnitude away.

As far as logical qubits are concerned, the best systems have only achieved a few dozen logical qubits so far (and even those are disputed), so no trendline is observable yet.

3. Investment in quantum firms is inflecting

It’s been hard to miss the rally in public quantum stocks this year. Standouts Rigetti (RGTI), IonQ (IONQ), and D-Wave Quantum (QBTS) are collectively worth $33.61b having begun the year at $18.7b. In the last 12 months, despite a sharp selloff recently, Rigetti and IonQ experienced blistering rallies in which their stocks surged by factors of 21x and 19x, respectively.

This rapid appreciation has created a cash spigot for these firms. IonQ has raised over $1.3b this year based on the rally in the stock, as well as using their equity for stock-based acquisitions and for hiring. D-Wave quantum, a struggling 2022-era SPAC, was on its last legs in 2024 before quantum hype hit. It was able to raise via an $400m ATM facility filed in 2024. Rigetti was a 2021 SPAC that suffered a 96% drawdown after listing but staged an impressive recovery in 2025, surging 50x from its 2024 lows. In mid 2025, they were able to take advantage of their appreciation to raise $350m in an ATM offering. And Infleqtion went public through a $1.8b SPAC that same month.

Though many believe the appreciation of these companies (which have de-minimis recurring revenue) is a retail mania, they have been able to turn the rally into very real cash hoards that they can redeploy into R&D.

In private markets, investment in quantum startups is also inflecting. 2025 was by far the most active year ever for quantum startup funding.

According to Pitchbook, while deal count has remained relatively static, 2025 was a banner year in VC financing for quantum deals at $6b of capital raised. Notably, PsiQuantum raised a $1b Series E on $7b pre led by BlackRock, Temasek and Baillie Gifford. PsiQuantum is explicitly targeting a million-qubit machine based on photonic qubits, aiming to go for mass scale via existing semiconductor supply chains. I’ll note that PsiQuantum cofounder Terry Rudolph attended and spoke at the Presidio Bitcoin Quantum Bitcoin summit this year. Honeywell’s subsidiary Quantinuum also raised $600m at a $10b pre-money valuation in a round led by Quanta Computer, NVIDIA, and QED.

Meaningful quantum R&D is also taking place at IBM, Microsoft and Google, even though it’s hard to break out how much internal investment is dedicated to the theme. There does appear to be real buy-in at the top though. Google’s Sundar Pichai said this year that “the quantum moment reminds me of where AI was in the 2010s, when we were working on Google Brain,” adding that he thinks practical QC is 5-10 years away. Microsoft’s Nadella has been more effusive, saying of Marjorana 1 “We believe this breakthrough will allow us to create a truly meaningful quantum computer not in decades, as some have predicted, but in years.” IBM is perhaps the most bullish of the big 3, forecasting genuine quantum supremacy (for certain applications) in 2026 and the first large-scale, fault-tolerant QC in 2029. Their roadmap sees them building a CRQC in the early 2030s.

Even disregarding the huge budgets R&D Microsoft, IBM, and Google are capable of throwing at quantum, or government research funding, it looks like private investors forked over around $10b of fresh powder in 2025 alone, a massive acceleration compared to prior years. I interpret this in two ways:

• Sophisticated investors have decided that within their investment timelines (generally 10 years or less for VC), quantum computers will be economically relevant

• Even if quantum was technologically stagnant prior to 2025, the mere addition of attention and capital to the theme has made it fundamentally more likely to work

Of course, there’s still the possibility that quantum is the subject of an investment bubble, and that Rigetti, IonQ, and D-Wave give up all of their gains. On the private side, even sophisticated investors are not immune to thematic mini-bubbles. Those who remember recent history might think of cleantech, mobility, shale, biofuels, 3d printing, NFTs, and so on.

In fact, I think it’s probably true that excitement around quantum has outpaced the fundamental growth of the technology – and certainly the ability for investors to monetize quantum on venture time horizons. But I think both things can be true: that quantum timelines are shortening, and that quantum is the subject of a mini investment mania. As AI bulls will remind you, fundamental technology shifts are more often than not accompanied by investment bubbles, but this doesn’t discredit the underlying technology. (I would argue that they are bicausal – that inflecting fundamentals catalyze investment manias, and that the manias themselves help accelerate the fundamental growth of the technology, even if much of the capital is misallocated). And what we are interested in here is whether quantum computers can become cryptographically relevant, not whether quantum stocks are worth owning.

4. Several major quantum milestones have been achieved this year

In a lot of my discussion with quantum experts they kept reinforcing that things seem to have changed this year, especially around gate fidelity.

In June, a University of Oxford team demonstrated single-qubit gate error rates of 10^-7. In October, IonQ demonstrated two-qubit gates with 99.99%+ fidelity. Quantinuum’s Helios result – a 98-qubit trapped ion processor with 99.921% two-qubit gate fidelities – was considered particularly impressive. Gate fidelity is crucially important. Every additional 9 after the decimal cuts the number of physical qubits required for useful computation by an order of magnitude. If you have 10^-4 error per gate, you can run 10k gates before failure, versus 1k for 10^-3. So 99.99% gate fidelity is generally considered the threshold demarcating toy and actually useful algorithms. And it looks like we are starting to cross that threshold.

Google’s Willow result (technically December 2024) was particularly important. Google showed that as they increased the encoded lattice size of physical qubits in a surface code, the logical error rate decreased in an approximately exponential fashion. One of the major stumbling blocks has been that average error increases with physical qubit count; the Google processor was one of the first times the opposite has been demonstrated. Quantinuum and QuEra also unveiled impressive results along those lines.

As one PHD told me: “error correction has been theorized since the 90s, but it has never been proven experimentally. 2025 was the first year in which we knew for sure it was working.”

On the algorithmic side, I’ll get into this further in part 6 of this section, but the Gidney result for RSA2048 was particularly notable. In June, Gidney released a paper requiring only 1500 logical qubits and fewer than 1m physical qubits to factor RSA2048 in a week, a significant improvement from his 2021 estimate (4000 logical/20m physical/8 hours).

RSA2048 is considered harder than ECC256 to break, so even though a comparable result to ECC256 (around 2000 logical qubits is still required) has not been found, Gidney’s paper demonstrates that algorithmic improvements can be made to further reduce required qubit counts.

On the actual capabilities front, startups like PsiQuantum breaking ground and actually starting to build large-scale quantum mainframes also got people’s attention. On the heels of a $1b round of funding, PsiQuantum announced that they would deliver a million-qubit commercial-grade QC by the end of 2027. There are still known and unknown unknowns with their approach, but they have shown intent to actually scale up their approach rather than just staying in the lab. So things have started to move from demonstrations to the actual construction of what are envisioned as utility-scale quantum computers.

