Michael Saylor’s Quantum Claims About Bitcoin, Checked

On the morning of October 13, 2026, Michael Saylor spoke at the World Bank in Washington in a fireside chat with Chris Brummer, the Georgetown law professor who founded DC Fintech Week. Saylor is the co-founder and executive chairman of Strategy, the company formerly called MicroStrategy and the largest corporate holder of bitcoin.

About 18 minutes in, the conversation turned to quantum computing. Saylor said there is no quantum computer, and that once a quantum threat forms and consensus follows, banks, technology companies, governments and crypto networks will all move to post-quantum cryptography. For Bitcoin, he said, “it’s probably a 90-day upgrade.” Upgrading any earlier would be like vaccinating a one-year-old against a disease the child might get at 67. A hundred such vaccines with a 1% mortality rate would kill the child. Brummer closed by remarking that many central bankers at the World Bank would be digging into the subject.

Saylor’s plan works only if Bitcoin gets enough warning of a quantum attack, and only if everything that must happen after the warning fits into 90 days. Nothing guarantees the warning. And 90 days is enough only if the design, code and review are already finished. That is the preparation he says can wait for consensus. Even then, moving the coins would take most of the time: one 2024 model puts moving nearly every coin at about 85% of Bitcoin’s block space for the full 90 days.

Saylor made most of these arguments before, in an interview on Natalie Brunell’s Coin Stories podcast in February 2026, weeks after Strategy announced a Bitcoin Security Program in its fourth-quarter earnings presentation. In February he described waiting about ten years for global consensus on how to respond. At the World Bank he added an estimate for the step after that: once consensus forms, about 90 days to upgrade.

I described the wider pattern of quantum denial in Bitcoin in May. Saylor is now making his version of the argument at the World Bank, so I checked each of his claims. In my view, the evidence does not support waiting, and nothing in his remarks or in Strategy’s published materials explains the 90-day figure.

Some of what Saylor says is correct. No publicly known machine is a cryptographically relevant quantum computer, or CRQC, able to break Bitcoin’s signatures. Some vendors sell fear, and I have spent years documenting this quantum panic industry. New cryptographic code does bring new risk. All three are true. Bitcoin’s migration will still take years.

Strategy has also joined a funding effort for Bitcoin security. In July it became one of nine founding members of the Bitcoin Security Consortium, whose members pledged an aggregate $15 million over three years, each directing its own money to the researchers it chooses, with post-quantum cryptography in the remit. The consortium takes no position on specific protocol changes.

Its launch statement does take a position on timing. It says that quantum computers able to threaten Bitcoin’s cryptography do not exist today and that credible estimates put them years away, and it calls preparing post-quantum protections “a meaningful long-term priority” anyway. Strategy put its name to that in July: no machine yet, preparation now.

Saylor argues that people who warn about quantum computing profit from the warning, so here are my interests. I am the founder of Applied Quantum, which runs post-quantum migration programs for financial institutions, governments and other organizations. I advise Project Eleven, a company that works on post-quantum security for digital assets. Steve Vaile, who works with Applied Quantum, is one of the six authors of BIP-361, a Bitcoin Improvement Proposal to phase out Bitcoin’s current signature schemes.

Strategy, for its part, holds more bitcoin than any other company, and its executive chairman has a direct financial interest in how investors price quantum risk. I link the source for every factual claim below, so readers can judge the evidence for themselves.

Saylor’s Fifteen Claims and What the Evidence Shows

Across the World Bank chat and the Coin Stories interview, Saylor made fifteen distinct claims. My verdict on each, in brief:

Whether the Threat Exists and When It Arrives (Claims 1–3)

Today’s Quantum Computers and the Machine That Would Break Bitcoin

Saylor’s first claim is false as stated. IBM, Quantinuum, Google and others operate quantum computers, and several sell access over the cloud. If he meant a CRQC, he is right: none of the machines publicly known is a CRQC, the fault-tolerant computer needed to run Shor’s algorithm against the keys that protect real money.

In March 2026, Google Quantum AI and co-authors from the Ethereum Foundation and Stanford published two designs for breaking secp256k1, the elliptic curve behind Bitcoin’s signatures. One uses 1,200 logical qubits and 90 million Toffoli gates, the other 1,450 logical qubits and 70 million. On a superconducting architecture with a physical error rate of one in a thousand, either design needs fewer than 500,000 physical qubits, and a full run takes 18 to 23 minutes.

Those figures come from Google’s whitepaper, which I analyzed when it appeared. The team reported a roughly tenfold reduction in spacetime volume, the number of qubits multiplied by the computation time, compared with the best previous estimates for this curve.

Nobody has built anything close. Turning the estimate into a machine takes more than manufacturing 500,000 physical qubits at that error rate. It also needs error correction at scale, fast logical operations, control electronics and real-time decoding, all sustained for the length of the computation. I track each of those gaps in my CRQC Quantum Capability Framework, including manufacturability. They are engineering problems, worked on by well-funded teams that publish their progress.

