Bitcoin’s quantum-computing debate is not simply a technical question about cryptography. It is also a dispute over which principles should prevail if elliptic-curve signatures can no longer reliably authenticate ownership: the promise that valid coins remain spendable by their owners, or the need to protect Bitcoin from a quantum-capable attacker that could seize a significant share of its supply.

Every serious option creates a conflict. Doing nothing would preserve current consensus rules but could allow future quantum attackers to take coins whose owners never consented. Freezing vulnerable coins could prevent that theft but would retroactively invalidate established spending conditions. A forced migration to post-quantum signatures could be prudent engineering while also appearing to impose a deadline-backed confiscation regime.

The central question is therefore how to minimize total property-rights violations if elliptic-curve signatures no longer reliably identify rightful owners.

The quantum threat

Bitcoin’s current authorization system relies on elliptic-curve cryptography. Legacy ECDSA signatures and Schnorr signatures use the secp256k1 curve. Under classical computing assumptions, deriving a private key from a public key is computationally infeasible. A sufficiently capable, cryptographically relevant quantum computer running Shor’s algorithm could change that: once a public key is exposed, an attacker could derive the corresponding private key and create a transaction the network would accept as valid.

Not all Bitcoin outputs expose public keys at the same time. Old pay-to-public-key outputs and Taproot outputs reveal public keys on-chain and could face long-range attacks. Other outputs hide the public key behind a hash until the owner spends. In those cases, a short-range attacker could observe a transaction, derive the private key quickly, and attempt to replace or front-run the spend.

Quantum mining presents a different issue. Grover’s algorithm could theoretically provide a quadratic speedup when searching for a valid block hash, while Shor’s algorithm provides a superpolynomial speedup against the assumptions behind ECDSA and Schnorr. The advantage of using quantum computing for mining is therefore considered substantially less practical than using it to attack elliptic-curve signatures.

Uncertainty over quantum computers

Whether a cryptographically relevant quantum computer will ever be built remains uncertain. Quantum skeptics do not generally dispute that Shor’s algorithm could break elliptic-curve cryptography. Their argument is that there is no clear reason to believe engineers will produce the powerful, fault-tolerant machines required to run it at a relevant scale.

Current noisy quantum processors cannot break ECC. Such an attack would require many reliable logical qubits, extremely low error rates, lengthy coherent computations, and quantum error correction that works at scale.

Mikhail Dyakonov has argued that the quantum fault-tolerance threshold theorem relies on idealized assumptions, including sufficiently independent noise, accurate gates, limited unwanted interactions, and the ability to keep errors below a threshold across a very large system. Gil Kalai has offered a more structural criticism, arguing that correlated noise and noise accumulation could prevent high-quality quantum error-correcting codes from scaling. In his 2011 paper, Kalai examined how physical implementations of quantum codes, correlations in stochastic systems, and accumulated noise could prevent scalable quantum computers.

Skeptics also reject simple extrapolations from progress in physical qubit counts. Moving from 50, 100, or 1,000 physical qubits to millions of physical qubits or thousands of logical qubits would require controlling crosstalk, leakage, correlated errors, calibration drift, thermal effects, measurement errors, fabrication variation, and control noise. Current demonstrations, which outperform classical simulations only on carefully selected sampling tasks, provide limited evidence about the ability to execute a long, structured algorithm such as Shor’s algorithm reliably enough to recover a 256-bit ECC private key.

Why migration matters

If a cryptographically relevant quantum computer appears, simply giving users the option to adopt post-quantum cryptography would not protect all vulnerable bitcoin. The exposed set includes early pay-to-public-key coins, coins controlled by reused public keys, Taproot outputs, and coins whose public keys or extended public keys have been disclosed outside the blockchain.

Old P2PK outputs account for a small share of UTXOs by count but represent approximately 1.7 million BTC. Broader estimates based on output types, activity patterns, and known ownership suggest that at least 2.6 million BTC could remain vulnerable even if active Bitcoin users moved their wallets to post-quantum cryptography. The article estimates that roughly 2.6 million BTC, or 13% of the current total supply, could be unable to migrate to quantum-safe locking scripts.

Those coins could create systemic risks beyond direct selling. A quantum attacker might use them to destabilize markets, undermine confidence, grief the network, or acquire enough hashrate to attempt a 51% attack. Protecting the coins would therefore require consensus changes that prevent vulnerable ECDSA or Schnorr signatures from being used.

Terms such as “confiscation,” “burning,” “freezing,” “stealing,” and “recovery” describe different mechanisms. A freeze would not transfer coins to the state, miners, developers, or a recovery fund. It would make specified outputs unspendable using vulnerable signatures. Advocates sometimes use “burn” because the coins would not be reassigned; however, a rightful owner who still possesses the original key could reasonably view the practical effect as confiscatory.

