What Bitcoin Did - The Truth About Quantum Computing & Bitcoin | Brandon Black

Episode Date: February 3, 2026

Brandon Black is a Bitcoin software engineer. In this episode we discuss why quantum computing is unlikely to threaten Bitcoin in the foreseeable future, how exaggerated claims around qubit scaling and Shor’s algorithm distort the real risk, what concrete evidence would actually force Bitcoin to act, and how questions around soft forks, post quantum cryptography, property rights, and confiscation should be framed if progress ever becomes real. THANKS TO OUR SPONSORS: ANCHORWATCH BLOCKWARE LEDN BITKEY SWAN CAPE CLUB ORANGE FOLLOW: Danny Knowles: https://x.com/\_DannyKnowles or https://primal.net/danny Brandon Black: https://x.com/reardencode

Once there's a fast quantum computer out there, sub 10 minutes, Bitcoin, as we know it today, is basically not usable because the coins will just be sold by someone else once they try to move. As soon as there is evidence of clear logical qubit scaling, of progressive factorization, there's a very clear evidentiary standard here. And as soon as that evidentiary standard is met, we have to start doing stuff. I can make a very defensible, like, logically tight claim that there is no way a cryptographically relevant quantum computer will happen in the next 10 years. What I think, never. I think it is never going to happen. Brandon, how you doing, man? I'm doing well. How are you, Danny? I am very good. Thank you. I'm really looking forward to this conversation.

So you've been kind of the quantum naysayer for a little bit now. And I've been going down this round. rabbit hole more and more over the last few days. Because maybe I'll frame this by, like, Nick Carter is someone who I know is controversial amongst Bitcoin. I think he's really smart. I think he writes some amazing pieces on Bitcoin. And when I first read his sort of quantum series that he started doing a couple of weeks, well, maybe a month ago or so, it made me think that quantum might be quite close. But the more and more I've kind of listened to stuff that you've been talking about and done my own research on this, I'm starting to think that I don't want to call it a scam,

but maybe it's much further away that we actually think. So I want to get into all of that with you today. But do you want to start just by introducing yourself? This is the first time you've been on what Bitcoin did. Yeah, sure. So yeah, I'm Brandon Black, Rood in Code on the Internet. I'm a software engineer. I guess I was a software engineer for 20 years, some of that time in management.

About eight years of that in Bitcoin full-time. In Bitcoin, probably my greatest accomplishments in Bitcoin were when I worked at BitGo, launching the first ever taproot multi-sig wallet and the first ever music two into production. So those are things I kind of did in the Bitcoin world. That was the way I got introduced to talking with people at Bitcoin conferences was doing research to do the music two. I met Jonas Nick and I was asking questions about it and got into the implementation and everything there with him. So I guess that's like the broad strokes of me.

These days, this year I'm launching a Bitcoin consultant. and see. I'm going to try to help people and businesses with their Bitcoin scripting needs and just general learning about Bitcoin. If anyone needs me to come talk to them about Bitcoin, I do that. And yeah, that's what I'm up to. So when did you get into the quantum stuff? Because as like a Bitcoin developer, someone who, well, maybe not on like core, but you've been working on like Bitcoin projects, like when did Quantum come into this? Because this FUD has been around for quite a long time now, but it's really ramped up over the last, I'd say, 12 months. Yeah, yeah. I would say I am naturally interested in all such things, whether it's cold fusion or quantum physics or, you know, all impossible things are naturally in my interest. I think that's how I got into Bitcoin in the first place is that same natural interest in these things. I was like, oh, magic internet money, that doesn't work until it turned out that it did. So I've naturally drawn to these kinds of things. And so I've been tracking the progress of,

quantum computing, gosh, for most of my professional career, just been watching it, seeing how things are going. So when the FUD comes up, I think I have a decent background to know, like, have we made a real step change that makes it now instead of 10 years to never to suddenly five years? And many people, of course, this year are claiming that we've made that transition from 10 years to never to within five years. And I just don't see any evidence of that. Okay. So I want to try and like set the table here because quantum computing to me, when I try and understand it, it still sounds like this Fugazi thing. Like I think it's really hard to actually, like if someone asked me to explain what a quantum computer does, I'd really

struggle. Can we start as basic as that? Can you explain what they're trying to do with quantum computers? Yeah. So the short idea of what quantum computing can do and what digital computers struggle to do is that a quantum computer can have its qubits, as they're called, represent a superposition of possible states as opposed to a single state. So in a digital computer, the binary digital computer is what we all use is what we're talking over right now. Every bit of information is either true or false. It's one or a zero. And that's every single thing. In a quantum computer, you can have bits that don't have a defined state yet. And then what you essentially do is you try to encode the properties of your real world problem, whether it's cryptographic

problems or chemistry simulations, whatever the physical thing you want to work on into the possible states of the quantum computer. And then the properties of the quantum gate interactions within the qubits can make the correct answers have a lower energy state and therefore become more likely when you read out values. So then you collapse these possible states into real states and read out the values. And what you get is the low energy state. So they call this quantum annealing, and that's kind of the current state of quantum computing,

is that it can be used in physics simulations to do this quantum annealing, where you encode the state of a physical system into the quantum annealing, quantum bits, you kind of shake them up, so to speak, and then you read out the low-energy state they come to. And if you do that a few times, with high likelihood, you get the lowest energy state of that encoded system. So this is the magic of quantum computing and why it can do things that digital computers can't do, because with digital computers, to do that same thing, you basically have to look through all the possible states that your system could get into to find the low-energy one. But with quantum computers,

quantum computers, because all of the possible states are encoded across the qubits, it can essentially simulate the combination of inputs and states that gets you to that low energy all in one go instead of having to iterate through every possible value of every input to get there. So this very clever guy, Shore, forget his first name, came up with an algorithm that can apply those properties of finding a low energy option out of some encoding. to cryptographic systems. And whether that's factoring or elliptic curves, the low energy state that we're looking for there,

in both cases, it relates to, well, in factoring, it's kind of a simpler problem to map. With factoring, you're like, oh, we got 15, and let me find three and five. And you can encode that so that the qubits resolve to lower energy state when you have inputs that multiply to the desired value, right? and so that's factoring

and then with elliptic curves you have to map it into this thing called a period finding problem but again it's the same basic problem where the amount of energy encoded in the bit is lower when you have found the correct sequence of movements through the elliptic

curve to encode the underlying value of the secret key and that's roughly what we're doing we're using this quantum annealing process to find the period over which the secret key translates in the elliptic curve realm. And if you can do that, then you can get the secret key out of a public key.

