1.7 Million Legacy Bitcoins, a 9‑Minute Attack Window: Quantum Computing Is Sparking a “Lock‑Swap” Surge.

1.7 Million Old Bitcoins, a 9‑Minute Attack Window: Quantum Computing Is Prompting a “Lock‑Swap” Wave….

The quantum computing risk facing Bitcoin is basically this logic.

Today, the reason Bitcoin can operate securely is that each wallet has a pair of “keys”: one called a public key, which can be public; the other called a private key, which must be kept secret. Under normal circumstances, even if someone knows your public key, it is practically impossible to compute the private key. So as long as the private key is not leaked, your funds are very hard for others to transfer away.

But quantum computing brings a problem. In the future, if quantum computers become powerful enough, they can use a method called  Shor algorithm that derives the private key from a public key. In other words, what previously required “stealing the key” to open a wallet may in the future only require a glance at the “lock”, and then a new key can be computed.

This is also where quantum computing truly threatens Bitcoin.If others can also compute your private key, then this Bitcoin actuallyhow shouldprove it belongs to you?

In the past, this issue was considered far from reality. Although quantum computing theoretically can break the cryptographic system used by Bitcoin, it was widely believed that building such a machine would require an astonishingly large scale.

This yearin March, a paper from researchers at Google Quantum AI, Stanford, Berkeley, and the Ethereum Foundation changed this assessment.This57‑page paper recalculated,How large a quantum computer will actually be needed in the future to threaten Bitcoin?

The author’s result is that breaking Bitcoin’s  secp256k1 cryptographic system may only require about 1,200–1,450 logical qubits.Under the superconducting quantum computing architecture they assume, the required physical qubits could even drop to  under 500,000.

What is even more striking is a number:9 minutes.According to the paper’s model, a sufficiently powerful and fast quantum computer in the future could potentially compute the private key from the public key in about 9 minutes

What’s more troublesome is that there are some coins that no one can proactively “relock”.For example, the massive amount of Bitcoin left from the Satoshi era hasn’t been moved for over a decade, and the private keys may have been lost long ago. If future quantum computers can recompute these private keys, these dormant Bitcoins could suddenly become accessible again.

So, what this paper truly merits discussing,is not solely focused on“quantity of sub‑computations that could break Bitcoin?”,but also delves deeper, raising a series of questions:

Why can quantum computing threaten cryptocurrencies?

How powerful a machine is needed for a real quantum attack?

How exactly could Bitcoin be attacked?

Why are the risks facing Ethereum more complex than those of Bitcoin?

The issues all stem from ECDLP, so why doesn’t everyone just switch to PQC?

What should be done if millions of dormant BTC cannot be transferred in the end?

With these questions in mind, let’s see how this paper answers them.

01

Why can quantum computing threaten cryptocurrencies?

This articlepaperdoes not focuson where quantum computers are stronger than classical computers,but insteadexplores a more specific cryptographic problem.

The security of many modern blockchains relies on the elliptic curve discrete logarithm problem, which is hard to solve on classical computers (ECDLP – Elliptic Curve Discrete Logarithm Problem).

Quantum computers relevant to cryptography CRQC (Cryptographically Relevant Quantum Computer) will threaten existing public‑key cryptosystems. RSA faces problems due to Shor’s algorithm efficiently solving integer factorization, while elliptic‑curve cryptography (ECC) faces issues arising from Shor’s algorithm can efficiently solve the ECDLP.

This is directly related to cryptocurrencies.Blockchains such as Bitcoin and Ethereum heavily use digital signatures based on the ECDLP.

Andthe core security of most cryptocurrencies is built on a fundamental assumption,which isthe ECDLP is hard to solve.Specific blockchain functions that rely on this hardness assumption include Bitcoin and Ethereum transaction verification, as well as Ethereum’s proof‑of‑stake (PoS) consensus mechanism.

Based on these estimates, the paper discusses two possible CRQC evolution scenarios, which will form the basis for the subsequent discussion of potential mitigation strategies. In particular, how quickly early CRQC can carry out attacks will directly determine which blockchain vulnerabilities can be exploited in practice, and thus which interim mitigation measures should be prioritized before a full migration to PQC.

Based on the required execution speed of the attack and whether each attack needs to access CRQC, or if a single use of CRQC can prepare a universally reusable attack tool, quantum attacks are divided into three categories:

1. On‑Spend Attacks: Targeting transactions that are in transit and have not yet been permanently recorded on the blockchain. After a blockchain user broadcasts a transaction, the attacker must derive the private key within the time window allowed before the transaction is recorded on the blockchain. This requires a quantum computer to solve the ECDLP. Settlement times vary across blockchains, ranging from a few hundred milliseconds to several minutes—for example, Solana is about 400 ms, Ethereum about 12 s, and Bitcoin averages around 10 minutes. On‑spend attacks are also known as “short‑range attacks” or “just‑in‑time attacks”.

2. At‑Rest Attacks: targeting public keys that remain exposed on‑chain or off‑chain for extended periods, such as dormant wallets that reuse keys. In this scenario, an attacker has days or even longer to derive the private key. At‑rest attacks are also known as “long‑range attacks” or “long‑exposure attacks”.

