Samson Mow told a nation to adopt Bitcoin. Now he's telling Bitcoin to wait.
The same man who stood beside Nayib Bukele as El Salvador made BTC legal tender โ the former Blockstream CSO, the Jan3 CEO with a decade of protocol-level credibility โ is warning the network against rushing its post-quantum signature transition. On its face, the statement reads as conservative caution. Read it through a vulnerability hunter's lens, and it's something else: a pre-mortem. Mow isn't saying post-quantum cryptography is unnecessary. He's saying the migration path โ swapping ECDSA for lattice-based or hash-based signatures on a network securing well over a trillion dollars of value โ carries more immediate systemic risk than the quantum threat itself. Not because quantum computers are weak. Because infrastructure migration is harder than mathematics.
Ledger logic never lies, only people do. The logic here has layers the headlines haven't touched.
The Cryptographic Foundation
Bitcoin's entire security architecture rests on a single mathematical assumption: the elliptic curve digital signature algorithm, instantiated over the secp256k1 curve, cannot be inverted in practical time. This assumption holds against classical computers. It does not hold forever.
Shor's algorithm โ published in 1994, three years before the cypherpunk community that spawned Bitcoin even coalesced โ renders ECDSA and RSA mathematically breakable, provided an attacker possesses a sufficiently large, error-corrected quantum computer. The debate is not whether this happens. The debate is when. Cryptographers typically estimate a 10-to-20-year horizon before a machine with millions of physical qubits can solve the curve's discrete logarithm problem at scale. IBM's roadmap targets error-corrected systems in the early 2030s. Google's Willow chip demonstrated in 2024 that error correction can improve with scale โ a necessary condition for the threat to materialize, and one that arrived ahead of most projections. The trend line is visible. The timeline is not.
Meanwhile, the standardization machinery has already moved. NIST has finalized three post-quantum primitives under FIPS 203, 204, and 205: CRYSTALS-Kyber for encryption, CRYSTALS-Dilithium for general-purpose signature verification, and SPHINCS+ for hash-based signatures. The cryptographic research community has converged. The infrastructure community has not.
Bitcoin's upgrade path runs through Bitcoin Improvement Proposals, community review, node operator consensus, and miner signaling. This is not a corporate board approving a dependency bump. It is a decentralized constitutional amendment process. SegWit took roughly two years from proposal to activation amid a bitter validation dispute. Taproot โ structurally simpler, commercially uncontroversial โ also required years of discussion. Both changes were cosmetic compared to what post-quantum migration entails. Neither touched the core signature primitive. Neither forced a single wallet to change how it generated keys.
ECDSA is not merely Bitcoin's signature scheme. It is woven into every address format, every wallet, every hardware signing device, every multisig script, every exchange integration, every institutional custody solution. Replacing it means touching every layer of a fifteen-year-old software stack securing a global settlement network larger than many sovereign bond markets.
Ethereum faces the same post-quantum horizon, but its social layer is structured differently. Development is more concentrated; validators signal through dense coordination layers; the roadmap treats change as a feature. Bitcoin's cultural DNA is adversarial rigidity โ the network is designed to change slowly because change is the risk its users opted out of. This is a strength and a scheduled accident at the same time.
This is the context in which Mow's warning operates. It is also the context his critics claim he is using as an excuse for inaction. Both readings deserve scrutiny. The first step is pricing the actual cost of migration.
The Physics of the Upgrade
The first-order problem is mathematical. ECDSA signatures on secp256k1 are 64 bytes โ compact by design, optimized for high-frequency verification on a network processing roughly seven transactions per second. Post-quantum candidates change this equation categorically.
Hash-based schemes in the Lamport and Winternitz family โ the conceptually simplest post-quantum replacements โ scale signature size and verification cost by one to two orders of magnitude. A Winternitz signature can run from hundreds of bytes to several kilobytes, depending on parameter selection. Lattice-based schemes such as Dilithium are more compact but still two to three times larger than ECDSA, with heavier signing operations. SPHINCS+ offers conservative security assumptions but demands verification work that dwarfs current ECDSA validation costs.
This is not an abstract performance footnote. It is a blockspace economics decision. Bitcoin's base layer records roughly one megabyte of economic history per block, every ten minutes. Larger signatures mean fewer transactions per block, higher fees per transaction, or both. For a network whose value proposition includes settlement finality, predictable fee markets, and auditable supply, signature size is an existential constraint. During the congestion periods that defined 2023 and 2024 Ordinals demand, a tenfold increase in signature size would have multiplied user costs drastically or forced a contentious blocksize debate redux.
And signature size is the easy problem. The hard problem is migration.