The Ten-Year Claim and the Survey Data

On Coin Stories, Saylor said the cybersecurity community broadly agrees that quantum risk, if it exists, is more than ten years out and not a problem for this decade. He cited no survey. Strategy’s February earnings presentation stated the same position, that quantum computing is ten or more years away, and gave no source for it either. I could not find a survey of security professionals that supports it.

In a study sponsored by Entrust and run by the Ponemon Institute, published in January 2026, 51% of IT and security practitioners expected a quantum computer able to break today’s public-key cryptography within five years, and another 24% in five to ten years, as I reported at the time. Twelve percent said it would never happen.

Capgemini’s 2025 survey of 1,000 organizations with annual revenue above $1 billion found that about 70% were working on quantum-safe measures or planned to within five years, and about six in ten of those expected Q-Day in the next ten years. That matches what I see: most of the security professionals I know are preparing now or planning to.

ISACA’s 2025 poll of more than 2,600 digital-trust professionals asked a different question: 62% said they worried that quantum computing would break today’s internet encryption before the new algorithms were in place. Fewer than half of Entrust’s respondents said their organizations were preparing. The profession’s problem is a late start.

The experts who study the hardware are split. Michele Mosca and Marco Piani of evolutionQ have surveyed experts on this question every year since 2019. For the Global Risk Institute’s 2025 Quantum Threat Timeline Report, dated March 2026, they asked 26 experts how likely a quantum computer able to factor RSA-2048 within 24 hours is over different periods. Thirteen of the 26 put the probability within ten years at roughly 50% or higher, and six put it above 70%, as I covered in April. Within 15 years, 18 of the 26 put it at 50% or higher.

The panel is small, and its answers were collected in 2025. Its question concerned RSA-2048, a harder target than Bitcoin’s curve. Under similar hardware assumptions, Google’s 2026 estimate for secp256k1 needs roughly half the physical qubits of Craig Gidney’s 2025 estimate for RSA-2048 and roughly a hundredth of the Toffoli gates. On the evidence I found, the consensus Saylor described does not exist.

Organizations exposed to the risk have stopped waiting for agreement on a date. Google set 2029 as the deadline for its own migration. Microsoft, which had planned to finish its transition in 2033, said in June 2026 that its critical products and services would move to post-quantum cryptography by 2029. Cloudflare has set 2029 as its target for full post-quantum security, authentication included.

The US executive order of June 22, 2026, on advanced cryptographic attacks, directs the Office of Management and Budget to issue guidance moving federal high-value assets and high-impact systems to post-quantum key establishment by the end of 2030 and to post-quantum signatures by the end of 2031. In January 2026, the G7 Cyber Expert Group, which advises the G7 finance ministers and central bank governors, published a non-binding roadmap for the financial sector. It asks institutions to start preparing now and names 2035 as the overall target, with critical systems a few years earlier. As I have argued before, those deadlines, more than any Q-Day prediction, are what get migrations funded.

A Range of Five to 30 Years Is an Argument for Starting Now

Saylor’s third claim is the most reasonable of the fifteen, and it supports the opposite conclusion. At the World Bank he said a threat might form in five or ten years, sooner, in 30 years or never. Mosca turned that kind of uncertainty into a planning rule years ago, now known as Mosca’s theorem. If the time data must stay secret plus the time needed to migrate exceeds the time until a CRQC exists, the data is already at risk.

For Bitcoin the test is different, because a holder can move coins to a safe output, after which the old key controls nothing. The design, consensus, activation and movement of vulnerable coins all have to finish before anyone can use the old keys. If a CRQC arrives at the short end of Saylor’s range, five years from now, Bitcoin has little time for years more of design and governance work. BIP-361, the draft transition proposal discussed below, allows five years from the day it takes effect to the end of ordinary spending from old outputs, and nothing has been activated.

The Claim That Everyone Will See the Threat Coming (Claims 4–5)

By Saylor’s own test, the warning has already come. He told Brunell that everyone would see the threat coming, because banks, internet companies and governments would upgrade first. They have. OpenSSH made a hybrid post-quantum key exchange its default in April 2022 and switched the default to one built on ML-KEM, formerly CRYSTALS-Kyber, in April 2025. Apple moved iMessage to its post-quantum PQ3 protocol in 2024. In the same April 2026 announcement that set its 2029 target, Cloudflare reported that more than 65% of the human traffic it serves was post-quantum encrypted. Bitcoin has not started its own upgrade.

Saylor named Google, Microsoft, Apple, Coinbase and BlackRock as companies with something at stake that would upgrade when the threat became credible. All five are already acting. Google set 2029 for its own migration and Microsoft set 2029 for its critical products and services. Apple moved iMessage to post-quantum encryption in 2024. Coinbase formed a quantum advisory board in January. BlackRock has warned its investors that a timely quantum-resistant transition for Bitcoin is not guaranteed, and it joined the consortium in July.

Strategy’s February presentation stated the next step plainly: “If Bitcoin requires an upgrade, there will be global consensus.” Even with agreement that a threat exists, Bitcoin’s developers and holders would still have to decide which signature scheme to adopt, how much block space to give it and what to do with coins that never move. Those are the decisions that have taken Bitcoin years, and consensus on contested changes has not come easily, as the failure of a soft fork called BIP-110 showed this summer.