3. Setup‑Stage Attacks (On‑Setup Attacks): Targeting fixed public‑protocol parameters, the goal is to create a universal, reusable backdoor in a cryptographic protocol. The attacker only needs to use  CRQC to perform a single offline quantum computation that constructs the backdoor; thereafter, attacks using that backdoor can be carried out with only classical computers. For example, an attacker might use Shor’s algorithm to recover the so‑called “toxic waste” that should have been destroyed during a Powers‑of‑Tau (τ‑powers) trusted setup ceremony. The Bitcoin blockchain itself is immune to setup‑stage attacks, but certain scaling solutions—such as Ethereum’s data‑availability sampling mechanism—and some privacy protocols, e.g., Tornado Cash, are vulnerable to this particularly stealthy and dangerous attack model.

It should be noted that other classification methods can be used for quantum attacks on cryptocurrencies. For example, they can be further subdivided according to the compromised security properties:

•Asset ownership attacks, such as forging transactions in Bitcoin;

•Consensus attacks, such as performing deep blockchain reorganization after compromising more than half of Ethereum validators;

• Confidentiality attacks, such as breaking the unlinkability between Zcash diversified addresses;

• Monetary integrity attacks, such as illicitly creating new coins in Mimblewimble or vulnerable Ethereum zk‑rollups;

• Solvency attacks, such as anchor collapse caused by illegal Rootstock redemptions or stablecoin redemptions, or silently draining the Tornado Cash anonymity pool;

• Data availability attacks, such as forging Ethereum’s data availability sampling proofs;

•Governance attacks, such as forging votes of Cardano or Ethereum decentralized autonomous organizations (DAOs), or hijacking cross‑chain bridge assets controlled by multi‑signatures.

Transaction verification on Bitcoin and Ethereum, Ethereum’s PoS consensus, and so on all rely on this assumption to varying degrees.

Taking Bitcoin as an example, its basic asset unit is the UTXO. Whether a UTXO can be spent requires the spender to submit a valid digital signature that matches the corresponding public key; generating a valid signature requires possession of the corresponding private key. Therefore, the paper summarizes Bitcoin’s cryptographic ownership relationship very directly.In cryptographic terms, owning bitcoin means possessing the private keys corresponding to the public keys that lock those bitcoin.

And the fundamental change brought by CRQC lies here.Once the public key is disclosed,CRQC can use Shor’s algorithm to derive the corresponding private key by solving the ECDLP.

The paper therefore argues that this will fundamentally undermine Bitcoin’s current ownership model built on cryptographic puzzles.

Why are cryptocurrencies especially worth paying attention to?

First, many blockchains, in order to achieve efficiency and scalability, heavily rely on cryptographic systems based on  the ECDLP cryptographic scheme. At the same security level, this type of scheme requires key lengths roughly an order of magnitude smaller than RSA, so the CRQC resources needed to break them are also smaller.

Second, traditional finance usually has multiple layers of security protection and transaction recourse mechanisms, whereas blockchain often lacks the ability to pursue fraudulent transactions. The paper explicitly states:A single successful digital signature forgery could result in irrecoverable asset theft.

Therefore, strictly following the paper’s logic, the threat of quantum computing to cryptocurrencies can be summarized as:

ECDLP is the underlying hard problem for digital signature security.Shor’s algorithm can efficiently solve ECDLP on a CRQC,public keys may be used to recover private keys,attackers can generate valid digital signatures,threatening existing mechanisms that prove ownership with a private key.

But the paper also emphasizes thatcannot be used to infer“quantum computers can easily break all parts of the blockchain”. Different protocols and functions have varying quantum resilience. For example, the paper argues thatBitcoin’s PoW consensus is not currently a realistic target for quantum attacks.

02

How powerful a machine is needed for a real quantum attack?

This paper presents a very important point:When evaluating a quantum computer capable of attacking  secp256k1, you cannot just look at “how many qubits”.

The reason is that, for the n bit  ECDLP problem, comparing existing state‑of‑the‑art Shor algorithm compilation schemes is not straightforward because there is a crucial space‑time tradeoff（space‑time tradeoff）.On one hand, the number of logical qubits determines how large the CRQC must be to launch a quantum attack, and on the other hand it is the number of Toffoli gates.

Fault‑tolerant execution When running Shor’s algorithm, the Toffoli gate usually dominates the overall resource cost and determines the total runtime of the algorithm, thereby directly deciding whether an attack is feasible at transaction time. The lowest logical qubit count reported in the public literature comes from a recent preprint by Chevignard et al.: for n=256, they estimate that only about 1100 logical qubits (asymptotically 3.12n+o(n)).

However, such a tiny logical quantum storage space comes at the cost of more than  1000 hundred million Toffoli gatesas a cost. Such a massive number of gates implies not only extremely long runtime but also a large amount of physical qubits..Because the actual number of physical qubits required depends on both the number of logical qubits and the circuit depth.

