Everyone is staring at the quantum cloud and asking whether 2028 is the year the cryptography breaks. I am staring at something quieter: the last time an old Bitcoin address broadcast a signature. That is the precise moment the vulnerability appears. Tom Lee, the Fundstrat founder who still commands a television audience every time he mentions Bitcoin, used that stage to warn that quantum computers could crack 35% of Bitcoin's supply by 2028. Adam Back, the Blockstream CEO who practically wrote the proof-of-work playbook, called the timeline nonsense. The two men are not actually disagreeing about the same asset. One is pricing a fantasy; the other is defending a protocol.
Mapping the tides while others chase the foam is my daily business. When a serious person takes a television-friendly estimate and announces it as a date, I stop listening to the date and start looking at the denominator. The 35% figure is a risk interval pretending to be a fact. It assumes a specific number of exposed keys, a specific error-correction threshold, and a specific attack model. None of those assumptions are stable. Quantum computing is not a static line item; it is a research curve with hype spikes and sudden retractions. Tom Lee is treating the top of that curve as the new normal. Adam Back is treating the bottom as the permanent state. The truth lives in the messy middle, and the middle is where portfolio decisions are made.
Error-corrected quantum computing is not measured in physical qubits. A lab can announce a chip with a thousand qubits and still be nowhere near the code distance required for Shor's algorithm. The relevant metric is logical qubits, the error-protected abstraction that can actually run a useful computation. Public conversations almost always use physical qubits, because logical qubits make the headline boring. The gap between the two is why the 2028 timeline should be flagged as optimistic, not because the cryptography is safe forever, but because the roadmap has a long bridge from physical toys to logical machines. I have priced many tail risks; this one is not as close as the fear suggests, and not as far as the dismissal pretends.
Let me place this warning inside the macro context. This is 2026, a bull market where AI-agent narratives are carrying more weight than token fundamentals. The same capital that rushes into quantum-crack headlines is the capital that was chasing AI-agent tokens last month. This is a rotation, not a revelation. The global liquidity map has two lanes: central bank balance sheets and narrative rotation. Quantum warnings live in the second lane. If you can scare people out of an old asset class and into a new narrative, you have generated liquidity. The real question is not whether quantum computers threaten Bitcoin. It is whether the fear itself will become the liquidity event.
The protocol background has been known since the early days of public-key cryptography. Bitcoin uses elliptic curve digital signatures, ECDSA in particular, with a curve called secp256k1. To move coins, the owner must produce a signature that proves control of the private key. Shor's algorithm, if it ever runs at sufficient scale, could solve the discrete logarithm problem fast enough to derive private keys from public keys. That is the mathematical core of the warning. What is missing from the television version is the difference between a hashed address and an exposed public key. The threat is not uniform across the supply.
The first hard truth about Bitcoin's quantum exposure is that the amount of exposed supply is not a fixed number. It is a function of on-chain behavior. Consider a Satoshi-era P2PK output: its public key is sitting on-chain in plaintext. Whoever controls the private key can be attacked today, if a sufficiently large quantum computer existed. But the vast majority of modern Bitcoin addresses are P2PKH or bech32. They are hashed. The public key does not appear until the owner spends the UTXO. So the dangerous asset is not every coin; it is every coin whose owner has broadcast a signature, plus every coin still sitting in plaintext public-key outputs. The first spend is the vulnerability event. That single sentence is the whole short position on the 2028 panic.
When Tom Lee says 35%, he presumably means the share of Bitcoin's supply that exists in outputs revealing public keys. But he did not show his work. A headline percentage without a chain-analysis fingerprint is a liquidity narrative, not a technical metric. I am not going to defend Adam Back by asserting a precise number; I have not audited the entire UTXO set this quarter, and anyone who tells you they have done it in a weekend is selling something. What I can tell you from the 2022 stablecoin audits I led is that the denominator always matters more than the numerator. When a report says X percent of the market is at risk, you need to know which outputs were included, what attack surface is being assumed, and whether the calculation conflates hashed addresses with exposed public keys. That is where most quantum panic dies.
There is also a temporal problem. The exposed supply is a moving object. Every time a user broadcasts a transaction, the previous public key is now visible in the spent input, while the change output creates a fresh hashed address. So the percentage of the supply whose public keys are exposed grows with every block. By 2028, if people keep moving coins, more addresses will have revealed public keys. A static warning like 35% cannot capture this dynamic. It is worse than wrong; it is a snapshot with no time stamp. If the market treats a stale number as a fixed property of Bitcoin, it will misprice the migration risk.
If the market truly believed that 35% of the supply was vulnerable, there would be a quantum-risk options market, an insurance product, or at least a liquid basis trade. There is none. The absence of a price signal is as informative as the presence of a headline. Sophisticated capital is not hedging a 2028 quantum event because the event, as framed, is not tradeable. It is a story. And stories rotate.
Alpha is not found, it is extracted from chaos. In this market, the chaos is the confusion between a public-key exposure and a full-UTXO exposure. If the market marks down all coins because 35% of the supply is described as vulnerable, an investor who knows that a particular bucket of coins is safe is buying an option from the panic. That is where the trade lives. I have watched this movie before. In 2017, the ICO market treated gas fees as a proxy for network health, and in 2022, the stablecoin market treated algorithmically pegged reserves as real collateral. The pattern is identical: a misleading metric becomes the foundation for a narrative, and the narrative moves the market until someone checks the underlying data.
Now the contrarian angle. The real danger is not a quantum processor. It is the migration. A premature anti-quantum hard fork would require changing Bitcoin's signature scheme while preserving twenty years of consensus. That means coordinating every node, exchange, custodian, and treasury. The historical evidence for this kind of coordination is not encouraging. SegWit took years. Taproot took longer. A post-quantum transition touches the sacred geometry of the coin. The more likely path is not a catastrophic theft at quantum scale; it is a decade of upgrade fatigue, alternative opcodes, and capital fleeing the uncertainty. The panic is itself a centralization vector. Retail holders, unable to audit their own exposure, will sell to institutions that can afford migration. That is not a security break; that is a wealth transfer wearing a technology costume.
I am not saying Tom Lee is deliberately manufacturing fear. I am saying that the market's reaction to fear is often more damaging than the event that triggers it. A quantum computer that never breaks a single key can still break a million portfolios if the holders sell before they need to. Culture pays dividends long after the hype fades. Bitcoin's culture has always treated the 21 million issuance schedule as a social contract. The moment the market believes that contract can be broken by a machine, the social collateral backing Bitcoin begins to reprice. Adam Back's contrarian confidence is valuable precisely because he is reminding the market that the protocol has survived panic before. But his dismissal should not become a reason to ignore the migration roadmap.
The correct response to a risk warning is neither dismissal nor capitulation. It is pricing. The migration to post-quantum signatures is an infrastructure problem, not a trading deadline. It will be solved by careful protocol evolution, not by television schedules. That is why I treat the 2028 date as a liquidity event, not a technological event. When a fixed-income trader sees a downgrade, they do not sell every bond; they reprice the curve. The same discipline applies here. The 35% number is a stress test, not a scenario. You need to know which of your assets are exposed, which are protected by hash preimages, and what the migration path would cost.
Mapping the tides while others chase the foam means treating this as a risk-pricing exercise, not a technology forecast. I do not predict the future; I price the risk. The only rational response to a quantum headline is to inventory your own exposure. Have your coins ever moved since 2017? Are they in P2PK outputs? Do you hold on an exchange where the private key is not yours? Four categories, four different risk prices. The signal is silent until the noise collapses. When the noise is as loud as a 35% headline, the real risk is not inside the quantum machine. It is in the crowded exit.
