Hi everyone,
Quantum computing is the most talked-about long-term threat to Bitcoin right now, and most of what you’re reading about it is either FUD or hand-waving. Below I’ve written out my classic long-form article, but if you’d rather watch a video, here is the video link.
Below I’ll cover what quantum actually breaks, how many coins are exposed, how close the machines are, the two BIPs everyone is fighting about, and where I land.
At the end there’s a 5-step checklist, including the one address type I’d stop using for long-term savings.
Overview
There are two main issues with upgrading Bitcoin to post-quantum:
The upgrade itself: how to technically upgrade Bitcoin in time
The old coins: what to do with coins that haven’t moved after the migration
I’ve been in Bitcoin since 2012, and I’ve always looked at the protocol through its three core value props: the hardest monetary policy in history, an asset that’s extraordinarily difficult to seize, and a censorship-resistant ability to send money.
Quantum computing is a real long-term risk to the second one.
But it’s not the apocalyptic FUD some people portray. It’s a solvable engineering problem that needs calm, rational discussion now.
The good news: Bitcoin is software, and we’ve upgraded it before.
What quantum breaks (and what it doesn’t)
What it breaks: your wallet/private key. Shor’s algorithm on a big enough quantum computer turns a public key into a private key.
What it doesn’t break: mining or the 21M cap. Adam Back put it simply: “quantum computers are NOT good at attacking hash functions. attacking bitcoin’s PoW is not the thing to focus on - it’s ECDSA.” (Aug 3, 2026)
There are two kinds of attack:
Long exposure (coins at rest): the public key is already on-chain, so the attacker has unlimited time.
Short exposure (coins in transit): your public key sits in the mempool until it confirms, about 10 minutes on average.
Long-exposure ones get hit first because a quantum computer can take all the time it needs to crack the keys.
How much BTC is exposed?
As of May 20, 2026, 6.04M BTC, or 30.2% of issued supply, has a visible public key.
Other counts run higher: Project Eleven has ~6.8M BTC (Google’s paper cites ~6.9M) (Bitcoin Risq List).
And the number that matters most for the Satoshi debate: Jameson Lopp estimates at least 2.6M BTC (about 13% of supply) would stay vulnerable even if every active user migrated to post-quantum secure cryptography (Bitcoin Magazine, Sep 16, 2026).
How close is Quantum Computing?
The requirement keeps dropping. On March 31, 2026, Google Quantum AI published new estimates:
Breaking a 256-bit elliptic curve key needs under 1,200 logical qubits
On superconducting hardware, that’s fewer than 500,000 physical qubits, running in minutes (the paper estimates ~18–23, or ~9 from a pre-computed start)
That’s an ~20x reduction in physical qubits compared with prior estimates
Today’s hardware is still far off. Google’s Willow chip has 105 physical qubits (Nature).
The roadmaps are aggressive. IBM’s roadmap targets Starling in 2029 (200 logical qubits) and Blue Jay in 2033+ (up to 2,000 logical qubits).
Expert surveys are moving closer:
Global Risk Institute / evolutionQ (26 experts): 28–49% chance of a cryptographically relevant quantum computer within 10 years, 51–70% within 15.
Project Eleven’s model: Q-Day 2030 optimistic / 2033 baseline / 2042 pessimistic
Governments aren’t waiting:
NSA CNSA 2.0: software and networking gear post-quantum by 2030; browsers and operating systems by 2033
NIST IR 8547: elliptic-curve crypto disallowed in US federal systems after 2035
Google: working to a 2029 migration timeline
Put it together: nothing breaks Bitcoin today, but the range of credible estimates now overlaps with how long a Bitcoin migration takes.
The fix, in three layers
1. The math exists
NIST finalized its first post-quantum standards on Aug 13, 2024:
FIPS 204, ML-DSA (Dilithium): lattice-based signatures
FIPS 205, SLH-DSA (SPHINCS+): hash-based signatures
The catch is size, which is my issue #1. Nic Carter estimates swapping in ML-DSA means about a 38x increase in data overhead (Carter).
2. BIP-360: a safe place to park coins
BIP-360 is now called Pay-to-Merkle-Root (P2MR). It was merged into the BIPs repo as a Draft on Feb 11, 2026. It is not activated.
Taproot minus the weak spot. A Taproot output has two ways to spend: a key path (just a signature) and a script path (a tree of scripts). The key path puts a public key on-chain.
P2MR deletes the key path. The output commits only to the Merkle root of the script tree. No public key sits on-chain until you spend.
New addresses: bc1z. P2MR uses SegWit version 2, so addresses start with bc1z…
3. BIP-361: the sunset (the controversial part)
BIP-361 (”Post Quantum Migration and Legacy Signature Sunset”) is a Draft. Jameson Lopp is the lead author. It depends on a post-quantum signature BIP that doesn’t exist yet.
The phases:
Phase A, about 160,000 blocks (~3 years) after activation: no new sends to quantum-vulnerable addresses
Phase B, 2 years after Phase A: ECDSA/Schnorr spends become invalid. Unmigrated coins, including Satoshi’s P2PK coins, are frozen.
Phase C (TBD): a possible recovery path, likely a zero-knowledge proof that you hold the BIP-39 seed.
Lopp himself calls it a contingency plan: “I know folks don’t like it. I don’t like it myself. I wrote it because I like the alternative even less.” (Apr 15, 2026)
Who’s funding the research?