At the opposite extreme, in previously published literature the lowest Toffoli gate count result comes from Litinski, about 200 million Toffoli gates. It should be noted that the paper’s title states 50 million rather than 200 million, because it includes some optimizations that reduce the amortized cost of multi‑instance solving, whereas this article focuses onsingle‑instance attacks.The Litinski approach reduces the Toffoli gate count at the cost of a logical qubit count more than twice that of the Chevignard et al. scheme. When further accounting for quantum error correction overhead, the Litinski scheme is expected to require about 9 million physical qubits .

This paper reports that the team has developed a logical quantum circuit for solving the elliptic curve discrete logarithm problem (ECDLP) over finite fields : for the case where the prime modulus length and group order are both n bits, its space overhead is about 4.5n. The paper presents two schemes with resource requirements for different n: one optimizes the number of qubits, the other optimizes the number of gates.

When n=256 when n=256, the two circuits respectively require:

•1200 logical qubits + 90 million Toffoli gates; or

•1450 logical qubits + 70 million Toffoli gates.

If wemeasurespacetime volume,this is a key resource metric that especially impacts quantum error‑correction overhead,then when solving a single ECDLP instance, our estimate improves by roughly an order of magnitude over the previously most efficient approach.This is exactly the resource estimate verified by the ZK proof described earlier. The conclusion can be directly applied to secp256k1 for ECDLP; this elliptic curve is widely used for digital signatures in major blockchains such as Bitcoin and Ethereum.

Figure

 1. Different studies compare the logical quantum resources (number of logical qubits and Toffoli gate count) required to break the 256‑bit ECDLP on the secp256k1 curve. Arrows indicate the effect of the two algorithmic optimizations from Litinski [44]:state reuse and division batching. State reuse means reusing the initial phase‑estimation state to derive multiple private keys from multiple public keys in a single execution (nine in the figure). Division batching means running several algorithm instances in parallel (the two points shown in the figure represent two instances, points outside the figure represent nine instances, the latter corresponding to 2.7×10⁴ logical qubits), and merging the modular‑division (inverse) operations across these instances; this technique is known in cryptographic literature as the “Montgomery trick”. Note that all resource estimates cited throughout this paper refer to a single instance and do not include the optimizations mentioned above.

When applying standard assumptions to superconducting qubit hardware,for example planar degree‑four connectivity, physicalerror rate of 10^-3, and running a surface‑code architecture variant with similar assumptions, the calculation shows that the above quantum circuit can be executed onfewer than 500,000 physical qubitsto run.

This estimate drops significantly partly because the optimized logical circuit size is smaller, reducing quantum error‑correction overhead; and also because it uses “yokes”high‑density surface‑code layout protected by “yokes”, storing logical qubits more efficiently.

To estimate the actual wall‑clock runtime of the circuit,the authorassumes quantum computing is executed in a reaction‑limited manner, i.e., the execution speed is mainly limited by the control system’s reaction time. If we assume the control system’s reaction time is 10 µs,a typical value for superconducting qubits [100], and assuming each Toffoli gates incur 50% extra overhead, then executing 70 million or 90 million Toffoli gates on a superconducting CRQC would take roughly 18 minutes or 23 minutes. This duration is already close to the average Bitcoin block time of 10 minutes.

If we consider that a quantum computer can pre‑compute the first half of the algorithm, the attack during a transaction would be even faster. The first half of the algorithm depends only on protocol parameters shared by all addresses, so a quantum computer can pre‑compute it and keep it in a “primed” state, waiting for the target public key to appear. In this way, the time from the public key being disclosed to the corresponding private key being derived can be cut in half.

Therefore, from the moment the attacker learns the public key and starts computing from the pre‑computation state, a transaction‑time attack is expected to take only about  9 minutes or 12 minutes. This means that a superconducting CRQC capable of performing a static‑holding attack on on‑chain assets is also likely able to carry out a transaction‑time attack on active transactions.

As will be discussed further below, it is not believed that extending from 1200 logical qubits to 1450 logical qubits would introduce a significant additional scaling barrier. To simplify the subsequent discussion, this paper therefore assumes: the first‑generation fast‑clock CRQC can on average solve within roughly 9 minutesto solve the ECDLP on secp256k1 and similar elliptic curves.

If the attacker has multiple machines already in a ready state, this time can be further reduced. Using  11 ready machines to launch the attack in parallel, each machine only needs to perform  32 elliptic curve point additions, instead of the  208 required by a single ready machine, achieving roughly a  6.5× speedup.

Figure 2. For elliptic curves with field size n=3264128256 , breaking the n‑bit ECDLP requires logical resources. The figure showsthe low‑gate variant (Low‑Gate Variant) and the low‑qubit variant (Low‑Qubit Variant).

To execute within  9 minutes, you need to execute 70 million Toffoli gates, which requires generating about  approximately  500,000 T states. A T state with a sufficiently low error rate can be prepared using roughly  about  50,000 qubit‑rounds for preparation. In a fast‑clock architecture with a 1‑µs error‑correction cycle, this means allocating roughly 25,000 physical qubits for magic‑state production..