BIP-361 divides migration into phases. Once a quantum-resistant address type exists, new coins would no longer be sent to quantum-vulnerable addresses. After a multi-year period, legacy ECDSA and Schnorr spends could become invalid. The proposal also leaves open recovery methods for users who can prove ownership without relying solely on broken ECC, potentially through a zero-knowledge proof derived from a seed phrase or HD-wallet structure. Its stated purpose is to create incentives and deadlines for users, exchanges, custodians, wallets, and institutions to migrate before ECC is deprecated.

Arguments for freezing

Supporters of a freeze argue that an attacker who derives a private key through quantum computation is not the legitimate owner in any meaningful sense. Allowing vulnerable coins to be taken would not be neutral, they argue; it would allow the first quantum-capable actors to loot outputs protected by a known weakness.

A successful sweep could redistribute wealth to an actor that spent relatively few resources to obtain it, potentially undermining Bitcoin’s security model, which assumes economically rational participants are incentivized to protect the value of their holdings. Lost coins are a particular concern. If attackers recover coins believed to be permanently lost, the effective circulating supply could increase even though the formal 21 million cap would remain unchanged.

The threat may also be political rather than purely financial. An attacker could destabilize markets, undermine confidence, or hold large quantities of BTC as leverage. Pieter Wuille’s comments in the mailing-list debate emphasize that the danger could arise from credible belief that a quantum computer will soon exist, even before an actual attack. A credible plan to disable vulnerable spends could therefore serve as a reassurance mechanism.

Supporters also argue that voluntary migration would be slow. Hardware wallets, exchanges, custodians, estate plans, multisig coordinators, and cold-storage procedures require years to change. Matt Corallo has argued that Bitcoin should add a simple post-quantum capability well before it becomes necessary, allowing wallets to begin embedding or committing to quantum-resistant public keys.

A known deadline would give public companies, ETFs, custodians, exchanges, compliance departments, and risk committees a concrete migration plan. BIP-361 argues that exchanges and custodians would face fiduciary and legal pressure to act once a deadline exists. Advocates further note that the same preparation could help respond to other situations in which ECC becomes weakened over time.

From this perspective, an objective soft fork that disables a demonstrably insecure spend path would be closer to replacing a broken lock than to arbitrary political confiscation. The rule would apply to script types rather than named owners and could be announced years in advance with a viable migration path.

Arguments against freezing

Opponents begin with Bitcoin’s established property-rights expectation: a valid coin remains spendable by the holder of the corresponding key under the consensus rules accepted when it was received. Retroactively invalidating that spend path, they argue, changes “not your keys, not your coins” into “not your upgraded-by-deadline, not your coins.”

Critics worry that a freeze would establish a precedent for selecting winners and losers among UTXO owners. Even if the rule were technically objective, it would target users based on address choices, wallet design, dormancy, or inability to act. Future coalitions might seek similar interventions for sanctions, theft recovery, inheritance disputes, state pressure, or coins presumed to be lost.

A freeze could not distinguish lost coins from dormant coins, imprisoned owners, deceased owners with heirs, users in hostile jurisdictions, timelocked arrangements, forgotten cold storage, or deliberate long-term savings. It could also create an incentive conflict: active holders might benefit from reducing the effective supply, while inactive rightful owners would bear the loss.

There is also uncertainty about quantum timelines and capabilities. A quantum computer may arrive later than expected, take a different form, remain secret, or be countered by less drastic measures. Permanently burning millions of coins before the threat materializes could itself become an irreversible property-rights violation.

The technical destination is uncertain as well. NIST has standardized ML-DSA, SLH-DSA, and ML-KEM, but Bitcoin requires compact, script-compatible ownership proofs with manageable verification costs. Chaincode’s comparison of candidate schemes notes that post-quantum signatures and keys can be much larger than Schnorr or ECDSA and differ significantly in maturity, size, signing cost, verification cost, and security assumptions. A poor migration could reduce throughput, raise fees, increase UTXO or witness-data burdens, introduce new assumptions, or require another migration later.

Alternatives to a permanent freeze

Several proposals seek to reduce systemic risk without immediately destroying old property claims. BIP-361’s Phase A would prevent new vulnerable outputs while leaving existing ones temporarily spendable. Boris Nagaev has suggested a temporary lock with a future re-enable height, while Conduition has examined interactions with P2QRH- or P2MR-like outputs and warned that broadly banning EC checks could affect hybrid constructions.

The Hourglass V2 proposal would rate-limit old P2PK spending to one P2PK input per block, with a net limit of one BTC per block. Its authors say this would prevent both immediate burning and an unconstrained quantum liquidation. Critics respond that it would still restrict permissionless spending and could create a decades-long race between legitimate owners and attackers.

Commit-delay-reveal schemes, sometimes associated with Guy Fawkes-style constructions, would allow a user to commit to a future spend, wait for confirmation, and later reveal the information needed to validate it. Chaincode describes the approach as opt-in, while the Optech summary notes that it could reduce migration urgency and protect coins from short-exposure attacks.

