The Schelling Asset of Q-Day

1.Mosca's inequality now says “worry”

Bitcoin satisfies Mosca's inequality under any reasonable estimate of current inputs. The cascade is not a future event; the academic update has already happened, and the market update has not.

The threat of large-scale fault-tolerant quantum computation to Bitcoin's signature scheme has been understood since Shor 1994. The standard decision framework is Mosca's inequality: if the time your data must stay secure (X), plus the time it takes to migrate to post-quantum cryptography (Y), exceeds the time until a quantum computer can break it (Z), then it is already too late to begin migrating. For Bitcoin, X is effectively forever — the chain's value depends on the immutable validity of historical signatures. Y is the multi-year coordination time of any soft-fork upgrade. Z is the variable that academic and industry communities have spent the last decade trying to estimate, and that has been collapsing in one direction.

The 2017 Roetteler–Naehrig–Svore–Lauter estimate placed the logical qubit cost of breaking 256-bit ECC near 2,330. The 2026 Chevignard–Fouque–Schrottenloher result reduced this to 1,193. Subsequent unconditional optimization brings it to 780. None of these results changes the date a cryptographically relevant quantum computer will exist; what they change is the difficulty of arguing the date is comfortably distant.

Mosca's 2015 estimate: a 1-in-7 chance of public-key crypto being broken by 2026, and 1-in-2 by 2031. Today is 2026.

The custodial markets for Bitcoin have not repriced this shift, because markets reprice on events, not on shifts in probability distributions over future events. The window between the academic update (already happened) and the custodial-market update (has not happened) is the structural mispricing this paper exists to identify.

A reader who believes the cascade probability is approximately zero on any investable horizon should stop here. The remainder of this document will not change their mind, because the disagreement is upstream of every argument that follows.

2.Bitcoin's own developers are now fighting about exactly this

Configuration (a) — Bitcoin migrating in place — is being attempted right now via BIP-360. The fight over how to handle dormant coins is the empirical confirmation of the fault line this paper predicts. Configuration (a) being attempted does not kill the thesis. It validates it.

A post-quantum cascade forces a Schelling decision among three logically exhaustive configurations.

The strongest evidence for this paper's framing is not theoretical. Configuration (a) is being attempted right now, with named proposals, named proponents, named opponents, and a debate that has split exactly along the fault line predicted by the dormant-coin problem.

BIP-360 (Pay-to-Quantum-Resistant-Hash, P2QRH), authored by Hunter Beast, Ethan Heilman, and Isabel Foxen Duke, proposes a new Bitcoin output type committing to one or more post-quantum signature schemes, riding on SegWit version 3 with addresses beginning bc1r. The candidate schemes named in the current draft include FALCON, ML-DSA, and SLH-DSA. Falcon's inclusion is the most important external validation available for Tidecoin's 2020 primitive choice: Bitcoin's own quantum-resistance proposers, working independently, arrived at the same primitive Tidecoin shipped five years earlier.

The Lopp–Papathanasiou sunset proposal is structurally distinct and more aggressive. Drafted in mid-2025 by Jameson Lopp and Christian Papathanasiou, it proposes a phased migration: Phase A disallows new sends to quantum-vulnerable address types; Phase B, triggered by a flag day approximately five years later, renders ECDSA and Schnorr spends invalid altogether, freezing any UTXO not migrated by the deadline. The proposal's stated intent is to convert quantum security from a public good into a private incentive: fail to upgrade and you will certainly lose access to your funds.

The opposition is similarly named. Adam Back and Samson Mow have publicly argued the threat is not imminent and the urgency is premature. The bitcoindev mailing list has been split on whether dormant coins should be confiscated or permitted to be quantum-recovered. One side argues freezing is necessary to prevent catastrophic theft. The other argues confiscation violates the immutability property that gives Bitcoin its value.

This is the social fork the paper predicted, observable verbatim in mailing list threads available to any reader.

The implication for this paper's thesis is precisely the opposite of what a casual reader expects. Configuration (a) being attempted does not kill the configuration (b) thesis. It validates it. The fault line within (a) is exactly the failure mode the §1 frame predicted, and its resolution — whichever way it goes — creates demand for a hedge against the loser.

