Some of the most credentialed cryptographers on the planet just told Bitcoin what it needs to do about quantum computers, then collectively shrugged on the one question that actually divides the community.
A Coinbase-convened advisory board released a report this week acknowledging that roughly 6.7 million bitcoin, worth north of $400 billion at current prices, sit in addresses vulnerable to a future quantum attack. About 1.7 million of those coins occupy roughly 20,000 early pay-to-public-key addresses, a format that publishes the owner’s public key directly on-chain and essentially hangs a target on it for any sufficiently powerful quantum machine. Many of those addresses are assumed to belong to Satoshi Nakamoto and other early holders who lost their keys years ago. The rest of the exposure, another 5 million or so bitcoin, stems from address reuse, according to Project11, a research group tracking the issue. Most of those are thought to be active holdings parked in exchange wallets.
The panel’s membership reads like a cryptography hall of fame: Scott Aaronson of the University of Texas at Austin, Dan Boneh of Stanford, and Justin Drake of the Ethereum Foundation all contributed. Their conclusion on timing? Quantum computers are not a threat to blockchains today, and nobody can say with confidence when they will be. But that uncertainty, they argue, is exactly why Bitcoin should not wait.
The Technical Migration Is the Easy Part
Swapping Bitcoin’s current signature schemes, ECDSA and Schnorr, for quantum-resistant alternatives is a well-understood engineering problem. Post-quantum cryptography standards already exist; the National Institute of Standards and Technology finalized several candidates in 2024. What the Coinbase panel stresses is that this migration work is independent of the governance debate and should not be held hostage to it.
The reason is simple: signature upgrades require network-wide coordination, testing, and soft or hard forks. None of that happens overnight. If the Bitcoin community waits until a credible quantum threat materializes, it will be scrambling to deploy code under pressure, the worst possible conditions for a network that guards hundreds of billions of dollars. The panel’s position is that planning should start now, full stop, regardless of where the abandoned-coins argument lands.
This is not a new observation. Ethereum has spent years preparing its own post-quantum roadmap, a point the source article notes explicitly. The contrast is instructive: Ethereum’s core developers have publicly discussed lattice-based signature candidates, while Bitcoin’s upgrade culture tends toward slower, more contentious deliberation. The panel seems to be nudging Bitcoin toward at least matching that pace.
For readers tracking this threat beyond wallets, our earlier coverage noted that venture capitalist Andrew Gault warned adversaries are already harvesting encrypted crypto traffic today for future quantum decryption. That harvest-now, decrypt-later strategy means the clock started ticking before any quantum machine actually breaks Bitcoin’s math.
The Fight Over Coins Nobody Moves
If the signature migration is the easy part, the hard part is deciding what happens to coins that never migrate because their owners are dead, lost their keys, or simply vanished.
One faction argues for a hard deadline: after a certain block height, Bitcoin’s legacy signature schemes stop being valid, and any unmigrated coins become unspendable. The logic here is defensive. Leaving millions of bitcoin open to quantum theft hands a future attacker, potentially a sanctioned state like North Korea, a war chest large enough to crash the market and call Bitcoin’s legitimacy into question. Imagine a headline: “Sanctioned Regime Dumps 1.7 Million Stolen BTC.” The reputational damage alone could be catastrophic, even if the price eventually recovered.
The opposing camp calls this approach confiscation dressed up as security. Bitcoin’s entire value proposition rests on absolute property rights, they argue. If the network can freeze coins under the banner of quantum protection today, what stops it from freezing coins under government pressure tomorrow? The precedent, once set, cannot be unset.
The Coinbase panel, notably, refuses to pick a side. It writes that there is “no correct answer” and that the Bitcoin community has to decide. This is diplomatic, perhaps too diplomatic for critics who wanted a clear recommendation. But it also reflects reality: cryptographers can model threat timelines and signature security, but they cannot tell a decentralized network how to weigh property rights against systemic risk.
Three Proposals, Not Mutually Exclusive
Instead of a single solution, the debate has spawned several competing proposals that the panel notes can be combined:
Hourglass would cap how many vulnerable coins can be spent per block. The idea is to prevent a supply flood if an attacker suddenly cracks thousands of old addresses. Rate-limiting the drain buys time for the network to respond, though critics point out it also slows legitimate migration.
BIP-361, from developer Jameson Lopp and collaborators, offers a middle path. Holders who migrate before a cutoff would be able to prove ownership afterward using a quantum-resistant proof that never exposes their private key. This protects active users who move in time while still allowing a future verification process for stragglers.
PACTs, from Paradigm’s Dan Robinson, take a different angle. Owners would timestamp a private claim now, cryptographically committing to their ownership without revealing anything on-chain. Later, when quantum computers arrive or a deadline hits, they could move funds using that timestamped proof. Our May coverage of Robinson’s proposal noted it could theoretically let even Satoshi prove ownership without ever touching the coins, though whether Satoshi is alive to do so is another question entirely.
