Time's Running Out for Bitcoin to Counter Quantum Computing Threat

Not all aspects of bitcoin are vulnerable to quantum computers. The process of bitcoin mining, which involves adding new blocks to the blockchain, utilizes a type of mathematics called hashing that quantum computers are unable to breach. The blockchain itself and the rule that new bitcoins can only be created through mining would remain intact in the event of a quantum attack. However, ownership of bitcoins would be at risk. Bitcoin wallets are secured by a different type of mathematics that converts a private key into a public address. This mathematics allows for easy conversion in one direction but not the other, which is the primary factor preventing unauthorized individuals from spending someone else's coins. A quantum algorithm known as Shor's algorithm can bridge this gap. A recent paper by Google demonstrated that such an attack could be carried out with significantly fewer resources than previously estimated, and within a timeframe that competes with bitcoin's block creation rate. This article, the final in a series, focuses on the response to this threat. It examines what is at risk, the measures bitcoin has taken so far, and whether a network designed to resist coordinated change can implement the largest security upgrade in its history before quantum computers become a reality. Approximately 6.9 million bitcoins, equivalent to one-third of all mined bitcoins, are stored in wallets whose public keys are visible on the blockchain. This includes early bitcoins from the network's first years, which were stored in an address format that published the public key by default, as well as any wallet that has been spent from, as spending reveals the key for the remaining balance. A quantum attacker would not need to compete with an ongoing transaction; instead, they could systematically work through wallets with exposed keys at their own pace. Bitcoin's pseudonymous creator, Satoshi Nakamoto, holds approximately 1 million bitcoins that have remained untouched since the network's early days and are now categorized as exposed. The 2021 Taproot upgrade inadvertently expanded the problem. Taproot is a modification to how bitcoin addresses function, intended to make transactions more efficient and private. A side effect of Taproot is that any bitcoin spent since its activation has published the key protecting the remaining balance at that address. While this was not an error, it was a reasonable trade-off at the time, given the perceived longer timeline for quantum threats. Currently, there are no concrete plans from bitcoin developers to address the quantum threat. Ethereum, one of bitcoin's major competitors, has had a formal quantum-resistant program in place since 2018. The Ethereum Foundation has dedicated teams working full-time on the migration, with multiple independent developer groups releasing weekly test networks. Ethereum has outlined specific upgrades across four upcoming network-wide changes, aiming to transition its security to quantum-resistant mathematics. In contrast, bitcoin lacks a comparable strategy. There are, however, efforts to solve the problem. One proposal, BIP-360, suggests introducing new quantum-safe address types that holders could voluntarily migrate to. Another proposal from BitMEX Research recommends implementing a detection system that would trigger defensive actions if a quantum attack is detected on the network. Neither proposal has gained broad support from bitcoin's core developers, and they address different aspects of the problem. Nic Carter, a prominent bitcoin advocate, has emphasized the urgency of the situation, stating that the elliptic curve cryptography used to secure bitcoin wallets is on the verge of becoming obsolete. He praised Ethereum's approach as 'best in class' and criticized bitcoin's as 'worst in class,' citing developers who deny, downplay, or ignore the issue rather than engaging with it. Adam Back, the CEO of Blockstream and an early contributor to bitcoin, disagrees on the urgency but agrees that bitcoin should prepare by incorporating optional upgrades in advance, allowing the network to migrate when necessary rather than reacting in a crisis. The primary challenge in implementing effective solutions against the quantum threat is not the mathematics itself but the coordination within the bitcoin network. Ethereum's migration is facilitated by its foundation, which funds engineering work, and its governance process, which regularly implements major upgrades. Bitcoin, on the other hand, lacks a central authority and a formal governance process, treating any centralized control as a potential failure mode. This development culture has kept the network stable for nearly two decades but makes addressing the quantum problem structurally more challenging. Migrating the 6.9 million exposed coins requires decisions that the network has historically avoided. Questions such as whether old address formats should be frozen after a certain date to protect coins, whether exposed coins should be allowed to move to new quantum-safe addresses using their original keys, and what happens to coins whose owners cannot or will not migrate, all pose significant challenges. The coins held by Satoshi Nakamoto are the most striking example, as freezing old formats would protect the coins but make them inaccessible, including to Satoshi, while leaving the old formats open would leave the coins vulnerable to quantum attacks. Setting a migration deadline would force Satoshi to either move the coins, revealing ownership, or lose them. Every option would alter bitcoin's character in ways the network has traditionally resisted. The future of bitcoin's response to the quantum threat remains uncertain. The Google paper frames the industry's stance, suggesting that a successful attack on bitcoin's mathematics should not be seen as a wake-up call to adopt post-quantum cryptography but rather as a potential signal that the adoption of post-quantum cryptography has already failed. This implies that by the time the threat becomes apparent, the window for response may have already closed. Developers are now faced with the question of whether a network designed to resist coordinated change can implement the largest security upgrade in its history before quantum computers become a reality. Ethereum's eight-year head start in addressing the quantum threat suggests that starting now is the correct approach. However, bitcoin's governance culture indicates that the network may wait until the threat is demonstrated before taking action. Only one of these approaches will be effective if the timeline turns out to be shorter than optimists estimate.