The goldfish paradox applies: Bitcoin is the bowl, the water, and the goldfish all at once. Changing the water while the goldfish swims requires a tank large enough for displaced volume, a filter that recognizes both old and new chemistry, and a schedule that doesn't disturb feeding. Most migrations fail not at the design stage but at the interface where old state meets new state.
Every address format, every derivation path, every multisig contract uses ECDSA. Hardware wallets โ Ledger, Trezor, Coldcard โ embed secp256k1 in silicon and firmware. Exchange hot wallets hold billions in ECDSA-controlled keys. ETF custodians like Coinbase Custody and Fidelity Digital Assets have compliance regimes built around current signing infrastructure. Layer-2 bridges verify Bitcoin signatures to mint pegged assets. Ordinals and inscriptions reference historical transaction data that will not re-sign under a new scheme.
Each of these layers must implement new key generation logic, adopt or define address format versioning, maintain backward-compatible verification during a multi-year transition, provide a defined path for funds held in legacy addresses, and operate dual-stack until the residual ECDSA population is small enough to ignore.
Change the signature primitive, and every one of these systems breaks unless deliberately, sequencedly, and individually upgraded. Mow's warning is not about cryptography. It is about logistics.
The Downstream Burden
My own audit experience shapes how I read this warning. In 2017, I audited fifteen ICO smart contracts during the token boom. Three had critical reentrancy vulnerabilities. None of the vulnerable code was exotic โ it was standard ERC-20 transfer logic, the patterns everyone assumed were safe. The failure never lived in the novelty. It lived in the interfaces between well-tested components arranged in new configurations. The same pathology recurs at every layer of cryptographic migration.
The burden distribution is counter-intuitive. Miners โ the actors who secure the proof-of-work chain โ face the least adaptation pain: node software updates and nothing more. The real burden concentrates downstream.
Wallets must ship new signing routines, new key derivation paths, and then simulate an ecosystem-wide migration of user funds. Exchanges must update custody backends while maintaining billions in withdrawable liquidity. Institutional custodians must revalidate compliance frameworks against a new cryptographic standard โ a process that takes quarters, not weeks. Layer-2 bridges verifying Bitcoin signatures face compound migration: their own stacks plus dependency on Bitcoin's stack. The Ordinals ecosystem references historical transaction data that will not re-sign under the new scheme.
This is a multi-year engineering program for a distributed set of institutions that have historically struggled to coordinate even on fee market changes. The institutional custody layer โ the exact entity class the 2024 ETF approvals brought into the ecosystem โ operates under compliance and audit obligations that make cryptographic migration a governance swamp. A rushed upgrade that creates even a brief compatibility gap between wallet versions and node versions would produce the operational failures that generate litigation rather than innovation.
I tracked stablecoin liquidity ratios across Uniswap and Aave during the 2021 cycle, modeling how capital flows between applications when yields rotate. The same framework applies here: map the value stored at each layer, then ask what happens when a protocol-level update forces every layer to migrate simultaneously. The answer is a liquidity fragmentation event โ assets locked in incompatible address formats, order books split across upgrade cohorts, arbitrageurs extracting value from transition chaos.
Pre-Mortem: Both Paths
Run the pre-mortem in both directions.
Path A: Rush the upgrade. Assume quantum progress accelerates โ a 1,000-logical-qubit machine demonstrated three years ahead of schedule. The community compresses the timeline. A post-quantum scheme is selected, BIPs are drafted, nodes are signaled, and the network activates within twelve to eighteen months. What breaks?
Undetected implementation bugs in new signature verification code. This is the critical risk. ECDSA has absorbed fifteen years of adversarial scrutiny. Any new scheme starts with near-zero real-world attack surface. The consensus code implementation becomes the network's single point of failure.
Client divergence. Bitcoin Core, Bitcoin Knots, and third-party implementations must ship coordinated releases. A single mismatch in verification logic creates a fork window. Bitcoin's history with consensus bugs โ the 2010 value overflow, the 2013 chain fork โ suggests the probability is not negligible.
Legacy funds stranded. Without a comprehensive migration bridge, old-format addresses become unspendable or dependent on trust-based relay mechanisms.
Custody panic. Institutions holding billions under legacy frameworks face sudden uncertainty about key validity. That means forced withdrawal halts. That means the kind of market-wide liquidity shock that pre-mortem analysis exists to predict. This is what Mow is pre-identifying: the systemic vulnerability created by the upgrade process itself.
Path B: Wait for maturity. Assume quantum computers remain stuck in error-correction limbo for twenty years. The community declines to upgrade. What breaks?
The wait position depends on an implicitly linear model of quantum progress. Quantum computing has never been linear. It has been punctuated โ gate fidelity thresholds crossed, logical qubit milestones reached, error correction demonstrated in ways none of the linear roadmaps predicted. Any single breakthrough could compress the horizon from twenty years to five.