5. Quantum firms project breaking ECC by 2028-2033

While company projections should always be treated with caution, since they have a natural incentive to exaggerate their performance and roadmap, I thought it would be useful to aggregate what the major players in QC have been projecting. The industry has moved away from talking about their capacity in physical qubit terms and is more focused on logical qubits, since the efficacy of physical qubits is so dependent on error correction which is highly variable. Trendlines are depicted with dashed lines.

According to the stated projections of major quantum firms, the industry expects to reach ECC256 breach capability (2000 logical qubits on this chart) between 2028 and 2033. For context on where we are today, Quantinuum unveiled a 48 logical qubit quantum computer on Nov. 5.

These projections are consistent with the responses I got from the physicists that I interviewed for this article. Most of them told me that they expected a CRQC in the early 2030s. Some of them even assigned a low but nonzero probability to the idea that a CRQC might exist already (having been covertly produced by a secretive firm or government).

Some companies have made physical qubit predictions as well, but these are harder to associate with an ECDLP break because there’s no specific number of physical qubits that corresponds to a logical qubit.

All of that said, with today’s fidelities, you’d be looking at a couple million physical qubits (the very top of this chart) to achieve 2000 logical qubits, and only IonQ and PsiQuantum are even projecting numbers that high.

DARPA also released a version of this chart in July 2025 in which they expect around 1m physical qubits to be the threshold for a CRQC, although they did express that their timelines were moving earlier.

6. The number of qubits needed to break crypto systems is dropping

The other problem is that not only are quantum computers expected to get better in the coming decade, but it’s reasonable to expect that the computational demands for cracking ECC via Shor get easier.

The number of logical qubits needed to break ECC256 with Shor is fairly well established: 2330 based on Roettler et al (2017). To go from a logical qubit count to an estimate of physical qubits, you need to bake in error rate assumptions (lower error rate = fewer physical qubits needed per logical qubit), and you can tighten or relax time requirements as needed (longer time = fewer physical qubits needed).

As time has passed, algorithmic improvements have brought down the number of physical qubits theoretically required. In 2022, Webber et al postulated 3.17 * 10⁸ or 317m physical qubits to break ECC256 within one hour or 13m to break it within 24 hours with an assumption of a 0.001 physical gate error. Of course, if gate error rate can be further reduced, the number of physical qubits continues to fall.

In 2023, Daniel Litinski of PsiQuantum proposed a mere 6.912m physical qubits for a 10-minute private key derivation, a significant improvement on earlier proposals.

In their 2025 paper, Dallaire-Demers, Doyle, and Foo standardize the physical qubit requirements for ECC256 and RSA found in the literature, finding four orders of magnitude drops in requirements between 2010 and 2025 for both cryptosystems (the grey dots and black squares on the below chart).

In that same paper, the authors derive their own estimate of the number of physical qubits to break ECC256, placing it in the 100k-1m range. As a reminder, the top labs are only able to produce 1k physical qubit processors today, so we are “only” two to three orders of magnitude away from a break. And remember, this convergence can happen through both algorithmic reductions in requirements or better hardware.

Based on demonstrated improving capabilities from top quantum labs and disclosed roadmaps, Dallaire-Demers and his colleagues simply extrapolate the falling physical qubit requirements for a CRQC alongside rising capabilities and expect the first intersections to occur between 2027 and 2033.

And if you want to sanity check this, simply refer to IBM’s own website: they predict that their Blue Jay system expected in 2033 will run circuits of 1 billion gates and 2000 logical qubits, enough to break ECC256.

7. Bitcoin is itself a bug bounty for quantum supremacy

This is an obvious one. Bitcoin is the largest concrete “buyer” of an industrial-scale quantum computer’s product. Satoshi’s coins are worth around $100 billion, with another $500 billion laying around in quantum vulnerable addresses today. We will cover various Q-day scenarios in the third and final installment of this piece, but I want to briefly touch on why the existence of Bitcoin is indeed an accelerant to quantum computing development. Let’s consider it from the perspective of four types of entities who get their hands on a CRQC: lawful evil, chaotic evil, lawful good, and chaotic neutral. I want to use this analytic frame because I often encounter people who tell me that no one would steal any Bitcoin because the consequences would be so dire – Bitcoin would collapse, they would go to jail, etc. But I can think of a few different threat models whereby Bitcoin is nevertheless vulnerable.12

Neutral evil: this is quantum from North Korea’s perspective. They like to steal crypto, not because they have any ideological issue with the US but simply because it pays the bills. In fact, they probably want crypto to keep existing, because stealing it is a good business for them. If a CRQC became sufficiently cheap and easy to create, it’s not impossible to imagine that pariah states like North Korea might get their hands on the technology. Personally, I would surmise that once a method to create a CRQC is established and known, it will be much harder to enforce non-proliferation than it has been with nuclear power, for instance.

So let’s suppose that in the not too distant future the method for creating a CRQC is established and North Korea is able to get their hands on the technology. I would imagine that they would try to monetize it, not with an obvious theft (like stealing Satoshi’s old coins) but simply by using quantum to exploit funds from an exchange coldwallet (with an exposed pubkey), and pretend that it’s a conventional hack. No exchange would realistically be able to tell the difference. (Although – any large or unexpected hacks from ~today forward will have people wondering if they are quantum in nature.) North Korea wants to keep their crypto franchise going so they won’t want to completely destroy the industry by tipping their hand. They also have absolutely no qualms about stealing Bitcoin from westerners. And the US can’t do anything in response because NK is already a pariah and has nuclear weapons. They are “neutral” in this example because they are basically economically motivated and we can model their behavior accordingly.

Chaotic evil: in Q world, this is China. China is the most likely candidate to develop a CRQC outside of the NSA or the American private sector. They have the talent, the capital, and a government that is spectacularly efficient when it comes to industrial policy. Given the immense strategic advantage that is afforded by being the first entity in possession of a CRQC, they have a strong incentive to conceal their progress.