Another possible recovery method would prove knowledge of a seed or derivation path rather than control of a vulnerable public key. Or Sattath and others have discussed “signature lifting,” and Olaoluwa Osuntokun built a proof of concept using zk-STARKs to prove that a Taproot BIP-86 output key was derived from a BIP-32 seed path. The latest optimized version requires a 200 KB proof. Recovering small UTXOs could become uneconomic because fees might cost several hundred dollars and potentially reach thousands or tens of thousands of dollars at higher fee rates. Other concerns include proof size, verification complexity, privacy leakage, wallet-derivation assumptions, and the risk of adding novel cryptography to Bitcoin consensus.

Marc Johnson and others have suggested a market-driven migration based on quantum-resistant outputs, optional dual signatures, and fee or policy incentives. That approach would better preserve property rights but might not address systemic risk if large amounts of valuable BTC remain exposed.

Technical and economic trade-offs

NIST’s post-quantum standards provide a foundation: FIPS 204 standardizes ML-DSA, FIPS 205 standardizes SLH-DSA, and FIPS 203 covers ML-KEM for key establishment. Bitcoin nevertheless needs digital signatures and script-compatible ownership proofs rather than general-purpose standards alone.

Hash-based signatures offer conservative assumptions but are large. Lamport-style signatures could be enabled through script upgrades such as OP_CAT, but a quantum-vulnerable Taproot key path would still need to be removed or disabled. BIP-347’s OP_CAT discussion identifies this problem. Lattice-based schemes such as ML-DSA are more compact than many hash-based options but carry different assumptions and implementation risks. Falcon-style signatures are compact but more difficult to implement, while SPHINCS+/SLH-DSA is conservative but large.

Chaincode estimates that migrating all UTXOs could take roughly 76 to 142 days if migration used all block space, or 305 to 568 days if it used 25% of block space. Those figures exclude wallet upgrades, institutional approvals, air-gapped signing, hardware replacement, accounting workflows, and coordination. A complete migration would therefore likely take years. Chaincode’s high-level estimate ranges from roughly five years in the best case to about 15 years in the worst case; an emergency could potentially compress the process to two years, although the report notes that historical emergency fixes are not directly comparable.

Historical precedents and governance

The Value Overflow Incident illustrates that Bitcoin’s consensus rules have changed to remove coins created under rules that were validly followed at the time. On August 15, 2010, block 74,638 was found to contain a transaction creating 184,467,440,737.09551616 BTC for three addresses. Two addresses received 92.2 billion BTC each, while the miner received an additional 0.01 BTC. The error resulted from integer overflow in transaction validation.

Within five hours, a new client rejected such transactions through a soft-forking consensus change. The blockchain split, and the “good” chain overtook the other at block height 74,691. The invalid transaction and the coins it created no longer exist on the chain with the greatest cumulative proof of work.

The DAO incident in Ethereum provides another comparison. In 2016, the community had about a month to respond to an attacker controlling 5% of ETH because The DAO’s contract included a delay before funds could be withdrawn. Ethereum ultimately hard-forked to return the funds, while the original chain became Ethereum Classic. Ethereum Classic struggled to reach 10% of Ethereum’s market value, although the two networks have different histories and structures.

A BIP-361-style Bitcoin change would be a soft fork rather than a hard fork. Users opposing the DAO fork could simply remain on the original rules, whereas opposing a quantum-migration soft fork with a hashrate supermajority would require coordinating a User Rejected Soft Fork, something that has never been done before.

Bitcoin has no central authority capable of imposing such a change. Any ECC deprecation would require broad agreement among node operators, miners, exchanges, wallets, custodians, merchants, and users. Acting only after proof of a cryptographically relevant quantum computer could mean deciding amid panic and market stress. Acting too early could impose irreversible costs before the threat is sufficiently credible.

A possible path forward

Matt Corallo has argued that the debate should be framed as protecting property rights to the greatest extent possible rather than simply refusing to freeze any coins. Under that framing, deprecating ECC could be defensible only if a widely reviewed quantum-resistant destination exists, the migration window is long enough, the rules are objective and narrow, and recovery options are available.

A five-year migration period has been proposed for BIP-361 because migrating too early could impose unnecessary costs or lock Bitcoin into an immature scheme, while migrating too late could leave the system exposed to a systemic threat. The article states that activation should not be seriously considered unless a cryptographically relevant quantum computer appears likely to be less than 10 years away.

The next steps do not include activating BIP-361. They include reducing address reuse, researching recovery proofs, reducing reliance on xpub sharing, developing more efficient post-quantum schemes, activating opt-in quantum-safe locking scripts, and preparing multiple contingency plans.

Bitcoin’s quantum problem is not urgent in the sense that users should panic today. It is urgent because decentralized systems must resolve difficult coordination problems before they become emergencies. The debate is not simply between respecting and violating property rights; it is between competing forms of property-rights failure. The article concludes that Bitcoin should treat quantum computing as a realistic but unquantifiable systemic risk while avoiding premature and controversial changes based solely on uncertainty.

This article is featured in the latest print edition of Bitcoin Magazine, The Quantum Issue, and is being shared as an early look at the ideas explored throughout the issue. It was written by Shinobi and first appeared on Bitcoin Magazine.