Approximately the amount required to run the entire algorithm Compared with 500,000 physical qubits, 25,000 qubits are only a small fraction. Therefore, on a fast‑clock architecture, we expect transaction‑time attacks to become feasible almost simultaneously with static‑hold attacks.

In contrast, in a slow‑clock architecture with error‑correction cycles of  100 µs or longer slow‑clock architecture, to achieve a sufficient  T‑state generation rate, about 2.5 million physical qubits. This number far exceeds the qubits required to run the algorithm itself at the slower speed. Therefore, we currently expect that on a slow‑clock architecture, static‑holding attacks become feasible before transaction‑time attacks.

However, if new magic-state preparation techniques emerge in the future,such as more efficient T‑state generation methods,and can operate efficiently under the constraints of a slow‑clock architecture,then slow‑clock platforms may also gain the capability to carry out transaction‑time attacks in the future.

To further understand the significance of these resource estimates, we ask readers to refer to Figure  3.

This image was originally published in a recent opinion article by Google Quantum AI. 

 

Figure 3.

 These figures first appeared in the literature to illustrate how, over the past decade, algorithmic and error‑correction research has dramatically reduced the resources required for a quantum computer to solve important problems. (Left panel) Shows, for different publication years, the number of physical qubits needed to break a 2048‑bit RSA encryption using a surface‑code superconducting qubit architecture under state‑of‑the‑art resource estimates. Some papers claim fewer physical qubits by adopting more aggressive hardware assumptions—e.g., higher connectivity or lower error rates—but this article chooses to compare results with comparable hardware assumptions. (Right panel) Shows, for different publication years, the state‑of‑the‑art Toffoli‑gate count required to compute the ground‑state energy of the FeMoco molecule to chemical accuracy; it displays resource estimates for the FeMoco active‑space Hamiltonian from Reiher (“small”) and Li (“large”) [106]. 

 

Figure The core message conveyed by Figure 3 is,Over the past decade, advances in quantum algorithms and quantum error‑correction architectures have continuously and dramatically reduced the physical resources required to implement important quantum applications. As a common saying in cryptography goes:“Attacks only get better (attacks always get better)”.

Of course, resource estimates cannot keep decreasing indefinitely. But the two types of applications highlighted in Figure 3, the RSA‑breaking and quantum chemistry simulation applications, represent cases where historically the publicly disclosed research effort has far exceeded that required to break RSA with quantum algorithms, namely the ECDLP. Consequently, the algorithms for these applications may already be closer to optimal than the best known attacks on ECDLP.In other words, future resource estimates for ECDLP may still have considerable room for reduction.

Fault‑tolerant quantum computing is expensive largely because of the overhead of quantum error correction.From an engineering perspective, building a complete and viable system requires a difficult balance among multiple conditions, including a hardware‑compatible connectivity topology, high noise tolerance, a fast syndrome decoder, and a logical instruction set with sufficient expressive power.

Mature and well‑studied surface codes can meet these conditions, but their efficiency is lower compared with other modern quantum error‑correcting codes. This efficiency is usually expressed bythe ratio of logical qubits to physical qubits, also known as theencoding rate (encoding rate), abbreviated as “rate”.

For example, recent studies onquantum Low-Density Parity-Check codes (quantum Low-Density Parity-Check, qLDPC codes)research offers a very attractive alternative direction: improving code rates by introducing long-range connections. Current resource estimates usually still assume surface codes, because their decodability has been validated and the hardware design requirements are relatively realistic; however, if qLDPC technology further matures, it may further reduce the demand for physical qubits in the future. Recently, researchers have also begun using AI techniques to accelerate the search for better quantum error-correcting codes.

Physical resource estimates discussed in this article, for example, about 500,000 physical qubits, using relatively modest hardware assumptions: planar 4-degree connectivity, physical gate error rate of  10^-3. In other words, this is essentially equivalent to scaling up the quantum processor that Google has experimentally demonstrated.

If a more aggressive hardware assumption is made, the physical qubit requirement could drop to nearly 100,000. For example, the “ 2‑gross qLDPC code“bicycle” architecture could reach this level, but the approach requires non‑local seven‑degree connectivity, which has not yet been demonstrated on real superconducting qubit devices.

Similarly, the recently proposed “Pinnacle” architecture indicates that, in theory, fewer than  100,000 superconducting qubits to break  2048‑bit RSA; however, it relies on more challenging ten‑degree, non‑planar connectivity, and the error‑correcting codes used currently lack large‑scale simulations and efficient decoders to characterize performance, and the entire computation would take nearly a month.

Devices that meet these stricter specifications are more complex to realize physically, so they may be harder to manufacture with sufficiently low physical error rates compared to larger‑scale devices with milder engineering requirements. Consequently, even Pinnacle‑style devices could theoretically break a 256‑bit ECDLP with fewer than 100,000 superconducting qubits,approximately 500,000 qubits, a planar four‑connectivity device that is currently the best‑understoodand also the most engineering‑feasible path. Nevertheless, searching for quantum error‑correcting codes that simultaneously have high encoding rates and satisfy realistic engineering constraints remains an active and promising research direction .