All right. So I do definitely want to get into the issues with factoring and elliptic curves. But before we do, these computers are never going to be like a general computer, right? They're going to be specifically targeted to either like breaking encryption or other like chemistry applications and things like that. That seems by far the most likely. some people have proposed they could also be very useful for AI where essentially it comes out of the same thing where you would encode the properties of an LLM, let's say,

into the quantum states. And instead of computing through a neural network, the output, you would quantum anil to the output of the LLM. So maybe you could also apply it to something like that. But yes, they're never going to be able to do the, like, hardcore, just sending bits across the internet type stuff because there's a setup and a readout process, and it's all about probabilities.

There's not a clear answer. And of course, for sending bits across the internet, you want to have a clear one or zero on each bit you send, and quantum computers aren't super well suited for that. Do you wish you could access cash without selling your Bitcoin? Well, Leeder makes that possible. They're the global leader in Bitcoin-backed lending, and since 2018, they've issued over $9 billion in loans

with a perfect record of protecting client assets. With Leiden, you get full-costly loans with no credit checks or monthly repayments, just easy access to dollars without selling a single SAT. As of July 1st, Leiden is Bitcoin only, meaning they exclusively offer Bitcoin-backed loans with all collateral held by Leiden directly or their funding partners. Your Bitcoin is never lent out to generate interest. I recently took out a loan with Leiden. The whole process was super easy. The application took me less than 15 minutes and in a few hours I had the dollars in my account. It was really smooth.

So if you need cash but you don't want to sell Bitcoin, head over to leaden.com, forward slash WBD, and you'll get 0.25% off your first loan. That's ledden.com. Privacy was never a priority for mobile networks. For companies like AT&T, T-Mobile and Verizon, data collection and monetization is the default. But CAPE is changing that. Cape is a premium US mobile carrier with nationwide coverage designed from the ground up with privacy and security at the core.

When you sign up, Cape collects the absolute minimum data required, stores it for the shortest time possible, and never sells it. They also make you significantly harder to track at the network level and protect against sim swap attacks, which are becoming one of the biggest security risks out there, especially for Bitcoins. Cape's sim swap protection is fundamentally different. Instead of usernames and passwords, your account is secured by a 24-word passphrase,

similar to how Bitcoin wallet works. No one can initiate a sim swap or take control of your phone number except you. This isn't a burner phone or a work around it's a normal mobile service built properly. If you care about privacy and security, there is no better mobile carrier. To learn more and get 33% off your first six months, head to cape.co slash WBD and use code WBD at checkout. That's cape.co slash WBD. With Fiat money constantly debasing, wealth preservation isn't optional. That's why I recommend Swan Bitcoin, a team of dedicated bitcoins who work with families and businesses to build and secure generational wealth with

Bitcoin. Strong relationships with clients are at the center of everything Swan does. A dedicated Swan private wealth representative, which is a real person that you can text and call, will help you build a Bitcoin wealth strategy using Swan's comprehensive platform of Bitcoin services, including tax advantage retirement accounts, advanced Bitcoin cold storage using collaborative self-custody, inheritance planning with both trust and entity accounts, tax loss harvesting, asset back loans, and more. Swan have helped over 100,000 clients since 2020, and if you see, serious about acquiring and securing Bitcoin, I recommend Swam. Meet the team at swan.com forward slash WBD, which is swan.com forward slash WBD.

If you haven't tried out Club Orange yet, then now is the time. It's my go-to place to find Bitcoiners whenever I'm traveling. Club Orange is a social app built for Bitcoiners where you can find local meetups and events in your area and find merchants that are accepting Bitcoin. There are over 19,000 Bitcoiners on there, and whether you're at home or traveling is a great place to keep in touch with Bitcoiners from all over the the world. I've been using Club Orange since it was Orange Pill app, and it really is awesome. So if you're on there, drop me a DM and say hi. And if you want to find out more and download

the app, just search for Club Orange on your app store or go to cluborange.org. Okay. So let's talk about factoring and elliptic curves, because factoring isn't really applicable to Bitcoin, but it is to other cryptographic systems. Is that right? Yeah, so RSA is the famous one that's based on large prime numbers that are difficult to factor. Okay, and so this is where, like, I don't want to call it a scam, but this is something that when I was looking at really shocked me, is that the highest number that a quantum computer can factor right now is 21, I believe. And the bit that really surprised me is they actually did that in 2012.

So all the talk over the last, like, few years of this really accelerating, they still can't factor a number bigger than that. Do you know why? So what I observe, and I think many others have made the same observations, I'm not alone on this, is that the basic properties of quantum of qubits are pretty well understood at this point. We can produce some cubits, we can map some state onto them, and we can resolve them into a desired state that we want to measure. And that enables factoring very small numbers, because if you can get a couple of qubits together, you can factor a small number using a quantum computer. And so what the quantum researchers have been doing over the last decade has been trying to make that scale to larger numbers of cubits.