China is chaotic evil when it comes to post-Q-day Bitcoin, because they have a well-established animus towards the system and an incentive to mess with the network. Bitcoin is now associated with the US, thanks to the Trump administration’s embrace of the network and the fact that a majority of coins are held by US firms, individuals, ETFs, and so on. And since China banned Bitcoin in 2021, while some Chinese firms and individuals presumably still hold it, presumably less Chinese wealth is in the coin. Not to mention that the Chinese government tends to be rather callous about destroying household wealth when its strategic needs dictate. The CCP also doesn’t care about decentralization or Bitcoin and is instead more keen to push their own CBDC or digital yuan. So China has relatively little to lose from disrupting Bitcoin, and a fair amount to gain – embarrassing the US and directly harming us economically. With the US holding a (likely growing) strategic reserve of Bitcoin, even if China can’t touch the reserve directly, they can still affect its value by shaking confidence in the Bitcoin network. It would be like reaching into Fort Knox and stealing some of the gold bars. If relations further deteriorate between the US and China, why wouldn’t they consider this option in their economic warfare toolkit?

For this reason, China gaining first access to a CRQC is what scares me most. They have the clear motive, potentially the means, and the opportunity to weaponize a CRQC against the Bitcoin network and by extension the US. Unlike North Korea, they might not seek to monetize their exploit, but instead aim to cause maximum chaos. All they would have to do is steal a couple of Satoshi’s old 50 BTC wallets (or the Binance coldwallet) and people would start to panic. If Q-day came abruptly, before any mitigation or migration plan was in place, with no shared agreement over what we should do about Q-vulnerable coins, China could exploit this to cause genuine network-destroying chaos. Bitcoin might still exist after a rushed and messy migration to post-quantum signatures, but the notion of surrendering 1-5m coins to the CCP might simply cause people to abandon the network in disgust. This possibility is genuinely existential and what motivated me to write this article in the first place. It worries me more than anything because China is indeed likely to obtain a CRQC (if the technology permits it) at some point. Even if they get it second, and Bitcoin isn’t prepared, they can still wreak havoc.

Chaotic neutral: Chaotic neutral is simply a law-abiding, private sector firm in the West. In terms of probabilities, assuming a CRQC is created, I think this is one of the most likely. I would wager that the first entity to produce a real CRQC would be a western (European or American) private company. Billion-dollar fundraises are not unusual in the quantum space these days. It is absolutely the case that in these fundraise discussions, the prospect of monetizing through Bitcoin is brought up. (It is generally whispered and hinted at rather than shouted from the rooftops.) Of course, outright theft would not be possible, but there is at a minimum a niche business to be had in mining for provably lost wallets. If that Welsh guy with the hard drive in the landfill remembers his public key, he would be an ideal client. White hat hacking, basically. And they might hold out hope that the US government could give them a privateer-esque license to go around stealing back stolen coins held by North Korea or a treasure-hunting license to go find “disregarded” coins (i.e., Satoshi’s stash, or coins that haven’t moved in over a decade). Like a wayward billionaire with a submarine trawling the ocean floor for shipwrecked Spanish doubloons. It’s technically still “stealing” but from some merchant 500 years ago. Digging up Satoshi’s coins is only a difference in degree.

These companies are already interested in Bitcoin, which is why they mention it in their pitch decks and their CEOs attend Bitcoin meetups. It’s not a secret that they view Bitcoin as an obvious, near term, highly intelligible means to monetize their otherwise very abstract technology. My point is that there are plenty of ways law-bound western private firms could still “attack” Bitcoin and justify it morally and legally.

Lawful good: this is perhaps the best-case scenario in my mind (barring a highly proactive and orderly fork protecting quantum-vulnerable coins, and moving Bitcoin over to PQ signatures). The lawful good actor in Q world would simply be … the US government.

I know, I know.

In the strange fantasy I’ve concocted in my head, the US government comes to care very much about Bitcoin’s long-term prospects – maybe the strategic reserve has swollen in size and Treasury doesn’t want it to simply vanish. Maybe it emerges that Satoshi is American and it becomes a matter of national pride. Or maybe the government doesn’t want trillions in savings of ordinary Americans to be deleted overnight.

So let’s say the US government gets their hands on a CRQC, either because they created it in-house at the NSA,13 or some American startup wins the race. They know that they have a very short window until China steals or copies the technology and builds one too.

Recall that after America empirically demonstrated fission in 1945 they only had 4 short years until the Soviets built a working bomb of their own. (The US assumed they would be the sole nuclear power for at least a decade, but Soviet espionage ensured that they were a fast follower.) The thing about scientific discoveries is that replicating them once the method is established tends to be much easier than figuring out how to do it in the first place. For instance, Germany spent all their time going down a heavy water dead end (you need tons of heavy water to make enriched plutonium and they could only make it at one plant in Norway, which got sabotaged). The US went the graphite route to enrich uranium, which Germany had discarded because they thought it was a dead end. In reality, Germany was using insufficiently pure graphite which tricked them into thinking it didn’t work. Had they known what Fermi and Szilard figured out – that boron impurities were ruining the refinement process – they could have built a bomb in time, too.

So I’m assuming that if the US builds a CRQC first, China will almost immediately know how to do it, either through industrial espionage, or simply reading press releases and figuring out the right modality and set of tradeoffs. At that point, it will be a matter of months until they are at parity.

So what does the US government do, fearful of China developing a CRQC and wreaking havoc on Bitcoin (among other things)? They authorize a private sector firm to pre-emptively “requisition” the quantum-vulnerable Bitcoin. (Let’s say that there’s only 1-2 million quantum vulnerable coins left at this point, because the US has informed all the Bitcoiners of the risk and everyone else has moved over to PQ addresses). They could do this by having the Attorney General provide a no-action letter to the quantum firm in question, allowing them to keep some percentage as a finder’s fee. The remainder of the Bitcoin (basically, Satoshi’s coins) would go right into the Bitcoin Reserve, where they would presumably be safe. The government could always maintain that if Satoshi returned and proved their identity beyond a shadow of a doubt they could rightfully claim their coins.

Or the government could simply requisition the coins directly, “for safe-keeping” of course. I think virtually all Bitcoiners would rather that the US government obtain the 1-2m BTC and commit to stewarding them responsibly as opposed to North Korea or China.

So depending on who obtains a CRQC first – a private sector entity, the US government, or a hostile foreign government – I think you can make the case that a huge tranche of coins would be vulnerable no matter what. For this reason, we should prepare for either theft by a hostile entity or a nevertheless unsettling seizure by a benign entity. No matter what, when Q-day arrives, some of the coins are going missing. Unless we do something first.

