The recording now, and I see I can see myself as blue bars.
So that's a start, and I hear Isabelle.
So that's a pretty good start.
This is a good start, yeah.
Yeah, we're getting somewhere here.
We're getting somewhere.
Well, I suppose, you know, 22 minutes late, it could have been 25 minutes late, I suppose.
I don't know.
I believe that Rearden and Hunter Beast are both quite short on time.
So as soon as Hunter Beast joins up again, I believe we should go ahead and get this thing rolling.
Well, we should give it straight to them and let them say whatever they want to say.
And then we'll actually have time today than I thought, so I'm good.
Oh, perfect.
All right, Hunter Beast.
Whenever he finds it, we're going to have to now, OK, I'm going to tweet out the real one.
Yeah, tweet out the new.
Yeah, get as many people observing the space as possible so that it collapses.
Yeah, it's always the good ones.
The space is both working, it's being recorded and not recorded, and working and broken at the same time.
Yeah, as Javison said, it's a quantum collapse, yeah, space rugged.
There goes Hunter Beast in the vault over there.
Hunter Beast up here, and thank you for joining again.
Just to give you a quick rundown, we're doing a debate about quantum.
On one side, we got Hunter Beast, a Bit360, as well as Javison Lopp.
On the other side, we got Rearden and Robin Linus, both of which think that quantum isn't a threat to Bitcoin at all and is not even real.
With that, I'll pass it over to Isabel and send up a prayer that this one goes through.
OK, that was a great introduction.
Thank you.
So, yeah, I mean, I think that we should just sort of start, I think, with the five panelists that we have on stage kind of summarizing their positions.
I think that's the appropriate place to start.
I'd love, actually, for each of you to kind of give a rating on a scale from 1 to 10.
How worried should Bitcoiners be about quantum computing?
How much should we care about the potential threat of quantum computing on a scale from 1 to 10?
And then a little summary of your position or kind of why you chose that number.
Why don't we start with Robin?
Sure, yeah. So.
I guess I should start with a disclaimer, like my purpose in this debate is to steam and the arguments of the quantum skeptics with the goal of balancing the discussion.
I'm by no means an expert in this field, not at all.
Like, I don't know much about physics at all.
But I think it's quite important to have this discussion in the first place, because we are having all these discussions about post-quantum cryptography and how to migrate to post-quantum cryptography.
But we are never actually having the discussion if it is actually real or not.
And since there's so much skepticism about the question, if quantum computing is real or will ever become real, I think it's great to have this discussion today.
And yeah, on like regarding the rating, I think.
After preparing for this debate, I think right now there is absolutely no reason at all to be worried about quantum cryptography or like quantum computers breaking cryptography.
I think it's a clear zero from my end.
Hunter, how about you, though?
Yeah, and I'm going to re-clarify the question rating on a scale from 1 to 10.
How much should Bitcoiners care about the threat of quantum computing?
And you can interpret that however you like.
Well, in the short.
So first of all, I'm a Hunter Beast, author of 5060 and well, co-author now, right?
And so we'll get into that in a bit.
But I would say the in the short term, Bitcoiners don't necessarily need to care a lot, especially because there's just not a lot they can do other than just avoid taproot, which, you know, most Bitcoiners do anyway, right?
And some scaling people, I mean, to be fair, some scaling people care about taproot.
Yeah, yeah.
some scaling people, I
mean to be fair,
scaling people care about Taproot.
Yeah, yeah. But nobody else cares about Taproot.
let's just be real.
like, there's only about 150,000 coins.
Okay, Ryendell, fine, whatever.
There's, but still, like, like, on chain, like, there's only 150,000 coins in Taproot
right now,
Right, let's just be real.
And compared to 1.7 million P2PK coins, which are probably a bigger concern,
but regardless of that,
just like giving you a sense of scale.
I would say that in the short term, Taproot addresses are,
well, in the short term, let's just say that we don't need to care too much right now.
However,
I think it will be a growing concern over time to the point where honest.
to one to ten like It'll need it.
Well, it'll be a ten.
It'll eventually be a ten It's just one of those things where it's like it's gradually
and then suddenly that's just my opinion Hunter just to like quickly follow up like how
much do you think Bitcoiners should care about this now?
Well
should,
not.
zero. yeah, like it's really not like a big deal right now.
Let's just be real.
Can I ask, are you working on a right now if Bitcoiners should care 0 % right now?
because
Because it is incredibly difficult to change Bitcoin.
also additionally,
there's a lot of fear around, so it could take a lot of time.
And there's a lot of fear around this problem.
There's a lot of concern.
We're being told by the government to be concerned, right?
We're being warned
essentially. as a result, I would say that
it would make,
it's prudent to have a plan, to be prepared.
And as a result, that could unlock,
unlock funds that are just like
not going into Bitcoin and instead going into things like gold because people are,
there are investors who are concerned.
so we should at least have a plan.
We should at least have like a cogent response, right?
Like something that's not like, it'll never
happen. That's not a plan, right?
So we need to have at least a good answer to the question.
That's just my opinion.
Okay. Let's move on to Ethan, co -author of BIP360.
How much do you think that Bitcoiners should care about the potential threat of quantum
computing and why?
Would you just sort of quickly summarize your position on
this?
So I think Bitcoiners should care, but in an optimistic
way, because I think Bitcoin will handle this problem.
I think that it is the way in which I view the problem is one of
like risk
mitigation. I don't play Russian Roulette, not because it's a one in six
chance, but because it's a unnecessary risk.
I think that maybe quantum computers will
occur, maybe they won't.
tend to think that they will.
But if we just imagine this as like a dice roll or a coin flip, would Bitcoin be better
off having mitigated this problem and having had solutions to this
problem?
Or would Bitcoin be better off not having attempted to mitigate the risks?
And I'm very much in the let's mitigate the risks camp.
Let's have an answer here so that we can assure holders that their funds are safe.
And so that we can,
a quantum emergency occurs, we are pre -prepared and we are not like
doing a soft fork under intense time pressure.
Awesome, Reardon, how about you?
What is your take?
how concerned are you on a scale from one to 10 about quantum computing and
what's your sort of general position on this subject?
subject?
Well, I'll take a somewhat tongue -in -cheek answer and say I'm equally concerned about
quantum computing, breaking Bitcoin's cryptographic systems, as I am about a unicorn
farting on the planet and dissolving all computers on the planet.
These are both things that are not going to happen,
BIP360 fan of BIP360 as it has evolved.
So on the one hand, don't think we should worry about quantum.
On the other hand, do support BIP 360.
Can I ask why?
Why do you think that BIP360 is even worth people's time if this is literally like
unicorn fairyland math that we're talking about?
So I think there's a benefit.
I'm an efficiency type of thinker and I think there's a benefit to having the option of
pay to taproot hash, there's
consideration of renaming BIP360 to pay to Taproot hash, is, or pay to tap script hash,
And I think that's a good option to have out there.
There was some discussion at Bitcoin++ in Austin a year and a half ago, where Rusty was
really strongly like, why do we have this mandatory
pubkey in Taproot?
Why can't that be an optional pubkey?
And if we have BIP360, now we have the pubkeys optional.
can do BIP360 addresses or you can do BIP341 addresses and you can do whatever one you
suit your needs.
So I'm fully in support of having both of those options out there.
I want to briefly say,
here's the two thought proposals as to why I'm not concerned about quantum at all.
think it's very dust.
One to think about is humans solve many difficult problems in physics
and elsewhere. And when we solve them, they're solved through first
a process of prototyping and ideation and then a process of scaling.
And we don't know whether it's possible to solve them until the prototypes work.
And quantum computing as of right now is still in the, we don't even have the
prototypes working phase.
We've had many amazing prototypes, the quantum researchers out there
build cool things.
then when they go to try and scale them, at the first step towards scaling, they
realize that there's still an exponential growth in the difficulty of error correction.
So until we see a quantum computer that they can scale, there's no evidence that it's
possible. I'm not saying that I can prove it's not possible.
I'm saying that
there's as of now no evidence that it is.
then the other thing, know, quantum computing, let's say concerned folks will say, you
know, Moore's law took us from X transistors to Y transistors so quickly.
Isn't that gonna happen with quantum but faster because we have AI now, because we have
whatever, it's gonna go
faster. we haven't seen other technologies grow like Moore's law.