And that turns out to be very, very difficult. And we've seen hundreds of millions or billions of dollars poured into trying to get that to scale. And what seems to happen is that as you increase the number of cubits you're working with, the difficulty of correcting the errors in the qubits goes up exponentially. And so every time they come up with new technologies that seem to have lower error rates, and they've gotten much, much lower error rates

on their individual qubits, but when they start trying to put more qubits together, they keep on seeing that the error rates rise exponentially as they go to more and more qubits. And so this is something we saw very clearly with the recent Microsoft Meyerana announcement where they have built a very cool, very low error rate single cubit device. And so this is like, oh, we can manufacture lots of these single cubit devices,

and that's very cool. And maybe there are applications for those. But what they haven't demonstrated with all of these new announcements that have been made is no one has been able to demonstrate the ability to tie a whole bunch of cubits together on a single device and not have the error rates go up exponentially. And so that's how we got to this state, where they did this thing, many years ago and it hasn't really advanced. The closest to an advancement we've seen was someone

used a quantum computing device to solve a 6-bit elliptic curve key. Now, 6-bits is ever so slightly larger than 21, but it's still like I joked that literally a child can solve a 6-bit ellipt curve key. It's not something that

requires great computing power. So it's in a similar realm of those 21-bit factorizations. Let's give them their Jews, right? Let's say they are making breakthroughs, things are going well in quantum computing world, they're putting billions of dollars in. What are they excited about?

Why are they thinking that this is progressing so fast? So a few things I've seen that are interesting. One is, like I said, better manufactureability of individual cubit devices. That was the Maillana announcement, right? So they went from, you know, it takes us like super customized, like, hand-built. We get one working qubit out of 100 attempts,

that level of difficulty of building qubits. With Meyerada, they're like, no, this is a qubit, we can produce this cubit in a factory. Like, everything that it takes to build this are things that we know how to put into factories. So that's a cool innovation, right? Now, instead of it being like hand building in labs, individual cubits and getting them to work sometimes, now it's manufacturable. So that's a big, a big step. We've also seen pretty big breakthroughs in error correction, where for a given error rate in the cubits, the classical computing or digital computing needed to correct the errors has become a couple order

of magnitude faster. So that's another big breakthrough they've made. And then another one that we've seen is some folks have made innovations in what they've called gate-based quantum computing, where they build quantum gates that are a handful of cubits. I don't know the exact numbers, but like less than 10 cubits on a on a device, and then they interconnect them, which is kind of similar to how we build digital computers.

In digital computers, we have essentially gates, NAND, NOR, XOR, the binary operations, and we interconnect them on a chip. So maybe we can do something interesting with quantum computing in a similar way, where instead of trying to get a whole bunch of qubits all tied together in a single device, you build gates where each gate is a kind of a quantum unit interconnected to other gates. And so we've seen developments in that area. The problem, as far as I understand it, and I'm not an expert on this,

so maybe someone can correct me, call in and tell me I'm wrong, essentially. But I don't think that gate-based quantum computing can ever break cryptographic systems. Because if I understand correctly, from reading Shores algorithm, you need to have a certain number of qubits all in a single device working together

to do the one step, this critical step in the Shores algorithm has to have all those qubits together. It can't be separated across gate boundaries. Again, someone could correct me if it wrong, but I don't think that's something you can map between A&B. So there are other problems in physics and chemistry and stuff where the gate-based quantum computers may be very useful,

but I don't think they apply to cryptosystems. So anyway, that's the things that I've heard where they've made major steps in the last decade or so. Okay, so one last piece of sort of table setting, before we get onto Bitcoin and what this potentially means for it. When you say qubits, are you talking about logical cubits or just normal cubits? And what's the difference between those two? Yeah, great clarification.

I was wondering if we're going to get into that. It's important. So you're right. So because cubits are these kind of flaky, difficult to deal with things, if you take a single cubit, which essentially a cubit is often a single, electron or a single, I think, muon or kind of other subatomic particles or a single photon, it's very hard to get any kind of reliable, like, setting and reading with a single physical cubit in one of those subatomic particles. So what they do is to do actual computation.

They take a whole bunch of physical cubits, and they actually, within the physical, interconnecting the physical cubits in a physical kind of device, let's say, they make it so a bunch of physical cubits represent one state, and they essentially self-correct each other within that so that there's a reliable state instead of a flaky, we can't really read it or write a state. So by putting a whole bunch of physical cubits together, they're able to create a somewhat stable.

We're talking in many cases stability over microseconds, but somewhat stable cubit state where the physical cubits reinforce each other to create a stable logical state. And that's what gives rise to the idea of a logical cubit. Now, there's a lot of nuance and debate about this, and I was having a discussion on X with someone who works in this area where some people have said

that doing this whole thing of mapping physical cubits into logical cubits is not necessary, and it's actually wrong-headed. Basically, if you're doing a whole bunch of work to take, let's say, tens or hundreds of physical qubits to make one logical cubit, and then you're going to try and tie a bunch of logical cubits together to get a low error rate output. That's the wrong way to approach it. And the right way to approach it is to take all those physical cubits,

map your problem directly onto those physical cubits, and then deal with the fact that they're flaky kind of internally to your algorithm. So basically make almost like one giant logical quantum device, rather than making a bunch of logical cubits and then tying those together. So it's not totally clear to me which one of these approaches is going to bear fruit if either of them ever will.

But that's the difference, is that a logical cubit is a single stable quantum state represented by a bunch of physical cubits, and that may be necessary in order to build computing devices out of quantum bits because the physical cubits are just too flak it to deal with on their own. Okay. I've said last bit of tail setting, but I actually have one more question.

In classical computing, we have Moore's Law, which I actually don't know the exact definition. Is it everything gets twice as fast and half the price every few years? It's actually the number of transistors in the same physical space doubles every 18 months. Every 18, okay. And that's, you know, over the history of computing, that's probably been accurate. In quantum computing they have, is it Nevins Law? And can you explain what that is and what they're... and what they, you know, if you believe in this.