At the same time, considering the significant speed disparity between fast‑clock and slow‑clock quantum computing platforms, and that the choice of mitigation strategy depends on whether a static‑holding attack will materialize far earlier than a transaction‑time attack, we believe the cryptocurrency community should develop contingency plans for the following two potential scenarios:

•Scenario 1: During transaction, both transaction-time attacks and static-hold attacks become feasible around the same time. If the first batch of  CRQC belongs to a fast-clock device, this situation may occur.

•Scenario 2: Static holding attacks become feasible well before transaction‑time attacks. This can occur if the slow‑clock quantum computing platform advances faster than the fast‑clock platform.

The reason we cannot determine which scenario will occur first is partly because many research labs, tech companies, and startups worldwide are simultaneously developing a variety of quantum computer architectures. For example,Google Quantum AI, IBM Quantum, Amazon, D-Wave, Rigetti, and IQM are all developing superconducting qubit architectures; PsiQuantum and Xanadu are building photonic quantum computers; Diraq and Intel are developing spin qubit devices. All three types of architectures have relatively fast basic operation speeds, making them compatible with scenario 1.

At the same time, companies including  IonQ, Quantinuum (a Honeywell subsidiary), and Alpine Quantum Technologies are advancing ion‑trap quantum processors; while companies such as QuEra, Infleqtion, Atom Computing, Pasqal, and Logiqal are developing neutral‑atom devices. The basic operations of these two platforms are noticeably slower. Therefore, if fast‑clock architectures encounter scaling bottlenecks, or if neutral‑atom/ion‑trap platforms achieve rapid scaling, Scenario 2 could appear before Scenario 1.

Existing research on technological innovation has pointed out that technological change often undergoes a two‑stage evolutionary process: initially a period of high innovation and highly diversified technological pathways, the “”Fermentation period (era of ferment）”, after which a particular “dominant design (dominant design）” gradually forms, leading to a stage of incremental technological improvement.

For example, during the “fermentation period” of the automobile industry at the end of the 19th century, multiple powertrain routes such as steam engines, batteries, and internal combustion engines were rapidly innovated, and eventually the internal combustion engine became the “dominant design.” After entering the incremental improvement stage, technological progress can be measured by gradually improving performance metrics, such as miles per gallon for cars, or the increase in component count in integrated circuits under Moore’s Law.

In contrast, quantum computing still has a very diverse set of hardware platforms, so it remains in the“fermentation stage”. At this stage, simple statisticsthe number of physical qubitsand similar simple models cannot accurately reflect technological progress. Real breakthroughs often occur as discrete jumps, corresponding to the emergence of a new internal capability or the overcoming of a scaling barrier. For example, reducing device error rates below the threshold of a quantum error‑correcting code, or achieving coherent interconnects for a modular quantum computing architecture. Therefore, understanding progress in quantum computing is better served by using athreshold model（threshold model）rather than simply looking at the number of physical qubits.

Similarly, other incremental progress metrics may also fail to accurately gauge how far we are from CRQC.  For example, the literature proposes the ECDLP “challenge ladder,” which gradually increases the modulus and group order from 6 bits to 256 bits; although it appears to allow step‑by‑step measurement of breakthroughs, it may not provide reliable early warning.

Assume a leading quantum architecture has already overcome all critical scaling issues before it manufactures a device capable of solving the  32‑bit ECDLP problem, then the time gap between “breaking a 32‑bit ECDLP” and “breaking a 256‑bit ECDLP” could be very short. More importantly, the community should not expect research institutions to publicly demonstrate how state‑of‑the‑art quantum error‑correction architectures and quantum algorithms are applied to real cryptanalysis problems.

Therefore, if one day a public experiment successfully demonstrates  Shor’s algorithm breaking 32‑bit elliptic curves, we should not interpret it as a “finally time to adopt PQC” alarm, but rather see it as a warning sign: the timely adoption of PQC may already have failed.

Which of the two scenarios actually occurs depends on the scaling obstacles each quantum platform faces and how quickly human innovation can overcome those obstacles.Given this uncertainty, it is recommended that cryptocurrency communities, before completing a full PQC migration, immediately implement and deploy some relatively simple static‑holding attack mitigations, such as: removing cost paths that are quantum‑vulnerable; updating wallets to warn users when they use weak addresses; disabling Rootstock deposit transaction support that exposes public keys across chains; introducing a rotation mechanism for validator keys in Ethereum, and for staking and voting keys in Cardano. These measures cannot eliminate quantum vulnerability, but they can significantly raise the difficulty of attacks.

Already seen, quantum hardware development is advancing toward the goal of “cryptographic relevance” by scaling up device size, continuously pushing quantum computers forward.At the same time, research on quantum error correction and efficient compilation of quantum algorithms is continually bringing this “goal” closer to current technological capabilities.

Paper authorsfurther argue that the closer one gets to CRQC, the finish line itself may become increasingly vague, and external understanding of the true state of current quantum capabilities may become less transparent. As the threshold for quantum computing development lowers, in the final stage of the race to build large-scale fault‑tolerant quantum computers, some “latecomers” might rapidly achieve CRQC capabilities, and intellectual‑property theft or industrial espionage could further accelerate this process.