Transistors are the only thing we've ever seen really grow like that.
So again, don't see any evidence that a quantum, even when we do get it scaling, is
going to in a similar way, exponentially like transistors did.
So with those two roadblocks in front of us, it's still in the land of unicorn parts.
right. Well, thank you, Root.
And I look forward to kind of digging into the potential of some kind of breakthrough
that could change the sort of like linear growth effect of computing into something
more exponential. But Jamison, let's hear from you before we get into sort of like the
more nitty gritty questions.
Jamison, how concerned do you
what do you think Bitcoiners should be about quantum computing
as a threat to Bitcoin on a scale from 0 to 10,
and what's the summary of your position,
also as the author or co-author of a quantum mitigation BIP?
I give it about a 7 on the existential crisis scale,
and not necessarily because quantum is going to become a threat anytime soon,
but rather due to my pessimism on the ability for Bitcoin as an ecosystem
to be able to perform the consensus changes and migration
that would be necessary
if a cryptographically relevant quantum computer comes along,
and that kind of resulted in the timelines
that I came up with my Bitcoin improvement proposal,
which really have nothing to do with post-quantum cryptography,
and have everything to do with incentives, game theory, and migration
that I expect would all become problems if such a threat arose,
and this really comes down to something I've been talking about
for a number of years now in the space,
which is ossification and the general pushback from Bitcoiners
to make any changes, even supposedly highly beneficial changes,
or in this case, it would be a systemically important defensive upgrade.
So I worry about the potential acceleration of quantum advancement.
In short, none of us who are up here on stage are quantum physicists.
I don't think any of us are really even cryptographers.
I'm not a cryptographer.
I think I saw a few people actually in the audience
who are quantum physicists and cryptographers
and are probably actually better suited to speak about some of these topics,
but I would say my expertise is more on the Bitcoin ecosystem
and game theory side, and so that is what worries me the most
is just the difficulty in coordinating a change like this,
because the more that I look into the problems
around a sufficient quantum computer threat,
the more I realize that it's not just one thing that we would have to agree upon,
but probably like half a dozen things that we as an ecosystem
would have to agree upon, and so it would really be unprecedented
to be able to come to a consensus on multiple things at the same time,
and it would be unprecedented to have to migrate people's money,
because I think that if it is an opt-in only issue,
then that's kind of a half-assed reply to such of a threat
that even people who opted in would ultimately suffer significantly
from an economic perspective,
because there would be just such a huge liquidity event
dumping coins back into circulation and crashing the price down.
Yeah, so you mentioned liquidity event.
Just for the folks who are listening who might not be as deep in the weeds
on this problem, I think that it would be useful for us
to kind of cover the risks on both sides, right?
So what are the risks if the pro-mitigation people are wrong,
and what are the risks if the quantum deniers are wrong,
or the quantum skeptics are wrong?
I'd love for each of you to share a little bit about
what you see as the risks to either implementing a mitigation plan
that maybe is mitigating fairy dust, as Reardon said,
versus the risks of not doing anything
and kind of just assuming that this is not going to happen,
and what happens if that ends up being, for whatever reason,
by some stroke of magic, not the way things turn out.
Robin, do you want to go first, kind of talking about the risks
of you being wrong versus your counterparty being wrong?
Well, first of all, I'm not suggesting to do nothing.
I'm suggesting to wait until we see that it is possible at all
on the most tiny toy examples.
If somebody ever makes it work to factor 15 or something,
then we could start being concerned.
But we are currently at the stage that the records, like 21 or something,
even those records, which is already a ridiculous record,
given the fact that we have seen 30 years of research
and billions and billions of investing,
still the record is factoring 21, and this factoring 21 is fake.
They hard-coded half of the solution into the circuit
because we don't have any quantum computer at all
that could actually run Shaw's algorithm.
It is like after 30 years of research, we are still not at the stage
that we could say this will ever work.
It's the exact opposite.
We ran the fake version, and the fake version is like
orders of magnitude slower than the most stupid classical algorithm,
like a factor of 1,000 or something.
It always appears as if we are at the stage that we have proven
that this technology actually works, and now we just have to scale it.
But that's totally not the case.
We are far away from ever proving that this technology will ever work.
Do you feel confident, Robin, that this will be the type of thing
where we'll have these sort of incremental linear breakthroughs
that will give us plenty of time to implement a plan
if this technology does advance?
Hunter alluded to this earlier.
The concern, I think, about quantum, and this came up
at the Presidio Bitcoin Quantum Summit as well,
is that this could be a gradually-then-suddenly issue.
There's some concern that while progress has been relatively slow,
perhaps it only takes one incredible creative breakthrough
to speed this along exponentially, at which point,
will Bitcoin and its snail-like pace be able to handle
that kind of threat in a timely fashion?
Yeah, I think Rian mentioned that.
The idea that Moore's Law for quantum computing would just work
is kind of doubtful, but even if we assume that,
which is pretty optimistic for the quantum computing people,
then we would still have something on the order of 15 to 20 years
from the first proof of concept until it would ever get to the point
that it can break ECDSA.
Why do you think that?
Where does the 15 to 20 years number lie?
If you assume the same growth as Moore's Law,
and Moore's Law was like...
exceptionally fast, we have never, as Rian mentioned, we have never seen any technology advancing as fast as the CPU speed has increased.
And also, there was plenty of money behind that because there is a huge market for CPUs, and there is a very tiny market for quantum computers in comparison, in particular for quantum computers to break cryptography.
And if we still assume that, then doubling the number of qubits every 18 months or something will lead from like, what would take us from nothing or from one to how many qubits do we need, like on the order of 4,000, 5,000 or something for SECP, that would take just 16 years or 16 to 20 years, depending on how efficient you can make it.
Hunter, Ethan, or Jameson, would any of you be willing to respond to that?
Yeah, so I think one potential flawed way of looking at this, if you're just like looking at Moore's Law, like Moore's Law fundamentally is about how many transistors you can pack into a chip, right?
And I'm not so certain that this is just a hardware engineering problem. I mean, there are many variables at play. And once again, I'm not a quantum computing expert, but there is a hardware component, and there are three or four different types of hardware that people are exploring to develop quantum computers and qubits and trying to get qubits talking to each other.
Fundamentally, it seems like the real challenge is scaling up these physical qubits so that they can essentially talk to each other like a network, because the more of these physical qubits that you try to connect to each other, the more noise there is, the more error correction there is.
And so it just seems to me like this is actually more like a software problem of trying to figure out this error correction issue. And just from that sort of high level hand wavy perspective, software efficiency gains, I believe, could be far more efficient and accelerate faster than Moore's Law efficiency gains.
Raredan, I saw you kind of poke up with your 100%. Do you have something you want to add to that?
Yeah, I mean, the thing I would say is, I hear where James is coming from, but that sounds very much like, if the magic works, right, to say that it's a software problem is to kind of deny what we've seen, which is when quantum researchers, and you've seen this in the papers that Robin was mentioning, when they've tried to build practical sized quantum computers, they consistently see this as a software problem.
They see that for each size, they try to go larger, they see exponentially greater difficulty in error correction. And that doesn't look like a software problem that there's like, oh, if we get the right error correction algorithm, we'll solve this.
That looks like a physical problem that because you're dealing with quantum phenomenon, the quantum universe is fundamentally noisy. And when you try to get more pieces of quantum together, that fundamental noise grows exponentially with the size of the thing you're trying to get together.
Now, again, I'm open to being wrong. For people that know me somewhat, you'll know that I'm always open to being wrong on these things. But we would have to see evidence of it. And that's the thing that frustrates me about this whole quantum debate is, why would we have a conversation about adding protections to Bitcoin, for something that we have no evidence will ever be a problem?
If there is evidence, it will be a problem, then we should mitigate it. But the risks of trying to focus on this right now, are that we then don't do important work on things like say, silent payments, or ARK, or BitVM, or any of the technologies that are based on the current cryptography in Bitcoin. And I think it's too big of a risk to basically shift investment from things that we have evidence will work to mitigating a thing we don't have evidence will be a problem.
I want to circle back to the risks associated with potentially introducing PQC into Bitcoin. So hold that thought Reardon. But in the meantime, Hunter, go ahead. And then we'll take Ethan.