8. Quantum is a race with geopolitical stakes like AGI

Much like AGI or superintelligence, CRQCs are of paramount geopolitical importance. In fact, they matter more to governments than anyone else. The first government to get access to a CRQC will be able to break (non-upgraded) TLS/HTTPS, VPNs, un-migrated industrial control systems, and decrypt harvested traffic. Certain systems have hardcoded cryptography and can’t easily be upgraded so will be vulnerable. Think industrial robots, power grid controllers, medical implants, and elevator controls. Devices with burned root keys like routers, modems, set top boxes and so on cannot be upgraded and would also be vulnerable. Now consider long-lived satellites already in orbit. They can’t receive firmware updates to change their crypto systems either. A quantum attacker could impersonate ground control and commandeer them.

While many systems will eventually be migrated to PQ crypto, the world for decades will be populated with legacy connected systems that are nevertheless unable to upgrade and hence vulnerable to takeover. Any government in possession of a CRQC could wreak havoc for a while.

They will most likely be able to make rapid progress in physics research, with likely advancements in chemistry and materials science.

This complicates things for us crypto people. First of all, if quantum starts to look at all realistic, governments will intensify their efforts to be first. Bonus if they can be first while others don’t think they have the capability yet. Once everyone has QCs, presumably the entire world will upgrade to post-quantum cryptography to the extent they are able, and communications infrastructure will be re-encrypted. But if just one government has a QC, and they don’t tell anyone about it, they will have a window of opportunity to read virtually all classically-encrypted but quantum vulnerable traffic. Think: locations of nuclear submarines, military readiness information, knowledge of what satellites are looking at, classified fighter jet schematics, frontier AI model weights, theft of high-value corporate IP, and so on.

Governments are also harvesting encrypted data from their adversaries today, with the expectation that they could decrypt it in the future. So even if future governments get smart and start to use PQ cryptography to encrypt sensitive communications, today’s governments are probably still leaking information.

It’s not inconceivable to me that China or the US or both launch a kind of quantum Manhattan project if it becomes more and more evident that a CRQC will exist. Just recently the White House announced the Genesis Mission, “a dedicated, coordinated national effort to unleash a new age of AI‑accelerated innovation and discovery that can solve the most challenging problems of this century,” mentioning quantum as well. China could and probably has already accelerated QC research with little fanfare.

As with nuclear fission, timelines can compress quickly once a technological development is known to be theoretically possible. It was only in 1938 that nuclear fission was discovered experimentally and then theoretically explained. Less than 7 years later, a working prototype was detonated in New Mexico. In my view, the collective discovery that error correction can actually work is a catalyst of a similar magnitude. Many experts thought quantum computing was a dead end for decades because errors in quantum system tended to be introduced faster than they could be corrected. Each additional qubit made the system worse, not better. It was only in the last year or so that researchers proved they could add qubits and reduce the net error in the system, creating the conditions for scale. Quantum supremacy had never realistically been demonstrated until Google’s 2019 demo or Quantinuum’s 2023/24 demos.

In my view, breakthroughs in error correction and gate fidelity are the proof points that should cause the expert consensus to be revised from “potentially impossible” to “likely and practical”. I expect that this will drive governments to dedicate significantly more resources to the task, further shortening timelines.

9. AI could accelerate the pace of quantum development

And of course, none of this is happening in isolation. It’s interesting to me that quantum is finally “happening” at around the same time as AI, and it’s indeed possible that 2027 ends up being the most interesting year in history, as the year in which we get both AGI and a CRQC.

AI is relevant to quantum in quite a few ways, and I view it as a potentially meaningful accelerant.

First of all, AI has trained investors to extrapolate exponential trends and consider what the world looks like a few short orders of magnitude away. If you were thinking in exponentials in 2019 or 2020, you realized that we could simply throw more data at these models and we could reliably get more and more intelligence. If you monetized this insight by going long OpenAI or NVIDIA you made a killing. Most investors were not thinking this way, but today they have been conditioned to reason like this. AI also taught us that capital can create massive speedups in an already exponential trend. Technology doesn’t progress in a vacuum. A decade ago, it would have been unthinkable to most that AI models would be passing the Turing test with perfect ease, that AI datacenter buildout would have eclipsed the telecom boom as a share of GDP, or that GDP growth would actually be largely driven by AI CAPEX spending. But the emerging utility of AI completely redirected economy-wide capital flows. Similarly, if we attain meaningful quantum supremacy in scientific and commercial applications (possible with 100s of logical qubits), investors will re-rate the odds of a utility-scale quantum computer, and accordingly pour more cash into the asset class. This dynamic of forward-looking exponential expectations which has now been hammered into investors’ heads by AI should carry over to quantum. Or as Scott Aaronson says, “Nowadays, of course, pessimism about technological progress seems hard to square with the revolution that’s happening in AI, another field that spent decades being ridiculed for unfulfilled promises and that’s now fulfilling the promises.”

Second, AI has already begun to accelerate scientific progress by assisting with mathematical discoveries. While AI hasn’t solved any major unsolved problems in math like the Millenium Prize Problems yet, mathematicians have started to productively use AI to devise new conjectures about π and e and find novel results in knot theory, combinatorics, and Ramanujan Machines.

And for QC specifically, AI has begun to pay dividends. Google’s quantum unit was even rebranded as “Google Quantum AI” to acknowledge the important role of AI in designing QC. Google used ML and RL for error correction in their landmark Willow processor. In the last couple years a vast literature has emerged employing neural networks to assist in quantum error correction.14 It is evident that advances in machine learning and AI are accelerating quantum development, although the magnitude of this effect is hard to determine.

10. Credible people have revised their quantum timelines

This one is tenth because this is the scientific equivalent of hearsay, but I still find it notable that quite a few quantum luminaries have become more excited about quantum in the last year or so.

It’s worth prefacing that expert consensus, to the extent it exists, is a markedly longer timeline than I am anticipating in this article.15 The best survey I can find of quantum experts is the Global Risk Institute’s Quantum Threat Timeline, which surveys a number of quantum experts every year. For some reason, they didn’t do it in 2025, but their 2024 edition has surveyed experts placing a 50% likelihood of an RSA break in 2040.16

The forecasting site Metaculus, which aggregates expert consensus, currently lists the mean timeline for a quantum RSA break at 2034. This has actually come down significantly from just a couple years ago when the mean timeline was in the 2050s.

So the experts are still fairly skeptical about a near-term quantum break.

But expert consensus is sometimes wrong.