About 6.7 million BTC were held in addresses whose public keys were exposed or reused when Google’s team counted them for its March paper, including a little over 1.7 million in pay-to-public-key outputs from Bitcoin’s first years. I mapped that attack surface in my analysis of Bitcoin’s quantum vulnerability. Many of the early coins have not moved since, but a dormant coin is no proof that its owner has lost the key. The exposure has already happened. An attacker with a CRQC needs only the public key, which anyone can download.

The first owner of a CRQC may have strong reasons to keep quiet. Google’s team wrote that early CRQCs “may first be detected on the blockchain rather than announced.” In the GRI survey, most of the 22 experts who addressed covert programs at state laboratories, stealth companies or criminal groups said such work could move the timeline by two years or more.

In June 2025, Saylor told Bloomberg, according to Decrypt, that Microsoft and Google would never sell a quantum computer that broke cryptography because it would destroy their own businesses. He may be right about that. An intelligence agency that builds one first would be under no obligation to sell it or announce it either.

A coin does not need to be old to be attacked. When an owner spends from an address whose public key was hidden behind a hash, the transaction reveals the key while it waits in the mempool for a miner. Google estimated that a primed machine, with the key-independent half of Shor’s algorithm computed in advance, could recover the private key in about nine minutes with its faster design.

If blocks arrive at random with a ten-minute average, a computation lasting nine minutes finishes before the next block about 41% of the time. That is the share of races an attacker could enter in time, not the probability that a theft succeeds. BIP-360’s authors state that their proposal protects against long-exposure attacks. They add that protection against these short-exposure attacks may require post-quantum signatures.

The two kinds of attack have different speed requirements. A CRQC too slow to win a ten-minute race could still work through exposed keys that have been on the blockchain for years. A faster one adds every ordinary spend to its targets, and against that machine, owners who wait for a CRQC before migrating will expose their keys during the migration itself.

The Claim That Bitcoin Can Upgrade in 90 Days (Claim 6)

Saylor gave no basis for 90 days, and none appears in Bitcoin’s record of comparable upgrades or in its current proposals. He did not say what the 90 days would cover. A code release, a change to the rules every node enforces and the movement of vulnerable coins are three separate jobs, and Bitcoin has never attempted the third. If he meant the software alone, the coins stay exposed. If he meant protecting the coins, he is assuming the hard work is already done.

Two Draft Proposals and No Post-Quantum Signature Scheme

Bitcoin’s index of improvement proposals lists two BIPs written for the quantum threat, and both are drafts. BIP-360, by Hunter Beast, Ethan Heilman and Isabel Foxen Duke, received its number in December 2024 and went through several designs before it was merged into the repository under its current name, Pay-to-Merkle-Root or P2MR, in February 2026. Its authors revised it again in June and July. P2MR works like Taproot without the key-path spend, so no public key appears on the blockchain until the owner spends.

BIP-361, assigned its number in February 2026 and written by Jameson Lopp and five co-authors, sets out how the old signatures would be phased out. Phase A, 160,000 blocks or about three years after BIP-361 activates, would stop funds from being sent to quantum-vulnerable output types. Phase B, two years later, would restrict ECDSA and Schnorr spends to rescue protocols, which are meant to let a genuine owner prove ownership in ways a quantum attacker could not, for example by proving knowledge of the seed behind a wallet’s keys.

The authors write that it “remains to be seen” how much of the old supply such protocols could cover. For the earliest pay-to-public-key coins, where they know of no such proof, they support a separate proposal called Hourglass. BIP-361’s header lists the proposal it requires as a post-quantum signature BIP still to be determined, and as of October 14 no such BIP had been assigned.

Working code exists outside Bitcoin Core. BTQ Technologies ran BIP-360 on its own test network from March 2026, and said the network enabled five signature opcodes for ML-DSA, formerly CRYSTALS-Dilithium. Blockstream Research has published SHRINCS, a compact hash-based signature scheme, with a sketch of an opcode to verify it. When I checked four of Bitcoin Core’s consensus and address files on October 14, its main branch contained no P2MR code, and no proposal has a mainnet activation schedule.

When Saylor said at the World Bank that the vaccine has been developed, he was right about the algorithms NIST has standardized. For Bitcoin, the vaccine is two drafts and a missing component.

How Long Bitcoin’s Consensus Changes Have Taken

Saylor pointed to Bitcoin Core’s version numbers as evidence that the software changes regularly, and it does: Bitcoin Core ships a major release about every six months. Release counts measure how often the software ships. They do not measure how fast the network can agree on new spending rules or move its coins. A change to the rules every node enforces is a different kind of release. Bitcoin can make one by soft fork, which older nodes still accept, or by hard fork, which they reject. Its last two consensus changes, SegWit and Taproot, were soft forks.

SegWit was proposed as BIP-141 in December 2015 and activated in August 2017, almost two years later, after a fight over block size in which Bitcoin Cash split off as a separate chain, a history I covered in my analysis of Bitcoin’s migration governance.

