Time's Running Out for Bitcoin to Counter Quantum Threat

Not all aspects of bitcoin are vulnerable to quantum computers. The process of bitcoin mining, which utilizes a type of math known as hashing, is resistant to quantum attacks. The bitcoin ledger and the rule that new coins can only be created through mining would remain intact in the event of a quantum attack, with blocks continuing to be produced and the chain remaining operational. However, ownership would be at risk. Bitcoin wallets rely on a different type of math that converts a private key into a public address. This math is easy to perform in one direction but virtually impossible in the other, which is the primary obstacle preventing unauthorized individuals from spending someone else's coins. A quantum algorithm known as Shor's algorithm can bridge this gap. A recent paper by Google demonstrated that this attack could be executed with significantly fewer resources than previously estimated, within a timeframe that competes with bitcoin's block times. This article, the final installment in a series, focuses on the response to this threat. It examines what is actually at risk, the measures bitcoin has taken to address the issue, and whether a network designed to resist coordinated change can implement the most significant security upgrade in its history before the threat materializes. The vulnerable pool of bitcoin is substantial, with approximately 6.9 million coins, roughly one-third of all mined bitcoin, stored in wallets whose public keys are permanently visible on the blockchain. This includes early bitcoin from the network's inaugural years, stored in an address format that published the public key by default, as well as any wallet that has been spent from, as spending reveals the key for the remaining balance. A quantum attacker would not need to compete with an ongoing transaction; instead, they could systematically work through wallets with exposed keys at their own pace. Bitcoin's pseudonymous creator, Satoshi Nakamoto, holds around 1 million bitcoin, which has remained untouched since the network's early days and now falls into the exposed category. The 2021 Taproot upgrade inadvertently expanded the problem. Taproot modified how bitcoin addresses function to make transactions more efficient and private. However, as a side effect, any bitcoin spent since Taproot's activation has published the key protecting the remaining balance at that address. While the quantum threat has sparked intense debate in recent months, and other blockchains are preparing, no concrete plan has emerged from Bitcoin developers yet. Ethereum, a major competitor to Bitcoin, has had a formal quantum-resistant program in place since 2018. The Ethereum Foundation operates four full-time teams working on the migration, with over ten independent developer groups releasing weekly test networks. They have outlined specific upgrades across four upcoming network-wide changes to transition Ethereum's security to quantum-resistant math. In contrast, Bitcoin lacks a comparable strategy. There are efforts to address the issue, such as the formal proposal BIP-360, which would introduce new quantum-safe address types for voluntary migration, and a competing proposal from BitMEX Research to implement a detection system that triggers defensive action if a quantum attack is observed. However, neither proposal has garnered broad support from Bitcoin's core developers, and they address different aspects of the problem. Prominent bitcoin advocate Nic Carter has expressed concerns, stating that the math securing bitcoin wallets is on the verge of obsolescence and describing Ethereum's approach as 'best in class' and Bitcoin's as 'worst in class.' Adam Back, CEO of Blockstream and an early bitcoin contributor, disagrees on the urgency but agrees that bitcoin should prepare now by incorporating optional upgrades in advance, allowing the network to migrate when necessary rather than reacting during a crisis. The biggest challenge in implementing effective solutions against Bitcoin's quantum threat lies in its coordination. Bitcoin's migration is more complex than Ethereum's due to reasons unrelated to the math itself. Ethereum has a foundation that funds engineering work and a governance process that regularly passes significant upgrades. Bitcoin, on the other hand, has neither, with a development culture that views any central authority as a failure mode and a social consensus that changes to the protocol should be rare and difficult. These principles have maintained the network's stability for nearly two decades but make the quantum problem structurally harder for bitcoin to solve. Migrating the 6.9 million exposed coins requires decisions that the network has spent twenty years avoiding. Should old address formats be frozen after a certain date to protect coins from future theft, or should exposed coins be allowed to move to new quantum-safe addresses using their original keys? What happens to coins whose owners cannot or will not migrate? Satoshi's coins are the most striking example. Freezing old formats protects the coins from theft but makes them permanently inaccessible, including to Satoshi. Leaving the old formats open means those coins remain a standing prize for whoever builds the first working quantum computer or has access to one and intends to attack. Setting a migration deadline forces Satoshi to either move the coins, revealing their ownership, or lose them. Every option changes bitcoin's character in ways the network has historically refused to change. The Google paper's framing is a summary of the industry's current stance. A successful attack on bitcoin's math should not be seen as a wake-up call to adopt post-quantum cryptography but rather as a potential signal that post-quantum cryptography adoption has already failed. This implies that by the time the threat becomes apparent, the window to respond may have already closed. Developers now face the question of whether a network built to resist coordinated change can coordinate the biggest security upgrade in its history before the hardware catches up to the theory. Ethereum's eight-year head start suggests that the correct answer is to start now, while Bitcoin's governance culture suggests that the likely answer is to wait until the threat is demonstrated, then act. Only one of these approaches will be effective if the timeline turns out to be shorter than optimists estimate.