Stanford cryptographer Dan Boneh says Bitcoin should prepare for quantum risk now, but warns a rushed post quantum migration could cause worse failures than the threat itself. Summary Boneh said “a hasty transition to post quantum, in my mind, is more likely to cause a catastrophic bug than we’ll be attacked by a quantum computer.” Google’s March 2026 whitepaper said breaking secp256k1 could require as few as 1,200 logical qubits and fewer than 500,000 physical qubits on some superconducting assumptions. The debate now centers on timing, migration design, and proposals such as BIP 361 for phasing out legacy Bitcoin signatures. Bitcoin’s post quantum transition debate is escalating after Isabel Foxen Duke highlighted a fresh interview with Stanford cryptographer Dan Boneh, who argued that the bigger near term danger may be a buggy migration rather than an imminent quantum attack on the network. In the interview, Boneh said, “Don’t panic, but don’t ignore,” framing quantum risk as a serious long range engineering problem rather than an immediate doomsday event for Bitcoin (BTC). “A hasty transition to post-quantum, in my mind, is more likely to cause a catastrophic bug…than the probability we’ll be attacked by a quantum computer,” says Stanford cryptographer @danboneh about Bitcoin’s potential PQ transition pic.twitter.com/J33hr0Bo9O— Isabel Foxen Duke⚡️ (@isabelfoxenduke) May 25, 2026 His most pointed remark was the one amplified on X: “If you try to aggressively move to a post quantum architecture, like for example by 2029, I think that would be a mistake for the blockchain,” adding that “a hasty transition to post quantum, in my mind, is more likely to cause a catastrophic bug than we’ll be attacked by a quantum computer.” Why is Bitcoin discussing quantum now? The immediate trigger is a March 30 whitepaper from Google Quantum AI, coauthored by Boneh, which said Shor’s algorithm against the 256 bit elliptic curve discrete logarithm problem on secp256k1 could run with “≤1200 logical qubits and ≤90 million Toffoli gates” or “≤1450 logical qubits and ≤70 million Toffoli gates.” The paper added that, on superconducting architectures with 10−310−3 physical error rates and planar connectivity, those circuits “can execute in minutes using fewer than half a million physical qubits.” Boneh told Foxen Duke that Google’s estimates matter, but he still views a cryptographically relevant quantum computer before 2035 as possible yet unlikely under current funding levels. He said anything by the end of the decade “seems very aggressive,” though not impossible if the field were treated like a national priority. That tension has already spilled into Bitcoin governance. BIP 361, titled “Post Quantum Migration and Legacy Signature Sunset,” says more than 34% of all bitcoin had revealed a public key on chain as of March 1, 2026, leaving those UTXOs theoretically vulnerable to a sufficiently powerful quantum attacker. What is Boneh actually proposing? Boneh is not arguing for complacency. He said Bitcoin “will survive” quantum risk and called claims that it cannot “insane,” because the core path is already known: move users toward post quantum addresses and signatures, then phase out vulnerable legacy paths over time. But he also criticized compressed migration windows. In the interview, he said a proposal like BIP 361 needs more complete design work and more time, while pointing to longer dated transition thinking as more reasonable. The dispute is broader than timelines. Boneh argued Bitcoin should strongly consider hybrid signatures that combine existing elliptic curve cryptography with post quantum schemes, rather than forcing a binary jump. He also said he would prefer lattice based signatures over purely hash based designs because they preserve more room for threshold signatures and further cryptographic innovation. That argument sits inside a wider industry push. In another crypto.news report, Coinbase advisers similarly warned that the threat is not immediate but preparation cannot wait. And in crypto.news coverage, the current consensus remained that no existing machine can break Bitcoin today, even as the estimated resource threshold is falling.
