Bitcoin 的後量子密碼學：為什麼遷移為時已晚

Frequently asked questions

Can bitcoin adopt post quantum cryptography?

Bitcoin can theoretically adopt post quantum cryptography through a hard fork that replaces ECDSA secp256k1 with quantum-resistant algorithms like SPHINCS+ for transaction signing and Kyber-768 for key encapsulation. However, in practice, this migration faces near-insurmountable obstacles: achieving consensus among miners, node operators, exchanges, and wallet developers; migrating billions of dollars in UTXO to new address types; handling lost wallets and dormant addresses that can never be migrated; and completing the transition before quantum computers arrive. As of March 2026, Bitcoin has no agreed-upon migration plan, no timeline, and no test implementation on mainnet.

Why is bitcoin quantum migration too late?

Bitcoin quantum migration is too late for three reasons. First, the consensus process for a protocol-level hard fork takes years of debate, development, and deployment. The SegWit upgrade took four years from proposal to activation. Post-quantum migration is orders of magnitude more complex. Second, harvest now decrypt later means transactions already made with ECDSA cannot be retroactively protected. The historical attack surface is permanent. Third, Glassnode counted 6.04 million BTC in May 2026, 30.2 percent of the entire supply and roughly 469 billion dollars, sitting in addresses with exposed public keys from prior transactions. About 2.3 million of that is irreversibly at risk and only about 3.7 million could still migrate, meaning a large share of those coins will be stolen by quantum attackers regardless of any protocol upgrade.

What happens to bitcoin when quantum computers arrive?

When quantum computers capable of running Shor's algorithm arrive, every bitcoin address with an exposed public key becomes instantly vulnerable. Attackers will derive private keys from public keys and sign transactions draining those addresses. The result is a cascading crisis: stolen funds flood exchanges, price collapses, and the network faces an emergency hard fork under extreme pressure. Addresses that have never transacted (public key still hidden in the hash) would survive temporarily, but the protocol itself remains fundamentally broken because any future transaction requires exposing a public key.

How long would it take bitcoin to migrate to post quantum cryptography?

Based on historical precedent, a bitcoin migration to post quantum cryptography would take 5 to 10 years from initial proposal to full network activation. The SegWit soft fork took 4 years. The Taproot upgrade took 3 years. Post-quantum migration is a hard fork requiring new address formats, new signature verification logic, new transaction structures, wallet ecosystem overhaul, exchange integration, and consensus among a famously contentious community. The quantum computers break bitcoin timeline of 2029 to 2033 does not leave enough runway for this process.

What is SPHINCS+ transaction signing and why can't bitcoin use it?

SPHINCS+ is a hash-based signature scheme standardized as NIST FIPS 205. SPHINCS+ transaction signing produces quantum-resistant signatures whose security relies on cryptographic hash functions, not algebraic structures vulnerable to Shor's algorithm. SPHINCS+ uses cryptographic salt to prevent precomputation against its Merkle tree. Bitcoin cannot simply swap ECDSA for SPHINCS+ because SPHINCS+ signatures are significantly larger (up to 49 KB vs 72 bytes for ECDSA), which would require increasing block size limits, redesigning transaction formats, and invalidating every existing wallet and hardware signing device.

Is any cryptocurrency already using post quantum cryptography in production?

SynX is one of five live blockchains that sign with post-quantum signatures by default, and the only one of those five that uses a stateless hash-based signature. It uses Kyber-768 (NIST FIPS 203) for key encapsulation and SPHINCS+ (NIST FIPS 205) for transaction signing on mainnet. There is no ECDSA fallback, no legacy address format, and no migration required. Other projects like QRL use different post-quantum schemes; SynergyX pairs Kyber-768 with SPHINCS+ and offers optional private sends.

What is the difference between a soft fork and hard fork for quantum migration?

A soft fork adds new rules that are backward-compatible with old nodes. A hard fork changes rules in ways that old nodes cannot validate. Post-quantum signatures could be added to Bitcoin by soft fork, as Taproot added Schnorr, but the proposals (BIP 360, BIP 361) are still drafts. A hard fork means every node, miner, exchange, and wallet must upgrade simultaneously or the network splits. Bitcoin's decentralized governance makes coordinating a hard fork extremely difficult, and the community has historically avoided hard forks due to chain-split risks.