Here is the awkward truth I keep coming back to: the thing that makes Bitcoin feel unstealable is also the thing that could, years from now, look fragile. Not because someone found a clever bug in a wallet app. Because the math underneath public-key signatures was never designed for a machine that can factor and search in a completely different way. European financial watchdogs just put that worry on paper again, and the timing is what makes it interesting. They are not saying a Bitcoin-breaking box exists in a lab this morning. They are saying the calendar for moving off old cryptography is already shorter than most people in crypto like to admit.
Why Quantum Computing Suddenly Matters For Crypto
If you hold coins, you live inside a story about keys. A private key signs. A public key proves. Hashes hide some of that proof until you spend. That story has worked for more than a decade and a half. It still works today. The problem is that quantum computers do not play by the same computational rules as the laptop on your desk. When they become large enough and stable enough, a famous algorithm associated with Peter Shor can take apart the number-theory assumptions behind RSA and elliptic-curve cryptography. Bitcoin leans on elliptic-curve signatures for ownership and authorization. That is the whole game.
I find the official tone almost more revealing than the science. The joint committee of European supervisory authorities talked about gains as well as damage. Better pricing models. Better fraud screens. Better compliance monitoring. Then, in the same breath, they noted that cryptographic risk could show up before commercially useful quantum applications become ordinary. That sentence should sit with you. It means the threat timeline and the opportunity timeline are not twins. One can arrive early. The other can lag.
Risks posed could also materialise faster than any commercially viable application.
That is not a movie plot. It is a planning problem. Financial data lasts a long time. Blockchain records last even longer. If an attacker can store public keys and ciphertext today, they can wait. People in security circles call that harvest now, decrypt later. On a chain, the harvest is already public. You do not need a leak. You need patience and a future machine.
What The Watchdogs Actually Said
The autumn risk update did not claim a working attack against live Bitcoin. That matters. Panic headlines skip that part. The warning was about preparation across transactions, communications, databases, and blockchains. In other words, this is not a crypto-only memo. It is an infrastructure memo that happens to include the asset class a lot of us care about.
A separate technical paper earlier in the year walked through the mechanics with more patience. Sufficiently advanced machines could run Shor-style attacks against public-key schemes. Current noisy intermediate-scale devices are not there. Anyone who has watched a demo knows how messy those machines still look. Qubits decohere. Error rates bite. You do not casually factor a secp256k1 key on a noisy chip and go home. Still, migration takes years. That is the real argument. You do not wait for the storm to finish the roof.
Industry roadmaps rhyme with that caution. One large computing firm has said fault-tolerant systems could start approaching cryptographic relevance toward the end of the decade. Notice the verbs. Approaching. Relevance. Not “Bitcoin is dead on Tuesday.” I’ve found that this kind of language is easy to flatten into either denial or doom. Both are lazy. The adult version is: start moving the high-value stuff while the physics is still expensive and unreliable.
How Bitcoin Ownership Actually Works
Let’s slow down, because this is where casual readers get lost and maximalists get smug. Bitcoin does not store a name. It stores spending conditions. In many common address styles, the public key sits behind a hash until coins move. When you spend, you reveal the key and a signature. If you never reuse that address, the window of exposure is short: the time between broadcast and confirmation. If you reuse it, or if the output type showed the key from day one, the window is long. Long windows are what a future quantum attacker loves.
Some early outputs put the public key right on the chain. Bare multisig can do something similar. Taproot also places a public key in view by design, even though it brings other benefits. Address reuse, partial spends, sloppy custody habits, and old paper wallets all add operational exposure on top of structural exposure. Two researchers can count the same chain and land on different totals because they draw that line in different places. That is not a scandal. It is methodology.
- Structural exposure: the output type reveals a public key by design.
- Operational exposure: reuse, partial spends, or custody practice leaves a key visible while coins still sit there.
- Short-exposure risk: a key appears only while a transaction waits in the mempool.
- Long-exposure risk: a key has been public for months, years, or more than a decade.
Perhaps the most interesting aspect is how ordinary this looks on a block explorer. No red siren. Just an address, a balance, a first-seen date. If that address is an old pay-to-public-key output, the key has been sitting in daylight since the spendable output was created. If it is a reused hash-based address, the key became public the first time coins left. After that, whatever remains is a sitting target for a machine that does not exist yet.
