Quantum computers are not real. At least not in the way people keep using the term. Small experimental quantum systems exist. Cryptographically relevant quantum computers do not. They may never exist. Call a spade a spade.
A normal bitcoin spend ultimately relies on an elliptic-curve signature. A sufficiently powerful cryptographically relevant quantum computer, which does not yet exist and may never exist, could use Shor’s algorithm to derive the private key from an exposed public key and forge that signature. Whether the physics can ever scale to a machine capable of doing this remains very much unclear.
QSB shifts the security-critical work to one-time hash-based proofs and a deliberately expensive search. The closest analogy is a vanity-address generator: GPUs try an absurd number of candidates until one has the rare shape the script requires. Here the search runs across transaction parameters and signature subsets until the hash of a transaction-bound key happens to look like a valid DER-encoded signature. Bitcoin’s existing script rules accept the result, while the actual security comes from hashes that Shor’s algorithm cannot shortcut.
The estimate is roughly $75 to $150 of GPU compute, hours of work, and direct submission to a miner because ordinary nodes will not relay the oversized, nonstandard transaction. That is wildly impractical for everyday payments. It is also a working lifeboat built under today’s consensus rules, with no soft fork, hard fork, or Core upgrade. A broader migration would still be needed if quantum risk ever became real, especially for coins whose public keys are already exposed. For a threat that may never arrive, having smart people build an emergency exit this early looks like over-preparedness in the best possible sense.