2030 Was a Lie.

A researcher just got paid 1 Bitcoin — $94,000 at current price — for doing something the cryptography community told us wasn't possible until 2030. The story ran in CoinDesk on April 24th. It was filed under "Bitcoin news."

It isn't Bitcoin news.

I want to tell you what actually happened, because the framing is burying the thing that should be on your desk.

The attack targets ECDSA on the secp256k1 curve. That's the signature scheme Bitcoin uses to prove you own coins. The researcher didn't steal anything — they proved that a quantum computer running Shor's algorithm can take a public key and work backward to the private key. The bounty was structured specifically to reward that proof. Someone set it up years ago because they wanted to know when the theory became real. Now they know.

Here's what CoinDesk didn't mention: Ed25519 and ECDSA are the same attack family. They're both elliptic-curve discrete logarithm problems. Shor's algorithm doesn't care which curve you're on.

Every AI vendor I've spoken to in the last six months — every platform selling "cryptographic receipts," signed decision logs, model attestations, audit trails — uses Ed25519 or ECDSA to sign those outputs. That's not a criticism. It's what NIST recommended until August 2024. The problem is that August 2024 was when NIST published FIPS 204, which introduced ML-DSA-65 and effectively deprecated ECC-based signing for new implementations. That was nine months ago. I have not found a single AI platform that has shipped ML-DSA-65 dual-signing in production.

So you have a class of attack that just moved from theoretical to demonstrated, pointed at a signature scheme that every AI governance vendor is still shipping, against a replacement standard that nobody has implemented. That's the story.

The 2030 number came from a 2016 paper that estimated how many error-corrected logical qubits you'd need to run Shor's algorithm at scale against Bitcoin-grade keys. The paper made assumptions about qubit error rates that were reasonable in 2016. Nobody updated the estimate when error correction improved. The field just kept repeating "2030" because it was a number and numbers feel authoritative.

What actually matters isn't the qubit count. It's whether you need a full-scale fault-tolerant quantum computer to break 256-bit elliptic curve keys, or whether a smaller, noisier, cheaper machine can do enough damage on enough specific targets. The bounty was won. That's the data point that supersedes the estimate.

There are 1.1 million Bitcoin sitting in wallets where the public key is already exposed on-chain. These are the Satoshi-era coins — addresses that sent a transaction at least once, which means the public key is in the blockchain, which means anyone with a capable quantum machine can attempt the private key recovery without needing the wallet to do anything. $107 billion at current price, exposed.

The reason those coins matter isn't that someone is going to steal them. The reason they matter is that when they move — when addresses that haven't touched since 2009 suddenly drain — every CISO on the planet will have 72 hours before it goes to the board. And nobody will be ready. Not because they didn't know quantum was coming, but because they filed it under "future threat" in 2023 and never moved it to the present column.

Your SOC 2 report, if it covers AI systems, almost certainly lists ECC-based digital signatures as a satisfactory cryptographic control. It should. Your auditors wrote that section against a control framework that was current when they wrote it. Auditors update their templates in 12 to 18 months, which means the earliest your next audit will flag this is mid-2027, assuming the auditor's firm updates before then, assuming the reviewer on your engagement knows to look.

The gap between when NIST deprecated ECC for new implementations and when your audit framework reflects that deprecation is your exposure window. It's not a theoretical window. It's a documented, measurable period during which you are attesting to compliance with a control that the standard body has already superseded.

Here's the question nobody is asking their AI vendors: "What cryptographic scheme do you use to sign decision receipts, and what's your migration timeline to ML-DSA-65?"

It's a specific enough question that it separates the vendors who have thought about this from the ones who haven't. Anyone who can answer it in 60 seconds has a roadmap. Anyone who says they'll get back to you is telling you everything you need to know about where post-quantum sits in their engineering priorities.

ML-DSA-65 isn't a drop-in replacement. It uses Module Lattice-based signatures, which have different key sizes, different signing speeds, and different verification overhead than ECDSA or Ed25519. The migration isn't a one-afternoon pull request. For a system generating millions of signed AI decisions per day, it's an architecture project. The vendors who start it now will own a compliance wedge that their competitors won't be able to close in 90 days when the auditors finally update their templates.

The harvest now, decrypt later problem is the one that keeps me up at night more than the others. Every signed decision log from 2024 and 2025 that used ECC-based signing is already collected somewhere — in your SIEM, in your audit trail, in your vendor's logging infrastructure. An adversary who captures that data today and runs the decryption in 2027 doesn't need to wait for your migration. They're working backward. The logs you signed last year thinking they were protected become forgeable the moment the math breaks.

That's not a scenario. That's a data retention and cryptographic hygiene problem with a clock on it.

NIST published the fix in August 2024. It's called ML-DSA-65, standardized as FIPS 204. The global migration timeline they estimate is 7 to 10 years. A capable attacker moves in weeks. The asymmetry is the story. Not 2030. Not Bitcoin. The asymmetry between how long it takes institutions to migrate and how fast a targeted attack moves once the proof of concept exists.

The researcher who won the bounty didn't build a weapon. They built a receipt. A proof that the window is open.

No Receipt. No Trust.

— Nigel

If you're the type of CISO that wants to see the receipt schema before the enforcement action: Book 30 minutes

.