The 6.89 Million Coin Question
Estimates of exposed Bitcoin bounce around because people count different things. One widely discussed figure from February put roughly 6.89 million BTC in a future quantum-exposure bucket. That mix included about 1.91 million coins tied to directly visible public keys and a larger pile whose keys may have leaked through earlier spending. Dormant early coins sit inside that story, which is why the number feels heavy. Lost coins and legendary early holdings are not a separate planet. They are outputs with history.
A later on-chain study landed near 6.04 million BTC, or about 30.2 percent of issued supply, as having public-key exposure at rest. Inside that total, about 1.92 million BTC were called structurally exposed because the output type shows the key by construction. Early pay-to-public-key coins, bare multisig, and Taproot sat in that structural bin. The rest was operational: reuse and custody habits rather than the script type itself.
Are those numbers gospel? No. They are maps. Maps disagree at the edges. What they share is uncomfortable enough. A non-trivial share of supply is not hiding behind a hash right now. If a cryptographically relevant quantum computer ever arrives, those coins are first in line. I do not enjoy writing that sentence. It is still the honest one.
| Measure | Approximate BTC | What It Captures |
| Broad exposure estimate | 6.89 million | Visible keys plus keys inferred from past spends |
| At-rest public-key exposure | 6.04 million | About 30.2 percent of issued supply |
| Structural exposure | 1.92 million | Output types that reveal keys by design |
When people hear millions of coins, they picture a heist movie. Reality would be messier. An attacker would still need a machine, energy, time, and a way to move coins without lighting up every surveillance desk on earth. Markets would reprice fear long before the last signature cracked. That does not make the cryptographic issue smaller. It makes the social issue larger. Confidence is a consensus asset too.
Why Public Keys Are The Bitcoin-Specific Wound
Banks can rotate certificates. Websites can flip TLS. A blockchain with a live monetary unit cannot shrug and reissue every key overnight. Coins sit. Owners disappear. Heirs do not know a seed exists. Companies used a format that made sense in 2013 and never touched it again. Quantum risk on Bitcoin is therefore not only “pick a new algorithm.” It is “convince a messy human network to move value before the old signatures get weak.”
Draft improvement proposals try to split that problem into pieces. One draft describes pay-to-merkle-root style outputs meant to cut long-exposure attacks against elliptic-curve keys. It calls out P2PK, reused outputs, and Taproot as categories with long-exposure risk. It does not pretend to close every path. Protection against an attacker who derives a key while a transaction sits unconfirmed may still need a post-quantum signature scheme, not just a prettier hash wrapper.
Another draft talks policy. After a post-quantum output type exists and activates, new funds would eventually be blocked from landing in quantum-vulnerable types. Later, spending rules for legacy ECDSA and Schnorr could tighten. The clock on that draft starts only after the new output is real. Until then it is a plan on paper. Plans on paper do not move coins.
Neither draft is an activated consensus rule. The repository still lists them as drafts, which means the standard and the migration policy remain unsettled.
In my experience, that last point is where online arguments go feral. One camp wants a clean freeze on vulnerable outputs. Another camp treats any restriction on ancient coins as a confiscation debate in disguise. Lost coins, inaccessible seeds, and early-era wealth sit in the middle like unclaimed furniture. I do not have a neat moral answer. I do know that pretending the debate will stay technical is wishful thinking.
Europe Wants Migration To Start In 2026
Public institutions in Europe already have a timetable that is easy to skim and hard to execute. Member states are expected to begin moving toward post-quantum cryptography by the end of 2026. High-risk use cases should finish no later than the end of 2030. That roadmap grew out of an earlier recommendation and a coordinated plan adopted the following year. A consultation update in early September found respondents asking for clear deadlines, risk-based priority lists, hybrid cryptography, and crypto-agility. Translation: do not bet the house on a single new algorithm, and keep the ability to swap again if the first choice ages badly.
Hybrid schemes matter more than the slogan suggests. You sign with the old system and the new system together for a while. If the new one has a surprise weakness, the old one still holds. If the old one later falls to a quantum attack, the new one still holds. It is belt and suspenders. Ugly? A bit. Sensible? Yes. Financial plumbing is not a fashion show.
- Inventory every place public-key crypto protects value, identity, or secrets.
- Rank systems by how long the data must stay confidential and how public the keys already are.
- Introduce hybrid signatures and key exchange on the highest-risk paths first.
- Retire pure legacy schemes only after the new stack has been beaten on in production.
- Keep agility so a second migration is possible without another decade of politics.