Gregory Maxwell proposed Taproot on the bitcoin-dev mailing list in January 2018. It locked in during June 2021 and activated at block 709,632 that November, according to Bitcoin Optech’s Taproot timeline, almost four years from proposal to activation. Taproot’s design had broad support, and it imposed no deadline for moving coins. Lopp and his co-authors acknowledge the pattern in BIP-361 itself: “Upgrades to Bitcoin have historically taken many years.”

The closer comparison with Saylor’s 90 days is the period after Taproot’s design was settled. Bitcoin Core 0.21.1, the release with Taproot’s activation code, came out on May 1, 2021. Miners had about three months to signal. Enforcement was expected in November, six and a half months after the release, for a change nobody had to migrate to.

The most recent attempt at a consensus change failed. BIP-110, a temporary soft fork to restrict data in transactions, entered its mandatory signaling period in August. Only 51 of 2,016 blocks, about 2.5%, signaled support, and the rules did not activate on Bitcoin’s main chain. A minority chain that enforced them stalled after two blocks. Saylor was among its opponents.

A post-quantum soft fork imposes costs Taproot did not: larger transactions, less room in each block and, if BIP-361 or something like it is adopted, a deadline for moving coins. I expect it to take longer than either SegWit or Taproot.

What 90 Days Could Cover

A visible threat would speed up coordination, and Bitcoin’s developers have moved fast in emergencies. In August 2010, they released a fix for the value-overflow bug within five hours of its discovery. NIST’s post-quantum algorithms already exist, and exchanges and custodians that keep coins for millions of customers can move them in large batches. An emergency soft fork could also freeze vulnerable outputs to buy time, at the price of deciding who loses access to their coins, which is the dispute Bitcoin has not settled.

Anyone making a credible 90-day estimate would say when the clock starts and what counts as finished. He would say whether the signature scheme, consensus code, wallet support and custody procedures were reviewed before day one. He would say whether the 90 days end with the software shipped, the new rules active or the vulnerable coins safe. He would say how much block space goes to migration and what happens to holders who miss the window. Saylor said none of this.

If the review is finished before the clock starts, that is an argument for doing the preparation now. A review that starts only after the threat becomes credible is the rushed review Saylor himself warned against.

Why the Software Release Is the Smaller Part of the Job

A soft fork gives Bitcoin a new type of output without moving any coins into it. Whoever controls the keys to each vulnerable output, whether an individual, an exchange, a custodian or a group of multisignature signers, has to sign a transaction that spends the coins into the new type, using the old key, and wait for a miner to include it.

In February, Saylor told Brunell that an iPhone update would deflect the threat. For one holder, after a soft fork and a wallet update, migration might be about that simple. The network’s job is bigger. Every output that moves has to be spent as an input to a transaction, batched or not, and each input carries an ordinary ECDSA or Schnorr signature. A migration therefore uses about as much block space as a payment does today.

Researchers at the University of Kent put a number on that workload in a 2024 preprint. Using a June 2024 count of about 187 million unspent outputs, and packing them into blocks with no overhead at all, Jamie Pont and his co-authors estimated that moving the coins secured by ECDSA signatures would take at least 76 days in which Bitcoin’s blocks carried nothing else, a figure they call a lower bound. That is about 85% of all block space for 90 days. With half the block space, their model gives about 152 days. The owners of lost coins will never move them at all.

Spending from the new outputs costs more. An ML-DSA-44 signature, the smallest of the ML-DSA parameter sets, is 2,420 bytes and its public key 1,312 bytes. The signatures most Bitcoin outputs use today are 64 to 72 bytes, with a 32- or 33-byte key, as I detailed in my technical roadmap for fixing Bitcoin.

Blockstream’s researchers modeled Bitcoin at about 6.5 transactions per second with Schnorr signatures, about 0.5 with ML-DSA-65, the next ML-DSA parameter set up, and up to about 3 with SHRINCS. Exchanges, custodians, ETF issuers, hardware wallet makers and multisignature setups also need new software, key ceremonies and audits before their customers’ coins can move.

Low fees help. In February, Saylor cited fees of one satoshi per virtual byte as proof that Bitcoin’s bandwidth problem had gone away. Once a quantum-safe output exists, holders who move while block space is cheap will pay the least. If quantum news sets off a rush, everyone trying to migrate at once will compete for the same blocks.

That is also what is wrong with Saylor’s iPhone comparison. Apple can push an update to a billion phones, and a bank can replace the software behind its customers’ accounts. A Bitcoin upgrade changes the rules and leaves every coin where it is until whoever holds its keys moves it.

Lost Coins and Saylor’s Own Position on Freezing Them

On December 16, 2025, Saylor posted on X that quantum computing would harden Bitcoin, because active coins would migrate to new outputs while “lost coins stay frozen.” Lopp replied that he was glad Saylor would support his BIP. Saylor’s post does not show that he endorses every provision of BIP-361, whose Phase B restricts old outputs to rescue protocols instead of freezing them outright. BIP-361’s authors write that the restriction would be at most mildly confiscatory if rescue protocols can cover most of the supply. Adam Back, Blockstream’s CEO, argued for optional quantum-resistant upgrades without a forced freeze.