The person who may have done the most to revise quantum timelines earlier this year is Scott Aaronson, a very well-known professor and theoretical computer scientist. In preparation for this blog post I read his book “Quantum Computing Since Democritus” and I will say that while I enjoyed the philosophical digressions I wouldn’t recommend it unless you have a strong math background. Aaronson is specifically known for being a quantum computing skeptic of sorts; though it’s the subject he’s best known for, he is also vocally skeptical of the hyperbolic claims that tend to characterize firms in the quantum space. So reading his blog entries this year I was extremely surprised to see that he had meaningfully revised his view of QC’s viability. In September he wrote:

I started in quantum computing around 1998, which is not quite as long as some people here, but which does cover most of the time since Shor’s algorithm and the rest were discovered. So I can say: this past year or two is the first time I’ve felt like the race to build a scalable fault-tolerant quantum computer is actually underway. Like people are no longer merely giving talks about the race or warming up for the race, but running the race.

And

I’m now more optimistic than I’ve ever been that, if things continue at the current rate, either there are useful fault-tolerant QCs in the next decade, or else something surprising happens to stop that.

As far as “why now,” he refers to 2-qubit gate fidelities, reminding us that at 99.99% accuracy, we can fix errors faster than they are introduced. At the start of his career we were in the 50% range, but in the last year some firms have demonstrated 99.9%.17

This is the exact same answer I got from a physics PHD who works in quantum when I interviewed him for this article. “Error correction is everything,” he told me. “We are making progress, and people are starting to notice.”

Back to Aaronson. Regarding ECC and RSA, he says:

To any of you who are worried about post-quantum cryptography—by now I’m so used to delivering a message of, maybe, eventually, someone will need to start thinking about migrating from RSA and Diffie-Hellman and elliptic curve crypto to lattice-based crypto, or other systems that could plausibly withstand quantum attack. I think today that message needs to change. I think today the message needs to be: yes, unequivocally, worry about this now. Have a plan.

As I was in the middle of writing this article, Aaronson surprised me by publishing a blog post with an even more ebullient prediction.

Evidence continues to pile up that we are not living in the universe of Gil Kalai and the other quantum computing skeptics. Indeed, given the current staggering rate of hardware progress, I now think it’s a live possibility that we’ll have a fault-tolerant quantum computer running Shor’s algorithm before the next US presidential election.

This was widely reported on, and seemingly influenced Ethereum’s Vitalik Buterin, who tweeted a few days later:

I think I sorta forgot elliptic curves exist over the last year.

(obviously privacy protocols still need them until we figure out proof aggregation, but in general they’re on their way out because looming quantum risk)”

And then he followed up by flatly stating “elliptic curves are going to die” at Devconnect.

Aaronson’s comments caused such an uproar that he was forced to write a post begging people to stop getting so excited about it. But even in that attempt to quell the excitement, he reinforced the danger Bitcoin faces:

[I]f you think Bitcoin, and SSL, and all the other protocols based on Shor-breakable cryptography, are almost certainly safe for the next 5 years … then I submit that your confidence is also unwarranted. Your confidence might then be like most physicists’ confidence in 1938 that nuclear weapons were decades away, or like my own confidence in 2015 that an AI able to pass a reasonable Turing Test was decades away.

Elsewhere, while you have Jensen Huang predicting useful quantum is two decades out, the founder of Google Quantum AI Hartmut Neven said in February: “We’re optimistic that within five years we’ll see real-world applications that are possible only on quantum computers.” In October, Google arguably demonstrated quantum advantage18 for the very first time on their Willow processor. I could cite the CEOs of all the quantum companies, but they have a financial incentive to overhype their capabilities, so that won’t be very persuasive.

One particularly detailed case of a revised timeline is Marin Ivezic’s June 2025 analysis in which he accelerates his Q-day timeline from 2032 to 2030. He cites three developments this year which shortened his timelines: IBM’s 2025 timeline aiming for 200 logical qubits by 2029; the May 2025 Gidney paper19 showing that perhaps 1000 logical qubits might be sufficient to factor RSA2048; and Oxford’s result demonstrating 10^-7 gate error.

Put those three facts together and my old 2032 Q-Day estimate is essentially baked in even if the field made zero further scientific breakthroughs after June 2025 and simply executed on what has just been published. Realistically, though, we’ll keep squeezing qubit overhead with better error-correction codes, smarter factoring circuits, and faster hardware integration. That steady drumbeat of incremental wins makes me believe that I should bring the estimate closer to 2030.

This entry is tenth on my list because it’s just a bunch of people saying things, while expert consensus remains fairly adamant that a CRQC is a 2035-2040+ phenomenon. However, the dissenters are notable enough to warrant mentioning.

What should Bitcoiners do today?

Let’s say you’re persuaded by all the above, and you’re more than a bit alarmed. I will cover all the proposed remedies to a CRQC and more detailed effects on various blockchains in my third installment in the series. But what should Bitcoiners do about the problem right now?

As we’ve established, CRQC destroys a key assumption that Bitcoin is based on – the notion that knowledge of a private key is tantamount to ownership. Post Q-day, mere knowledge of the private key is no longer sufficient to establish someone as the rightful owner of a given UTXO.

The first major risk is to quantum-vulnerable bitcoin in the three exposed formats: p2pk, p2ms, and p2tr. Unless you’re Satoshi, you probably haven’t used p2pk outputs. P2ms is an obsolete multisig format that only secures 57 BTC (multisig today is done with p2sh, p2wsh, or Taproot). Weirdly, Taproot addresses (“bc1p…”) are more exposed to quantum risk than other contemporary address types, since they can expose a public key in the output.20 You perhaps can’t fault the developers behind the Taproot upgrade because they may not have been thinking about quantum risk back in 2018 when they first proposed it. But the grim truth is, if you are worried about a quantum breach, you should regress to using only hashed address formats like p2pkh (“1…”), p2wpkh (“bc1q…”), or p2sh (“3…”).

These are safe on Q-day IF you have not previously spent from those addresses. But even for hashed addresses, the moment you broadcast a transaction from one of those addresses, you expose your public key to an attacker. So pragmatically, what you should do is never reuse addresses, and if you do spend from an address, don’t leave any change or residual funds there. Wherever your funds are at rest, they must be in an address that has never broadcast an outgoing spend. And this is already established wisdom, but don’t leak your xpub anywhere online – it allows a quantum attacker to view all public keys connected to that master key.

Alternatively, if you don’t trust yourself to maintain good wallet hygiene, you could send your coins to a custodian that credibly signals a state of quantum readiness. At the moment, few if any custodians have signaled that they are taking active measures to quantum-proof their coins, but one assumes they will as Q-day approaches. Not to mention that custodians will be bigger honeypots for quantum-enabled hackers. And truthfully, until Bitcoin adopts a post-quantum signature scheme at the protocol level, any coins in transit and many coins at rest will be vulnerable.

