I don't think this is tinfoil season anymore, but I also don't think Bitcoin should start ripping out ECDSA because a few headlines got people excited.
The sensible answer is to work on crypto agility now, quietly and seriously, so there's a migration path before things start to get bad. That means research, standards, test implementations, wallet support, and ugly discussions about how to deal with old exposed pubkeys and ancient coins that may never move. The worst move would be doing nothing for years and then trying to cram a rushed fix through under panic conditions. Bitcoin is very bad at emergency surgery, by design.
Also, not all coins are sitting equally naked here. Coins with exposed pubkeys are the obvious first-class snack if quantum ever gets teeth. Reused addresses and old output types would be the part that keeps me awake, not fresh coins that haven't revealed more than they need to.
So yes, start the work now, absolutely. Just don't confuse "prepare now" with "flip the table tomorrow." With Bitcoin, the boring path is usually the path that keeps the chain alive.
There are no current proposals suggesting a dramatic shift from ECDSA straight to a post-quantum signature scheme. The more realistic path is to first add a new signature scheme, likely using P2MR as the foundation, and then push migration over time.
The biggest question is whether that migration should be
mandatory or
optional. Under an optional scheme, dead Bitcoin cannot be migrated and will eventually be stolen.
On the consensus side, we wrote a paper on this topic:
The Bitcoin Backbone Protocol Against Quantum AdversariesIn the quantum random-oracle model, a quantum adversary can still be handled if its total quantum hashing power is tightly bounded. Relative to the classical analysis, each quantum oracle query is effectively much more valuable, and the security condition worsens by an extra factor on the order of p^(-1/2), where p is the success probability of a single classical hash query.
The paper also shows that, to achieve the same negligible failure probability, the required number of rounds or confirmations grows by about p^(-1/6).