Yeah, I just want to say that the problem with like needing evidence to make a decision here, which as obviously, like, I mean, it would be really nice if we add, like, super, like, incontrovertible, controversial evidence, especially because like, like, like, Todd Dreijer, for example, introduced a way to just to verify on chain that, yes, like, you need a quantum computer to, to spend a script.
And that would be essentially spending a script that had a shot to six of a public key, that you would then be able to spend that if you could spend that if you could sign a shot to six public key, then you you need a quantum computer for that, right.
So that would be really cool. And we'll probably get that one day, who knows. But the problem about quantum computing is that it's not sovereign computing. It's not like computing how we're used to how we've had it in our daily lives, like quantum computing is for institutions and spooks. And just like, you know, people like things we will, like, we could probably, for the next 10 years, never run into an actual working quantum computer.
Like, just just like in our, in our course, our daily lives, just because, like, they will be so out of the reach of ordinary people. And so, that said, we should also not heed, we should also, in my opinion, like, heed their warnings, because like, it's not like, like, the fact that they, they exist, or could exist, or they might already exist, guys, like, that's another thing is like, like, like, there's, there's, there's, there's, there's, there's
the US government has been working on this stuff for like, way longer than the private industry has been. And even like, like, there was a program called penetrating hard targets. Back in 2013. We learned from a from this is from a Snowden leak. This is not like this was not public information. This was just a leak leak from what the government was doing internally. Back in 2013, they were spending $80 million on
building a quantum computer that could be cryptographically relevant. And so this, and this was this was 12 years ago. And like, so I'm just saying, like, like, there's, there's a lot of information asymmetry in this space. And as a result, that can be capitalized on by breaking Bitcoin. And I don't know about you guys, but I don't want to leave that up to chance.
Ethan, go ahead.
So I want to
I should preface this by saying that, while I'm a cryptographer, I'm not a quantum cryptographer. But what I have seen with quantum cryptographers is that a few, like three years ago, they were like, you don't really need to be worried about this stuff. Scott Aronson, for example, um, but now they're saying you do need to be worried about this.
I think that some of the breakthroughs we've had in quantum error correction, present a credible roadmap that people are, that experts who do this are very concerned about. And this is one reason why we see, you know, banks and governments, and internet browsers now a significant percentage of internet traffic is
post quantum, because they have been convinced by the breakthroughs that we have seen. But all that being said, I want to, I want us to imagine. So I'm, I think that we will probably have a quantum computer at some point, whether it's in 10 years, 15 years, 20 years, 40 years, I don't really know. And I think about that as coin flips.
But let's say, let's take the most optimistic view, and it's 40 years away. And Bitcoin does not upgrade to post quantum cryptography, while the rest of the world does, while the banks do, while other cryptocurrencies do. This presents two vulnerabilities for Bitcoin.
The first vulnerability is that people look at Bitcoin, and they're like, well, they don't take security seriously, everyone else has mitigated this risk. And Bitcoin chose not to mitigate that risk. The second thing is that if there is something that looks like a breakthrough, that could very likely spark a panic if Bitcoin does not have a, like a ready solution.
And the consequence of that is that it seems to me that if everyone was convinced, or like a large number of holders were convinced that a quantum computer was around the corner, they would be very concerned with the price, and miners would be very concerned with the price.
And someone showing up with a soft fork, that's like, let's freeze all these coins, would have a very convincing case, because the miners want to be able to make money, and they need to pay their electricity bills. So there's also just this concern that if Bitcoin doesn't have a ready answer, it's more likely to produce a panic, if there is a breakthrough, or if there is even the appearance of a breakthrough.
I think this is a key point. I believe Peter Wille actually tweeted out last week that his concern about this is more related to the fear of quantum than quantum itself, but that that fear may actually warrant taking some action just for the sake of, you know, not thwarting adoption. We'll circle back to this, but Robin, go ahead.
Yeah, thanks. So I want to stretch again that quantum computers don't exist at all. Like, it's not, they are not existent. We cannot even factor the number 15 without hand wiring half of the answer into the circuit. And quantum error correction does not translate into any practical results yet. It's not that these advancements in quantum error correction changed anything about the fact that we cannot factor 15.
We have never seen any quantum speed up at all. And assuming that it would be maybe 40 years away is still like a completely wide guess, assuming that it could work, even though we don't have any evidence for that being the case.
It's assuming like what if somebody comes who has magic abilities?
if in 40 years somebody comes who has magic abilities?
And it becomes a bit absurd if we start assuming these things because why don't
we prepare for someone breaking ECDSA using classical crypto analysis
for example. The probability is non -zero that somebody is actually capable of doing
that. It's only how all this ECDSA, all the elliptic curves 40 years or something,
maybe someone finds something that allows them to break
ECDSA just like
as if would be nothing.
why don't we prepare for like more crazy things?
Why don't we prepare for alien invasions that might use telekinesis to read our minds
or something? Because it's absurd, you know?
And the more we allow to like assume absurd things
in our threat model, the more
absurd the entire mitigation becomes.
I think it's still the best way to just wait until this
technology has been proven, at least like in theory, at least like in a toy model,
because currently we don't have any proof at all that it will ever work at all.
And the other thing regarding
different threat model because they are assuming
the harvest now decrypt later threat model.
they are concerned that stuff that they encrypt today might be harvested and
then decrypted in like 50 years or something.
And then it could become a problem for them.
This threat model does not apply at all to Bitcoin.
We don't have that.
is just, it's for secret data.
It's not for signatures.
And I think no serious research at all is assuming that
quantum computers breaking cryptography would just
happen suddenly without any prior progress and any theoretical breakthroughs or
something. It would certainly not happen from one day to another that suddenly someone
has a mega -quantum computer out of nowhere and that would even break Bitcoin.
Because that's another thing that people talk about quantum computers as if you have
like a general quantum computer.
And once you have that, then you can break Bitcoin.
But that's not true.
you would have to invest billions and billions of dollars into a very specific quantum
computer that is only designed to break Bitcoin keys.
And then you would have to pull off that attack like in stealth.
You have to do it very slowly such that you don't
create too much noise because people would notice that all these
coins are moving suddenly.
And if people would notice and migrate suddenly, then your billions of dollars of
investment in quantum computers would be gone.
It would be completely worthless.
It's not that you can use that quantum computer for medical
research or something.
is just hardwired to break Bitcoin and Bitcoin only.
even assuming that attack, even the economics of that attack don't really make sense.
And since there's so many steps that just make it very unrealistic that this ever
will happen. think
it just doesn't make sense to
fuel that fear because as people said, it's mostly a fear -based
discussion. It's not that we are seeing all these hard evidence or something that would
actually justify being concerned.
It's the other way around.
There evidence
that it probably will never work at all.
But there's all these companies that are creating these fears because they are living,
they need billions of dollars to do their research.
So they have to create narratives and justifications for these
astronomical evaluations, sorry, evaluations,
And then, know,
you can it a lot of it with
with do it then,
peer investors and not amplify these
assumptions that it will suddenly become a thing in five years or something because
that is what scares investors.
If we would just steer the discussion into the
pound -and -impact direction,
then we could probably take the fear from these investors and help them to...
We're going to circle back also to why investors are pouring billions of dollars into
this technology if it's us, yeah, Ethan, go ahead.
mean, Bitcoin investors...
invest in together.
As well, as separately.
I mean, one and one, one, one, one, one, and and
this one, and this one, and this
and this and this one,
this
and
work. We have already achieved quantum supremacy in that there are quantum computers on
like random circuit sampling that are better than classical computers, like better than
those to verify the results of a recent Nature paper.
They required, I think it was like several months of the top four US
supercomputers to verify a result, a random graph sampling result from a quantum
computer. So we are seeing quantum computers be used in these ways.
We're just not seeing, Shor's algorithm is not the first immediate use that we will see
for it. But quantum computers are being used for
cryptography problems, random graph sampling.
I think that we should take this.
isn't a risk.
It's a great But there's risks.
What? I think the random circuit sampling is a great example for the
stage of where we are at.
Because random
circuit sampling is completely like, it was used to justify the term
quantum supremacy, but when you think of quantum supremacy, you think about that magic
that quantum computers are promising, which is they can break cryptography or they can
do computations exponentially faster than we can do them
classically. like useful computation that matter.
is what we actually think of.
has useful cryptographic applications.
is completely useless computation, right?