Blockchains add a twist that a government network does not. Existing assets may need to move before old signatures become unsafe. That requires agreement among developers, miners, businesses, wallet vendors, and people who run nodes. No committee can decree a Bitcoin soft fork into existence because a risk memo landed on a Thursday. Coordination is the product.
Harvest Now, Decrypt Later Is Already Happening
Encrypted files with a long shelf life are the classic example. Think health records, legal archives, state secrets, long-term contracts. An opponent copies the ciphertext today and waits for a machine that can strip the wrapping. On a public chain the “ciphertext” of ownership is often just the public key and the script. Nobody has to break into a server. The archive is the ledger.
That is why regulators talk about multi-year security work instead of a weekend patch. Information outlives the algorithm that first protected it. Coins outlive the fashion of address types. If you issued a long-dated obligation under today’s cryptography, you should care about the cryptography of 2032, not the cryptography of this afternoon’s press cycle.
Does that mean every idle Bitcoin address is doomed? Of course not. Many coins still sit behind unused hash-locked outputs. Owners who never reused addresses and who can still sign have a path: move to a safer output when one exists. The painful cases are the ones that cannot move. Burned keys. Forgotten seeds. Estate messes. Those coins become a moral and market problem if legacy signatures ever become cheap to forge.
Wallets And Custody Will Be Harder Than The Algorithm
Choosing a post-quantum signature is a research contest. Shipping it through hardware wallets, exchange cold storage, multisig policies, inheritance schemes, and consumer backup rituals is a logistics contest. I have a soft spot for the people who keep saying the second contest is the real one. They are usually right.
Some institutional custodians are already designing for optionality. They want architecture that can support more than one candidate scheme so they are not trapped if the chain picks a different winner than their first bet. That sounds dull. Dull is how you avoid a scramble. A chief cryptographer talking about scheme-agnostic custody is not marketing fluff. It is an admission that consensus has not finished arguing yet.
Hardware makers face a different grind. Secure elements have limited space. Firmware updates have to be signed by the old world to boot the new world. Users lose cables. People store seeds in ways that would make an auditor weep. Changing “the algorithm” is the easy slide in the presentation. Changing millions of slightly broken human setups is the rest of the deck.
Migration reality check: Algorithm choice = hard science, visible debate Wallet upgrades = slow, uneven, easy to postpone Dormant coins = political, emotional, unresolved Market confidence = moves first, asks questions later
What NISQ Machines Can And Cannot Do
Noisy intermediate-scale quantum devices are real. They are also noisy, which is not a joke. You get a few dozen to a few hundred imperfect qubits, short coherence times, and error rates that make large factoring a fantasy. Useful sampling tasks and chemistry experiments are the honest near-term pitch. Breaking 256-bit elliptic curves is not.
People still wave small demos around as if they were a skeleton key. I’ve watched that movie too many times. A toy integer is not a Bitcoin key. A variational algorithm that approximates a molecule is not Shor’s algorithm at cryptographic scale. Skepticism here is not anti-science. It is anti-hype. The same skepticism should not slide into “therefore we can ignore 2030.” Those are different claims.
Fault tolerance is the missing bridge. Logical qubits encoded across many physical qubits, with error correction running fast enough to outpace decoherence. When that stack is big enough, the conversation changes. Nobody on earth can give you a clean date with a straight face. Roadmaps talk about the end of the decade as a zone of relevance, not a birthday party. Treat them as weather forecasts, not train timetables.
Other Chains Are Not Off The Hook
Bitcoin gets the headlines because the unit of account is famous and the supply schedule is simple. The same public-key family sits under a lot of other networks. Account models that reuse a single key for years can look worse than Bitcoin’s typical one-and-done address habit. Smart-contract systems add upgrade politics of their own. Some can swap signature precompiles. Some cannot without a hard decision that splits a community.
I would not assume “we will just hard-fork” is a comfort. Forks have losers. They have exchange support questions. They have replay risks. They have users who never update software. A chain that can change faster is not automatically safer. It is only more willing to argue in public.
Databases and messaging systems inside traditional finance may actually be the first places you see mandated hybrids, because a supervisor can order a bank to move. Nobody can order Bitcoin. That asymmetry is why the European note still matters to crypto readers. It sets a cultural clock. Institutions that touch both worlds will start asking wallet vendors awkward questions. Those questions leak into product roadmaps whether or not a BIP is merged.