The dispute over unmigrated coins is real, because the blockchain cannot tell a lost key from a patient owner. Any rule that restricts old outputs also binds owners who are alive and have not moved yet, and it raises questions about property and about which chain the market will recognize.

Whatever form it takes, a restriction protects coins only if it takes effect before anyone can steal them. Once a CRQC operator has moved early coins, the theft is a valid transaction under Bitcoin’s rules. Bitcoin has no ordinary mechanism for reversing it.

For lost coins to stay frozen, as Saylor wrote in December, a contested restriction has to be agreed and activated before a CRQC exists. In October he advised deferring the decisions that matter, activation and the fate of unmigrated coins, until the threat is visible. Both positions can be right only if the network gets years of warning, and Saylor has not said where it would come from.

His July posts add a third position. Arguing against BIP-110, he called Bitcoin’s consensus rules its constitution and wrote that rewriting them for a faction would “attack the economic rights of every participant today and every generation to come.” A rule that freezes coins whose owners have not moved them also rewrites economic rights. Saylor has not said how he would square that with December’s freeze.

Complex Libraries, AI Attacks and Other People’s Research (Claims 7–9)

Where Saylor Is Right About New Cryptographic Code

Saylor gave three reasons for waiting. Post-quantum libraries are more complicated and bring new attack surfaces. AI-assisted hacking is the bigger threat. And the rational course is to let Microsoft, Google, the US government and the NSA mature the code first. He is right about the risk of new code and wrong about what follows from it.

New cryptography brings new risk, of two kinds. Some candidate algorithms have broken mathematically. Ward Beullens recovered keys for Rainbow, a signature finalist in NIST’s standardization process, in about 53 hours on a laptop for its second-round level-1 parameters. His attack beat earlier ones on every parameter set submitted. SIKE, a key-exchange candidate still under consideration in NIST’s fourth round, fell the same year to a classical key-recovery attack.

Other failures have been in implementations. The KyberSlash disclosures of 2023 and 2024 showed timing leaks in several implementations of Kyber, the algorithm NIST standardized as ML-KEM.

In July 2026, Anthropic reported that its Claude Mythos Preview model had found an improved key-recovery attack on HAWK, a lattice-based signature scheme then in the third round of NIST’s call for additional signatures. According to HAWK’s designers, the attack roughly halves the lattice-reduction block size needed to recover a private key, and Anthropic describes it as an exponential-time attack. The designers withdrew HAWK from NIST’s process on July 29.

The work took about 60 hours and roughly $100,000 in API costs. The same model found a faster attack on a seven-round version of AES. Anthropic reported no effect on production systems or on the post-quantum algorithms NIST has standardized. AI tools are already finding weaknesses in young cryptographic designs.

Why New-Code Risk Is a Reason to Start Now

Cryptographers defend against immature designs with years of public scrutiny before deployment. The algorithms may be mature by the time Bitcoin needs them: ML-DSA and SLH-DSA have been NIST standards since 2024. In a 90-day emergency, the Bitcoin-specific work is what gets compressed: the consensus code, the wallet and custody software, the testing and the recovery plans. A design proposed in 2026 and activated in 2029 gets three years of human and AI-assisted review of that work first.

Bitcoin’s developers also have conservative options. Hash-based signatures such as SLH-DSA, formerly SPHINCS+, depend on the security of hash functions like SHA-256, which Bitcoin already relies on for mining and addresses. Blockstream’s SHRINCS depends on the same assumptions but is newer and has had far less review than SLH-DSA. Hybrid designs require a classical and a post-quantum signature together, so an attacker has to break both. An opt-in output type forces no one to move before they are ready, although every new output type adds to what nodes must validate and maintain.

Outside Bitcoin, the libraries Saylor calls too complicated already run at internet scale, in the OpenSSH, Apple and Cloudflare deployments above. Those deployments protect key exchange, and Bitcoin needs post-quantum signatures. Running that code across billions of connections a day is how implementation bugs come to light.

Saylor is right that AI-assisted attacks are a present threat. They threaten all cryptography, including the ECDSA and Schnorr signatures Bitcoin uses today, and a network can work on AI-driven risk and quantum risk at the same time.

The published results do not show a practical classical attack on Bitcoin’s signatures. They do show cryptanalysis getting faster, which is the case for crypto-agility, the ability to replace an algorithm without redesigning the system around it. On a blockchain, developers also need a way to switch a broken scheme off. Until it is switched off, an attacker can still spend through it, whatever other options exist. I made that argument for digital assets earlier this month.

Saylor’s own warning applies to his plan. At the World Bank he said the danger is upgrading software to be too complicated, too quickly, before the threat has manifested. A 90-day upgrade that starts when the threat appears is that upgrade.