At the same time, as quantum computing R&D programs gradually approach large‑scale commercial quantum computers, their transparency is likely to decrease. These factors will increase our uncertainty about the arrival time and technical nature of the first CRQC. Consequently, a perfectly conceivable scenario is the first time humanity confirms an early CRQC already exists, not because a company or a nation publicly announces it, but because we first observe its attack traces on the blockchain.，humanity’s first confirmation of an early CRQC already exists, not because a company or a country publicly announces it, but because we first observed its attack traces on the blockchain.

As this article will repeatedly argue, the safest choice for the cryptocurrency community isto start preparing for quantum attacks now.

03

How exactly could Bitcoin be attacked?

All quantum attacks on Bitcoin ultimately point to the same thing.Attackers obtain the public key, use a quantum computer to reverse‑engineer the private key, then use that private key to sign a transaction that looks perfectly legitimate on the Bitcoin network that appears completely legitimate, and moves the coins away.

Bitcoin does not have a “account”. The blockchain records unspent transaction outputs, i.e.,  UTXO. Each UTXO has associated spending conditions, typically requiring the holder to provide a valid digital signature that matches the public key. Under normal circumstances, only the person who possesses the private key can generate this signature, so from a cryptographic standpoint, the private key is the foundation of asset control.

The problem is,Bitcoin’s widely used digital signatures are based on the elliptic curve discrete logarithm problem (ECDLP). A classical computer, even knowing the public key, can hardly derive the private key; however, a sufficiently powerful cryptography‑related quantum computer (CRQC) can accomplish this using Shor’s algorithm.

So, the quantum attacks that Bitcoin faces can be simply divided into two types.

First case: the coins are still there, and the private key is derived.The paper calls it at‑rest attack, a static‑holding attack.

Some  Bitcoin addresses expose the public key directly on the blockchain. The most typical early example is  P2PK, as well as the newer  P2TR (Taproot). For these addresses, an attacker doesn’t need to wait for the user to send a transaction; the public key is already public and can be handed to a quantum computer for computation in advance.

Attack ProcessIt’s not complicated, roughly:Read the public key on the chain,thenCRQC derives the private keyandgenerate a valid signature with the private key,finallytransfer BTC to an address controlled by the attacker.

Early The P2PK script still locks over 1.7 million BTC, which includes a large amount of Satoshi-era mining rewards.Although P2TR is a modern script introduced after 2021, it also writes the tweaked public key directly on-chain, so from a quantum‑security perspective it similarly faces static attack risks. 

Another type of address, for example P2PKH, P2WPKH hide the public key behind a hash. As long as the address has never spent coins and the public key has not been leaked elsewhere, a quantum attacker currently has no explicit public key to target.

But this protection has a very important prerequisitethat is,Do not reuse addresses.

Once an address has been used to initiate a transaction, its public key is usually already exposed. If there is still BTC left in the address, an attacker can locate this public key from historical transactions and then use quantum computing to derive the private key. The paper therefore argues that address reuse will cause otherwise more secure addresses such as P2PKH and P2WPKH to ultimately degrade to a risk level similar to P2PK and P2TR.

According to the paper’s on‑chain data estimate, during writing the public key being directly exposedor key reuse, while being subject to static quantum risk  BTC, totaling about 6.9 million.

This means that the first batch truly vulnerable to quantum attacks in the future may not be the Bitcoin currently being traded, but rather those large assets whose public keys have long been exposed and have been lying on the chain. public keys that have long been exposed and large assets sitting on the chain.

Method 2: As soon as you broadcast a transaction, the attacker intercepts the coins on the way“intercepted”. This is the so‑called on‑spend attack described in the paper, an attack during transaction.

Some  Bitcoin addresses can hide the public key most of the time, but the problem is that when a user actually wants to spend the funds, the Bitcoin network must see the public key and the digital signature in order to verify that the transaction is valid.

Therefore, after a transaction is broadcast, before it is actually written into a block by miners, it enters the public memory pool, i.e.,  mempool.

At this point, the attack window appears. The attacker can read the just‑published public key from the mempool, then immediately launch quantum computation, using Shor’s algorithm, to obtain the private key from the public key.

After obtaining the private key, the attacker can re‑sign a transaction and send the same BTC to their own address. If this malicious transaction is confirmed by miners earlier than the original one, the theft is complete.

This is also why the paper’s“9‑minute”is so important.

Bitcoin averages about 10 minutes to generate a new block. According to the paper’s estimates for future fast‑clock superconducting CRQC, after completing some precomputations in advance, it may only take about  approximately 9 minutes clock.

In other words, such a scenario may arise in the future.The userjustbroadcasted a Bitcoin transaction,the public keyonceenters mempool,quantum computers startcalculating.About 9 minutes later, the attacker obtains theprivate key,while the original transaction may not yet have entered the next block.

Thus, Bitcoin’s 10‑minute average block time is, for the first time, on the same order of magnitude as the potential attack time of quantum computing.

