Time is Running Out for Bitcoin to Mitigate Quantum Computing Threats

Not all aspects of bitcoin are vulnerable to quantum computers. The process of bitcoin mining, which involves adding new blocks to the blockchain, utilizes a type of mathematics known as hashing that quantum computers are unable to compromise. The blockchain itself and the rule that new bitcoins can only be created through mining would remain intact in the event of a quantum attack. However, ownership of bitcoins is a different matter. Bitcoin wallets rely on a distinct type of mathematics that converts a private key into a public address. This mathematics functions effortlessly in one direction but is impractical in the other, and it is the sole barrier preventing unauthorized individuals from spending someone else's coins. A quantum algorithm known as Shor's algorithm can bridge this gap. A recent paper by Google demonstrated that this attack could be executed with significantly fewer resources than previously estimated, and within a timeframe that competes with bitcoin's block times. This article explores the potential consequences and the response from the bitcoin community. Approximately 6.9 million bitcoins, equivalent to one-third of all mined bitcoins, are stored in wallets with publicly visible keys, making them susceptible to quantum attacks. This includes early bitcoins from the network's inception, stored in an address format that publicly disclosed the key by default, as well as any wallet that has been used for transactions, as spending reveals the key for the remaining balance. A quantum attacker would not need to compete with an ongoing transaction; instead, they could systematically target wallets with exposed keys at their leisure. Bitcoin's pseudonymous creator, Satoshi Nakamoto, possesses roughly 1 million bitcoins that have remained untouched since the network's early days and are now at risk. The 2021 Taproot upgrade inadvertently expanded the problem by making bitcoin addresses more efficient and private, but as a side effect, any bitcoin spent after the activation of Taproot has publicly disclosed the key protecting the remaining balance at that address. While the quantum threat has sparked intense debate in recent months, and other blockchains are preparing for the threat, bitcoin developers have yet to propose a concrete plan. Ethereum, a major competitor, has had a formal quantum-resistant program in place since 2018, with four teams working full-time on the migration and multiple independent developer groups testing networks weekly. In contrast, bitcoin lacks a cohesive strategy. Although there are efforts to address the issue, such as the BIP-360 proposal, which suggests introducing new quantum-safe address types, and a proposal from BitMEX Research to implement a detection system, neither has gained broad support from bitcoin's core developers. The lack of a unified approach and the reluctance to engage with the problem have been criticized by prominent advocates like Nic Carter, who described bitcoin's approach as 'worst in class' compared to Ethereum's 'best in class' strategy. The main challenge in implementing effective solutions lies in bitcoin's decentralized nature and its development culture, which treats any central authority as a potential failure mode and emphasizes rare and difficult changes to the protocol. This has kept the network stable for nearly two decades but makes addressing the quantum problem structurally more difficult. Migrating the exposed coins requires decisions that the network has historically avoided, such as whether to freeze old address formats to protect coins from future theft or allow exposed coins to move to new quantum-safe addresses using their original keys. The fate of Satoshi's coins is a poignant example, as freezing old formats would protect the coins but make them inaccessible, including to Satoshi, while leaving the old formats open would leave the coins vulnerable to quantum attacks. The Google paper's framing suggests that a successful attack on bitcoin's mathematics should not be seen as a wake-up call but rather as a potential signal that the adoption of post-quantum cryptography has already failed. This implies that by the time the threat becomes apparent, the window to respond may have already closed. Developers are now faced with the question of whether a network built to resist coordinated change can coordinate the largest security upgrade in its history before quantum computers become a reality.