Bitcoin's Quantum Upgrade Has a Name: Falcon-1024 — 5 Numbers That Decide When Your BTC Must Move

Bitcoin's quantum upgrade finally has a name. On November 7, Blockstream Research named Falcon-1024 as its top candidate to replace the signatures that protect every bitcoin in existence — and the numbers behind the decision are more urgent than most holders realise. Roughly 6 million BTC sit exposed to a future quantum attack, 2.3 million of them cannot be saved by any upgrade, and researchers now put the chance of a cryptographically relevant quantum computer arriving by 2035 at about one in six. Your coins are safe today — the question is for how long.

The announcement moves the quantum debate from theory to engineering. For years the threat was abstract: a machine that does not exist yet, breaking math that has held for decades. Now there is a concrete proposal, a draft Bitcoin Improvement Proposal, a working demonstration on Blockstream's Liquid sidechain, and hardware-wallet benchmarks showing the devices people already own can produce post-quantum signatures. Below: what Falcon-1024 is, the five numbers that decide whether your bitcoin is safe, and the checklist to follow before the upgrade arrives.

What Blockstream Actually Decided

Blockstream Research published a peer-reviewed paper on August 6, 2026, evaluating three lattice-based post-quantum signature schemes — Dilithium, Falcon and Hawk — as candidates for a future Bitcoin upgrade. Falcon-1024 won: its combined public key and signature come in at 3,073 bytes, the most compact of the three, and it verifies fast, which matters on a network where every full node checks every signature. The paper, covered in detail by Crypto Briefing, is the most concrete step yet toward quantum-proofing Bitcoin.

Picking a favourite is not the same as picking a launch date. The same paper is blunt about why Falcon-1024 cannot simply be dropped into Bitcoin tomorrow. First, memory: Falcon's signing process requires about 90 KB, a heavy demand for the small secure chips inside hardware wallets. Second, Falcon lacks native support for hierarchical deterministic (HD) key derivation — the system that lets one seed phrase generate all of your addresses. Third, Falcon-1024 still needs final standardisation at NIST before Bitcoin builds its long-term security on it.

Blockstream is pursuing a two-track plan. The near-term track is hash-based signatures: in late August 2026, its researchers co-authored the first draft SHRINCS Bitcoin Improvement Proposal, and in March 2026 they completed a post-quantum transaction on the Liquid sidechain. Hash-based schemes are conservative and well understood, but their signatures are large. The long-term track is Falcon-1024: once NIST finalises its standard, it could replace the SHRINCS backup with something far smaller and faster for every node to verify. As Blockstream's Q3 2026 update puts it, the work has moved from proposal to draft BIP and from theory to real hardware-wallet tests.

The most reassuring finding came from the hardware tests. In August, Blockstream benchmarked five hash-based signature schemes on Jade Plus, Trezor Safe 3, 5 and 7, two Ledger devices and the BitBox02 Nova — and every device tested could already produce post-quantum signatures. The bottleneck is agreement: standards, wallet software, and eventually a Bitcoin soft fork.

The 5 Numbers That Decide If Your Bitcoin Is Safe

Number 1: 1,200 to 2,330 logical qubits to break a Bitcoin key

Bitcoin signs transactions with ECDSA over the secp256k1 curve. Shor's algorithm, published in 1994, can solve that curve's discrete logarithm problem in polynomial time — but only on a machine large enough. A June 2026 evaluation published on arXiv, "Quantum Horizon", puts the requirement at roughly 1,200 to 2,330 logical (error-corrected) qubits, or 0.5 to 320 million physical qubits depending on the design. The best machines of 2026 hold roughly 1,000 to 1,200 physical qubits and at most about 100 logical qubits — a gap of about 400 to 500 times even against the most aggressive estimate. No cryptographically relevant quantum computer exists today, and the gap is closing, not widening.