What makes it even more troublesome is that Bitcoin’s block generation is not strictly every 10 minutes. Sometimes the next block appears within a few minutes, other times it may take 20, 30 minutes, or even longer. Therefore, as long as quantum computing speed approaches this window, there is a probability of a successful attack. The paper even notes that with further algorithmic optimization or future CRQCs possessing more qubits, the private‑key derivation time could continue to decrease.

However, after obtaining the private key, there will be a “fee war”.

When a quantum attacker cracks the private key, it does not mean the original transaction automatically disappears. In practice, it is more likely that two transactions, both bearing valid signatures, will compete simultaneously: one from the legitimate asset owner,and another from the quantum attacker who has already derived the private key.

Bitcoin miners usually have an economic incentive to prioritize transactions with higher fees. Thus, an attacker can attach a higher fee to a theft transaction to compete with the original owner.

The paper calls the most extreme outcome scorched earth,“scorched earth” situation.

Because the attacker is not spending his own money, he can keep raising the transaction fee. If the legitimate holder wants to prevent the asset from being stolen, they can only keep outbidding. In theory, this bidding war could even push the fee up to a value close to that of the asset itself.

The result is that even if the attacker ultimately didn’t take BTC, the original holder may have paid most of the asset’s value to miners to prevent the theft.

Therefore, the problems caused by quantum attacks are not only“the hacker knows your password”. It could turn the Bitcoin’s normal transaction confirmation mechanism, into agenuinerace between the owner and the quantum attacker.

What are the Bitcoin at greatest risk? According to the paper’s analysis, the order roughly depends on the degree of public‑key exposure.

The first batch consists of assets whose public keys are already public, such as P2PK, P2TR, and some legacy multisig assets.

The second group consists of addresses that have been used before and experienced address reuse, such as P2PKH, P2WPKH, etc. Although they originally hid the public key with a hash, historical transactions have already revealed the public key.

The third group consists of addresses whose public keys have not yet been exposed. They can temporarily resist static holding attacks, but as soon as a transaction is initiated in the future, the public key will be revealed in  the mempool, so they may still be vulnerable to transaction-time attacks.

The core conclusion presented at the end of the paper is,once sufficiently fast CRQC, all standard Bitcoin transaction types may ultimately face quantum attacks at transaction time.Therefore, “Hiding the public key” can only delay the attack and does not fundamentally solve the problem.

Alsoa commonly misunderstood question: will quantum computing first destroy Bitcoin mining?

The paper’s judgment is exactly the opposite. At least according to the current technical roadmap, quantum computing first threatens not Bitcoin’s PoW mining, butdigital signatures.

In theory, Grover’s algorithm can accelerate SHA-256 search, but the paper argues that the massive overhead of quantum error correction and the difficulty of scaling Grover’s algorithm in parallel will cause this advantage to shrink dramatically in real-world mining.

The paper even presents an extreme assumption.Even if a CRQC could complete a SHA‑256 hash in each 1‑microsecond quantum error‑correction cycle, its computing power would be only about 0.25 TH/s, still far below mature ASIC miners; if realistic hardware conditions are used, the gap would be even larger.

Therefore, the paper argues that, in the foreseeable present stage,“Quantum mining rigs dominating Bitcoin” is more like science fiction.The truly realistic risk is that once a quantum computer obtains your public key, it can recompute your private key.

 

04

Why are the risks facing Ethereum more complex than Bitcoin?

If we say the quantum threat facing Bitcoin is actually quite easy to understand.After the public key is exposed, a quantum computer can use Shor’s algorithm to derive the private key and then forge a transaction.

 

So when it comes to  Ethereum, things become much more complicated. The reason is not just that Ethereum has more code, but that its role is entirely different.

Bitcoin is more like a global distributed ledger, primarily responsible for recording the ownership and transfer of BTC.Ethereum, on the other hand, is more like a global distributed computer. It records assets, executes code, and supports a wide range of applications such as smart contracts, stablecoins, DeFi, real‑world assets (RWA), cross‑chain bridges, and Layer 2 solutions.

Therefore, if you only look at  Ethereum’s own market cap, it is easy to underestimate the true value that Ethereum carries. The paper notes that as of February 2026, ETH’s market cap was about $400 billion. However, when you include stablecoins, RWA, and Layer 2 solutions, Ethereum’s total value secured (TVS) already exceeds $600 billion. In contrast, Bitcoin’s economic value remains primarily concentrated in BTC itself.

This also determines that the risk structures of the two are different when facing quantum computing.

The paper first eliminates a common misunderstanding,the most concerning issue for Ethereum right now is not transaction‑time attacks like those on Bitcoin.

Ethereum generates new blocks in slots of about 12 seconds, and most transactions are processed in less than a minute, while a private mempool already exists in the ecosystem. According to the paper’s estimate for the first‑generation fast‑clock CRQC, even if quantum computers have the capability to break elliptic‑curve private keys, it would be difficult for them to carry out a typical transaction‑time attack within Ethereum’s very short transaction confirmation window.