It's like an artificial problem that is made up.
Just justify like progress, where
there is actually no real progress.
We don't have any quantum supremacy at all.
Let's finish your point and then we'll go back to
the recent Nature paper that built a crypto system out of
random graph sampling, it's not useless computation
And it does show quantum computers significantly beating classical computers.
Actually, Ethan,
could I ask you specify exactly which nature paper you are referring
to? OK.
have a Google, but I can look at the boundaries of
quantum supremacy by random circuit sampling, 2023.
that sounded like it or no?
No, it came out in I think 2025.
The author was at the DCI the other day.
Yeah, let me me look it up.
I'll come back to that.
But like, we have demonstrated quantum
supremacy, which is a pretty big point to have crossed.
while we can argue that like even if quantum computers and Shor's algorithm never
happens, Bitcoin should try to mitigate that risk.
I do think that there is a
significant chance that this will happen.
And we're seeing not just the government with the concern about the store and break
later attacks, but like banking standards and banking APIs are now moving to post
-quantum. This is like a very real thing that a number of industries are taking
extremely seriously,
including other cryptocurrencies.
And if Bitcoin falls behind on this, there will always be this fear that
Bitcoin will be broken.
And that fear is not an absurd fear.
That is a real fear that lines up with a lot of changes in how experts are now more
concerned about quantum computers,
So,
I'm not sure if that's a strong argument because other cryptocurrencies are also
concerned about boiling the oceans, they are migrating to proof of stake and stuff like
that. So I'm not sure if that is really the bar that we want to hit.
But back to the actual argument of quantum supremacy.
I think it's a marketing buzzword, because it suggests to people who don't really
understand what random circuit sampling is, that quantum computers actually achieve
this kind of magic that everybody is talking about, or that justifies the entire
industry. The
entire industry is justified by that assumption that we can actually break cryptography
or do like magical kinds of computing.
sure, like we have these random circuit sampling things but for the things that
actually matter like categorization or breaking ECC or stuff like that,
we haven't even, we aren't in on par with classical computing.
are thousands, like a factor of thousands off
when we are cheating.
I just posted the maker article.
We are far away from quantum supremacy, orders of far away from
real quantum supremacy.
There's only that buzzword floating around where we have achieved quantum supremacy on
a very artificial problem that is very irrelevant for the things that we're actually
talking about. Robin, in your defense, and Reardon also alluded to this, can you just
share a little bit about what you think the risks of,
implementing some kind of mitigation strategy would be because I think many folks on
the pro -mitigation side take the position that it's better to be prepared
in the utmost of caution given the potentially very extreme
risks associated with a cryptographically relevant quantum
computer popping onto the scene.
Would you mind explaining a little bit of your position there?
Why not just be prepared for the hell of it, given the fact that the risks on the other
side of this seem so or potentially existentially fatal for Bitcoin?
Yeah, best part of
why not prepare for alien invasions?
But I think to be more concrete, we can talk about the really concrete risks.
And there was some discussion of that on the original version of BIP360, which I wasn't
supportive of, the new version I am supportive of.
If we
add into Bitcoin new additional cryptographic algorithms
that introduces additional risk surface to Bitcoin itself, both in the code, in the
implementation, and also in the crypto systems, One of the great things and the reasons
that it was very tractable to bring Taproot to Bitcoin is that Taproot relied on
actually a reduced set
-quantum I'm a
crypto -cryptographer.
I'm a crypto -quantum -cryptographer.
not not a crypto -cryptographer.
I'm I'm a crypto I'm not I'm a crypto -quantum
-cryptographer.
either have to accept a dramatically reduced number of transactions or payments
makeable on Bitcoin in order to get them, or we have to add additional extension block
space of some sort to hold those keys and signatures.
that, we know historically that Bitcoiners are not willing to take much larger blocks
for a lot of good
reasons and also much higher verification costs for nodes.
So what do we do there?
that's one big risk is the size of these things right now.
then I just covered the two.
So the risk of the code itself and then the risk of the size.
and then Hunter and James, and I'd also love to hear from you again on the potential
risks
So, how can we get the
additional risk mitigation of post -quantum cryptography in Bitcoin without the
drawbacks that you mentioned?
And if you put, say, like,
post -quantum cryptography in a tap leaf, and then you just continue using Schnorr along
with that, you don't have any the size concerns or the security
concerns until the point at which you actually want to use it.
So I think that you can kind of square the circle on this
and get the protection without necessarily the cost.
Yeah, exactly. mean, in my post that's in the NASTAP here that LayerTwo Labs put up
there, it says exactly that.
Like I support Bit360, I support an optional Tapleaf based post quantum
algorithm for those who are
concerned, because then we can basically say in good faith, if quantum happens, can
quickly disable elliptic curve -based key spans and those who prepare to themselves
using this technique are protected.
I wouldn't bother protecting myself, but anybody who wants to can, and that's great.
Hunter, Jameson, do you have any other thoughts on this?
Just that Ethan has been working on that problem, not only from the perspective
of having the choice between either
post -chlorography or elliptic group photography, but also we've been working on
something called Bitzip, which is essentially
-wide cross -transaction compression
upgrade.
It would help scale post photography.
James, any thoughts?
Yeah, mean, I
had a whole slide about how I felt that there's
kind of a quantum entanglement, if you will, pun intended,
of all of the issues that are overlapping in this case.
so one is the fact that all post
-quantum cryptographic schemes suck in the context of Bitcoin's resource constraints.
We would prefer not to reignite the block size debate unless you're me.
you know, I've already kind of done that talking about the dynamic block size ideas
as a long term strategy for
a number of different things and scalability.
There's multiple inviolable properties of the protocol that are actually in conflict
and that you know we end up going down this road, whether we do something or do nothing
there will likely be people who are upset about these properties being
violated.
there's the issue that my improvement proposal talks about, which
is this kind of concepts that some could call
confiscation or forced migration.
then if you have more of a defensive perspective, you might call it enforced security
upgrades
or enforcing and incentivizing security improvements.
There's also this issue of, well, Bitcoiners and as an ecosystem,
we should display strength through stoicism and simply allow bad
bad actors who achieve certain powers to be able to manipulate the protocol because
they're just following the rules versus a more proactive approach of saying, well,
we know that this may become a problem and we know that we can work on trying to get
solutions in place in the
There's also the issue of viewing 1
BTC equals 1 BTC and Bitcoin is the unit of account and that's all that matters versus
the alternative viewpoint that Bitcoin
Bitcoin is simply not a unit of account for most individuals and businesses and there
would be actual destruction of spending power and economic volatility
that would have negative ripple effects across the ecosystem.
There's game theory ultimately, with regard to
selling your coins in certain situations or being in favor
of forced migration or confiscation of quantum vulnerable coins.
And I think the game theory effectively plays out such that it ends up being what
you could call a game of whales versus guppies, where the whales
who have the vast majority of their savings, their treasuries, what have you,
in Bitcoin would probably prefer to eliminate
having large amounts of quantum vulnerable coins that could be liquidated, versus the
guppies or the people who are still accumulating.
Bitcoin would probably love to see the price crash so that they could buy the dip and
become a whole coin or so on and so forth.
And then there's just wealth redistribution dilemmas all over the place.
Whether we're talking about freezing or burning
or like an hourglass
spending volume throughput proposal, what have you.
And then finally, there is the game theory around doing all of these proposed
changes, which are pretty much all soft fork changes, but they could
ultimately be highly controversial soft forks.
and
and then the way to reject or resist a controversial soft fork, there is game
theory around that, but it's never actually played out in reality.
it could get very interesting.
Okay, Robin, go ahead.
Isabel, think maybe if you,
sometimes when Jameson speaks, I get the blue dots on your name and his quality
goes down. So I don't know if maybe you could mute if he
is talking. don't know if that will help or maybe it will not make any difference to
anyone else. I'm the only one experiencing it.
don't know. Sure, will do.
Robin, do you want to go ahead?
then I just let up Martin on stage.
hear you're trying to raise money to break Bitcoin.
So we'd love to hear from you as well.
But Robin, go ahead first.
I wanted to talk a bit about the risks of mitigating,
of migrating before it's an issue.
