Time Runs Out for Bitcoin to Mitigate Quantum Computing Threat, Putting 6.9 Million BTC at Risk

Not all aspects of Bitcoin are vulnerable to quantum computer attacks. The process of Bitcoin mining, which involves adding new blocks to the blockchain, utilizes a type of mathematics known as hashing that quantum computers are incapable of breaking. As a result, the blockchain itself and the rule that new Bitcoins can only be created through mining would remain intact in the event of a quantum attack. The production of blocks would continue, and the chain would remain operational. However, ownership would be severely compromised. Bitcoin wallets rely on a different mathematical approach that converts a private key into a public address visible to everyone. This math functions effortlessly in one direction but is impractical in the other, and it is the sole barrier preventing an unauthorized individual from spending someone else's coins. The first part of this series on quantum computing delved into the realm of physics, explaining that a quantum computer is fundamentally distinct from a conventional computer. It begins with an extremely cold, minuscule metal loop where particles exhibit behaviors unlike anywhere else on Earth. The second installment examined the implications of directing this machine at Bitcoin. Bitcoin wallets depend on a one-way mathematical problem. Converting a private key into a public address takes mere milliseconds, whereas reversing the process, from public address to private key, would take a conventional computer longer than the age of the universe. The Shor's quantum algorithm bridges this gap. A recent paper by Google demonstrated that this attack could be executed with far fewer resources than previously estimated, within a timeframe that competes with Bitcoin's block times. This final piece in the series focuses on the response, discussing what is actually at risk, the measures Bitcoin has taken, and whether a network designed to resist coordinated change can coordinate the most significant security upgrade in its history before the relevant hardware becomes available. The vulnerable pool is substantial, with approximately 6.9 million Bitcoins, roughly one-third of all mined Bitcoins, stored in wallets whose public keys are permanently visible on the blockchain. Most of this consists of early Bitcoins from the network's first years, stored in an address format that published the public key by default. It also includes any wallet that has ever been spent from, since spending reveals the key for the remaining balance. A quantum attacker would not need to compete with an ongoing transaction; instead, they could systematically work through wallets with exposed keys at their own pace. Bitcoin's pseudonymous creator, Satoshi Nakamoto, holds about 1 million Bitcoins, which have remained untouched since the network's early days and now fall into the exposed category. The 2021 Taproot upgrade expanded the problem. Taproot is a modification to how Bitcoin addresses function, intended to make transactions more efficient and private. A side effect was that any Bitcoin spent since Taproot's activation has published the key protecting the remaining balance at that address. Although this was not a mistake, it was a reasonable trade-off at the time, given that quantum timelines appeared much longer than they do now. Several efforts are underway to address the quantum threat, but nothing concrete has emerged from Bitcoin developers yet. Ethereum, a major competitor among institutional investors, has had a formal quantum-resistant program in place since 2018. The Ethereum Foundation runs four full-time teams working on the migration, with over ten independent developer groups releasing weekly test networks. In contrast, Bitcoin lacks an equivalent strategy. There are, however, formal proposals, such as BIP-360, which would introduce new quantum-safe address types that holders could migrate to voluntarily. Another proposal from BitMEX Research suggests a detection system that triggers defensive actions if a quantum attack is observed on the network. Neither proposal has broad support from Bitcoin's core developers, and they address different aspects of the problem. The challenge in implementing effective solutions lies in Bitcoin's migration being harder than Ethereum's due to its governance structure. Ethereum has a foundation that funds engineering work and a governance process for passing major upgrades, whereas Bitcoin has neither. Its development culture views any central authority as a failure mode, and its social consensus holds that changes to the protocol should be rare and difficult. This has kept the network stable for nearly two decades but makes the quantum problem structurally harder for Bitcoin to solve. Migrating the 6.9 million exposed coins requires decisions the network has spent twenty years avoiding, such as whether old address formats should be frozen after a certain date to protect coins from future theft or whether exposed coins should be allowed to move to new quantum-safe addresses using their original keys. The fate of coins whose owners cannot or will not migrate, including Satoshi's, poses a significant challenge. Setting a migration deadline forces Satoshi to either move the coins, revealing their ownership, or lose them. Every option changes Bitcoin's character in ways the network has historically refused to change. The Google paper's framing serves as a summary of the industry's current stance, suggesting that a successful attack on Bitcoin's math should not be seen as a wake-up call to adopt post-quantum cryptography but rather as a potential signal that such adoption has already failed. This implies that by the time the threat becomes visible, the window to respond may have already closed. Developers now face the question of whether a network built to resist coordinated change can coordinate the biggest security upgrade in its history before the hardware catches up to the theory. Ethereum's eight-year head start suggests that starting now is the correct approach, while Bitcoin's governance culture suggests waiting until the threat is demonstrated before taking action. Only one of these approaches will work if the timeline turns out to be shorter than estimated.