Realistically, beyond making sure your coins are sitting in non-reused, hashed addresses, ordinary Bitcoiners have little to do ahead of Q-day. Instead, you should engage in “watchful waiting” – mindful of the threat, but not overly concerned unless something changes. Informationally, a useful tool would be a set of prediction markets organized like options strikes going out to 203521. The prediction markets could be structured as follows:

[x] bits of ECC broken by a quantum computer by [date]

So far, researchers have broken 6-bit elliptic curve keys using QCs. The pace of breakage and the future risk implied by the prediction market will allow us to both better assess when Q-day might arrive (informing the urgency of making protocol-level changes), and also to hedge our Bitcoin exposure. I expect the 256-bit markets for 2027 and onwards will be the most liquid, and if you are concerned about your Bitcoin position losing value because of uncertainty surrounding a quantum break, especially an “early break” before Bitcoin has adapted, you could go long Yes on the prediction markets. Think about it like catastrophe insurance or long-dated out of the money SPY puts. Since the market implied odds ought to be fairly low (if I had to guess, I think the market will price a clean break by 2030 at around 5%), the cost of insurance should be low as well. All of this presumes sufficient liquidity. And Polymarket will have to find a way to deliver your coins post-quantum break, which might be easier said than done.

Even though you may be a little worried reading this, I am not panicking. I think the best way to deal with an uncertain future is to embrace unpleasant truths, rather than believe pleasant fantasies. Let’s say quantum happens – sometime in the next 5, 10 or 15 years. It’s better to acknowledge that it’s a problem today and get started on the debates that matter, so that we aren’t caught by surprise on Q-day:

• What do we do about Satoshi’s and other abandoned, vulnerable coins?

• What kind of protocol level change to Bitcoin should we make and how?

• What sort of post-quantum cryptography should we adopt?

• When should we initiate the migration process?

• How long do we realistically have?

That’s the point of this series. Not to spread panic, but to galvanize action so we can tackle this future problem in an orderly manner rather than dealing with forks, theft, or chain halts down the road.

Update 11/26/25: updated language around a potential fork to render vulnerable p2pk coins unspendable. Such a fork would be a soft fork, since it tightens protocol rules

Quantum computing is, in my opinion, the biggest risk to Bitcoin. It’s a big looming problem for a lot of financial systems, and for various other blockchains too, but it’s kind of a uniquely big and intractable problem for Bitcoin. I have been developing these views for some time and recent developments have only further convinced me that this needs to be treated some urgency and seriousness. In this series I lay out how Bitcoin works, why I think quantum is a real and particularly challenging issue for Bitcoin specifically, and various post- quantum break scenarios.

Before we get into quantum, though, we need a brief refresher on how and why Bitcoin is secure.

I’m going to explain Bitcoin’s cryptographic security first in three ways:

1. a literal protocol-y way

2. a visual, mathematical way; and

3. via analogy.

Building intuition around elliptic curves is very hard. I’m sure there are some mathematicians who great intuition around it. Truthfully I didn’t before writing this article. I just took it for granted that the cryptography worked.

(This section is giving me a real “If you wish to make an apple pie from scratch, you must first invent the universe” feeling. I am struck by how many load-bearing cryptographic techniques are involved in a “simple” bitcoin keypair, and I don’t have time to recursively explain all of them.)

Bitcoin from the protocol perspective

You start with randomness (entropy). Simply speaking, you think up a really big number between 1 and 2²⁵⁶.1 Let’s use the SHA256 hash of “example”2 to generate a toy private key. That gives you a 256-bit integer. This is your private key:

50d858e0985ecc7f60418aaf0cc5ab587f42c2570a884095a9e8ccacd0f6545c

You then take this integer and use it as an input into a special curve equation that we’ve all agreed to use for ECDSA called secp256k1. What you do specifically is (in an elliptic-curve, scalar way) multiply the private key k with G, a known point in the secp256k1 curve we’ve all agreed on. What you’re actually doing here is adding G to itself k times, on this specific elliptic curve.

The output of k * G is your public key. In our example, our public key in hex is

02 4033389cf6632a172546748fda79e7fbabce944b552db5dba81b16c01fec377b

For a legacy address in P2PKH format, you then hash the public key twice (once with SHA256 and once with RIPEMD) and in this case you get:

17oFBXabB2LLgDoUfu5P5bPxWvNepHQ96T

This is your pay-to-public-key-hash bitcoin address. If you’ve used Bitcoin it should look familiar. It’s not the only address format and not the only digital signature that we use in Bitcoin. Since 2021, we also have Schnorr signatures, which use the same elliptic curve (secp256k1) but are simpler and have some other useful properties.

Assume your address has some Bitcoin associated with it. More precisely, assume the Bitcoin UTXO set contains some unspent transaction outputs (UTXOs) that list YOUR address in the locking script. That’s what we talk about when we talk about “owning a Bitcoin” – knowing the private key corresponding to the public key whose hash the bitcoin blockchain lists as being able to satisfy the spending conditions to un-encumber some units of Bitcoin, if you provide a valid signature.

In more literal terms, a UTXO in the blockchain might look something like this:

value: 0.50000000 BTC

scriptPubKey: OP_DUP OP_HASH160 4a8fba212554eac0a6f956d7d34ef783a7a16ca2 OP_EQUALVERIFY OP_CHECKSIG

The hash “4a8f…” is a 20-byte hash of your earlier compressed public key.

To spend a P2PKH output, you must provide (to the other participating nodes) a signature and your public key. Your wallet, which still has knowledge of your original private key (“50d858e…”) produces an ECDSA signature over the hash of the transaction data (some administrative stuff, the previous UTXO script, and the outputs you’re creating – as in, where you’re sending how much BTC).

The other nodes on the Bitcoin network that receive your transaction duplicate the public key -> address transformation by hashing the public key which you broadcast and making sure it corresponds to the hash that exists on the blockchain. They then verify the signature you’ve posted against the pubkey and the transaction hash. In plain language, when you publish a signature, you are saying “I know the private key corresponding to the public key whose hash locks the UTXO I’m spending.”

Even though you can receive transactions to your address (“17oFB…”), you have to actually broadcast the public key (“02 4033389…”) when you want to spend the coins. This is important, remember this for later.

Ok, so that’s a very mechanical explanation of how Bitcoin works, but it leaves us with little intuition. What we’re really interested in is understanding why and how the discrete log problem is hard.

Bitcoin’s cryptographic security in a visual way

(I have no background in math beyond doing stats and econometrics in my graduate program. It’s entirely possible I’m making mistakes here. For alternative primers on ECC/ECDSA see here, here and here).