The first thing is, of course, fixing problems
that aren't real takes resources from real problems.
We have all these conferences and on -conferences.
People are talking about it.
It just takes mindshare of problems that might be actually relevant and might make a
difference.
the other thing is that preparing too early is also a risk in itself because
quantum schemes are not matured yet at all.
essentially, we have two kinds of schemes.
We have very large hash -based schemes, and we have other schemes that are based on
lattice cryptography. And we are not even sure if these lattice cryptography things are
actually quantum resistant.
There was a paper claiming
to break them.
But then somebody found a bug in the paper.
But there still a lot of rumors in the community that people might be able to fix that
bug and then actually break all kinds of lattice -based
cryptography with quantum computers, if
for the utmost of clarity, do you think is the biggest risk with
introducing PQC into Bitcoin?
worst case scenario?
think, as I said, think it takes away my share from real problems.
I think it might
be,
we don't have the cryptography yet to actually make a good decision what kind of scheme
we would like to use.
And I think also that putting that much focus on this topic fuels the quantum
panic amongst Bitcoin investors, because that is actually a real thing that
Bitcoin investors, panic about, like, what would happen if tomorrow a quantum computer
comes up, even though that this is not a rational fear.
It's panic. It's paranoia.
And kind of investment fear seems like a very horrible idea, because it can be
all kinds of irrational fears that we could design for.
and we should do the opposite.
should calm down investors by making arguments grounded in real world evidence.
Do you have any concerns about that approach?
like silencing conversations, even in a scenario where maybe there are breakthroughs
and quantum computers do advance and we do get farther down the
line. know, that culturally an appropriate attitude to have that we should be
of, you know, quiet about these conversations?
mean, do you have any concerns about that?
I mean, sure, should totally like watch the
progress. And once there happens something
in that space, for example, somebody would actually run Szor's algorithm and would
factor 21 without any kinds of crutches.
That would be concerning.
Then we would actually might run into that exponential race that within the next
15 years, it becomes a reality.
And then we should definitely prepare for
that. until we are in that stage where it's absolutely not real at all, it's all like
promises to investors and sales pitches, we should not engage in that
unreal discussion. We should ground the discussion in the actual reality of quantum
computers not being real at all.
Ethan, do you want
I think that's
a
good question. I question.
question. question.
are far more concerned about this, that have changed their opinions over time.
But I really want to go back to something that he said earlier, which is that,
like, what if ECDSA gets broken?
Or what if one of these quantum algorithms gets broken?
I think that if our goal is to
have the ability to store Bitcoin in a coffee can in your yard for 100 years and dig
it up and still have it be secure, we need more than one signature algorithm in Bitcoin
because on those sorts of timescales, signature algorithms are broken, quantum
computers are not.
And so I would argue that hash -based
cryptography like Sphinx, which is also post -quantum, would give us, would give
Bitcoin far more long -term security and would allow us to transition
over time as algorithms are broken.
think we should always be concerned with
how
Bitcoin never has a single point of failure or single point of compromise.
Within the quantum debate,
should also just be concerned with classical breakthroughs and thinking about ways to
mitigate this. And I think the way that I've been thinking about mitigating
quantum attacks is also lining up with how we can mitigate classical
attacks, which is have more than one signature algorithm based on different
assumptions. So it is extremely unlikely that if one signature algorithm is broken,
then Bitcoin security will be lost.
Martin, I heard through the grapevine
that you're raising money to try to steal
Satoshi's coins with quantum computers.
Is that true? How's it going?
Good. Thanks for having me.
I'm so happy to have this discussion.
Very few people are interested in this.
So there's a lot of parallel threads, actually.
So I have a very large, short position
in the publicly traded quantum companies,
and I've gotten relatively close
to all the private ones.
I'm a quantum bear.
My girlfriend and I are having a baby
in four weeks, by the way.
We have been focused on this problem
quite a bit.
So she is one of the first employees
of OpenAI, and she has a master's degree
from MIT in this field,
and she also taught with Scott Aronson,
who is one of the preeminent quantum experts,
I'd say, in the world.
And so a couple of interesting data points here.
So I've used every single quantum platform.
I've spent a lot of money on my own
using IBM's quantum platform,
which is probably the most sophisticated.
But on AWS, you can use IonQ's system
as well as Rigetti's system
and a couple of others.
So you cannot actually even run a Shor's program
on these systems right now.
Some people have implementations,
but they're so-called partial Shor's
or kind of Shor's-inspired, if you will.
So running a QFT dagger
is actually not possible right now on Shor's.
One of the reasons is, for Shor's,
on current quantum.
So one of the reasons is
you have tremendously low gate fidelity.
So you have around a 99.9% gate fidelity,
which sounds not terrible,
but if you have 500,000 gates that you compile,
0.999 to the 500,000th power
is a very, very, very small number.
That's 10 amounts of zero.
And so we need better fidelity
in the quantum world before we can get anywhere.
For anybody that wants independent verification of this,
that's really, really good.
I stumbled upon this esoteric podcast
called 692 or 632 Nanometer,
which is a very nerdy physics podcast
that's not very popular.
But they had an episode with a fellow named Chris Monroe.
Chris is like an academic hero of mine.
He started IonQ,
which is one of the largest
publicly traded quantum computer companies.
And IonQ has like a 60 qubit computer
and IBM's best is 133.
All of these are with low fidelity.
And what's interesting about fidelity
is that in the quantum community,
it's been five or six years before fidelity added to nine.
So just for references sake,
transistors have around nine,
I guess nine to 10 to the negative 18th fidelity.
So we got around 10 to the negative third fidelity
in quantum.
So really, really, really well-fidelity
and bandwidth as well.
These computers just don't work.
They're extremely slow.
But we do know you go from a polynomial time,
factoring time or DLP time
from an exponential speed time.
So this is the only thing in quantum.
So this is really,
this is the only thing quantum computers could do well.
There's really no other point,
which is why I'm short the common stocks of those companies.
So, but if you want a really good data point,
as I was saying,
watch the 632 nanometer broadcast
because you'll see Chris Monroe,
again, my academic hero amongst others,
but one of my top scientists
that I'm jealous of their brain.
He says that we're still 30 years away
from a practical quantum computer that could do Shor's.
Shor's is what quantum computers were invented for
after Peter Shor did his thing.
IBM started publishing on prototypes.
There was never a need to build a quantum computer until then.
The other thing I'll mention is that quantum computers
are exquisitely slow.
It's something that's not well understood.
You know, you read lay press articles that say,
well, quantum computers,
they can run these calculations so fast, et cetera.
Well, it's not exactly true.
The clock speed of quantum computers,
anywhere from 10 Hertz to 10,000 Hertz.
So quite a lot less than the gigahertz we're used to.
There's only one core, so to speak.
The coherence time is very low.
There's lots of like,
it's sort of a toaster compared to an NVIDIA chip.
The only reason the little toaster can beat the NVIDIA chip
is because it's one specific algorithm, right?
You're going from exponential time for the NVIDIA chip
to polynomial time for the quantum chip.
And that's exciting enough to be on top of it.
And forgetting the raising money thing and all that,
it's maybe a rumor that's too fresh.
Just some ideas I've been having,
but I certainly spent around that ballpark of money,
myself and my girlfriend, looking at this unique problem.
It's kind of one of the hardest problems
or most interesting problems humanity
is sort of tackling at the moment.
And I think there's sort of, we have three approaches.
So the first is a brute force approach,
which many believe is outside realm of possibility.
I'll talk about that in a second.
The second approach is a mathematics breakthrough
in classical.
And I think that's the strongest, most likely approach
that's going to hurt ECDSA.
And the third is quantum, which I sort of view as a backup,
but I want enough of a good relationship with quantum
where if anybody gets to be the first
to run a Shor's algorithm
on a working large-scale quantum computer,
I want it to be me.
Now, the repercussions of taking Satoshi's coins,
what's interesting about that
is that it's really not a question of if.
This is going to happen.
The only way that you could put forth maybe a proposal
to end this possibility is if the community of miners
and anyone else who has the authority to upgrade Bitcoin
would agree to throw away Satoshi's coins,
make them impossible.
So any key in the P2PK8 era
where the X coordinate was released,
you literally have the number that you need to map across
ECC to get to the private key.