If the freezing camp wins, holders of dormant coins and immutability-sympathetic Bitcoiners need exposure to a chain that did not have to make this choice. If the non-freezing camp wins, holders facing the prospect of quantum theft of dormant tranches need exposure to a chain whose dormant tranches do not exist (Tidecoin's fair launch having no premine and the founder having departed without a known dormant balance). The configuration (a) attempt creates the demand for the configuration (b) hedge regardless of which side prevails.

3.Tidecoin is the only chain that fits the criteria

Tidecoin satisfies the configuration (b) criteria under a strict reading: right primitive, fair launch, no foundation treasury, identical 21M supply cap to Bitcoin, founder departed, community maintenance picked up. The implementation is rough at the surface; the structural properties are not synthesizable after the fact.

Tidecoin (TDC) was published as a whitepaper on December 10, 2020, by an author using the pseudonym EverettX. Mainnet launched seventeen days later. The chain's design choices map onto the configuration (b) criteria as follows:

3.1 Why Falcon is the only defensible choice

For a UTXO-model chain in which every input carries a signature, signature size is destiny. Among NIST-standardized post-quantum schemes, only Falcon has sub-kilobyte signatures.

Anatomy of a Tidecoin object. Addresses use base58 prefix 0x21 (decimal 33) and begin with the character E. Public keys are 897 bytes prefixed with magic byte 0x07. Signatures are bounded above by 666 bytes (~9× ECDSA). Block target spacing is 60 seconds; MAX_BLOCK_WEIGHT is 6,000,000. Genesis block hash is 0x480ecc7602d8989f32483377ed66381c391dda6215aeef9e80486a7fd3018075; the genesis output script is the literal 897-byte Falcon pubkey wrapped in OP_CHECKSIG.

4.The hedge math: a 10,000× gap

If 1% of Bitcoin holders rationally hedge against post-quantum transition risk, the implied demand for the configuration (b) instrument is approximately ten thousand times Tidecoin's current market capitalization. The bet does not require this demand to materialize in full.

The strongest demand-side argument does not require Tidecoin to displace Bitcoin. It requires Tidecoin to function as a hedge that Bitcoin holders rationally purchase against the transition risk of their primary holding. A Bitcoin holder facing the configuration uncertainty has a clean portfolio solution: hold the primary position in BTC, and allocate a small fraction to the asset that wins under (b).

5.The founder left. The community picked it up. This is the Bitcoin pattern.

EverettX departed Tidecoin much as Satoshi departed Bitcoin. Community maintenance picked up under the Tidecoin Foundation organization, with a BIP-style improvement process and reproducible signed builds. This is not a deviation from configuration (b); it is the same trajectory Bitcoin followed, observed earlier in the life cycle.

The most under-appreciated structural fact about Tidecoin is that its evolution has followed rather than diverged from the Bitcoin pattern. EverettX, like Satoshi, launched the chain pseudonymously, participated briefly during the early mainnet period, and departed. The chain did not die. Community maintenance picked up under the Tidecoin Foundation organization (github.com/tidecoin), which now hosts approximately twenty repositories spanning the core protocol, a JavaScript library, a Web3 wallet browser extension, an Android miner, network bootstrap seeds, the post-quantum primitive library, the BIP-style improvement proposal process (tips), and reproducible signed builds (guix.sigs) with attestations updated as recently as February 2026.

This is the Bitcoin pattern, not a deviation from it. Bitcoin's first community maintainer was Gavin Andresen; its second was Wladimir van der Laan; its third generation was a distributed set of contributors operating under BIPs and Guix-based reproducible builds. None of these maintainers had upgrade authority over Bitcoin's monetary policy. They were stewards of an implementation whose monetary rules were fixed in code by an absent founder. The protection against their capture was not their anonymity — they were named — but the structural fact that any unilateral change to monetary policy would create a fork that holders could reject.

Tidecoin is at the maintenance stage Bitcoin was at during the Andresen-to-Van-der-Laan handoff window, not the stage Bitcoin is at now.