A Practical Stance For Holders Right Now
You do not need to sell everything and hide in cash. You also should not sneer at the topic because current machines are noisy. The useful middle looks almost boring.
- Stop reusing addresses. This remains free and still underused.
- Know which output types you actually hold. Curiosity beats folklore.
- Prefer setups that can add a new script type later without rebuilding your life.
- Treat long-dormant coins as a project, not a personality trait.
- Watch draft proposals, but do not confuse drafts with deployed rules.
If you run a company that holds customer keys, start an inventory this quarter. Which coins sit in P2PKH that has already been spent from? Which sit in Taproot? Which are in old multisig templates that advertise keys? How would you move them if a safer output type activated next year? If the answer is “we will think about it when the press gets louder,” you already have a project management problem dressed up as a cryptography problem.
Personal holders can keep this simpler. Backup hygiene still matters more than quantum lore. A seed you cannot find will not be saved by lattice signatures. A hardware device you never update will not grow new math by itself. Get the unglamorous house in order. Then keep an eye on the migration debate so you are not the last person moving coins in a panicked week.
The Debate About Dormant Coins Will Get Ugly
Every few years someone proposes burning or freezing coins that cannot migrate. Every few years someone else answers that immutable property rights are the product. Both sides can quote the white paper energy if they want. The chain does not care. People care. Markets care. Exchanges care when they have to decide whether a migrated asset and a stubborn legacy UTXO are the same unit.
There is no painless version. Leave vulnerable coins spendable forever and a future attacker might move famous balances. Restrict them and you have rewritten the social contract for owners who simply did not show up. I lean toward giving living owners a long, loud runway and refusing to pretend lost coins are a rounding error. That is an opinion, not a protocol rule. Protocol rules will be decided by the usual messy coalition, or they will not be decided at all and the market will improvise.
Rhetorical question, because it helps: if a quantum-capable adversary ever exists, do you want the first stolen trophy to be a cluster of early coins that everyone already treats as probably lost, or a cluster of active treasury wallets that reused keys? The second nightmare is the one operators can still prevent. The first is a story we will argue about in comment sections until the heat death of the timeline.
What “Crypto-Agility” Should Mean In Practice
The phrase shows up in policy papers because officials needed a noun. Under the hood it means software that can add a signature algorithm without redesigning the universe. Addresses that can wrap more than one proof. Libraries that do not hard-code a single curve like it was a religious text. Test suites that assume the next change is coming.
Bitcoin is conservative on purpose. That conservatism protected the monetary rules. It also makes agility feel like heresy. You can hold both thoughts. Keep the supply schedule sacred. Still admit that signature algorithms are tools, not commandments. Tools wear out. That is not betrayal. That is maintenance.
Other systems will move first and look clever. Some of those moves will be sloppy. Being first is not the same as being right. Being last is not the same as being safe. The winning posture, if there is one, is watching implementations, not slogans, and insisting that any new path is reviewed like money depends on it. Because it does.
A Clear-Eyed Ending, Not A Countdown Clock
So where does that leave a reader who just wanted to know if the sky is falling? The sky is not falling this week. Current devices are not picking secp256k1 locks. Supervisors said as much even while they waved the yellow flag. IBM-style timelines talk about the end of the decade as a zone to take seriously, not as a confirmed heist date. Draft Bitcoin proposals exist and remain drafts. Exposure estimates cluster around a few million coins depending on how you count. Europe wants institutions to start the shift by 2026 and to finish high-risk cases by 2030. Custodians are sketching scheme-agnostic vaults because they do not want to guess the winner too early.
I keep circling one sentence from the official update: risk can show up before the useful applications do. That is the part worth taping above a monitor. Quantum computing might price options better and catch fraud faster. It might also age a family of signatures we treated as furniture. Furniture can be replaced. Monetary networks replace furniture slowly, in public, with an audience that loves a fight.
If you remember only a handful of points, remember these. Public keys that already sit in the open are the special Bitcoin problem. Hash-hidden keys that never get reused still have a mempool window. Migration is less about a beautiful new equation and more about wallets, coordination, and coins that cannot move. Hybrid cryptography is a bridge, not a religion. And the people who tell you either “never” or “next month” are usually selling a mood.
The work now is unglamorous. Count your outputs. Stop casual reuse. Ask your custodian what agility means in their stack, not in their blog. Read the drafts when they change. Leave room in your head for a future where signatures look different and the unit of account does not. That is not fear. That is how you treat an asset you actually want to keep.