What Google, Microsoft and the NSA Will Not Build for Bitcoin

Much of what Saylor would wait for already exists, and only Bitcoin’s own developers and holders can finish what remains. NIST published ML-KEM, ML-DSA and SLH-DSA as federal standards in August 2024, and FN-DSA, formerly Falcon, is in progress. The organizations Saylor named are not waiting for a consensus that the threat exists. Google and Microsoft set the 2029 deadlines above, and the NSA’s CNSA 2.0 schedule sets 2035 as the goal for national security systems, with earlier dates for some categories of equipment.

Their work does not include the parts specific to Bitcoin. Those include a signature scheme that fits Bitcoin’s block space, an address format and the soft fork to deploy it, and a replacement for the public-key derivation that watch-only wallets use today, which depends on elliptic-curve arithmetic that lattice and hash-based schemes do not offer. They also include a policy for early coins whose owners may no longer be able to move them. Bitcoin’s developers and its largest holders have to do that work, and in October 2026 it is still in draft.

Vaccines, Insurance, Y2K and the Block Size Wars (Claims 10–13)

A Vaccine With a 1% Mortality Rate

Of Saylor’s fifteen claims, the vaccine analogy is the hardest to take seriously. No regulator would license a childhood vaccine that killed one child in a hundred to prevent a disease of old age. Regulators withdraw vaccines over far smaller risks.

RotaShield, a rotavirus vaccine for infants, was licensed in the United States in August 1998. In October 1999, the CDC’s vaccine advisory committee stopped recommending it and the manufacturer withdrew it, after the CDC estimated that it caused one or two additional cases of intussusception, a serious bowel obstruction, for every 10,000 infants vaccinated. That rate, for a serious complication rather than a death, was 50 to 100 times lower than the death rate in Saylor’s example.

Routine vaccines are watched for reactions far rarer still. In a CDC Vaccine Safety Datalink study of more than 25 million doses, researchers confirmed 33 cases of anaphylaxis, a rate of 1.31 per million doses. Medicine also vaccinates children against diseases of adulthood. The CDC recommends HPV vaccination at 11 or 12 to protect against infections that can cause cancer decades later. Even Saylor’s arithmetic is off: a hundred independent 1% risks give about a 63% chance that at least one proves fatal.

The analogy depends on an invented lethal vaccine, a familiar move in anti-vaccine arguments: inflate the risk of the intervention and leave the disease out. Applied to Bitcoin, the disease is concrete. A CRQC could target any coin whose public key is exposed, and about 6.7 million BTC are. Saylor offered no failure rate for the “vaccine”, an opt-in output type that no one has to use until they are ready, because none has been measured.

He also treats funding research, reviewing code, adding an optional output and forcing a migration as one decision. They are four, and only the last forces anything on holders. The real choice is between preparing a tested migration path now and improvising one later, under attack. This vaccine also takes years to administer: BIP-361’s draft schedule runs five years from activation to the end of ordinary spending from old outputs.

The 0.01% Threat and the Cost of Insuring Against It

On Coin Stories, Saylor described a hundred hypothetical risks, each 0.01% likely and each insured at 1% of income, and argued that covering all of them would bankrupt you. In the same interview he put quantum in that category, calling it “the 0.01% likely quantum threat” and saying an iPhone update would deal with it. He gave no source for that number, no time frame and no definition of the event.

Nineteen of the 26 experts on the GRI panel put the chance of a quantum computer able to break RSA-2048 within ten years above 5%, and half put it at roughly even odds or higher. Three-quarters of the practitioners in the Entrust study expect a machine able to break today’s public-key cryptography within ten years. At the experts’ figures, his own arithmetic argues for buying the policy.

His premium is wrong too. The part of it Strategy has actually committed so far is small: the consortium’s nine members pledged $15 million between them over three years. Even if Strategy had pledged all of it, that would come to about 0.007% a year of a bitcoin position worth about $70 billion in mid-October. Migration will cost more, in new wallet and custody software, audits, transaction fees and larger transactions afterwards, and Saylor offered no estimate of that either. The loss that premium insures against is about a third of all bitcoin, and the confidence of everyone who owns the remainder.

Y2K Was Quiet Because of the Work Done Before It

Saylor asked Brunell whether she remembered deciding to make her own systems ready for Y2K. He agreed that the episode had been a non-issue and said billions of people did nothing about it. He is right that most people did nothing. Of all his comparisons, Y2K is the worst for his case: individuals could do nothing because institutions did the work for them, for years and at great cost, before the deadline.

In November 1999, the US Commerce Department estimated that US government agencies and companies would spend about $100 billion on the Year 2000 problem between 1995 and 2001. The research firm IDC put worldwide spending at $320 billion, Computerworld reported, and in February 2000 the US Senate committee created to monitor the problem concluded that the money had been well spent.

Y2K also had advantages the quantum transition lacks. Its date was fixed decades in advance. Its cause was understood from the start, even though finding and fixing every instance took years of inventory and testing. It had no adversary, since a date bug does not choose its victims or hide its progress. And the systems belonged to institutions that could fix them on their customers’ behalf.