The panel’s contribution is less about ranking these ideas and more about framing them as a menu rather than a battle. Hourglass could coexist with BIP-361; PACTs could layer on top of both. The real question is whether Bitcoin’s governance can coordinate adoption before a threat timeline clarifies, and the panel is clearly skeptical that waiting is wise.
For context, our Fear and Greed Index currently shows market sentiment in neutral territory, but a sudden quantum-theft event affecting millions of bitcoin would almost certainly spike fear to extreme levels, a scenario where preparation looks a lot cheaper than reaction.
Calculating the Exposure
Let’s put some numbers around the risk. At roughly $63,000 per bitcoin (the price referenced in a related market story this week), 6.7 million vulnerable coins represent about $422 billion in exposure. The 1.7 million in pay-to-public-key addresses alone account for roughly $107 billion, and since those addresses cannot be migrated by their presumed-dead owners, that sum is permanently at risk unless the network intervenes.
Compare that to Bitcoin’s total market cap, currently hovering around $1.2 trillion. The vulnerable coins represent roughly 35% of all bitcoin that will ever exist (6.7 million of 21 million) and about 35% of current market value. If even a fraction were stolen and dumped, the supply shock would dwarf any sell-off in Bitcoin’s history. The largest single-day ETF outflow on record, part of a two-week stretch that saw $2.26 billion leave U.S. spot ETFs, barely moved the needle compared to what a quantum attacker could theoretically liquidate.
These calculations are not speculative modeling; they are arithmetic derived directly from the source’s figures. The panel does not cite a probability or timeline for a quantum breach, because no one can, but the magnitude of the downside risk is the reason the panel says planning should not wait.
What Ethereum Did Differently
The source article’s closing jab, that “Bitcoin has yet to act on” the move-now instruction “while Ethereum has spent years preparing,” deserves unpacking. Ethereum’s post-quantum planning began in earnest around 2022, when Vitalik Buterin and other core developers started discussing account abstraction and signature agility as part of the network’s long-term roadmap. The idea is that Ethereum’s smart-contract layer makes it easier to upgrade signature verification logic without a hard fork: wallets can adopt new schemes individually, and the network can support multiple schemes simultaneously.
Bitcoin’s UTXO model is more rigid. Every address type is baked into consensus rules, and changing which signatures the network accepts requires a network-wide upgrade. That architectural difference means Bitcoin’s quantum migration is inherently more contentious and slower to deploy, which is precisely why the panel is urging early action.
None of this means Ethereum is safe and Bitcoin is not. Both networks rely on elliptic-curve cryptography today. But Ethereum’s governance, for all its own controversies, has proven more willing to coordinate large upgrades (the Merge, for instance) on compressed timelines. Bitcoin’s culture of minimal intervention is a feature when it comes to monetary policy; it may be a liability when it comes to cryptographic agility.
The Communication Gap
The panel’s second explicit commitment, beyond starting technical work now, is communication. “Users need to know this problem is being taken seriously. Uncertainty is its own risk,” the report states.
This is not empty rhetoric. Retail holders who read headlines about quantum threats but see no coordinated response from core developers may panic-sell or lose confidence in the network’s long-term viability. Institutional allocators, who now hold billions through spot ETFs tracked on our Bitcoin Treasury dashboard, face compliance questions if their holdings sit in addresses their risk teams cannot verify as quantum-safe. Silence from Bitcoin’s developer community fuels both problems.
The panel is essentially calling for a public roadmap, even if that roadmap leaves the abandoned-coins question open. Saying “we are working on post-quantum signatures; here is the timeline; here are your options” is categorically different from saying nothing and hoping the threat never materializes.
Where This Leaves Satoshi’s Coins
The approximately 1.7 million bitcoin in early pay-to-public-key addresses, roughly 1.1 million of which are commonly attributed to Satoshi, remain the emotional and philosophical center of this debate. If those coins are frozen, Bitcoin has effectively repudiated its founder’s holdings. If they are stolen, Bitcoin’s origin story becomes a cautionary tale about hubris.
Neither outcome is palatable, which is why the panel punted. But punting has a cost. Every month without a decision is another month for nation-state adversaries to advance quantum research, another month for the harvest-now, decrypt-later strategy to accumulate data, and another month for market participants to wonder whether their holdings are actually secure.
The panel’s membership gives the report credibility: Aaronson is a leading voice in quantum complexity theory, Boneh helped invent pairing-based cryptography, and Drake has shaped Ethereum’s cryptographic roadmap for years. When people of that caliber agree on the urgency of preparation but refuse to endorse a specific solution, it signals that the technical community sees the governance challenge as genuinely hard, not a problem that smarter algorithms can solve.
Bitcoin now faces a choice its pseudonymous creator never anticipated: protect the network by constraining property rights, or protect property rights and hope the quantum threat never arrives. The cryptographers have spoken. Whether Bitcoin listens is another matter.
For those tracking the threat landscape, our Quantum Computing Threat to Bitcoin guide offers a deeper primer on the cryptographic mechanics at stake.