Yeah, yeah. So first with the big, one important distinction on Moore's law, it really should have been called Moore's observation, right? This wasn't Moore saying, oh, I predict that we're going to see a doubling of transistors on a device every 18 months. It was an observation. He looked back at computing, starting with the very early integrated circuits, and noticed that we're seeing a doubling of transistors every 18 months and said,

this may continue for some time into the future, and it got called Moore's law. So in quantum computing, they're saying there's Nevin's law, which would, and they talk about this interesting thing where they call it a double exponential in computing power is what the, I believe, the claim of Nevin's law. And the claim is that because, and this is, if quantum computing can scale, there is truth to this first part, because quantum computing represents a complete, fleet possible state space in its entangled bits, your equivalent digital computing goes up exponentially with the linear increase in qubits. And that's an important thing about quantum computing,

and I think why people get excited or scared about it, right? If we can get quantum computing to work, it's absolutely true that the equivalent digital computing that you get out of a quantum device goes up exponentially with a linear increase in the number of functional qubits. That's very important. Then the claim comes that we will see a similar exponential rise in the number of useful qubits as we saw with useful transistors in a device. So that's a prediction right now which has no historical justification. And so unlike Moore's law,

Nevin's Law is making a prediction not an observation. And that's why I am highly skeptical of it. And I keep saying on X and elsewhere, I'm waiting to see a couple of cycles of, you know, true scaling of quantum device complexity, where we see, oh, they factored 21, they factored 125, they factored bigger and bigger numbers over, let's say, five years, and then we'll be able to know what the correct rate of growth is for Nevin's law.

Maybe it's doubling every 10 years. Maybe it's actually linear. Maybe it's not exponential the way transistors were. We just don't know yet because we don't have the observations. More made a prediction based on observations. So I don't believe in Nevinslaw as of right now. I mean, anything that claims a double exponential, I'm immediately skeptical of.

So in terms of quantum computing for such a long time has always been this thing that's like a 30 year away problem. And then in the last couple of years, people think this is becoming more and more imminent, to the point where we have people working on quantum proof addresses on Bitcoin, like Hunter Beast doing Bit 360, Nick Carter's saying that this is an imminent threat. Where are you on that scale? Do you think it will ever be a threat or how far out do you think it is?

I have two answers to that question. I think I can make a very defensible, like logically tight claim that there is no way a cryptographically relevant quantum computer will happen in the next 10 years. it just requires too much increase in the number of logical cubits on a device. There's no way from a kind of human, even with AI enhancement development process, the industrial production ability, it can't be developed in less than 10 years. So that's a defensible. I think there's a strong logical claim of that.

My personal, emotional, like what I think, never. I think it is never going to happen. I suspect that there are physical laws that prevent it from happening. But that's an emotional thing, not something I can do a scientifically rigorous study of or anything. Okay, so let's go with the 10-year prediction then. It's at least 10 years off. It's still worth talking about as of maybe now. 10 years isn't that longer time, and we know that changes take a long time to be implemented in Bitcoin.

Let's get into what the actual threat to Bitcoin is if we get a quantum computer that can break cryptography. So what will happen first? Yeah, so the relevant thing, as I mentioned earlier, Shores algorithm. And Shores algorithm would enable the quantum attacker with a cryptographically relevant quantum computer to take our public keys and turn them into secret keys. And if they could do that, of course, then they could spend anyone's Bitcoin. And so that's the threat. And so we don't know exactly how that would play out because it's very hard to game out. let's say you are the first person that develops

a cryptographly relevant quantum computer, what are you going to do first? Are you going to go for Satoshi's coins? Are you going to try and hack into North Korea? Are you going to try to hack into Russia? Are you going to try to hack into the U.S. government? Like, what's the first target if you get that device? And it's very hard to know because there's different game theoretical reason

to do each of those things. You know, a certain entity might find just kind of slowly siphoning Bitcoin away to be the best use of that device, but another entity with the exact same device might think that infiltrating the president of, I don't know, the Ukraine even, might be their first target.

Like, we just don't know. And so I don't know what happened first. What I do know is that Bitcoin's public keys would become vulnerable to such a device. And this is where we get into then this long exposure versus short exposure that everyone likes to talk about. And so if you are someone who's,

public keys are just as secret as your secret keys, meaning you've never used, reused an address, you've never exposed your ex-pub, you've never exposed your descriptor, you've never used a taproot address or a paid-a-pub key address. You've only used address presenting an H, as Hunter likes to call them. And you've been absolutely perfect about your key discipline. Your public keys are as secret as your secret keys. The quantum attacker cannot steal your Bitcoin at rest because your public keys are not known. And the only thing that a quantum computer is likely to be able to do when it's first developed a relevant quantum computer is to reverse public keys into secret keys.

At some point, and if this happens, it's hard to know exactly the timeline here, but at some point after the first cryptographically relevant quantum computer, there will come a time where such a device can take a public key and develop a secret key in the 10 minutes it takes to find a Bitcoin block. And when that happens, then even those of us that maybe have perfect public key security, our public keys are absolutely secret from everybody are then vulnerable to the quantum computer as well because they can see our transaction,

maybe even see it after it gets confirmed and have a deal with a miner to mine an alternate block that takes those coins to themselves instead, right? Once there's a fast quantum computer out there, if sub-10 minutes, Bitcoin, as we know it today, is basically not usable because the coins will just be stolen by someone else once they try to move.

So that's the threat to Bitcoin, is yes, with Shores algorithm, a sufficiently powerful quantum computer can start taking people's coins. Okay, I think it's worth diving into that a bit deeper because there's, I think in Pate's Pub Key, which is a very old address format, I think there's about two million coins that we know of in that address format. So those ones are essentially gone immediately for the reason being that you can see those public keys on chain at any one time. Is that right? Yeah, they're at risk immediately because the public keys are readily available.

Okay. And then for anyone else who's using like, Segwit addresses, the public key isn't exposed until you actually make a transaction. So as long as the quantum computer can't break the cryptography in less than 10 minutes less than it takes to get in a block, you're going to be okay. If you've had perfect public key security and you've never leaked your ex-pop and never leaked your public key, it never leaked your descriptor, which I've said this in a few other places. Like, this is a really strange security assumption. So I like to say there's really no difference that Bitcoin is broken once there's even a slow quantum computer. Because to me, the idea that we're going to hang our hats on people having perfect public

key security is very, very strange. I don't accept that as a security claim for Bitcoin. No, I totally agree with that. I think I would probably say the majority of my Bitcoin addresses will be fine, but I bet there's one in there that's not. I wouldn't be sure. But, so why do people focus so much on Bitcoin with quantum computing? Because if quantum computers do break this cryptography, then there's a wide array of things they can go after. Why is Bitcoin the focus here? So I think there is a legitimacy there in that Bitcoin is hard to change.

