Time Runs Out for Bitcoin to Counter Quantum Threat

Not all aspects of bitcoin are vulnerable to quantum computers. The process of bitcoin mining, which involves adding new blocks to the blockchain, utilizes a type of mathematics known as hashing that quantum computers are unable to effectively breach. The blockchain itself and the rule that new bitcoins can only be created through mining would survive a quantum attack, with blocks continuing to be produced and the chain remaining operational. However, ownership would be at risk. Bitcoin wallets rely on a different type of mathematics that converts a secret private key into a publicly visible address. This mathematics functions easily in one direction but not the other, and it is the sole barrier preventing unauthorized individuals from spending your coins. A quantum algorithm known as Shor's algorithm bridges this gap, and a recent paper by Google demonstrated that the attack could be executed with far fewer resources than previously estimated, within a time frame that competes with bitcoin's block times. This article, the last in a series, focuses on the response to this threat. It examines what is actually at risk, the measures bitcoin has taken, and whether a network designed to resist coordinated change can implement the largest security upgrade in its history before the advent of quantum hardware. The pool of vulnerable bitcoin is substantial, with approximately 6.9 million bitcoin, or about one-third of all mined bitcoin, stored in wallets whose public keys are already permanently visible on the blockchain. This includes early bitcoin from the network's first years, stored in an address format that published the public key by default, as well as any wallet that has ever been spent from, because spending reveals the key for whatever remains. A quantum attacker would not need to compete with a transaction in progress but could instead work through the wallets with already exposed keys at their own pace, one by one. Bitcoin's pseudonymous creator, Satoshi Nakamoto, holds roughly 1 million bitcoin, untouched since the network's early days, which now falls into the exposed category. The 2021 Taproot upgrade expanded the problem by making transactions more efficient and private, but as a side effect, any bitcoin spent since Taproot activated has published the key protecting whatever remains at that address. While the quantum threat has sparked intense debate in recent months, and other blockchains are preparing, nothing concrete has emerged from Bitcoin developers yet. Ethereum, a major competitor, has had a formal quantum-resistant program since 2018, with four teams working on the migration full-time and a dedicated website to publish progress. Bitcoin lacks a comparable strategy. There are efforts to solve the problem, including a formal proposal called BIP-360, which would add new quantum-safe address types that holders could voluntarily migrate to, and a competing proposal from BitMEX Research that would install a detection system to trigger defensive action if a quantum attack is observed on the network. However, neither proposal has broad support from bitcoin's core developers, and they address different aspects of the problem. The biggest challenge in implementing effective solutions against Bitcoin's quantum threat lies in its governance culture, which treats any central authority as a failure mode and holds that changes to the protocol should be rare and difficult. Migrating the 6.9 million exposed coins requires decisions that the network has spent twenty years avoiding, such as whether old address formats should be frozen after a certain date to protect coins from future theft, whether exposed coins should be allowed to move to new quantum-safe addresses using their original keys, and what happens to coins whose owners cannot or will not migrate. The fate of Satoshi's coins is the most striking example, as freezing old formats protects the coins from theft but makes them permanently inaccessible, including to Satoshi, while leaving the old formats open means those coins remain a potential prize for whoever builds the first working quantum computer or has access to one and wants to attack. Setting a migration deadline forces Satoshi to either move the coins, revealing their ownership, or lose them, with every option changing bitcoin's character in ways the network has historically refused to change. The Google paper frames the situation as a summary of where the industry stands, stating that a successful attack on bitcoin's math should not be seen as a wake-up call to adopt post-quantum cryptography but rather as a potential signal that post-quantum cryptography adoption has already failed. This implies that by the time the threat becomes visible, the window to respond may already have closed. Developers now face the question of whether a network built to resist coordinated change can coordinate the biggest security upgrade in its history before the hardware catches up to the theory. Ethereum's eight-year head start suggests starting now is the correct answer, while Bitcoin's governance culture suggests waiting until the threat is demonstrated, then moving. Only one of these approaches will work if the timeline turns out to be shorter than estimated.