Number 2: 6 million BTC exposed — but only 2.3 million irreducibly at risk

About 6 million bitcoin — roughly 30 percent of supply — sit in addresses whose public keys are exposed on-chain, according to the same arXiv evaluation. Here is the crucial distinction most coverage misses: only about 2.3 million of those coins, around 12 percent of supply, are irreducibly at risk. Those are coins in old pay-to-public-key (P2PK) addresses, where the public key was published directly on-chain from the start, and coins in addresses that have already been spent from once, exposing their keys. The other exposed coins can be moved to quantum-safe addresses once an upgrade exists. The 2.3 million include roughly 1.1 million BTC widely attributed to Satoshi Nakamoto — coins that have never moved. If you want the full story of those untouched coins, read our guide on who Satoshi Nakamoto is and why his coins have never moved.

Number 3: A 1-in-6 chance of a code-breaking quantum computer by 2035

The arXiv paper's arrival distribution for a cryptographically relevant quantum computer is about a one-in-six chance by 2035, near 30 percent by 2040, and about 60 percent by 2050. Those are not predictions of doom — they are the reason the upgrade work is happening now. Moving Bitcoin to new cryptography would take years: standardisation, wallet support, and a network-wide migration of funds. Starting when the machine already exists would be far too late.

Number 4: 3,073 bytes — the price of a quantum-proof signature

Today's ECDSA signatures are about 71 bytes. Falcon-1024's combined public key and signature is 3,073 bytes — more than 40 times larger. That size is the central engineering trade-off of the whole upgrade: bigger signatures mean bigger transactions, bigger blocks, and higher fees if the network is not careful. It is also why Falcon beat Dilithium and Hawk in Blockstream's evaluation — it was the smallest of the three. The 90 KB of memory its signing process needs is the reason hardware wallets, not the Bitcoin protocol itself, are the first deployment hurdle.

Number 5: 15 bits — the largest key ever publicly broken

Perspective matters. The largest public-key recovery demonstrated so far is a 15-bit elliptic curve key, which won Project Eleven's Q-Day Prize in April 2026, as tracked by independent researchers. Bitcoin uses a 256-bit curve. The distance between 15 bits and 256 bits is the distance between a laboratory demonstration and an existential threat — but the direction of travel is one-way, and the Q-Day Prize exists precisely to track that progress in public.

How the Estimates Compare: Three Roads to Breaking Bitcoin

Estimate (2026)	Logical qubits	Physical qubits	Time to recover one key
Google Quantum AI (March 2026)	1,200–1,450	Under 500,000	Minutes
Caltech / Oratomic (March 2026)	Over 1,000	~10,000–26,000	~10–264 days
Textbook construction (Roetteler et al.)	2,304	~3.9 million	Not estimated

The pattern is consistent: the machine does not exist, the qubit counts needed are in the thousands (logical) to hundreds of thousands (physical), and the fastest designs would still take minutes per key. A slow attack can only reach keys already exposed on the ledger.

Which Coins Are Actually at Risk?

Not all bitcoin is equally exposed. Coins fall into three buckets.

First, the directly vulnerable: early pay-to-public-key (P2PK) outputs, mostly mined in 2009–2010, where the public key is visible to everyone, forever. Satoshi's estimated 1.1 million BTC live here, along with other early miners' coins. These coins can never be made safe by an upgrade, because the owner would have to move them — and the owner is absent or unwilling.

Second, the exposed-but-movable: coins in addresses whose public key became visible because the address was spent from once. Modern wallets using SegWit and Taproot keep public keys hidden until a coin is spent, which is why the standard advice is never to reuse an address. These coins are safe today and can be moved to post-quantum addresses the moment an upgrade ships.

Third, the safe: coins in fresh, never-spent Taproot or SegWit addresses, where only a hash of the public key is on-chain. A quantum computer cannot derive a private key from a hash, so these coins face no quantum risk at all until their owner spends them — and by then, the upgrade should exist.

The uncomfortable truth is that the 2.3 million irreducibly at-risk coins will probably never move. The market has, in effect, already priced in a scenario where a quantum computer one day sweeps Satoshi's coins — and with Bitcoin trading near $76,000, about 40 percent below its $126,080 all-time high, traders are clearly more worried about this week's Nasdaq sell-off and ETF outflows than about quantum computers. For the full picture, read our coverage of how Bitcoin's crashes compare to past drawdowns.

