SoK: The Atomic Cryptographic Substrate of Blockchains: A Post-Quantum Vulnerability and Migration Analysis

"Is chain X quantum-safe?" is usually argued at the chain level, which mislocates the risk. We relocate it to the level at which an algorithm acts: a chain's post-quantum fate decomposes into three layers—the hardness assumption securing its signatures (Shor-vulnerable discrete-log/factoring, hash, or lattice), that assumption's status under the physically-realizable computational model (classical BPP vs quantum BQP), and the physical floor beneath it (unstructured-search and serial-depth bounds, not unconditional security). The abelian-hidden-subgroup assumption is efficiently broken under BQP; no efficient break is known for hash or lattice. For plaintext and revealed-key authorization the operative vulnerability is one object—the exposed public key; hash-committed authorization (P2PKH/P2WPKH) additionally admits a generic alternative-preimage route that never exposes the original key, whose thinner Bitcoin margin we measure separately. For the exposed-key branch we give an operational compromise decomposition: compromise requires exposure, feasibility, and non-revocation. These conjuncts answer to four distinct authorities (mathematics, the ledger, engineering, the owner or protocol), and each surveyed per-asset defense is classified by the primary conjunct it denies. Empirically, a first-party, reproducible classifier over the Bitcoin UTXO set reconstructed at block 957,269 assigns 1.93M BTC (9.6% of reconstructed unspent value) to standing-key script classes; including address-level reuse widens this to a scenario band of 5–7M (25–35%). Standing P2PK is the least classification-sensitive component, Taproot an upper- and reuse a lower-bound one, so we report a band rather than a strict interval. One architectural finding recurs: account and governance chains migrate most readily while immutable UTXO chains are hardest—an immutability–migration trade-off. All verdicts are contingent: no unconditional security exists, and BQP as the physical ceiling of computation is an assumption, not a theorem. Changes in this version (v2): Major revision incorporating external technical review. The Bitcoin exposure figures are a public-history reconstruction reported as a classifier scenario band (1.93M BTC, 9.6% of reconstructed unspent value; widening to a 5–7M band with address-level reuse), with documented genesis/BIP-30 edge cases and a structural cross-check against a community-distributed AssumeUTXO-format snapshot whose base-block hash and coin count match Bitcoin Core's committed height-880,000 metadata — the standard hash/witness classes reproduce that snapshot to displayed precision and the total to 0.001%, with residuals documented; because the serialized txoutset commitment was not recomputed, this is a structural cross-check, not consensus-level authentication. The compromise decomposition is stated as a necessary condition scoped to the exposed-key branch (hash-committed authorization additionally admits a generic alternative-preimage route); the physical floor is split into a robust 2^128 component and a weaker HASH160 multi-target operational assumption. Adds a methodology and single-coder literature-coding protocol, a related-work comparison, evidence sub-tiers, and updated resource estimates. No headline result changed.