The Quantum Threat to Bitcoin’s Security
The emergence of quantum computing poses a significant existential threat to Bitcoin’s cryptographic foundations. Specifically, the potential for a hostile actor to utilize Shor’s algorithm to recover private keys from exposed public keys—particularly those belonging to early "dormant" coins—could destabilize the network and erode global market confidence.
The Vulnerability of Exposed Assets
Research indicates that approximately 30.2% of the Bitcoin supply is currently vulnerable because the associated public keys are already visible on the blockchain. This exposure primarily affects early Pay-to-Public-Key (P2PK) outputs and addresses where keys were revealed through previous spending or address reuse. In a worst-case scenario envisioned by investor Nic Carter, a quantum-capable attacker could quietly harvest these keys and then broadcast a massive wave of transactions across just ten blocks. Such a rapid movement of millions of BTC would not only represent a colossal shift in control but could also trigger a systemic collapse in holder sentiment.
The Logistics of a "Quantum Sweep"
The technical logistics of such an attack are alarmingly feasible under Bitcoin's current block-weight rules. Theoretical models show that roughly 2.5 million BTC, spread across 50,000 early outputs, could fit into a sequence of ten blocks while remaining beneath standard weight limits. While network congestion and miner decisions play a role, the sheer capacity of the blockchain allows for a rapid "sweep" of assets before the community can react. This realization has shifted the focus toward preventive measures, such as Google’s 2029 target for quantum-ready infrastructure, highlighting the urgency for Bitcoin to adopt stronger cryptographic standards.
Defenses and the Migration Dilemma
To counter this threat, developers have introduced various Bitcoin Improvement Proposals (BIPs), such as BIP-360 and BIP-361. these frameworks suggest migrating to quantum-resistant output types and implementing phased restrictions on legacy signatures. However, these solutions present a difficult trade-off: while sunsetting old signature types protects the network from attackers, it also risks locking out legitimate owners who fail to migrate their funds in time. The community must eventually decide how to recognize valid ownership claims once an ordinary signature can no longer distinguish an original holder from a quantum-equipped adversary.