Tidecoin has reached the same configuration earlier in its life cycle. The Foundation has named contributors. The TIP process exists. Reproducible builds are being attested. The 21,000,000 supply cap is fixed in genesis code. A maintainer who proposed changing the issuance curve would face the same outcome a Bitcoin Core maintainer would: a fork the holders did not follow.

The named-contributor model is a partial deviation from pseudonymous-founder purity, and a careful reader should note this rather than have it papered over. The mitigation is structural: the protocol has no upgrade authority that can unilaterally change monetary policy, and any contributor (or coordinated set) attempting to do so faces the same fork-and-rejection mechanism that protects Bitcoin from its own maintainers. The risk is non-zero and is weighted in §8. The maintenance-stage observation is also a feature for participants, not a defect: the organization is small enough that competent contributors have outsized influence on the trajectory; the codebase is unmodernized enough that the work is well-defined; the user base is small enough that the social cost of mistakes is low.

6.What you're probably thinking right now

Five objections likely to fire in a careful reader's mind. Each gets a direct answer; none of them kills the thesis.

7.The code is old but improvable; here is the roadmap

Tidecoin's technical position is the early-Bitcoin-Core-maintenance phase. The defects are localized to wallet and script-policy layers; consensus is correct. The modernization roadmap has five items in priority order, of which four are weekend-to-month work and one is the binding constraint on the entire thesis: contributor recruitment.

Baseline. The original codebase, preserved in tidecoin-old/tidecoin, was a fork of Bitcoin Core 0.18.3 with the Falcon-512 reference C implementation bolted in at the wallet layer. The defects most often cited against the project — CKey::Sign returning success on cryptographic failure, CPubKey::IsFullyValid calling secp256k1_ec_pubkey_parse on Falcon pubkeys, BIP66/BIP146 enforcement commented out, raw printf in cryptographic paths — are real but localized: none is in consensus code. The chain has produced agreed-upon blocks for five years notwithstanding these defects, which is empirical evidence that the consensus surface is correct even where the surrounding code is not polished.

Frontier. The Tidecoin Foundation organization is the maintenance frontier: guix.sigs commit activity in early 2026; the tips BIP-style governance process; multi-repository ecosystem; ongoing footgun remediation against the original codebase. Readers should verify the active fork's current state against the historical baseline rather than relying on this paper's prose.

Roadmap. Five items in priority order:

1. Formalize the Falcon script-policy layer. Restore the BIP66/BIP146 defense-in-depth that was removed, replacing it with Falcon-aware length and prefix checks. Weekend work.
2. Fix the wallet-layer defects. Return-on-failure, stale validation, logging. Weekend work.
3. Rebase against modern Bitcoin Core. Brings six years of upstream security work, V2 P2P transport, descriptor wallets, package relay, AssumeUTXO. Months of well-defined work.
4. Evaluate Taproot for Falcon. Open research question. Some properties translate; others require redesign.
5. Expand the contributor base. The binding constraint on the entire thesis. A four-named-contributor maintenance organization is one bus-factor failure away from re-abandonment. The single highest-leverage social investment in the project is recruitment.

8.What could go wrong (honest probabilities)

Five dominant risks, each weighted as a probability range. Multiplying through, the joint probability of the full ultra-bull outcome is 1–5%. The bet is asymmetric on a ~10,000× gap, and small allocation is the right sizing.

Multiplying through, the joint probability of the full ultra-bull outcome is approximately 1–5%. Against a ~10⁴ asymmetry, expected value sits in the 10×–50× range. This is asymmetric in the rationally interesting direction, but it is correctly sized as a small allocation, not a primary thesis.

Internal coherence is a property of all well-constructed false beliefs, not just true ones. Size against the probability, not the elegance.

The failure mode against which the strongest warning applies is the substitution of internal narrative beauty for base-rate reasoning. The narrative developed in this paper is internally coherent. Internal coherence is a property of all well-constructed false beliefs as well as true ones. The position should be sized against the probability range above, not against the elegance of the framing.

9.What to do next

Three reader types, three concrete first moves. Pick the one that matches your situation.

The question this paper has tried to answer is whether the structural thesis is real. The question it leaves to the reader is whether they wish to participate in determining whether the trajectory continues.