And so, you know, we saw with the Y2K, you know, well, at least I did. I don't know if you're as old as I am. But with Y2K, everyone said the world's going to end. But then it didn't. Why? Because a bunch of software engineers busted ass and made it not end. And that's true for all the other systems. You know, if quantum computers look like they're around the corner, you know, governments, most governments and most computer operating systems and all that stuff can change to other cryptography in the time frame necessary to protect their users. It's less clear that Bitcoin can do that. I think that's where Nick is kind of doing this,

like, oh, because of this slowness, we have to act now, even though quantum is, only maybe a thing, yes, Bitcoin's hard to change. And so that's why they'll focus on Bitcoin is that it might take five years to make a change to Bitcoin, and that might be too long. So there's a legitimacy there. Yeah, I guess the other thing being there's no recourse with Bitcoin. So if someone, you know, if you own the private key, you own the Bitcoin. It's not like you're able to claw back money through the banking system or however it might be. There's no insurance here. Like this is this, if you own the private key, you own the Bitcoin. So there are obviously, there are things we can do to mitigate this attack. But when do you think the conversation really needs to

ramp up from something that is like cool for developers to be working on? We should be thinking about this. But when does it get to the point where you're like, oh shit, something needs to happen now? Yeah. So I've said this on the internet before, but I think it's really worth saying in many different forums over and over, as soon as there is evidence of clear logical qubit scaling, of progressive factorization or reversing of elliptic curve keys that gets greater bit counts reversed with sub-exponential scaling of energy input, right? There's a very clear evidentiary standard here, and as soon as that evidentiary standard is met, we have to start doing stuff.

But as of right now, no one has gone from reversing a 6-bid-ec key to a 10-bid-ecky-key using sub-exponential increases in time and energy. And until there's a sub-exponential increase in the difficulty of doing that, we still have the exact security model we've always promised with elliptic curves, which is that is exponentially difficult to break elliptic curve keys of a certain size. And as long as it's scaling exponentially with energy input, we still have that. So it's very easy to change my mind. The evidence can be just put out, hey, look, someone made a quantum device that for a six-bit

key takes X energy and for a 12-bit key takes Y energy and that sub-exponential scaling. Oh, okay, shit, we got to do something. If you already self-custody of Bitcoin, you know the deal with hardware wallets, complex setups, clumsy interfaces, and a seed phrase that can be lost, stolen or forgotten. Well, BitKee fixes that. BitKee is a multi-sig hardware wallet built by the team behind Square and Cash App. It packs a cryptographic recovery system and built-in inheritance feature into an intuitive, easy-to-use wallet with no seed phrase to sweat over. It's simple, secure self-custody without the stress, and Time named BitKee one of the best inventions of 2024.

Get 20% off at bitkey.world when you use the code WBD. That's B-I-T-K-E-Y.W-WD and use the code WBD. This episode is brought to you by Anchor Watch. The thing that keeps me up at night is the idea of a critical error with my Bitcoin called storage. And this is where Anchorage comes in. With Anchor Watch, your Bitcoin is insured with your own A-plus rated Lloyds of London insurance policy and all Bitcoin is held in their time-locked multi-sig volts. So you have the peace of mind knowing your Bitcoin is insured,

while not giving up custody. So whether you're worried about inheritance planning, wrench attacks, natural disasters, or just your own silly mistakes, you're protected by Anchor Watch. Rates for fully insured custody start as low as 0.55% and are available for individual and commercial customers located in the US.

Speak to Anchorage for a quote and for more details about your security options and coverage. Visit anchorwatch.com today. That is anchorwatch.com. What if you could lower your tax bill and stack Bitcoin at the same time? Well, by mining Bitcoin with Blockware, you can. New tax guidelines from the Big Beautiful Bill allow American miners to write off 100% of the cost of their mining hardware in a single tax year.

That's right, 100% write off. So if you have $100,000 in capital gains or income, you can purchase $100,000 of miners and offset it entirely. Blockware's mining as a service enables you to start mining Bitcoin right now without lifting a finger. Blockware handles everything from securing the miners to sourcing low-cost power to configuring the pool, They do it all. You get to stack Bitcoin at a discount every single day while also saving big come tax season. Get started today by going to mining.blockware solutions.com forward slash WBD. Of course, none of this is tax advice. Speak to your accountant or tax advisor to understand how these rules apply to you. And then head over to mining.blockware solutions.com forward slash WBD and you'll get one week of free hosting and electricity with each hosted miner purchased.

I mean, it's funny because like I probably buy some of the stuff that Nick's saying, like I can believe that there's plenty of people who would willingly allocate money to Bitcoin that see the quantum computer threat, think that this is real and is closer than it may be in reality, and then be cautious of ever like touching Bitcoin because of that. I think that probably exists. I think it's probably a small minority at the moment, but it's probably going to grow as well as the hype around quantum computing grows. So we do have people working on solutions.

What are those solutions? So quantum proof cryptography, like maybe explain how that works and why it's not an ideal solution at least right now. Yeah, so there's two major camps of quantum-resistant cryptography out there being proposed for a Bitcoin at least right now, and those are hash-based and lattice-based. I understand hash-based mostly. I don't understand lattice-based mostly. But they, for the moment at least, have somewhat similar problems, which is that they are much

They require much more data to prove ownership and validate signatures than elliptic curves. Eliptic curves were chosen for a lot of cryptosystems because they have really, even compared to RSA, which was a previous cryptosystem that has similar properties in many ways to elliptic curves, they have much smaller keys and signatures. So like a Bitcoin key is 32 bytes, 33 bytes, depending on things. and a Bitcoin signature is 64 to 70 bytes. These are very small amounts of data to prove the ownership of something. Really, if you think about the what you're doing, the ability to move Bitcoin and prove ownership with a total of 100 bytes is just shockingly efficient.

