Time is Running Out for Bitcoin to Mitigate Quantum Computing Threat, Putting 6.9 Million BTC at Risk

Not all aspects of bitcoin are vulnerable to quantum computer attacks. The process of bitcoin mining, which involves adding new blocks to the blockchain, utilizes a type of mathematics known as hashing that quantum computers are unable to crack. As a result, the blockchain itself and the rule that new bitcoins can only be created through mining would remain intact in the event of a quantum attack. New blocks would continue to be produced, and the blockchain would keep operating. However, ownership would be severely compromised. Bitcoin wallets rely on a different type of mathematics that transforms a secret private key into a publicly visible address. This mathematical function is simple to perform in one direction but virtually impossible to reverse, which is the primary obstacle preventing unauthorized individuals from spending someone else's coins. The first part of this series on quantum computing delved into the physics behind it, explaining that a quantum computer is fundamentally distinct from a regular computer, operating at extremely low temperatures and small scales where particles exhibit unique behaviors not observed elsewhere on Earth. The second part explored the implications of directing a quantum computer at bitcoin, highlighting that bitcoin wallets depend on a one-way mathematical problem. While converting a private key into a public address takes mere milliseconds, reversing this process using a conventional computer would take longer than the age of the universe. However, a quantum algorithm known as Shor's algorithm significantly reduces this time gap. A recent paper by Google demonstrated that such an attack could be executed with far fewer resources than previously estimated, and within a time frame that competes with bitcoin's block times. This final installment in the series focuses on the response to this threat, examining what is at risk, the measures bitcoin has taken so far, and whether a network designed to resist coordinated changes can implement the largest security upgrade in its history before quantum hardware becomes a reality. Approximately 6.9 million bitcoins, representing about one-third of all mined bitcoins, are stored in wallets with publicly visible keys on the blockchain. Most of these coins are from the network's early days, stored in an address format that, by default, published the public key. Additionally, any wallet that has been spent from has also had its key exposed, as spending reveals the key for any remaining balance. A quantum attacker would not need to compete with ongoing transactions but could methodically work through wallets with exposed keys at their own pace. This includes the approximately 1 million bitcoins held by bitcoin's pseudonymous creator, Satoshi Nakamoto, which have remained untouched since the network's inception and are now in the exposed category. The 2021 Taproot upgrade inadvertently expanded the problem by changing how bitcoin addresses function, aiming to make transactions more efficient and private. As a consequence, any bitcoin spent after the Taproot activation has published the key protecting the remaining balance at that address. Although this was a deliberate design choice at the time, given the perceived longer timelines for quantum threats, it now poses a significant risk. Efforts to address this issue are underway, albeit not as concrete or formalized as those seen in other blockchains like Ethereum, which has had a formal quantum-resistant program in place since 2018. Ethereum's approach includes four full-time teams working on migration, numerous independent developer groups, and a detailed plan for upgrades to secure the network against quantum threats. In contrast, Bitcoin lacks a unified strategy to combat the quantum threat. There are proposals, such as BIP-360, which suggests introducing new quantum-safe address types for voluntary migration, and a proposal from BitMEX Research for a detection system that would trigger defensive measures upon observing a quantum attack. However, these proposals have not gained broad support from core developers and address different aspects of the problem. The challenge in implementing effective solutions lies in bitcoin's governance structure, which is designed to resist centralized change. Ethereum's foundation and governance process facilitate regular upgrades, whereas bitcoin's development culture views central authority and frequent changes as failure modes. This has kept the network stable but makes addressing the quantum problem more difficult. Migrating the exposed coins requires making decisions that the network has avoided for twenty years, such as whether to freeze old address formats to protect coins or allow exposed coins to move to quantum-safe addresses. Each option alters the character of bitcoin in ways it has historically avoided. The future of bitcoin's security in the face of quantum computing threats remains uncertain, with the industry at a crossroads between proactive migration and waiting for a demonstrated threat before acting.