And that's a really good headstart.
Otherwise you can sort of attack the non side of it
or attack both.
And so I think on the classical math side,
there's a lot of promising avenues,
but GPT-5 is out for at least for employees of OpenAI
and it's very, very good.
And GROK4 is also very, very good.
And math problems we couldn't solve before,
I don't know, you can take Fermat's last theorem
or something like that,
they did get solved eventually.
And math that we thought was impossible became trivial.
And even things like integer factoring,
which is sort of thought to be isomorphic to discrete log
is something that I think,
I'm not sure anything's safe.
There's a, it's never been proven
that you couldn't find a polynomial time algorithm
for IFP or DLP.
So I feel like we may do it.
I've been working on a lot of exotic ideas.
There's a recent, Bill Buchanan and Jamie Gilchrist,
I think, I've been in correspondence with these guys
who published affine non-to-tact vulnerabilities
that are interesting.
And relying on the poor implementation, right?
Of some vendor a long time ago who repeated nonces
or something like that.
I think that's probably out of the question,
but there are other types of attacks.
There's sort of a lattice sieving
and things that you can do.
For example, one wallet I've looked at
as kind of a nice, I don't know,
first interesting proof of concept
is any wallet that has like hundreds of thousands
or millions of out transactions.
I think those types of wallets have unique vulnerabilities
because they're certainly leaking potential entropy
as they sign millions of transactions.
And Binance, even with completely random nonce,
I think that there's an opportunity there.
So I think AI is gonna be our best friend here.
I think if somebody were to start a multimillion dollar
or even tens of millions or hundreds of millions
of dollar effort to get Satoshi's tokens,
which has become economically more and more exciting, right?
As Bitcoin price has gone up
and it seems like the Lindy effect has taken hold.
If somebody were to do that,
I think they would try to focus on mathematics.
There's maybe five or 10 living cryptographers
that are really skilled at elliptic curve cryptography,
including some people who invented like the Koblitz,
who invented the Koblitz curve, that he's still alive.
And Van Stone, who passed away,
his colleague, Menendez, and a fellow in Australia.
There's a handful of people that have done this.
The GLV endomorphism, for example,
Galbraith is the G in the GLV, he's still alive.
Pollard, who's Pollard's row attack
is the current fastest known attack
for ECDSA or any elliptic curve for that matter
is also still alive.
And that is a root sort of a quadratic attack.
So for two to the 256, you need two to the 228 operations.
I have a very rare opinion
that that's actually computationally feasible.
Today, it's not exactly computationally feasible,
but I do think that in the next 10 years,
two to the 128 sort of, we will cross that threshold,
whether it's with Moore's law or something else
into being able to do two to the 128,
which is basically enough to crack every key
or at least a chunk of the keys.
So I think it's gonna happen.
It's just a question of where is, who does it, when, how?
Are they doing it for the glory?
Are they doing it for the money?
Are they doing it for both?
That's kind of where I come out.
I'm curious, are there specific breakthroughs in quotes
or like milestones that you would be looking for
before you would think Bitcoin should take some action?
And also, I just wanna clarify your position.
Would you advocate for a coin burning approach
when it comes to Satoshi's coins or P2PK coins?
Yeah, I don't know.
I think that any attack that can only,
it depends on how successful the attack is.
If there's a way to crack sec P256K1 in general,
then you have a big problem.
If there's a way to crack ECC in general,
then you have a way bigger problem.
Because we just don't know if it's this curve.
Just having to focus on this curve
makes the mathematician's job infinitely easier,
but you could do it as a general attack.
And that seems a little more far-fetched,
but in the realm of possibility,
in terms of advocating for what you do with the tokens,
I think it's gonna be a function of a number of things,
including the attitudes of the people involved.
My personal attitude is, I'm not sure it's that important,
but I think that certainly anyone in support
of this community,
I don't think would be the type of person that would,
anyone who's been around Bitcoin, et cetera,
would be somebody that wants to hurt the community.
I think they probably wouldn't want a reward of some kind.
Some Bitcoin maxis I've talked to have said,
well, these tokens represent a bounty.
And if you can solve the bounty, they're yours.
Others disagree.
If the Bitcoin proposal just basically says Satoshi's dead
and we're gonna burn them, I think there's a good,
it's very against the Bitcoin ethos, right?
But it's still kind of a security upgrade.
And because the opt-in of a PQC system
would probably, I think,
get you most of the tokens to opt-in.
And I think that whether it's a Mt. Gox tokens
or Satoshi's tokens,
10 or 20% of the tokens would be left behind,
but maybe that's better than not.
So a good analog was the Euro.
Some countries will permanently honor Euro exchange
for Deutsche Mark or whatever.
Other countries have said, there's a drop dead date.
If after 2001 or two, I think it was,
there were countries,
like I struggle to remember which country exactly,
but France or Italy said,
after this date, you can't change your lira or franc
into Euro.
And I think that it's not unreasonable to say the same.
There are people who've been looking to laws,
like if you don't claim property after 10 or 20 years,
is it lost property?
If somebody leaves a $100 bill on a subway
and they go out and they mind their own business
and then they die,
that $100 bill, whose property is it?
It's probably lost property
and it's yours if you pick it up.
So-
I mean, just on the flip side of that argument,
are you concerned about the market impacts?
Let's just like live in this universe
and there's like fairyland for a second
that like quantum computers are real and they're happening
and this is something we need to worry about
like sooner rather than later.
Do you, are you concerned about the market impacts?
I mean, like what's your kind of position
about the market impacts
of a Satoshi's coins liquidation impact basically?
Yeah, I mean, I'm a market guy
and I still don't want to kind of think about it
because like, I feel like on one hand,
if done properly, maybe the person can exit
depending on what the Bitcoin temperature looks like
five or 10 years from now,
they may be able to just exit orderly
and that's not that crazy.
On the other hand,
they could try to exit and it could crash.
I think that it depends on what you're in it for.
If you're North Korea, that's one thing.
If you're me, that's another.
And I, and that's why I actually think
that the first reaction I was talking to somebody,
it sounds like you know,
because there's literally one person that knows this
about this idea,
but this person also told me they'd connected to you.
I know who you're talking about, of course.
They're a lovely person.
Lovely person.
Absolutely no problem, I'm telling you
because I think they specifically said
you're the person to talk to.
But the, I think you're better.
Their first reaction was, no, don't do this.
What the hell are you talking about?
Their second reaction was, wait a second,
if it's going to happen,
it should probably happen on Bitcoin community terms,
not, you know, North Korean terms or somebody else.
And again, you keep saying quantum.
I just want to underline that, you know,
my opinion is quantum is the backup plan.
And I think that advanced math comes from anywhere.
But when I get back to the point of like eight or 10 decent,
you know, elliptic curve researchers in the world,
what I'd say is that with AI and things like GPT-5,
which are, you know, scheduled for imminent release,
you probably have a superhuman at some point.
I don't know if it's GPT-6, seven, eight,
I don't know what, when,
but you will absolutely have a computer
that can get you closer to solving these problems.
And if you look at the running time of different algorithms,
many have improved and things like matrix multiplication,
they've undergone slow improvements over decades.
And, you know, Pollard's row
and the so-called kangaroo attack,
you know, and other things like GLV endomorphism,
which is sort of a speed up to all of those,
we will slowly get faster and faster solutions
for reversing ECC primes or ECC key pairs.
And, you know, there's just no doubt about that.
And humans that are smart can work in these problems.
Andrew Weil solved a 400 year old problem by himself,
you know, with thousands of AI mathematicians
who are smarter than humans,
I think we're gonna see something here.
And, you know, that's where a lot of my work is done.
I can, you know, implement some of these things
is the only advantage I bring,
but the mathematics success, you know,
instead of like relying on a handful of those professors
to get them interested in taking a sabbatical,
to get them interested in spending their time on this
of the rest of however long it takes to do it,
you know, AI is going to be the answer, I think.
Again, the other thing is Moore's law has not stopped.
And, you know, there's all kinds
of new computing substrates coming, not just quantum,
but optical, thermodynamic, so-called analog.
When Alan Turing wanted to do Riemann sums,
he made a machine and just before he worked
on the Manchester computer in around 44, the war was over,
he needed a new project.
He wanted to make a machine
that would calculate Riemann sums.
