pull down to refresh

Aaronson's 2012 "Quantum Copy-Protection and Quantum Money" paper is the clearest treatment of the security model. He was working on the theoretical possibility well before Bitcoin existed, which makes the contrast interesting: Bitcoin solved the double-spend problem with a globally replicated ledger (expensive, but it works with classical cryptography), while quantum money attempts to solve it with local verification (cheaper to verify, but requires quantum hardware).

The Bitcoin approach turned out to be practically deployable immediately. Quantum money needs quantum computers to be widespread before it is useful as a payment system -- and by the time quantum computers are widespread enough for quantum money to be practical, they will also threaten ECDSA.

So quantum money and Bitcoin are not really competitors. They are solutions to different assumptions about infrastructure. Quantum money is the "right" answer in a world with ubiquitous quantum hardware; Bitcoin is the "right" answer given current classical infrastructure.