Saylor's 90-Day Quantum Defense Estimate Faces Coordination Hurdles

By Elena Vasquez

The Bitcoin Security Consortium has committed $15 million over three years to Bitcoin security research, including post-quantum cryptography. Strategy joined BlackRock, Coinbase and four other major financial institutions and crypto companies to form the group in July.

Separately, Saylor said at the World Bank in Washington in October that Bitcoin could resist any realistic quantum-computing threat through a coordinated software upgrade. He estimated about 90 days once worldwide consensus is reached on the need for quantum-resistant cryptography, but no start date accompanies that conditional timetable.

What is the quantum risk to Bitcoin?

Bitcoin relies on elliptic curve cryptography for transaction security. A sufficiently powerful quantum computer could, in the scenario described, reverse-engineer private keys from exposed public keys and gain access to Bitcoin holdings associated with those keys.

No known publicly available quantum computer can currently break Bitcoin's cryptography in that manner. The risk is therefore prospective rather than an active exploit, and the industry debate concerns what a future machine may achieve.

What did Saylor's 90-day estimate assume?

Saylor's proposal was collective rather than centralized: the network would come together and upgrade its software once participants accepted the need for quantum-resistant cryptography. The 90 days refers to implementation after that agreement, not the time required to reach agreement. The estimate comes without a named implementation plan, testing protocol or list of responsible developers.

He also warned against introducing new cryptography hastily, reasoning that more complex security measures may create their own weaknesses. That caution makes validation and migration design part of the proposed timetable, rather than treating the estimate as a race to ship a replacement algorithm.

The estimate has drawn scrutiny because a network-wide shift requires developer agreement and users moving funds to new, secure addresses. Code deployment alone would not complete that migration, and no participation threshold, adoption measure or independent test supports the schedule. Bitcoin's quantum defense cannot be clocked until the industry agrees on what to build.

Who is funding Bitcoin's security work?

Beyond its consortium membership, Strategy has initiated research and development aimed at Bitcoin's long-term security. No separate Strategy budget, staffing plan or delivery schedule accompanies those efforts, so the company's own contribution should not be inferred from the consortium total.

The consortium's $15 million commitment over three years averages $5 million a year only if spending is even; no annual budget or allocation accompanies the figure. Post-quantum cryptography is one area of focus, not necessarily the sole use of the funds. The commitment creates research capacity, but it does not yet deliver quantum-resistant Bitcoin.

The participation of BlackRock and Coinbase gives the group financial-institution and crypto-company representation, but no governance terms, voting rules or technical mandates are described. Those omissions matter because a consortium can identify and test a migration path without securing adoption across the network.

What is BIP-360 changing?

Bitcoin developers are already working on ways to address the quantum-computing issue. One prominent proposal is Bitcoin Improvement Proposal 360, or BIP-360, which introduces a new transaction-output type called Pay-to-Merkle-Root, abbreviated P2MR.

BIP-360 advances protocol design, but the available details do not establish that developers have activated it or that it alone provides quantum resistance. Any eventual address migration would still depend on developers agreeing on technical changes and users moving their Bitcoin to new, secure addresses. BIP-360 is preparation, not proof of a finished quantum-resistant network.

What would validate the 90-day claim?

A credible timetable would require documented developer agreement on the cryptographic change, a defined implementation scope, tested software and a migration path for funds. The available details provide none of those milestones, no start date for the 90-day period and no activation deadline for BIP-360.

Until those records emerge, three facts remain firm: no public quantum computer is known to break Bitcoin, the consortium has committed three years of research funding and developers have an existing BIP-360 proposal. The next meaningful deadline is the start of Saylor's 90-day implementation window, which requires publicly documented consensus. Until that consensus exists, the 90-day clock has not started.