https://en.wikipedia.org/wiki/Post-quantum_cryptography

i think there is still a huge energy cost to quantum computers and they are a long way from making them even big enough. the cost of running one of the current devices is very high - a 10k qbit device uses 10KW. if that scales linearly then 1 gigawatt is the minimum cost for a device that could come close to running shor's algorithm on this basis.

they are potentially more efficient on power basis but still, it's only like 50% better than a supercomputer of similar capability.

the other thing is that it already doesn't affect AES or ChaCha20-Poly1305 or ECDH, comparatively the improvement on breaking those keys is marginal.

it only really affects elliptic curve signatures and public keys.

there is a number of options, i'm not sure which ones are the best, but a very old signature scheme based on merkle trees is quite strong because it is purely based on hash functions, and there is lattice, multivariate, elliptic curve isogeny and coding schemes based on error correction codes like reed solomon.

the most important thing, though, is that it is still probably years away from them being able to make the million qbit machines that pose a real threat, and as i point out, a computer that requires a gigawatt of power is not going to be wasted on attacking trivial amounts of bitcoin either. so, keeping your UTXOs relatively small is for sure a defense against it.

average US electricity cost currently is about $0.16/KWh so that is $160,000/h to run a 1GW installation for an hour. in europe that comes to more like $400,000/h. i assume that there is some amount of time required for the algorithm to break one key:

> Estimates suggest that breaking the encryption within one hour would require approximately 317 million physical qubits, assuming a surface code with a code cycle time of 1 microsecond, a reaction time of 10 microseconds, and a physical gate error rate of 10^-3.

>

> To break the encryption within one day, it would require about 13 million physical qubits.

>

> These requirements are far beyond the capabilities of current quantum computers, such as IBM's largest superconducting quantum computer, which has 127 physical qubits.

so, if you look at that cost, and best case scenario for power cost as we see in USA (btw power cost is similar in bulgaria), the cost of running a 1 million qbit machine for long enough to crack one bitcoin key would be 13 days with a cost of:

49 million dollars.