And quantum resistant algorithms, whether hash-based or lattice-based, are many kilobytes. So not many, several kilobytes at least, many kilobytes for kind of simple systems to do that same job of proving ownership and transfer of Bitcoin. So that's the big problem. right now. Recent research has made great strides in reducing the cost of these things, especially the compute cost. So there's been some posts going back and forth on the Bitcoin dev mailing list

about these post-quantam schemes and how they've really gotten the signature verification, which is probably the most important to optimize portion of the Bitcoin process, to about the same compute cost as elliptic curve verification. So that's like a huge innovation and great progress is have made there. So we're just really, I would say in the Bitcoin world, we're looking for a sufficiently developed post-quantum crypto system that doesn't have major downsides for the system, like multi-kilobite keys. And the issue there, like in layman's terms, is it takes Bitcoin from being, I don't

know, do you know, how many transactions a second? I even hate that metric, but how many transactions? Seven transactions per second is often cited. Okay, but then it's going to go down to probably less than one if we go to these larger signatures. Yep, exactly. And so if we have 10 years, how small do you think we can make those transaction size, the signature sizes, and like how close to what we're sort of working with now? I am not a cryptographer.

So I'm hesitant to even put a prediction on it. What I would guess is that over 10 years, we can make sufficient developments in kind of layered Bitcoin technologies, whether that's arcs or lightning or, or bit VMs or whatever else people are working on so that we can work with the larger signatures, however big, however small we can get them in the same time. So this kind of attack it from two sides, right? Make Bitcoin more efficient with layering and reduce the size of the signatures sufficiently

over the course of the time so that we can build a system that really works for people by the time we need to. It's one of those funny things where I guess the ideal solution here, if you assume quantum computing is real and it's going to be able to break cryptography at some point in the future, you want to make the change as late as possible so you have the best solution possible. But to get that, you do need people working on today, which we do have. But if we do get there and we need to make a change to Bitcoin, is this a soft fork or a hard fork?

Soft, yeah. Everything here can be done in a soft fork. I think there'd be a really interesting discussion on the same way that segregated witness was a soft fork that technically added. block space. If we've made significant strides in the validation cost and we've seen, you know, increases in storage capacity on typical devices and stuff, it might make sense to do another thing like Segwit where, okay, we get post-quantum and we make a special quantum signature block that lets us keep about the same transaction throughput. So there's a lot of conversations

to be had here when the time comes. In the meantime, as you said, the right thing to do right now is to continue developing these post-quant signature schemes, making them better and better and better over time so that we're ready. One of the most interesting things I've heard you say on this is that you think regular computers might break cryptography before quantum computers. Explain that. What do you mean? As many as people have said, crypto systems have a shelf life. You know, RSA 1024 bit was secure when I first started using cryptography,

but soon after I had to upgrade my RSA keys to 2048, and then I upgraded further to 496 bit keys. Shaw 1 is no longer secure. MD5 is not a secure. You know, crypto systems have a shelf life. And elliptic curves, the nice thing about modern cryptography, like we're kind of several generations in, obviously, of cryptography, is that we have pretty strong proofs of security.

Like we have, here's the assumption, if you don't break this assumption, this system is secure. but there's still new math being discovered every year. And there's no way to know for sure that some genius working in a university somewhere doesn't come up with a way to basically attack the underpinnings of the very elliptic curve system. You know, the SECP-256K1 curve that we use in Bitcoin has a specific formula that describes the shape of the elliptic curve.

And then on that curve, our whole cryptosystem revolves around moving a point around on that curve based on secret keys and public keys, right? What if there's a vulnerability in that curve and the points on the curve can be predicted based on the public key? That's a possibility. I don't think so. It's been around for long enough. But to me, that's a more likely attack vector for Bitcoin than quantum computing,

because we've seen that happen many times. As you'll hear, I kind of go with evidence. And the evidence is that crypto systems are broken by innovations in mathematics and cryptography. They're not broken by like brand new types of computers. They're broken by math. And that's what I would think is the most likely vulnerability. Now, the great thing is that the solution to both of these is the same thing. We should keep developing other cryptosystems that might be suitable for Bitcoin.

And we should implement one in Bitcoin when the time is right. Oh, great. We'll do that. I mean, I imagine AI is going to also. So like people talk about the breakthroughs that may come in math and physics through AI. Like that is probably one of the most realistic ways that current cryptography is broken. It's funny. I was actually talking to AI the other day and I was like, how would you break ECDSA?

And it won't tell you. Like it just refuses to answer that question. Or it did for me at least. I mean, not that I was going to understand anything that it said anyway. But so, okay, if we need to soft fork, then that's one of the really interesting parts of this conversation. It's like, what do we do with the old coins that, will otherwise be stolen. And there's going to be part of the Bitcoin community that think that those should be confiscated.

I, at least as of right now, I'm very strongly against that. Like one of the key principles in Bitcoin to me is property rights. And I don't think we should steal someone's coins, just the threat that a bad actor steals the coins later. Where do you fall on that whole thing? Yeah, I've found people arguing with me on both sides of this because I'm in the middle. If there is a sudden quantum break, let's say tomorrow we find out. that there's actually already a quantum computer active stealing coins, right?

So I think it's never happening, but tomorrow someone proves, hey, look, I'm doing it right now. Here's your secret key. Then we should confiscate the coins because there was no opportunity for anybody to retain their ownership. And so the entire system's ownership

has just been invalidated suddenly. So in that case, we confiscate the coins and we create some kind of a claim system where some people can reclaim their ownership, but we don't just leave a business. vulnerable to the quantum attacker because everyone's ownership was simultaneously ruined, essentially. On the other hand, if what is, I think, a much more reasonable expectation, we see a gradual progression.

And let's say in five years, quantum computers start factoring 20-bit numbers, and we say, okay, it's time to do something. So a year later, we activate a soft fork that has quantum-resistant cryptography in it. And then that year, they factor 32-bit numbers, and they keep progressing. then people have time from the time we deploy that quantum-rits-in-soft work to move their coins to quantum-resistant addresses. And at some point down the road, that quantum attacker is going to first break a meaningful Bitcoin key. They're going to factor a 256-bit number and break a Bitcoin key. But by then, everybody who was active in Bitcoin has already started using the new soft fork.