What Most People Get Wrong About Quantum and Bitcoin

The quantum debate attracts confident nonsense from both sides. Here is what the research actually says:

Myth 1: "Quantum computers will break Bitcoin mining." False. Grover's algorithm gives only a quadratic speedup against proof-of-work, and error-correction costs, the square-root parallelisation wall, and Bitcoin's difficulty adjustment erase that advantage. The threat is to signatures, not to mining.

Myth 2: "A quantum computer will drain all wallets overnight." False. Breaking one key takes minutes even on the most aggressive 2026 designs, and only keys already exposed on-chain are reachable at all. An attacker would work through the exposed set coin by coin, in public, while the network races to upgrade.

Myth 3: "All 19.9 million bitcoin are at risk." False. Only about 6 million have exposed public keys, and only 2.3 million cannot be moved to safety. Coins in fresh Taproot and SegWit addresses are protected by hashing, not by the elliptic curve at all.

Myth 4: "Satoshi's coins will crash the market when quantum arrives." Unproven and probably wrong. A quantum sweep of Satoshi's coins would require the attacker to reveal a working code-breaking machine, instantly triggering a global emergency upgrade — and the coins themselves would likely be frozen by consensus or simply unspendable if the network moves first. The "landmines" proposal from Bitcoin developers, which we covered in our earlier piece on whether quantum computers can break Bitcoin, would deliberately burn exposed coins rather than let an attacker take them.

Myth 5: "Bitcoin developers are ignoring the problem." False, and Falcon-1024 is the proof: a peer-reviewed paper, a draft BIP, a working sidechain transaction, hardware-wallet benchmarks, and a $15 million Bitcoin Security Consortium commitment over three years.

The Upgrade Path: SHRINCS, Liquid and the Staged Transition

Blockstream's research points toward a staged transition, not a single switch — the right design for a $1.5 trillion network that cannot afford a mistake, and the reason the timeline stretches over years rather than months.

Stage one is the backup signature. SHRINCS — a hash-based scheme — reached draft BIP status in late August 2026, the first concrete proposal for a post-quantum signature scheme designed for Bitcoin. Hash-based signatures are conservative: their security rests on hash functions, not lattice mathematics, so they survive even if Falcon turns out weaker than believed. The cost is size — which is why SHRINCS is the backup, not the final answer.

Stage two is the live testbed. In March 2026, Blockstream completed a post-quantum transaction on its Liquid sidechain, proving the cryptography works in a production-like environment. Liquid is also where the hardware-wallet benchmarks were validated.

Stage three is Falcon-1024 itself. Once NIST finalises the Falcon standard, it could replace the SHRINCS backup with a signature far smaller and faster for every node to verify. But two problems must be solved first: the 90 KB signing memory, which strains hardware wallets, and the missing HD key derivation, which breaks the seed-phrase model every wallet relies on. Neither is a deal-breaker, but neither is solved yet.

Stage four is the network migration, and it is the hardest part. Even after the code ships, every holder must move their coins to new quantum-safe addresses. Bitcoin's history says that migration will take years: old address types linger for a decade after they are superseded. That is why the work starts now, while the probability of a code-breaking machine is still low. For new holders still learning the basics, our beginner's guide to Bitcoin explains how addresses, keys and signatures fit together.

What Bitcoin Holders Should Do Now: The Checklist

You do not need to panic — but stop doing the few things that leave your coins needlessly exposed. Work through this list once.

• Never reuse a Bitcoin address. Every spend publishes its public key on-chain; a fresh address for every receipt keeps your keys hidden behind a hash until you spend.
• Move coins off old legacy addresses. If your bitcoin sits in addresses created before 2017, or in any address you have already spent from, send it to a fresh Taproot address — one move takes your coins out of the exposed set.
• Use Taproot or SegWit for new receipts. Both keep your public key hidden until spending time, which is the whole point of the protection.
• Check whether your wallet supports post-quantum signatures. The August benchmarks showed Jade Plus, Trezor, Ledger and BitBox devices can already produce hash-based post-quantum signatures — but wallet software support is still rolling out.
• Do not try to "front-run" the upgrade. There is no quantum-safe Bitcoin address type to move to yet — anyone selling you one today is selling a scam. Wait for the BIP process and the soft fork.
• Watch three milestones, not the headlines: NIST finalising the Falcon standard, the SHRINCS BIP moving from draft to deployment, and a concrete soft-fork proposal with a migration plan. When the second of those three lands, move long-term holdings to the new address type the same month.