And he made one out of wood and steel.
And, you know, there's no reason an analog computer
specifically focused on this exact problem,
not in ASIC so much, but a different style of computer.
There's an interesting nature paper
about using magnets to find primes
or find, you know, solutions to semi-primes.
So I feel like there's, you know,
it's going to happen before quantum, quite frankly,
but if it's quantum first, and it's one of these companies
that does have like logarithmic breakthrough, you know,
again, who's going to be the first person to push that button
because it's $100 billion button.
And I'd like to be the first person, obviously,
but, you know, it's sort of,
it brings up a lot of legal questions.
It brings up other questions and burning it to a PKC wallet
would kind of be the most bullish thing you could ever do.
But if you do come up with a classical breakthrough
or even be the first quantum person,
I think you get a little immortalized
and that might be worth more than the money.
As much as the money is, one, you may not get to keep it.
It could be some law enforcement that says,
no, no, no, no, you can't take that.
And then secondly, you know, money is money,
but I think in mathematical fame terms,
there's no comparison to be somebody who say
develops a real attack on ECDSA.
That's probably worth more than $100 billion,
as crazy as that sounds in math credit.
Hunter, I'd love to hear from you really quickly, Martin,
though, before we go to Hunter.
I'm just curious, you know,
you said that you think that this is likely
like a 30 years away problem.
Given what you know about Bitcoin governance,
what do you think is the appropriate timeline
for Bitcoin to start, you know, preparing or making plans
or, you know, actually executing
some of these mitigation proposals,
some of which are pretty heavy handed.
I mean, burning Satoshi's coins is not gonna be easy
to get over the finish line.
So I'm just curious, like, at what point do you think,
you know, core devs, et cetera,
should start, you know, seriously thinking
about mitigation plans here?
Like how far away of a problem is this in your opinion?
Yeah, and again, I hate to pick on this
because our mutual friend has only the best things
to say about you and you sound very,
a bit like a very nice person,
but I don't think that it's just quantum, right?
Quantum is 30 years away in my mind.
But, you know, AI is vastly outstripping quantum.
And, you know, with what I've heard about GPT-5
and other things going on in AI,
I just don't underestimate a superhuman computer
figuring this out.
The discrete log problem has stymied human minds
since it sort of arised,
but it may not stymie, you know, an AI mind.
So just keep that in mind.
Quantum is kind of the dumb way,
the common denominator here that like,
okay, if AI doesn't get good enough,
or if you believe that ECDSA or ECC in general
is a true one-way function,
then okay, you have to like fall back on either quantum
or again, don't sleep on,
I wouldn't say Moore's law,
because it's not just Moore's law,
but, you know, if you have a hundred thousand H-100s
and you find, you know,
maybe not a complete solution to the problem,
you would also could find various speed-ups
to say Pollard's row.
There's no reason to believe at all
that Pollard's row is the fastest thing.
John Pollard retired.
He has the cutest website in the world.
I've been trying to go find a way to go meet him.
But if you find his website, you'll get a good chuckle
because he's really the true autist mathematician
who by himself found extremely large number
of interesting cryptography advances.
But so again, I don't know that all that stuff
is all just quantum.
In terms of protocol stuff,
I always go to Eric if I have a question on this stuff.
I'm not, you know, steeped in the Bitcoin community.
I think this is maybe the most interesting hack of all time.
So, you know, hackers, you know,
who are interested in this are, you know, there are a few,
but I think a well-determined, like very well-funded,
aggressive kind of incentivized team
could probably do better than the errant
kind of one mathematician who's maybe brilliant,
but doesn't have funding, doesn't have the time,
doesn't have the dedication to sit there
and do like a 10-year plan like a government
might be able to do or a sophisticated corporation,
you know, might be able to organize.
That makes a lot of sense.
And actually, Robin, one of my questions on my list for you
was, you know, at what point do you think
that we'll need to upgrade, you know,
cryptographic security for Bitcoin, you know, just generally?
Like, even if it's not quantum,
is there like any other risk that would warrant
some kind of crypto upgrade for Bitcoin?
Oh, go ahead.
One last thing I'd say is just going to 512 bits
would be a very big deal.
That would be a much higher security.
Interesting.
Hunter, thoughts?
Oh, yeah.
Wow.
Well, thank you very much, Martin, for popping in.
It's funny.
It reminds me a bit of how Bitcoin-ers
talk about things in a bit of an echo chamber,
and it's always kind of fun to see outsiders looking in.
And I wouldn't say you're necessarily an outsider.
You're kind of peripheral, but, you know,
I appreciate you popping in and giving us like your takes.
I'm definitely not Mr. Bitcoin, so.
Yeah.
And so the one thing I would say is just,
if you do wind up finding an exploit,
could you please like coordinate with us to like,
you know, like a canary, you know,
like we've talked about like a canary UTXO
or like the output of block one, for example.
This is undoubtedly Satoshi's coins.
It's right after the Genesis block.
It is spendable.
Maybe we could just like point to that and say like,
if you can spend that, then like, oh, you know,
and obviously like that's a different thing
than like, you know, hacking Binance's wallet
or something, right?
But like, I don't know, if you just could get close to,
I would just ask.
And also this is in your own selfish interest too,
in that like, you don't want to like tank the price,
right?
Necessarily, like you want to help us be prepared,
help us like understand like the scope of the threat.
And that's really cool that you're thinking about
this problem and a number of different angles,
not just the quantum angle, but like Paulette's row,
the like the, just like any fundamental ECDLT breaks,
you know, like that's really cool.
And wow, so anyway, just asking politely,
maybe you could coordinate with us to like indicate
that it's.
A really quick story on that is there's a Bitcoin zillionaire who's, you know, played a big role in the community that I was, I was asked to consult on because he also happens to have a very large holding in a quantum computing stock.
Quantum computing is, as you, as you guys may know, it was this shit industry and you couldn't give stock in quantum computing companies away.
And somehow it's become a hot industry again, which baffles my mind because almost no progress has been made.
But the fellow said, you know, he's very close with the core developers and he said something like, look, you know, just, just give us a heads up and we can talk about it and work on it.
And I said, that's no problem with me because, you know, the mathematical glory here again is, is the prize, you know, I, I, you know, even taking that money and trying to spend it and all that, you know, I'm independently, you know, successful anyway.
I think this is just like the best paper you could ever publish in the history of mankind almost.
So it's just like, you know, it is literally accomplishing the impossible.
Like, I, yeah.
And that's the other thing I'd say is that, you know, just keep in mind efforts between whether it's mine or somebody else's, I mean, they have a very low probability of working soon, but they also have the feature of, they have almost a certain probability of working at some point.
And I'm a relatively young person that, that I think I could see this through, whether it's 10 years from now or 20 or 30, I still want to be the first person to touch that button.
It's less impressive if it happens 30 years from now.
But, you know, that's, that's, thanks for listening.
Well, I just, I consider this all just part of protocol hardening, you know, like, like, if there is truly like an exploit that is possible, given enough resources, Bitcoiners should know.
And so it's really just, you know, yeah, I appreciate your efforts.
And you, what you're doing is essentially hardening the protocol.
So I wouldn't consider it an attack.
I would consider it somebody who's just exploring the problem space, making sure that Bitcoin's safe for everyone.
Yeah, I agree.
And I think that, you know, the literature on, at least on archive, but some other places as well, like, there are definitely, there is definitely progress being made.
You know, the, the Affine Nance attack caught me off guard.
I ran this attack or in my own derivative on it, and certainly found wallets that were, I guess, exposed, you know, they didn't have tokens in them.
But I do think that as the tax and the cryptography community become more advanced, because EDSSA, EDSSA, EDSSA, as ECDSA also is implemented in things like SSH, and in many, many other things.
So it's not just Bitcoin, and it's probably the most important part of it, to be frank.
But I do think, you know, there are papers every year on new attacks.
They almost all, most of the interesting ones focus on lattice attacks.
And, you know, one recently, very sophisticated AI, which may or may not be available to the general public, recently told me about an interesting attack using something called tropical geometry.
Which is, you know, I never, I've never, never heard of it before.
I'm not a professional mathematician.
But tropical geometry is an extremely esoteric, small field that was developed years ago.