Bitcoin faces an unknown date, a fix it has not chosen and an attacker who may prefer to stay hidden, and every self-custody holder and custodian has to move the coins it controls. I compared the two transitions in Q-Day (Y2Q) vs. Y2K in 2019. Bitcoin cannot count on anyone announcing Q-Day in advance.

The Block Size Wars and a Hundred Narratives

Saylor counts quantum as the latest of a hundred failed predictions about Bitcoin, including bandwidth, mining concentration in China and energy use. Bitcoin survived those concerns, in part because people worked on them. Shor’s algorithm is a proven mathematical result: a large enough fault-tolerant quantum computer recovers an elliptic-curve private key from its public key. In my view, the only open question is when someone builds one.

His own example also tells against his 90 days. The block size war ran for years. Bitcoin Cash split off on August 1, 2017, and SegWit activated later that month. The SegWit2x plan to follow it with larger blocks was called off that November. A dispute that ended in a chain split is a poor precedent for a 90-day upgrade. Bitcoin’s developers have met earlier threats with engineering, including the 2010 overflow fix, which they released within five hours of the bug’s discovery. A post-quantum upgrade takes years of engineering.

The Claim That Crypto Has the Most Sophisticated Security Community (Claim 14)

Saylor told Brunell that moving bitcoin at scale involves multifactor authentication, hardware keys and cold storage, and that the protocols behind bank wires and stock trades are orders of magnitude weaker. He expects the crypto security community to perceive the quantum threat first and lead the response.

The practices he describes stop thieves from taking private keys. They do not stop a CRQC, which never needs to break into the vault: it computes the private key from a public key on the blockchain and produces a signature the network will accept. Hardware wallets and cold storage sign with ECDSA or Schnorr signatures on secp256k1, the curve Shor’s algorithm attacks. The members of the crypto security community who have engaged with the threat, from BIP-360’s authors to Blockstream Research, are writing the upgrade Saylor says can wait.

Banks have something Bitcoin lacks by design: a party that can fix the system on its customers’ behalf. A bank can rotate its keys centrally and reverse many fraudulent transfers, and its customers often have legal recourse. Bitcoin was built without those options, which is why its holders, more than any bank’s customers, need to act before the threat arrives.

The Claim That Quantum Warnings Serve Opportunists (Claim 15)

In the longest part of his Coin Stories answer, Saylor described quantum warnings as the work of alarmists and ambitious opportunists who want money or power, and grouped quantum with climate policy, pandemic masks and vaccine debates. Whatever one thinks of those debates, the effect of Shor’s algorithm on secp256k1 does not depend on them.

He is right that a quantum panic industry exists. I have documented tokens marketed as quantum-safe that use unaudited cryptography, and vendors who sell fear. His own company, though, warns its investors about the same risk, and so do organizations with nothing of that kind to sell:

• Strategy. Its annual report for 2025, filed on February 19, 2026, lists developments in quantum computing among those that could make the cryptography of the Bitcoin blockchain insecure or ineffective. It separately warns that AI-driven cyberattacks and the potential for quantum computing could make traditional cryptographic techniques less effective. Its annual report for 2022 used similar language: such developments “could result in the cryptography being used by bitcoin becoming insecure or ineffective.” In July 2026, Strategy became a founding member of the Bitcoin Security Consortium.
• BlackRock, whose iShares Bitcoin Trust prospectus, as amended in May 2025, warns that “there is no guarantee that new quantum-proof architectures will be built” and that a transition may not be implemented across the network at scale in time. The prospectus adds that the broad consensus such a transition would need may not be reached. BlackRock is also a founding member of the consortium.
• Coinbase, which Saylor cited as having its own security program, and which formed an Independent Advisory Board on Quantum Computing and Blockchain in January 2026.
• The G7 Cyber Expert Group, whose January 2026 roadmap asks financial institutions to start preparing now.
• Bitcoin’s own developers, who wrote BIP-360 and BIP-361.

Risk-factor sections list remote risks alongside likely ones, and Bloomberg ETF analyst James Seyffart called BlackRock’s additions basic risk disclosures at the time. BlackRock’s warning is specific, though: it is about execution, the part of the problem Saylor left out. These organizations sell no quantum-resistant tokens, and each of them either discloses quantum computing as a risk or is preparing for it.

Saylor’s Expertise and Strategy’s Stake

Saylor asks who profits from quantum warnings. I ask the same of his reassurance, and what qualifies him to give it.

Saylor’s Background

Saylor is one of bitcoin’s most effective advocates, and his company holds more of it than any other company in the world. His official biography lists dual degrees from MIT, in aeronautics and astronautics and in science, technology and society, and a career founding and running a business software company. It lists no work in cryptography or quantum computing.

Anyone may hold a view on quantum risk, but Saylor offered no evidence for his technical claims: no survey behind the ten-year consensus, no plan behind the 90 days, no measured risk behind the 1% vaccine or the 0.01% threat. He was most confident exactly where the evidence is against him. On each of those points he contradicted the people who do the work. Google set a 2029 deadline for its own migration, and its quantum team warns that early CRQCs may first show up on the blockchain. NIST and the NSA have set deadlines of their own. The authors of BIP-361 write that Bitcoin’s upgrades take years.