So then we just say, fine, they can have such as coins, they can have all the dead coins. It's going to be a race between different quantum actors, who gets which coins? and as you said, we enforce the ownership and say, no, whoever gets those keys is the owner because that's the only thing we know in Bitcoin. So mostly I'm with you unless it's a sudden thing where tomorrow someone starts stealing quantum coins or quantum vulnerable coins. See, I don't know if I even agree with that part. Like it just, it feels very like Ethereum Dow type situation where you're not happy with an outcome

so therefore you kind of roll back the chain and give people their Bitcoin back. Like, I don't know if I can ever get on board with that because, like, one of the issues that I think people will have here is they'll see that, you know, I don't know, two million coins or whatever it is in Pace Pub Key addresses are going to hit the market. That's going to have a massive impact on Bitcoin price. And therefore, they're like, that's a bad thing. But if you completely remove or invalidate one of the value propositions of Bitcoin, which is property rights, like, what does the long term value actually become? Like, I think the number is far lower in the long term, even if you have a short term, huge impact on price. I don't know. I feel like confiscating coins at any point is wrong, whether it's tomorrow or it's in 10 years. I love that perspective. I mean, I think it's a, it's a very kind of baller perspective to take, essentially. I think realistically, and this is, the plain reality of Bitcoin, and I was talking about it on Tonne Vease show the other day, it's a market question. And neither of us knows what the market will do. I would bet that if we do see there's a sudden quantum adversary where no one knew it was coming

and suddenly all the coins were starting to move, we would see a chain split, rather. So a chain split would happen. There would be the one that retains ownership. Exactly, as you said, it's just, it's Bitcoin. We add quantum resistance and people start kind of fighting each other to get their coins, quantum resistant. And like, we just kind of yolo, it's where we're baller, we're going to go with it. And on the other hand, we have people where we cut off the quantum vulnerable cryptography.

and we make some kind of a claim process, and we try to preserve ownership the best we can within that scenario. And I have no idea, really, which would have more value. I know that I prefer one of them, but I'm only one market actor with a small number of coins. I don't know what the future would hold on either one of those two coins, but I think we'd have a clear chain split. Yeah, and the funny thing is, like, even though I feel quite strongly that you can't ever confiscate coins under any circumstances,

I also could see a world, like, if you do take the Ethereum down, analogy where I would be on the side of like the Ethereum Classic, which fades into insignificance. That would definitely be a change split where I'd never sell the coins on either side. Exactly. And I think a lot of people do that. Yeah, but I do think it's probably one of the most interesting sort of dilemmas that may occur if we do actually get this. If that happens, so if we have a soft fork, so let's say we know quantum computing is coming, we've seen the progress, like it's an imminent threat, we make a change, we have a soft fork, Would everyone then have to migrate keys to a quantum proof address?

Yeah, everyone have to move their coins, which would be a big privacy impact for many people. Huge privacy impact. And also, it would take a very, very long time, right? Like, block space is limited. Like, how long would that process take? I think it's like, for all the UTXOs, it's like three or four years right now. No, no, not that much. Okay. I'm not exaggerating it. It's a good while, but it's measured in years, not decades, for sure. Okay, so you basically then are in that situation where you need to move your coins as quickly as possible because the idea is if the quantum computing progress is so fast that not only can it break cryptography, but it can now do it in less than 10 minutes, then those coins are also going to be lost forever, essentially. Yep. So miners are going to be happy. Fies are going to go through at the absolute roof.

Yeah, no, I think that's a, that's right. Does it have any other impacts apart from the, like, does it have any impacts in mining quantum computing? Very unlikely. There's an algorithm out there called Grover's algorithm that can reduce the difficulty of finding a shot to 56 collision by a square root factor, basically. But the reality is that Bitcoin's difficulty adjustment can handle that. So if quantum miner is square root faster, it's okay. It doesn't matter. As far as anyone researching has figured out so far,

there's not really a problem for mining because we have a difficulty adjustment. And so as quantum miners start to roll out, we've seen bigger improvements in mining already in the CPU, GPU, ASIC migration than you would see from a quantum device. Okay. So if anyone listening to this has been panicking about quantum, you think they can relax for a good deal of time right now?

Yeah, I mean, like I said, I can only say with confidence, like serious confidence, it's going to be more than 10 years. And so we should watch and we should look for the evidence. And I think even to go further than that, it makes sense to start taking whatever steps toward improving Bitcoin's resistance to an EC break. We can take the day that are clearly good steps for Bitcoin, that they don't have downsides, whatever. We should just do them. I mentioned, I think, Hunter Beast once in this already, he developed a BIP with some other folks called Bip360, which adds a

taproot type address, but without an exposed public key. And that would give options for quantum resistance in the future. It also would reduce the cost of certain types of on-chain contracts that people want. And so it's like, oh, that's a good thing regardless. Let's just do it. Let's, I think it makes great sense to

take concrete steps today that we know our good steps and keep watching the quantum computing and the post-quantum cryptography in the meantime. And last question on Bitcoin on this side of Bitcoin, I do want to get into how contentious a soft fork may be in this scenario. But does it have any impact on mining?

Obviously, to open a channel, you have to do a transaction, so it has an impact there. Is there anything else? Definitely. I mean, things are so complicated here, right? So we've been developing Bitcoin with elliptic curve keys in mind for a decade and a half already. And so we have determinants,

hierarchical deterministic wallets use elliptic curve key transformations to derive the keys. MUSEG-2 and Frost are elliptic curve key aggregation protocols. We've got lightning point-time-locked contracts being worked on. Those are key-based. We've got silent payments, which is a very elliptic-curve-specific method of doing more private addresses. We've got all this stuff that's all based on elliptic curves. And so absolutely, it impacts everything about Bitcoin. You know, DLCs, like all these technologies that we rely on for Bitcoin are based on the elliptic

curve math. And we would have to kind of redevelop them for whatever type of post-quantum signature we build. So there's a lot of work coming up. Okay. So let's get into the juicy topic of an actual soft thought happening. Like the idea of a soft fork happening to just improve Bitcoin or change Bitcoin in a way that you might get like, I don't know, CTV or whatever it might be, these have become already like really hot button topics. Like, it seems like, I don't think Bitcoin's ossified, but it's always trending

more and more towards ossification. Like, these are getting more and more contentious. Do you think this would be an easy soft fork to actually implement? I think that the ossification kind of narrative is largely an artifact, I would say, of the past, of the block space, the block size war and of other things. And I don't know, I can't predict the future, of course, but I think there is a memetic shift that will happen when the right combination of proposal and person and timing happens. Maybe it's this quantum narrative right now that creates that shift so that we see BIP 360 is the kind of best example right now being implemented as soft work and people seeing kind of a a different viewpoint on Bitcoin softworks, where instead of Bitcoin softworks being the big