What Happens Next

The near-term milestones are visible: NIST standardising Falcon, the SHRINCS BIP moving from draft toward deployment, and the first wallet shipping post-quantum address support by default — the moment the migration becomes real for ordinary holders. The Bitcoin Security Consortium, whose members pledged $15 million to Bitcoin security research over three years, is funding exactly this work.

The market, for now, is unmoved — and that is rational. With Bitcoin down about 40 percent from its all-time high and spot ETFs shedding $430 million in a single session, traders have immediate problems. Quantum is a 2035 problem with a 2026 head start. The holders who will be hurt are the ones who left coins in reused legacy addresses for a decade and never checked. For how ETF flows shape the price, see our guide on how spot Bitcoin ETFs work.

Frequently Asked Questions

Can a quantum computer break Bitcoin today?

No. Breaking Bitcoin's secp256k1 signatures needs roughly 1,200 to 2,330 error-corrected logical qubits. The best machines of 2026 have at most about 100 logical qubits — a gap of 400 to 500 times even on the most aggressive estimates. No cryptographically relevant quantum computer exists today.

How much Bitcoin is actually at risk from quantum computers?

About 6 million BTC, roughly 30 percent of supply, sit in addresses with exposed public keys. But only about 2.3 million BTC, around 12 percent, are irreducibly at risk — mostly early pay-to-public-key coins including Satoshi's estimated 1.1 million BTC. The rest can move to quantum-safe addresses once an upgrade ships.

What is Falcon-1024?

Falcon-1024 is a lattice-based post-quantum signature scheme that Blockstream Research named in November 2026 as its top candidate to eventually replace Bitcoin's ECDSA signatures. Its combined public key and signature is 3,073 bytes, it verifies fast, and it beat Dilithium and Hawk in Blockstream's peer-reviewed evaluation. It still needs NIST standardisation and fixes for its 90 KB signing memory and lack of HD key derivation before deployment.

When will Bitcoin upgrade to quantum-proof signatures?

There is no date yet. The staged plan runs through the SHRINCS hash-based backup signature (draft BIP, August 2026), live testing on the Liquid sidechain, NIST finalisation of the Falcon standard, and finally a Bitcoin soft fork plus a multi-year migration of funds — realistically the late 2020s to early 2030s, ahead of the roughly one-in-six chance of a code-breaking machine by 2035.

Should I move my Bitcoin now because of the quantum threat?

Move it once, to a fresh Taproot address, if it sits in an old legacy address or one you have already spent from — that is good hygiene regardless. But do not pay anyone for a "quantum-safe" address today: no such Bitcoin address type exists yet.

Is mining at risk from quantum computers?

No, not meaningfully. Grover's algorithm offers only a quadratic speedup against proof-of-work, and error-correction costs, the square-root parallelisation wall, and Bitcoin's difficulty adjustment erase that advantage. The quantum threat is to signatures, not to mining.

Conclusion

Falcon-1024 is the first time Bitcoin's quantum upgrade has had a name, a size, and a plan — and the plan is reassuringly boring: a peer-reviewed paper, a draft BIP, a working sidechain transaction, hardware wallets that already pass the benchmarks, and a staged migration measured in years. The five numbers tell the story plainly: 1,200 to 2,330 logical qubits needed against about 100 available; 6 million BTC exposed but only 2.3 million truly stuck; a one-in-six chance of a code-breaking machine by 2035; 3,073 bytes per quantum-proof signature; and a 15-bit key as the largest ever publicly broken.

None of that is a reason to sell. It is a reason to do the one thing that costs nothing and protects everything: stop reusing addresses, move old coins to fresh Taproot addresses, and watch the three milestones — NIST standardisation, the SHRINCS BIP, and the first wallet with post-quantum support. Bitcoin has survived every obituary written about it, including the quantum ones. This time it has a named answer ready before the question becomes urgent — and that may make the Falcon-1024 announcement the most important Bitcoin news of November.

This article is for education only and is not financial advice. Figures are as reported by the cited sources at the time of writing and will change. Do your own research.