The actual elliptic curve used in ECDSA is called secp256k1 and it is defined as:

Where p is the following prime number:

The “curve” sits on a very large field, bounded on both axes by p. If you end up with a coordinate which is larger than p, you simply divide by p and keep the remainder, staying in the finite field.

The mod in mod (p) is short for modulo, which is fancy math talk for “the remainder after a certain number is reached,” or in more simple terms, “wrapping around”. We actually do modular arithmetic all the time, when we count time. On a clock, we count “mod 12”. If it’s 10 am and we want to add 5 hours, we hit 12 and wrap around to 3pm, not onwards to 15 (unless we’re in Europe).

In the clock example, we are doing (10 + 5) mod 12 = 3.

Modular arithmetic ensures that the “game” we are playing happens on a finite “map”. We need this so computers can make sense of everything. But unlike in a video game, it’s a map where if you hit the edge, you instantly teleport to the other side.

Plotting at the elliptic curve y² = x³ + 7 not modulo anything, but simply plotted over real numbers, gives us this:

Bitcoin’s curve doesn’t look anything like this though. By making the secp256k1 curve modular (or “discrete”) we are setting clear rules for the “game” so everyone is on the same page and computers can do the math without weird infinities and edge cases.

Once you define the curve group over a finite set of numbers with the prime modulus, you get a curve that looks more like this:

Keep in mind that this curve has a modulus of 211, whereas secp256k1’s modulus is ~2²⁵⁶.

For this reason, you can’t really “look” at Bitcoin’s curve. In fact, you literally can’t. Let’s say you tried to depict a portion of Bitcoin’s elliptic curve on a standard HD screen with ~2m pixels where one pixel equals one integer. Bitcoin’s grid stretches over 10⁷⁷ x 10⁷⁷ possible integers. So you’re only rendering a minute fraction of the curve space (10^-74). No points at all would show on your screen. You’d have to zoom out by 10³⁵ on each axis before you could expect to see a single point.

Bitcoin land is big. And invisible.

For the sake of intuition, let’s return to the more intelligible elliptic curve defined over the set of real numbers, with no modulus.

Recall from earlier that we are picking a private key k (a random large number) and then multiplying set starting point G by itself k times. So we are multiplying k * G but really in elliptic curve land we are adding G to itself k number of times.

Visually, this is what it looks like. The “game” is to add various points together and make progress by moving around the curve (unpredictably). The way you “add” points in a geometric sense on elliptic curves is to draw a line between them, find the point where that line intersects the curve, and invert that point over the x axis. (This works because there is a rule in algebraic geometry that says that any non-vertical line intersects an elliptic curve exactly three times.3) When you are adding the same point to itself, you take the tangent of the curve. You can build intuition for why we take the tangent if you think about drawing a line between two points on a curve that are very close together.

Recall that we want to multiply G by k, or add G to itself k times.

First, we add G to G by taking its tangent. We follow this line until it hits the curve again, and then reflect it over the x axis. (The entire curve is symmetrical.) This new point is 2G.

Once we have 2G, we want to keep adding G’s. So we simply add G to 2G, and we do this by drawing a line (or the “chord”) between G and 2G, finding the intersection point, and again reflecting this over the x axis. That gives us 3G.

The thing to remember is that when you’re incrementing to an odd number, you have to add +1G using the point-to-point (chord) method. However, when you are going up to an even number (2G to 4G), you can skip ahead and double your point to itself. We represent this geometrically with a tangent, even though in Bitcoin-land this doesn’t make visual sense as we are just dealing with a field of points. Rest assured though, the tangent math still works algebraically.

If we continue our progression to get to 4G you can see that instead of going from 3G to 4G, we can instead simply double 2G to get to 4G by taking the tangent of 2G. (You’ll notice that you can also get to 4G by adding G to 3G with the chord rule.) Pay attention to this, it’s important.

So in our simplified model, after adding G to itself k number of times, you get to a set of coordinates on the grid, which is our public key. For instance if your private key was simply 4, with the starting position G being (2, 3.87) on this chart your public key would be 4G or (8.27, -23.96). In ECC, a third party would have to try and guess the number of steps you took to get to those coordinates – with no way to reverse-engineer it aside from simply brute forcing it (starting at known coordinates G and counting hops until they happened to stumble on the public key). But as discussed, this is computationally infeasible.

To give you a more concrete sense of the “scrambling” happening in true elliptic curve groups, lets look at our simplified modulated example from earlier. This is a minuscule example that sets the modulus at 211 instead of ~2²⁵⁶. Here we start at G (94,99) and perform the same exact scalar multiplication process we described above, just that it’s happening on the discrete, discontinuous field of integers.

As before, we take the tangent of G until we hit the curve again at (59, 100). We then reflect over the x axis to find 2G (59, 111). We repeat the process by adding G to 2G to find 3G and so on. It should be easy to understand at this point why it might be hard to find k given an arbitrary multiple of G.

It’s harder of course to tell why the tangent of G would lead us to 2G, since there’s no visible curve here, just a cloud of points. But the same thing is happening. Here I’ve depicted exactly what’s going on when we simply go from G to 2G:

You can see clearly how to the modular arithmetic scrambles the output as we advance from G to 2G. We wrap around the defined plot area multiple times in search of the next valid point. In Bitcoin-land, most scalar operations that we undertake as part of ECC wrap around too – even though the Bitcoin plot is inconceivably large.

(One quick note on the intuition here. The line isn’t “jumping” from the top to the bottom. What we’re actually looking at is a 2D representation of a torus, which is a geometry word for a donut. It only looks like it’s jumping because we are staring at a flattened out version of a 3D object. Imagine gluing the top and bottom edges to each other, so you have a cylinder, then gluing the right and left to each other, to make a donut shape. If you traced a helix around the outside of the donut with a pen, and then unrolled it back into flat paper format, it would look something like this.)

Ok, back to the simplified, real number example.

You might be wondering to yourself – well if incrementing k times in the elliptic curve costs an unholy number of operations, how is the public key derived efficiently in the first place?

And this is where the visual really shines for me.

As you see in the chart again, there’s two ways to get to 4G. You can add 3G to G, plot the line between the two points, and reflect it across the x axis when you hit the curve. Or, you can simply double 2G, taking the tangent and doing the same reflection when you hit the curve. The tangent “doubling” operation is an insane short cut!

Think about if you wanted to get to 13G. You could add G to G, add 2G to G, and so on. Or you could go G + G (2G), 2G+2G (4G), 4G+4G (8G), 8G+4G (12G), 12G+G (13G). That’s only 5 operations (3 doublings and 2 additions) instead of 12 point additions. (See here for a visual depiction.)

