The Part You Cannot Patch
A quantum error-correction record and a federal exclusion order arrived in the same week. Both describe legacy objects whose secrets are already public, and how slowly a system moves off an assumption it has already broken.
A quantum error-correction record and a federal exclusion order arrived in the same week. Both describe legacy objects whose secrets are already public, and how slowly a system moves off an assumption it has already broken.
Two documents crossed the wire on Monday morning, and neither mentioned the other.
The first was a press release from a quantum computing company. Its machine, called Helios, had held a logical qubit together through five errors in a million operations — 99.9995 percent fidelity, ten times better than the same company's record from September, and a hundred times better than anything reported on rival hardware. The second was a Federal Register notice confirming an order signed on 24 July, directing every civilian agency of the United States government to remove a family of artificial intelligence models from its computers.
One is a laboratory measurement. The other is a procurement instruction. Put them side by side and they describe the same shape of problem. A security assumption baked into a system long before anyone worried about it; an upgrade path that reaches only the future; a population of legacy objects that cannot be recalled. That is the shape this decade keeps producing, and it is the anatomy of every slow-motion failure in cryptography.
That last clause is the whole story. Cryptography and supply chains fail in the same place — not in the algorithm, but in the inventory. The keys already published, the weights already shipped, the dependency already compiled into last year's build. Every serious migration fights the same enemy, and the enemy is arithmetic that has already happened.
A quantum computer's native components are unreliable in a way that has no classical analogue. A physical qubit loses its state to heat, vibration, stray electromagnetic noise; the error rates on good hardware sit somewhere around one in a thousand. Running an algorithm on those components directly produces noise, not answers.
Error correction solves this by spending many bad qubits to build one good one. You spread the information of a single logical qubit across a lattice of physical qubits, measure parity around the edges, and correct the damage without ever reading the underlying state. Above a hardware-specific threshold, this works the way compound interest works: each increase in the code's distance — the size of the lattice — suppresses the remaining error by a constant factor, while below that threshold every added qubit makes the result worse.
Quantinuum's number is a statement about that suppression. Using a color code that encodes as many as 37 physical qubits into one logical qubit, the company reports errors falling by a factor of twelve with each tested increase in distance. Its September result used a lighter code, ten physical qubits per logical, and reached 99.999 percent. The heavier code cost more hardware and returned three orders of magnitude more cleanliness at the top of the range.
One week earlier, Google's quantum team published a different result on different hardware: a technique called magic state cultivation, which reduced errors fortyfold and reached 99.99 percent logical fidelity on the states that make quantum gates universal. Superconducting circuits on one side, trapped ions on the other, two entirely different error-correction schemes, and two records inside seven days.
That coincidence of timing, not either number on its own, is what changed the argument this week. Exponential improvement on one architecture is an anecdote. Exponential improvement on two, at once, on a schedule both companies describe as reaching commercial fault tolerance by 2029, is a curve.
Now the part the press releases leave out: how much computation an actual attack requires.
The reference point is still a 2017 paper by Martin Roetteler and colleagues at Microsoft Research, which worked out the circuit for Shor's algorithm against an elliptic curve over a prime field. Their result is a pair of expressions rather than a single figure. A discrete logarithm on an n-bit curve takes at most 9n + 2⌈log₂n⌉ + 10 qubits, and at most 448n³log₂n + 4090n³ Toffoli gates.
Set n to 256, which is Bitcoin's curve. That gives 2,330 logical qubits. And it gives 1.29 × 10¹¹ Toffoli gates — that figure is my arithmetic on the paper's own formula, not a quote. Their conclusion was blunt even then: at comparable classical security levels, elliptic curves need fewer qubits than RSA. ECC is the softer target.
Hold those two numbers against Monday's record. At five errors per million logical operations, a computation of 1.29 × 10¹¹ operations accumulates roughly 644,000 logical faults before it finishes. Again, my multiplication, not the company's claim. Fault tolerance at that gate count needs a logical error rate near 10⁻¹², six more distance steps at the factor of twelve Quantinuum measured. Distance enters physical qubit count quadratically, so each of those steps costs four times the hardware of the step before it. Using the 37-to-1 ratio from the color code, 2,330 logical qubits become 86,210 physical ones before any of that extra distance.
So the machine does not exist, and the distance to it is not a factor of three. It is a factor that has to be crossed in hardware, in refrigeration, in wiring, and in the engineering of a code large enough that its own classical decoder keeps up in real time.
That is the honest reading, and it is also the reading the industry prefers. It rests, though, on an assumption that has quietly stopped being safe — that the curve of improvement matters less than the absolute gap. Both matter, and a gap of nine years that closes by half every eighteen months is a different object from a gap of nine years that does not move.
Here is where the standard commentary on Bitcoin's exposure goes wrong, in a way that flatters the network.
The usual formulation, repeated in the TFTC piece that pulled these threads together, is that an attacker needs to break a key inside a ten-minute confirmation window. That is true for exactly one case: an output whose public key becomes visible only when the owner spends it, sitting in the mempool, waiting for a block. There, speed decides.
It is not true for the coins that actually carry the risk. A P2PK output publishes its public key in the locking script itself, at the moment the coin is mined. A pay-to-public-key-hash address publishes it the first time its owner spends from it, because the signature and the key both land on chain. For both, the public key has been sitting in a public database for years, and the attacker faces no clock at all. He can run the computation for a month, verify the signature offline, and broadcast when he is ready. The victim learns nothing until the coin moves.
This distinction matters because it inverts the usual advice. "Move to a fresh address" helps with attacks on spends in flight. It does nothing for an exposed output, which is a legacy object: the leak already happened, publicly, permanently, on a ledger nobody can edit.