Strategy’s Stake in the Bitcoin Price

Strategy owned 848,250 BTC on October 11, about 4% of the 21 million bitcoin that will ever exist, bought for about $64 billion, The Block reported, with money raised by selling shares, preferred stock and convertible debt. It pays dividends on its preferred stock and interest on its debt, and keeps a dollar reserve for those payments, $4.88 billion on October 11. This year it has also sold bitcoin to help pay the dividends: about $218 million worth by late July, by its own account.

A credible warning that a quantum computer could break bitcoin’s signatures within this decade would weigh on the price of the asset behind all of this. I cannot know what Saylor believes. I can see that the message he took to the World Bank, no threat now and a 90-day fix later, is the message least likely to unsettle investors in that asset. Strategy’s February presentation, which announced its security program, also filed quantum under the heading “Bitcoin FUD is Inevitable”, as the last of twenty kinds of fear, uncertainty and doubt, after Ponzi and volatility.

In my view, the 90-day figure is public relations: reassurance without the assumptions needed to evaluate it, for an asset whose community has not agreed on how to protect it. It fits the pattern of quantum denial I described in May. Strategy’s consortium pledge shows that it takes security research seriously. Coins move only when the holders of their keys spend them, and Strategy has not said which migration plan it backs.

A Year of Quantum Statements From Saylor and Strategy

• December 16, 2025. Saylor posted that quantum computing will harden Bitcoin and that lost coins stay frozen.
• February 5, 2026. Strategy announced its Bitcoin Security Program with its fourth-quarter results. Its slide said quantum computing is ten or more years away. The same slide said global consensus would form if Bitcoin needed an upgrade.
• February 2026. Saylor told Coin Stories that the world would wait about ten years for global consensus. He put the quantum threat at 0.01% and said an iPhone update would deflect it.
• July 23, 2026. Strategy and eight other institutions launched the Bitcoin Security Consortium, with an aggregate $15 million in member pledges over three years, post-quantum cryptography in its remit and a launch statement calling post-quantum preparation a meaningful long-term priority.
• July 27–28, 2026. Arguing against BIP-110, Saylor wrote that Bitcoin’s core design is set in stone. He added that protocol changes “should be rare, conservative, and driven by necessity, not ambition,” and the next day called its consensus rules a constitution.
• October 13, 2026. Saylor told the World Bank audience that the upgrade would probably take 90 days and that the rational course is to wait.

Between February and October 2026, BIP-360 and BIP-361 stayed in draft, BIP-360 was revised in June and July, and no post-quantum signature proposal received a number. Each consortium member funds research independently, and the group takes no position on protocol changes. The executive chairman of one of its founding members is telling policymakers that the rational course is to wait.

Funding research while advising the market to wait works only if the research produces a migration plan that Bitcoin can complete before a CRQC arrives. Strategy could publish its assumptions: which design it would support, which milestones would show the work is ready, what should happen to coins that cannot migrate and how much block space it expects migration to need. It could also say whether any of its own 848,250 BTC are held in outputs whose public keys are already exposed. Investors and central bankers could then test the 90-day estimate against something.

What Bitcoin’s Largest Holders Could Do Now

If I were advising a board that owns bitcoin, and I do, I would tell it to support activation of a post-quantum output type as soon as a reviewed design is ready and to agree on the policy for coins that cannot migrate before anyone is able to steal them. For Strategy and the other consortium members, and for the ETF issuers and custodians that keep coins for others, that means:

1. Fund the missing work and say which design you support. BIP-360 needs review, testing and an implementation in Bitcoin Core, and BIP-361 still lacks the post-quantum signature proposal it depends on. Consortium members can fund that work through their own commitments without directing the protocol, and each can still say publicly which design it would run.
2. State a position on coins that cannot migrate. Saylor already has one. In December he wrote that lost coins should stay frozen. Repeating that at the World Bank, with a view on how a freeze would tell lost coins from patient owners, would have given central bankers a concrete policy to evaluate.
3. Prepare your own coins. Inventory your unspent outputs, address types and custody arrangements, because the block space needed to move coins grows with the number of outputs, whatever the amount of bitcoin in them. Avoid address reuse, review the use of Taproot outputs, whose output key is itself a public key on the blockchain, and check whether keys have been exposed through shared extended public keys or other systems off the chain. Outputs whose keys are hidden behind hashes reduce long-exposure risk, as Google’s paper notes, but do not protect a coin at the moment it is spent. Plan and rehearse the migration of your own holdings, so it can run while fees are low once a quantum-safe output exists.

My practical guide sets out the steps for holders, developers, exchanges and institutions.

If Bitcoin can someday complete a quantum upgrade in 90 days, it will be because the work Saylor says can wait was done first. Brummer expected central bankers at the World Bank to dig into the subject. In January, the G7 group that advises finance ministers and central bank governors urged them to start preparing now and to protect critical systems before 2035. Bitcoin holders should take the same advice, because no protocol upgrade will move their coins for them.

From the author