Segwit change that added more block space or the big taproot change that took away certain kind of weird restrictions in how Bitcoin could be used, we see instead, oh, Bitcoin is improving in a slow and steady, responsible way to mitigate future risks that maintain the security of the system. And so the whole, I think the whole narrative will change at some point. because, you know, everything is driven on memes. Like, that's the fundamental learning of our lives on the internet and of Bitcoin. And the memes will shift at some point. And instead of there being this justification narrative, there'll be just the natural thing of,

oh, yeah, we're going to solve quantum gradually. We're going to do Bip 360 today. We're going to do some other thing tomorrow. And we're going to add quantum resistant signatures at some point later when they're ready. And that's just the obvious natural thing. So I do think it'll happen. I don't know if it's going to be easy, but I think we'll just see a shift in memetics. and it'll just happen.

So here's a, I'm going to put you on the spot and make you do a prediction. Do you think a quantum soft fork will be the next soft fork? If we count Bip 360 as a quantum soft fork, which is how it was originally built, I'm going to go with yes. I would say yes, that is the most likely next soft fork. I think the other option that's really out there for a next soft fork is probably the consensus cleanup. And I think that's also a good change.

I think it will go at some point. but it has much more to talk about. Not even that any of it is wrong or weird, it's just got more stuff, whereas Bit360 is a very focused, very single change that I think makes sense for a whole bunch of reasons, and so it's going to be easier to have the conversation

about Bit360, so I think it's more likely to be the one that shifts the memetics. The funny thing with that one, if there was a huge breakthrough in quantum computing, and we thought we didn't have three years or two years, however long it takes to migrate all of these coins. And we needed to put a block size increase in it as well. Like, that's how this could get really contentious.

Yeah, that would be a mess. And there's so many messy things out there because like James and Lott proposed confiscation. And like, we should start confiscating soon. And that, of course, we're like, wah! So there's a lot of controversy to be had. And that's I think that's why Bip 360 is very appealing as a next software, because it basically dodges all the controversy. It's just a stepwise improvement.

It's better for certain contracts today. It's better for both quantum in the future. It has support from all different circles. Lightning developers like it for certain things. Arc developers like it for certain things. Everyone likes it. So I think, yeah, I'll go with yes. A quantum change, PIP316 in particular, is the next soft work.

That might be bearish on CTV. Why does Jameson think we should start confiscating coins now? I've not seen that. So I think the idea was that we should deploy post-quantum crypto, and as soon as it's deployed, we should start a clock that includes confiscation X, Y, or Z years after, like, stops the creation of new quantum vulnerable coins after three years and then stops the spending of quantum vulnerable coins after five years, something like that.

So it wasn't like immediate confiscation, but it was like, as soon as we can do a post-quant fork, we should. And as soon as that's done, we should start a clock. And I think you and I would agree that we should not do that. If we have a post-quantam fork, people can voluntarily move their coins, and the other coins are the quantum attackers. That's part of the definition of the system. But at least it's not as crazy as I first made it out to me.

Sorry, Jameson. I think when you, if you look at Satoshi's coins, like, I don't know, people estimate it has a million. They're in a ton of different PACEPob key addresses. He talked about quantum computing, I think. He must have known that this was a potential future thing. and he still left his keys vulnerable. I think you just have to accept that decision that you made.

I don't disagree, yeah. It's going to be interesting. Is there anything else on the quantum side that you've like really paying attention to at the moment? Well, the one thing I mentioned already of the idea of maybe we don't need logical qubits and maybe that we should be building logical devices rather than logical cubits and then tying those together. That's something I'm definitely following. the particular person I was talking to

was not totally compelling on that topic, but if that were to be the case, it could reduce one more hurdle in the way of quantum computing ever working. So, yeah, I think people who know we know I'm open to having my mind changed, but it takes evidence. As of now, there's no evidence

that quantum is a kind of a current threat. Yeah, I mean, I've really liked both listening to your work and seeing what you've been putting on Twitter, because like, like I said, said, I was just kind of going along with the narrative that a load of changes were happening in quantum. It was getting really close. And I think listening to you has made me far less worried about this. I don't think it's a never problem, but I think it's a long way away. So Bitcoin's going to be fine. We're going to make changes if we need to. And it's going to be interesting.

We'll have a lot of content out of it. The podcast Industrial Complex will survive. Exactly. Brandon, this has been awesome. Thank you. you, man. Is there any way you want to send anyone if they want to check out everything that you're doing? Yeah, follow me on X. I'm mostly, as Robin Linus likes to call me, I'm an addict of X. I'm there all the time. I post about Bitcoin stuff and other topics there. As I said earlier, I'm starting a consulting business this year. So if you need help with anything Bitcoin related, hit me up. I'm happy to talk about how we can help with your Bitcoin questions and do Bitcoin stuff. So what are you doing with that? You're targeting like startups and businesses that might need help?

That's the thought. Mostly, yeah, is if you're writing a new Bitcoin wallet or a new Bitcoin script, I have expertise in scripting and kind of security modeling for Bitcoin applications. So if someone needs some help, they're either building it or reviewing it. I want to make myself failable. Awesome. If you vibe coding an app and you actually can't read code, speak to Brandon. This has been awesome. Thank you, man. I will definitely follow up with this. Hopefully it's in 10 years and it's still 10 years away. but I appreciate the time, man.

That's been cool. It's been great. Thanks, Tony.