Project Eleven estimates that roughly seven million coins sit in outputs with already-exposed public keys. The Quantum Alliance, an industry group that formed this year without a single Bitcoin Core contributor involved, put the range at 6.04 to 6.4 million. Take the larger figure and price it. Seven million coins is 34.8 percent of the 20.10 million in circulation, which I calculated from the block height of 972,285 and the subsidy schedule. At this morning's price of $81,433 that is $570 billion of collateral whose defence depends on a problem remaining hard.
Bitcoin's answer exists, in draft. BIP-360 defines a quantum-resistant output type — pay-to-merkle-root, prefix bc1z — that anyone can migrate to. It was merged into the BIPs repository in February and runs on testnet. It is voluntary, which is why it is not controversial: it protects new coins without touching old ones.
BIP-361 is where the fight is. Published as a draft in April, it proposes retiring ECDSA and Schnorr signatures in stages, and includes a mechanism that would eventually restrict spending from legacy outputs that never migrated.
Read that clause slowly. Somebody has to decide which coins count as unmigrated, and what happens to them. An owner who is alive, solvent and paying attention can move. An owner who died, lost a seed, or mined the coins in 2009 cannot, and no procedure exists to distinguish "cannot" from "will not". The earliest coins — the ones nobody has moved in seventeen years, sitting in exactly the P2PK format that publishes its key — are the purest case. They are either going to be taken by whoever builds the machine first, or frozen by the network, and both outcomes require Bitcoin to legislate about property whose owner is absent.
The network has no precedent for that, because it has never had to. Coinbase, which holds roughly five percent of all bitcoin, has already called for post-quantum migration on mainnet. A custodian can move its clients' coins in a weekend. The long tail of self-custody cannot be moved by anybody but its owners, and that is the population the seven million figure describes.
The Homeland Security order is a different document about the same problem, and its details are worth more attention than its headline.
It was signed on 24 July under the Federal Acquisition Supply Chain Security Act of 2018, a statute written for hardware vendors. It cites three threat vectors: sensitive data flowing to servers in China, intelligence collection against federal employees and agencies, and the possibility of malware inside the models themselves. Those are not exotic claims. A model file is a serialised object, and deserialising an object from an untrusted source has been a standard route to code execution for as long as serialisation has existed.
The scope is the interesting part. The order does not stop at products branded DeepSeek. It covers any third-party product built on a DeepSeek implementation, which means a federal buyer now has to audit the lineage inside the software stack and not merely the vendor's name on the invoice.
And then the timing. The order sat signed for nearly three months before its public filing appeared on 19 October. Agencies wanting an exception had to submit sixty days in advance with a compelling justification. That window closed before the notice became public.
There is the shared structure, stated plainly. In both systems, a class of objects becomes non-compliant retroactively, and the list is drawn by someone the affected party did not choose. Bitcoin's version is a draft BIP and a distant vote. Washington's version is an order already in force. Same shape, different clock speed.
The argument on the other side deserves its full weight, because it is not stupid.
Quantum timelines have been five to ten years away since the turn of the century. Every previous prediction of a cryptographic break has been wrong in the safe direction. A fidelity record measured on codes of a few dozen physical qubits is not a system, and the extrapolation from it — including mine, above — assumes the engineering scales without new physics. It might not, because error budgets that look generous in a laboratory have a way of vanishing when a machine has to hold coherence across thousands of qubits for hours.
Against that, a rushed signature migration is a real risk of its own. New cryptography is where implementation bugs live, and a consensus change forced by deadline pressure is precisely how a network acquires a permanent split. Bitcoin's conservatism is not stupidity; it is the accumulated memory of every chain that changed too fast.
The DHS order, read alone, is procurement hygiene inside a genuine threat model, limited to civilian agencies and silent on the private sector. One document is not a regime.
All of that is fair. What it does not address is the asymmetry. Starting a migration early costs engineering time and political capital. Starting it late costs the coins, permanently, because there is no rollback for a signature that was forged with a valid key. The network cannot reorg its way out of that; a valid spend is a valid spend.
Four observations would move this, in either direction.
Independent replication of the 99.9995 percent figure at larger code distances would pull the clock in, because it would show the suppression factor holding as the lattice grows. The opposite — Apollo slipping past 2029 while Google's roadmap slips with it — would push it out, and would make this whole argument look like the 2018 cycle's quantum panic.
On the Bitcoin side, a mainnet activation proposal for BIP-360 appearing before 2029 would soften the urgency considerably, since it would mean the network found a voluntary path in time. And a second exclusion order naming a vendor from a different jurisdiction would confirm that model-lineage auditing is a template rather than a single decision about one company.
Two limits on the above, stated plainly.
The fidelity figures from both companies reached me through their announcements, not through independent measurement. Google's result was published in Science, which is a form of review; Quantinuum's arrived as a press release with a share-price reaction attached, which is not. If neither result replicates at larger code distances, the schedule argument in this piece weakens in proportion.
And the seven-million figure is somebody else's estimate of a quantity nobody can compute exactly without an index of every spent output on the chain. My own contribution is only the division and the pricing, both of which are arithmetic on a number I did not verify at the source.
Everything above resolves to a single uncomfortable observation. The variable that decides how this ends is not the fidelity number and not the qubit count. It is what happens by default to the objects nobody can move.
If no rule is written about exposed legacy outputs, then the rule is "first come, first served", and the first party to arrive will not be a company with a press office and a share price that rose 4.3 percent in premarket trading. Press releases are the lagging indicator of capability. The leading indicator is silence, and silence is what a state programme produces.
So the only work available today is the work that needs no consensus. Move coins you control out of outputs whose keys are visible on chain, and stop putting new ones there. Everything else is a vote, and votes in this network take years — which is fine, right up until the thing you are voting on stops waiting for you.