Even under peaceful conditions, infrastructure migration at Bitcoin's scale requires five to ten years once consensus forms. The conservative position does not eliminate migration cost. It defers it into a narrower window. The narrower the window, the higher the probability of the sequencing errors Mow fears.
Then there is the harvest-now-decrypt-later attack: sophisticated adversaries collect ECDSA public keys and signed messages from exposed addresses, archive them, and wait for quantum capability. This attack vector is silent, unobservable, and cannot be mitigated by any single wallet. It converts every year of delay into a larger stockpile of keys that will eventually be decryptable. In this light, the "don't rush" position enables a long-fuse asset heist that no future upgrade can undo.
Bitcoin's last major consensus conflict โ the block size war of 2017 โ is the closest historical analog. It lasted two years, produced a hostile fork, consumed enormous community bandwidth, and resolved into a compromise nobody fully embraced. Post-quantum migration touches orders of magnitude more code, more coordinated actors, more value, and carries a hard external deadline. The block size war had no external clock. Post-quantum migration has a clock the community does not control.
Both paths are dangerous. Mow's warning prices the near-term path correctly. The public debate lacks an honest model of the delayed path's compounding risk.
The Regulatory Arbitrage Flip
Post-quantum security has a regulatory dimension the crypto community systematically underestimates. NIST's standardization is not merely academic. Governments are beginning to mandate post-quantum readiness for critical infrastructure. The United States has issued a National Security Memorandum pushing federal agencies toward quantum-resistant cryptography. The European Union's cybersecurity agency has published post-quantum transition guidelines. The compliance clock for traditional financial infrastructure ticks independently of Bitcoin's consensus process.
The regulatory arbitrage map here is revealing. Central banks introducing CBDCs โ I have spent two years inside the eNaira pilot, reverse-engineering its ledger permissions and comparing its architecture against Bitcoin's monetary policy โ will adopt post-quantum standards as part of their mandate to maintain state-of-the-art financial infrastructure. They enjoy centralized authority. No consensus process required. They upgrade by decree.
Bitcoin cannot. Its decentralized governance is its principal regulatory arbitrage advantage โ no compliance officer can be compelled to make the network's cryptography compliant. But that immunity becomes a liability if the network cannot self-direct the upgrade in time. The map flips: the very feature that made Bitcoin censorship-resistant becomes the structural reason it migrates last, and migrates under pressure.
CBDCs are infrastructure, not ideology. Bitcoin is ideology as infrastructure. The distinction becomes existential when the cryptographic foundation shifts.
The Contrarian Position
Here is the counter-intuitive thesis: the most dangerous position in the post-quantum debate is not the accelerants. It is the maximal caution Mow's warning represents.
Bitcoin's governance culture treats every protocol change as a constitutional amendment โ a hard-earned, defensible instinct. But cryptography is not politics. The threat curve is not subject to community consensus. When the quantum threshold arrives, the migration must happen under time pressure โ the worst possible conditions for the careful engineering Mow demands. The gradualism he defends increases the probability that the eventual migration is a discontinuity rather than a transition.
There is a third path the warning ignores: incremental adaptation. Introduce post-quantum signing as an optional output type. Build validation infrastructure in parallel. Seed wallet ecosystem adoption slowly. Let the market migrate funds at its own pace over a decade, rather than forcing a single high-stakes fork during a crisis. This soft-landing approach carries its own costs โ increased protocol complexity, dual-stack maintenance, potential attack surface expansion โ but it avoids both the rushed-fork failure mode and the cliff-edge migration that pure procrastination guarantees.
Security assumptions are not property. They are loans that compound interest. Every year the network defers migration, the interest obligation grows in the form of harvestable keys, infrastructure debt, and institutional uncertainty. Mow's warning is correct about the risk of a botched transition. It is silent about the risk of a transition that never starts until it must.
The Signals That Matter
Watch three signals. A quantum computing milestone โ the 1,000-logical-qubit threshold โ could compress the threat timeline from decades to years. The first serious post-quantum BIP proposal reveals the migration path. NIST's subsequent standards releases lower the technical uncertainty floor. Each signal shifts the calculation: the first creates urgency, the second reveals feasibility, the third removes excuses.
Mow's warning is correctly calibrated for the risk matrix available today. But the matrix is incomplete. No honest assessment can rely on unknown quantum physics milestones. The right question is not whether to upgrade. It is what migration infrastructure exists the day before the threshold is crossed.
The network that solved double-spending must now solve triple-entry bookkeeping under quantum uncertainty. The clock started years ago. It has never paused.