Bitcoin Security Consortium: nine firms including BlackRock, Fidelity, Coinbase, Strategy and Galaxy pledged $15M over 3 years (CoinDesk)
Galaxy: separately, up to $5M in developer grants (Bitcoin Magazine)
Coinbase: names P2MR (BIP-360) and P2TRv2 as designs that appear to offer the flexibility it wants (Coinbase, Oct 13, 2026)
Blockstream: actively researching
The debate: Carter, Back, and Lopp
Nic Carter: “this is your warning”
Carter brings the urgency.
On warning signs: “you will not get warning. the warning is what you are getting now. this is your warning.” (Mar 31, 2026)
On deadlines: “the testing and deployment of a PQ signature scheme on Bitcoin has to occur in 2026.” (same post)
Adam Back: build it, make it optional
Adam Back invented Hashcash, is cited in the Bitcoin white paper, and runs Blockstream. We spoke about this directly at Paris Blockchain Week.
The hardware is still in the lab. He’s tracked quantum hardware for 25+ years and sees today’s machines as “lab experiments” with incremental gains.
Start optional, deprecate later. Add opt-in quantum-resistant upgrades now, give users a long voluntary migration window, and only later deprecate legacy signatures, without chaos.
Hypers and realists can disagree on timelines. Preparation has clear value either way.
Jameson Lopp: prepare for the worst
Lopp is Casa’s Chief Security Officer.
On timing: “We are orders of magnitudes away from a real usable quantum computer that can crack the algorithm that is used to secure your Bitcoin.” (Oct 26, 2026)
On the real problem, which is coordination: “It is urgent in the sense that decentralized systems must solve hard coordination problems before they become emergencies.” (Bitcoin Magazine, Sep 16, 2026)
On Satoshi’s coins: “Quantum recovered coins only make everyone else’s coins worth less. Think of it as a theft from everyone.” (Against Allowing Quantum Recovery of Bitcoin)
On activation: he doesn’t expect BIP-361 to be seriously proposed “unless it looks highly likely that a cryptographically relevant quantum computer is less than 10 years away.”
Where they agree: prepare now, and post-quantum signatures come first. Lopp: “The security upgrade must come before BIP-361.” (Apr 16, 2026)
What about Satoshi’s coins?
This is the real fight.
There are four options on the table:
Do nothing. Whoever builds a quantum computer first can take them.
Freeze them. This is BIP-361 Phase B: legacy spends become invalid.
Throttle them. “Hourglass” rate-limits P2PK spending, so a quantum thief can’t dump everything at once.
Salvage them. Carter’s first choice is salvage into the US Strategic Bitcoin Reserve (SBR): “The coins are lawfully salvaged, held in Trust for Satoshi to claim, and ultimately escheated into the SBR.” (Carter). Or you could put them back into the issuance schedule which may solve the long term security budget.
Even Carter admits a freeze changes Bitcoin: “something about Bitcoin will truly have died. It would survive, but it will be forever changed.”
I don’t believe the protocol shouldn’t decide who owns coins. No burning, no freezing.
My take
I combine these views: Carter’s urgency without the panic, Back’s technical preparedness without complacency, and Bitcoin’s immutable principles at the center.
I’ve publicly opposed proposals like BIP-361, which would deprecate or effectively freeze coins that don’t migrate by a certain date.
Bitcoin’s monetary policy is sacred: 21 million, no exceptions.
Its unseizability is what makes it better than fiat, or even gold, under authoritarian regimes.
A protocol-level change that makes unmoved coins effectively seizable, by destroying them or forcing their loss, undermines both.
Intelligent markets will price in the lesser evil of a few cracked early coins (Satoshi’s included) far better than they’d price in the erosion of the “extremely hard to seize” property. Also, who is to say that an attacker (likely a government) would immediately sell anyways? They could hold onto the coins, or slowly sell over a decade.
As Lopp put it in the post above, in a take I endorsed: watch quantum progress closely and prepare for a worst-case 5–10 year migration, but don’t overreact.
The path forward is Bitcoin-native:
Optional post-quantum signatures
Voluntary migration, so users rotate funds into quantum-safe addresses
Long timelines, so individuals, institutions and even dormant holders all get time
No confiscatory forks or freezes. Community consensus decides, not top-down mandates.
Privacy coins offer no meaningful edge here. Quantum doesn’t care which chain you’re on.
What you should do now
You don’t need to panic. You do need decent wallet hygiene.
Stop reusing addresses. Once you spend from an address, its public key is public, and anything left there is exposed at rest.
Keep long-term savings in an address that has never been spent from. Unspent 1…, 3… and bc1q… addresses hide the public key behind a hash.
Don’t park cold savings in Taproot (bc1p…). This is the one most people don’t expect. Taproot shows the key by design. It’s the newest address type, and it’s exposed at rest.
Don’t paste your xpub into random apps. Xpubs and wallet descriptors reveal public keys too.
Watch for P2MR (bc1z…) and post-quantum support in your wallet or custodian, and migrate when it’s real (THIS WILL TAKE MANY YEARS, WAIT UNTIL YOU GET CONFIRMATION FROM DOZENS OF QUALITY SOURCES) Don’t rush into “quantum-proof” altcoins out of fear.
Conclusion
Bitcoin has survived far worse: 51% fears, exchange hacks, regulatory wars. Quantum is just the latest stress test.
As I’ve said recently, Bitcoin easily survives quantum computing. With thoughtful preparation starting today, it won’t just survive. It’ll come out even more antifragile.
Let’s discuss solutions, not scare stories.
HODL, Dan Held
Sources: Glassnode exposed supply · Google Quantum AI paper · BIP-360 · BIP-361 · NIST PQC standards · IBM roadmap · GRI/evolutionQ · Project Eleven Q-Day model