But if you think about it again, how Weil solved Fermat's last theorem, which was thought to be nearly intractable, he used this vastly different area of math to sort of bridge two gaps in math.
And I think that's probably what's going to happen here.
And again, quantum is kind of your last resort, in my opinion.
I mean, whenever the dumb quantum industry, you know, you know, they're sort of very poorly run generally kind of place, whenever they can get, you know, something to happen, I think, you know, we'll wait.
But if you look at Google, for example, Google does not rent a quantum computer.
So, you know, you could also view them as a relatively sophisticated actor that's probably not interested in stealing anything.
And just by virtue of them creating a quantum computer, they're just, I think, sort of a better actor, I wouldn't call them a good actor, but a much better actor to the extent they get where they get to.
IBM also, while they put their quantum computers on the cloud, they don't necessarily, aren't going to rush to put out a super powerful quantum computer on the cloud.
And Bitcoin tentacles run deep.
I mean, both of those companies could easily establish or have already established really good relationships with those companies and other companies like SciQuantum, which is a fairly strong, large, privately held company, who some think are contender to be first.
They're also in that camp.
So I think, you know, there may be an ability to sort of intercept those companies and before letting other people use their computers, intercepting them and say, hey, we represent the Bitcoin developers.
We really now see your advance.
Congratulations. But we have a very important decision to make very soon.
And don't don't put this computer on the cloud before we can get our ducks in a row.
We have a few more minutes before I think we need to wrap up.
Martin, I did have one question.
I'd actually like to hear Robin's perspective on this as well, which is why do you think quantum companies are getting so much attention right now, given how little progress there's been?
Like, why is this blowing up so much, in your opinion?
Yeah, I've lost millions of dollars on this, so I'm ready to tear my hair out answering this question.
But we're sort of in a bubble of sorts.
You know, the meme coin bubble is a good example.
There's a bubble in nuclear energy, in eVTOLs, it's just a bubble.
And it sounds super exciting.
It's very, you know, kind of French science and exotic, you know, leading edge science.
NVIDIA has been such a big performer.
It's the biggest company in the world now.
So it kind of makes sense that people kind of want what's next.
Amazing.
Any final thoughts from Hunter, Robin, Jameson, Ethan?
This was a really great space.
Paul, I hope you had fun in particular.
But yeah, any final thoughts on kind of like, Robin, do you want to go ahead?
I see you just took your mute off.
Yeah, my final thought is just that I think it's absolutely safe to wait for actual quantum computers to pop up.
And then we can start thinking about migrating and mitigations and stuff like that.
And until then, we should calm down people and treat it as like a thing from like magical land that is just not real yet, maybe.
And maybe we'll never become real.
That's what I meant.
So, Ethan, what are your final thoughts?
I think the best way to get people to panic is to tell them, don't panic.
There's nothing to panic about.
I think the right approach to convince people that Bitcoin is taking all of these threats seriously, including just classical attacks on ECDSA, is to have plans and very well thought through proposals on how to do that.
And very well thought through proposals on how to mitigate those risks on a both short timescale and also on a longer timescale.
Jameson, go ahead. Yeah.
So this is more meta and thinking in terms of ossification.
But one of the things that I find most frustrating when discussing protocol level changes, improvements, what have you, these days, is that it seems like there's more and more of a cacophony of pushback saying, why are you rushing this?
What's the urgency all of a sudden?
Even if we're talking about something like CTV or covenants or proposals that have been around for five plus years, people are saying, why are you pushing this?
What is the urgency?
And so I don't think anyone is saying that right now there is urgency for us to do something.
What we're saying is we've seen the trajectory of Bitcoin becoming slower and slower to react and be able to improve itself and that that in and of itself is concerning.
We're trying to get ahead of the curve.
We're trying to be prepared and to not be caught by surprise.
So I think everyone gets to work on whatever they want to in Bitcoin.
And certainly some of this stuff may be distracting to some people, but I can tell you for sure there are plenty of protocol developers who don't care at all about quantum and they're not going to spend any of their time working on it.
And that's fine.
And I don't think we're saying that they need to.
I think the people who care about it should work on it and those who don't continue working on whatever interests them.
So like I've said, I don't think that we're going to have a cryptographically relevant quantum computer in the next few years.
But I think this is a weird balancing act and that if something happens where the time frame speeds up with quantum computing development and we get caught by surprise.
And when I say by surprise, I mean, if we don't see it coming at least a few years away, preferably five plus years away and come to a consensus that it's going to be a problem in five years or so, that's when I think very bad things will happen if Bitcoin cannot react in sufficient time.
Robin, go ahead and then we'll finish with Martin.
I just wanted to add that if you really want to be on the absolute safe side, just use a hash key.
And then if the quantum apocalypse becomes a reality, then you can go to Slipstream and mine your transaction in private and then it will never hit the public mempool.
And as long as Slipstream will not rip you off, then you will be absolutely safe.
TBH, Robin, I think that that handles like 10% of the problem.
Like, theoretically, if this day were to come, like Satoshi's coins being liquidated would probably be a much bigger issue that would affect all holders.
Do you have a response to that?
Well, I mean, should we optimize for such things?
Like what, like just the theoretical scenario that Satoshi would come back and just wanted to dump all his coins.
Would we want to stop him?
I think we should not.
So I think it's just part of the protocol and we should leave it as it is.
And we should not change the rules just because there is like BlackRock or somebody being concerned about Satoshi's coins getting turned into a bug bounty for quantum computers.
I think it's like we are starting to entangle like the economics of investing in Bitcoin into like the engineering of Bitcoin.
I think that's always a very bad idea.
So I think we should not care about that at all.
I think that's going to be a tough sell, but I hear you.
Martin, go ahead.
Yeah, just something everybody here can do.
I think probably at least half the room are pretty sophisticated programmers is if you go to quantum.ibm.com, you get 10 minutes of free quantum compute time every month.
And the way quantum computers work is they basically run instantly.
So, you know, 10 minutes is actually a long time.
And you could also pay if you so desire.
And I've done that and it's not too expensive.
And everybody here could understand the thousand lines or 500 lines of code that it would take to run a true fully true quantum shores.
Right now, you cannot do that.
As I mentioned, it's too complicated for quantum computers to run.
You could do a quantum inspired sort of half quantum shores.
And right now, the biggest number, me and my team, mostly my girlfriend, have been able to get the biggest number we can get factored as a biprime is in the kind of five or six digit range.
So, you know, obviously the state of the art in integer factorizations in several hundred numbers.
So 250, I forget exactly what the record is right now, but we're very, very, very, very far along away from a quantum computer being useful or operational.
You can run smaller algorithms on them.
So I would say, you know, don't make this like some intangible theoretical problem.
Just start programming on these things.
They're up and running right now.
It's not that hard to go write code on them and you'll come to the same conclusion as me, which is these machines are really pathetic and, you know, they have a ways to go.
And then in three years or two years, if they're a little bit better, you can get some telemetry on.
OK, well, they're advancing at this kind of rate, assuming they can even accelerate advancing.
You know, once you can factor a 20 digit number on a quantum computer, then you say, oh, well, hold on.
We're getting to a point where, you know, another log order and then, you know, you know, well, another log order gets you to state of the art.
So, you know, that's the good time to worry right now.
These computers can't factor much of anything.
So try it.
You know, if it's a theoretical worry, go make it a practical worry and understand the state of the art in quantum right now.
The cloud system makes it so easy to do that for free or for a couple hundred dollars.
You can try every single quantum computer other than the ones captive within, say, say, a Google.
Awesome, I loved this space.
Thank you guys so much all for participating.
Yeah, lots of amazing takes from so many interesting people, some of my favorite people in Bitcoin.
So thank you, Paul and LayerTwo Labs.
Thank you guys so much for hosting.
Do you have any final thoughts?
I just think this is the second one of two.
So I think we're going to keep we're going to keep trying to do this probably every other week on Friday.
So stay tuned.
Thanks, everybody, for joining.
Thanks to all of our guests for joining the space on short notice and all of our speakers that joined.
Thanks especially to Isabel for moderating this debate and bringing her insight, as well as Enduro for hosting the space on such short notice.
Thanks, everybody, for joining.
And go ahead and follow both LayerTwo Labs and Enduro for more exciting spaces like this.
Have a good evening.
Thanks, guys.