Time is Running Out for Bitcoin to Mitigate Quantum Computing Threat

Not all aspects of bitcoin are vulnerable to quantum computers. The process of mining, which involves adding new blocks to the blockchain, relies on a type of mathematics known as hashing that quantum computers are unable to break. As a result, the ledger and the rule that new bitcoins can only be created through mining would survive a quantum attack. However, ownership is a different matter. Bitcoin wallets are protected by a distinct kind of mathematics that converts a private key into a public address that anyone can see. This mathematics works easily in one direction but not the other, and it is the only thing that prevents a stranger from spending your coins. A type of mathematics known as elliptic curve cryptography is used to secure bitcoin wallets. However, a quantum algorithm known as Shor's algorithm can break this type of cryptography. Google recently published a paper demonstrating that this attack can be carried out with far fewer resources than previously thought, and it can be executed within a time frame that competes with bitcoin's block times. This article, the final installment in a series, explores the potential consequences of a quantum attack on bitcoin and the steps that can be taken to mitigate this threat. Approximately 6.9 million bitcoin, or about one-third of all bitcoin that has been mined, is stored in wallets whose public keys are already visible on the blockchain. This includes early bitcoin from the network's first years, which was stored in an address format that published the public key by default, as well as any wallet that has ever been spent from, because spending reveals the key for whatever remains. A quantum attacker would not need to compete with a transaction in progress. Instead, they could work through the wallets with already exposed keys at their own pace, one by one. Bitcoin's pseudonymous creator, Satoshi Nakamoto, holds roughly 1 million bitcoin, which has been untouched since the network's early days and is now at risk. The 2021 Taproot upgrade expanded the problem by making any bitcoin spent since the upgrade publish the key protecting whatever remains at that address. While the quantum threat has sparked a heated debate in recent months, and other blockchains are preparing, nothing concrete has emerged from Bitcoin developers yet. Ethereum, which is one of Bitcoin's largest competitors, has had a formal quantum-resistant program in place since 2018. The Ethereum Foundation runs four teams working on the migration full-time, with more than ten independent developer groups shipping weekly test networks. Bitcoin has no equivalent strategy so far. However, there are efforts underway to solve the problem. One such formal proposal is BIP-360, which would add new quantum-safe address types that holders could voluntarily migrate to. A competing proposal from BitMEX Research would install a detection system that triggers defensive action if a quantum attack is observed on the network. However, neither proposal has broad support from bitcoin's core developers, and the two proposals solve different halves of the problem. Nic Carter, one of bitcoin's prominent advocates, has called out the issue in recent months. "Elliptic curve cryptography is on the brink of obsolescence," Carter wrote, referring to the mathematics that secures bitcoin wallets. He described Ethereum's approach as "best in class" and bitcoin's as "worst in class," citing developers who "deny, gaslight, gatekeep, bury heads in sand" rather than engage with the problem. Adam Back, the Blockstream CEO and a prominent early bitcoin contributor, disagrees on the urgency but agrees on the direction. "Quantum computing still has a lot to prove. Current systems are essentially lab experiments," Back said at a conference earlier this month. However, he also said bitcoin should prepare now, with optional upgrades built in advance so the network can migrate when needed, rather than scrambling in a crisis. The biggest challenge in implementing effective solutions against Bitcoin's quantum threat is the coordination problem. Bitcoin's migration is harder than Ethereum's for reasons unrelated to the actual mathematics. Ethereum has a foundation that funds engineering work and a governance process that regularly passes major upgrades. Bitcoin has neither. Its development culture treats any central authority as a failure mode, and its social consensus holds that changes to the protocol should be rare and hard. Those priors have kept the network stable for nearly two decades, but they also make the quantum problem structurally harder for bitcoin to solve. Migrating the 6.9 million exposed coins requires decisions the network has spent twenty years avoiding. Should old address formats be frozen after a certain date to protect coins from future theft? Should exposed coins be allowed to move to new quantum-safe addresses using their original keys? What happens to coins whose owners cannot or will not migrate? Satoshi's coins are the sharpest example. Freezing old formats protects the coins from theft but makes them permanently inaccessible, including to Satoshi. Leaving the old formats open means those coins sit as a standing prize for whoever builds the first working quantum computer or has access to a quantum computer and wants to attack. Setting a migration deadline forces Satoshi to either move the coins, revealing their ownership, or lose them. Every option changes bitcoin's character in ways the network has historically refused to change it. The Google paper's own framing is a summary of where the industry stands. A successful attack on the mathematics bitcoin uses "should not be seen as a wake-up call to adopt post-quantum cryptography as much as a potential signal that PQC adoption has already failed." This means that by the time the threat becomes visible, the window to respond may already have closed. Developers now face a question of whether a network built to resist coordinated change can coordinate the biggest security upgrade in its history before the hardware catches up to the theory. Ethereum's eight-year head start suggests the correct answer is to start now. Bitcoin's governance culture suggests the likely answer is to wait until the threat is demonstrated, then move. Only one of those answers works if the timeline turns out to be shorter than the optimists' estimate.