This might seem trivial but it starts to really matter when you are staring 2²⁵⁶ operations in the face.

In our above toy model, we can call our tangent operations “doubling” and our point-to-point operations “adding”. As it turns out, there’s an algorithm called “double-and-add” that takes advantage of the doubling shortcut. It accomplishes in 384 elliptic curve operations what would otherwise require an infeasibly many ~2²⁵⁶. Quite the efficiency gain. (A conceptually similar algorithm was first found on an Egyptian scroll called the Rhind Papyrus which dates to 1650 BC.)

The way it works is exactly as described above. Instead of tediously adding G to G 10⁷⁷ times, you process the bits of k one at a time, sometimes doubling (tangent rule), sometimes adding (chord rule). To process 256 bits, we need to do 256 doubles and around 128 adds. We don’t actually iterate through all the multiples of G. We skip ahead.

In complexity notation, you would write the “naïve” method of simply adding G to G k number of times as O(k) – the work required scales with the size of k. By implementing double-and-add, we massively reduce the work to O(log(k)) – depicted above.

But why is there no point division, if we’re doing point multiplication, you might ask? After all, all we’re doing is k * G = P where k is your private key, G is the known starting point, and P is the public key. Since G and P are known, why not simply divide P by G to get k, you might ask?

The answer is that elliptic curve “multiplication” isn’t actually multiplication at all. As we’ve demonstrated, it’s actually repeated addition. We have just found clever ways to speed up the addition so we can skip a lot of steps.

Inverting this process – finding k given P and G – is the discrete logarithm problem itself. Bitcoin’s cryptographic security is based on that problem being hard.

More generally, the reason it’s hard to reverse point addition in the elliptic curve is because of its structure, and this is why elliptic curves were specifically chosen for this. The equation mixes a cubic and a quadratic variable, which makes it nonlinear and hard to invert algebraically. Moving over from real numbers to finite fields means you can no longer use calculus to get a sense of direction, distance, or slope. There’s no “which way is closer” or “how fast am I approaching the target” – every step is a blind jump in a featureless, discontinuous space.

Because you are wrapping around the modulus with almost every operation, there’s no “progress” visible on the graph. Where you are at any given point gives you no information about how many “spins” you have undertaken. Unwinding it is like turning a cake back into its ingredients or a smoothie back into fruit. The elliptic curve multiplication process is a gigantic, one-way, deterministic number scrambler.

Bitcoin’s cryptographic security in natural language

When I first started writing this post I thought I would do the mechanical and then the more mathematical explanations as a preamble to the natural language section which would really drive intuition. But having been through the laborious process of working out the geometric explanation above I actually feel pretty good about the math. Nevertheless, if you’re not there yet, let’s consider two analogies that might help you if you are still feeling lost.

Imagine a circular one-mile racetrack. You are driving a specially configured car that generates exactly the same amount of thrust with each press of the gas pedal. The unusual thing about this racetrack is that you can only occupy a finite set of positions on it. There are thousands of tiny markers arranged on the track, allowing you to know with extreme precision exactly where you are. When no one is watching, you hit the gas a certain number of times, and loop around the track a bunch of times, leaving your car parked on the track. Your public key is the location of the car, G is the fixed thrust generated by the gas pedal, and your private key is how many times you pressed the gas. You’ve looped around the track so many times, and there are so many possible positions on the track that it’s virtually impossible to tell how many times you pressed on the gas just by looking at where the car is parked. The only way to figure it out as a third party is to get in the same car, head to the starting line, and press the gas and loop around the track until they end up at the exact same position as the original driver. But this might require years – or centuries – of looping around and around.

But there’s no asymmetry in this analogy. The private to public key transformation is still brute force, so we need a speedup, just like the log-time scalar multiplication in Bitcoin.

Now imagine that the car has a lazy driving mode. It’s still configured the same way as before – each press of the gas pedal generates a fixed amount of thrust and moves you around the track a predetermined distance. But there’s now an optional autopilot feature in the car that doubles the prior distance every time you engage it. So you can combine the longer autopilot stretches with the ordinary pedal presses to get to the same k, just with many fewer pedal taps. Based on your target k, you can actually pre-plan your trip in advance. Now to get to k = 13, you only have to press the pedal 6 times – three ordinary taps, and three autopilot doublings. The magic of scalar multiplication in elliptic curve world is that these long taps take just the same amount of time as the short taps, even if a long tap is driving you 10⁵⁰ times further. And the guy trying to reverse-engineer your final position can’t use lazy driving mode. He doesn’t know the sequence of long and short taps that got you there, so he has to drive the whole track manually – checking his position against yours after every single tap.

If that didn’t do it for you, let’s try another. Suppose you have a freshly ordered deck of cards. That’s starting point G. You shuffle it in exactly the same way k number of times. K is your private key. That gives you a nicely shuffled and random-looking deck. The order of cards in the shuffled deck is your public key. No matter what, if you shuffle the same fresh deck k number of times, you’ll end up exactly at the same deck configuration.

From inspecting the shuffled cards, there’s no way someone else could guess how many times you shuffled them. The only way to “reverse engineer” the shuffle count is simply to replay it yourself, starting from the fresh ordering, and tediously shuffling over and over until you get the same result. To take it a step further, the original shuffler (the person deriving the keypair) has access to a card-shuffling machine that can shuffle many times faster than a human. But the person trying to figure out your private key can only shuffle at human speed. And no one can shuffle “backwards”.

Interestingly, a deck of cards actually has less entropy than secp256k1 – 2²²⁶ versus 2²⁵⁶ bits.

Unfortunately, I can’t help build intuition around how digital signatures (and third-party verification of those signatures) work, because they are much more complex and unlike anything that exists in the real world. This is a shame, because signatures are an essential part of how Bitcoin works, beyond just initial key derivation. In plain language, a signature is the specific computation that only someone who knows the private key could produce, and that everyone else can verify with just knowledge of the public key.

There aren’t many good analogies for this, and it’s far more complicated to explain than elliptic-curve multiplication, which is the more fundamental concept anyway. We can mostly skip a long discussion of signatures since they depend on the one-way-ness of the ECC function is the most important thing, and that is the thing that is threatened by a practical quantum computer. ECDSA and Schnorr are both based on the elliptic curve discrete log problem being hard generally, and secp256k1 specifically.

Bitcoin’s entire cryptographic premise is “there exists a one-way function that’s easy to compute in one direction, and infeasible to invert.” We’ve never had to worry about this before, because it’s such an ironclad assumption in cryptography.

Until now.