Ethereum’s bigger problem is,the massive number of public keys and cryptographic parameters are already exposed long‑term, giving quantum computers ample time.

Therefore, the paper argues that the main risk to Ethereum comes from static holding attacks, which the paper further categorizes into five types:account vulnerability, admin vulnerability, code vulnerability, consensus vulnerability, and data‑availability vulnerability.

These five types of risk each stem from Ethereum’s three core components: the account model, smart contracts, and PoS consensus.

Layer 1: The account itself becomes a long‑term exposed attack target.

The first major difference between Bitcoin and Ethereum is that they use different account models. Bitcoin uses UTXO. Users can keep changing addresses, and as long as the public key is not exposed, they can reduce the risk of static holding attacks to some extent.

Ethereum, on the other hand, uses long‑lived accounts. In practice, an Ethereum user often uses the same EOA for a long time, because the account may be linked to assets, DeFi positions, governance history, identity records, and various on‑chain relationships.

The problem is that once this account sends its first transaction, the digital signature will expose the full public key to the entire network.

From that moment on, the public key remains on the chain permanently. In the era of classical computing this is not an issue, because recovering the private key from the public key is still extremely difficult. But if CRQC emerges, these long‑exposed public keys become ready‑made attack targets.

The paper calls this situationaccount vulnerability (Account Vulnerability）, and considers it a systemic long‑term exposure.Unless the entire protocol migrates to  PQC, it is difficult to fundamentally eliminate it solely by ordinary users changing their usage habits.

The paper also performed a concrete calculation:Using a fast clock CRQC, an attacker canin less than 9 daysto derive the private keys of the top 1,000 exposed accounts with the highest net worth in Ethereum.

These accounts hold approximately 20.5 million ETH.

What truly deserves attention here is,a compromised account may have other consequences.

For example If a DAO’s governance account is compromised, an attacker can forge votes.Even if an exchange’s hot wallet has a low instantaneous balance, once its private key is recovered it can lead to continuous outflow of custodial assets.

Layer 2: The more dangerous ones may be those admin accounts with “little money, great power”.

This is also a major difference between Ethereum and Bitcoin. Ethereum natively supports smart contracts, while many smart contracts actually have administrators.

These administrators may have permissions such as pausing the protocol, upgrading code, withdrawing funds, and changing critical parameters.

The paper specifically uses a very important concept:high-leverage,i.e.high-leverage administrator account.

These accounts may have almost no assets themselves, but the control behind them is extremely valuable. The paper reports that, in the top 500 smart contracts by ETH balance, at least 70 accountsexhibit admin vulnerabilities, collectively holding directly about 2.5 million ETH.

According to the paper’s hypothesis, if a fast clock is used CRQC, the private keys of all 70 administrator accounts can be derived, and the total time is even less than 15 hours.

The real problem lies ahead. If an attacker obtains a  RWA administrator key, they could illicitly mint tokens representing real-world assets.If they obtain a cross-chain bridge administrator key, they could drain the liquidity that supports cross-chain assets;

If the obtained is the oracle node private key, they can send incorrect prices to  DeFi protocols, triggering cascading liquidations; If the obtained is a Guardian account, they could directly pause the protocol, freeze assets, or even modify the code.

The paper therefore points out that the real difficulty in quantifying administrator risk lies in its numerous second‑order effects.

The assets directly held by the admin’s vulnerable contracts are already large, but the greater exposure comes from the stablecoins, RWA, cross‑chain bridges, oracles, and other DeFi infrastructure controlled by these admins.

According to the paper, approximately  2000 billion USD of stablecoins and tokenization  RWA relies on contracts with admin vulnerabilities.

So from this layer onward, quantum attacks are no longer just“coin theft”,it could evolve intostablecoin de‑pegging, cross‑chain bridge liquidity freezes,DeFi cascade liquidations, and even the relationship between real‑world assets and on‑chain ownership certificates could be broken.

Third layer: i.e.makes the Ethereum mainnet has upgraded, old smart contracts will not automatically be safe.

The second, more tricky problem comes from the code.A large number of smart contracts on Ethereum invoke various cryptographic primitives. The issue is that, as the paper points out, none of the current Ethereum precompiled contracts include modern post‑quantum cryptography primitives.

This means that a large number of existing smart contracts rely on ECDSA, elliptic curve pairings, and some zero‑knowledge proof systems, which themselves still pose quantum risks.

Layer 2 further amplifies this issue. Systems such as rollups and cross‑chain bridges need to rely on smart contracts and accounts to interact with Ethereum L1, and they naturally inherit the quantum vulnerabilities already present in Ethereum accounts and smart contracts.

Some L2 zkSNARKs are also built on cryptographic primitives that have quantum vulnerabilities.

Conservative estimate in the paper, only the main L2 and cross‑chain bridge‑related risky assets, which amount to at least 15 million ETH TVS. The most troublesome part here is,Even if the Ethereum base layer completes a post‑quantum upgrade in the future, it will not automatically fix the smart contracts that were deployed earlier.

Because the EVM does not automatically recompile already deployed contracts. Every protocol, each cross‑chain bridge, and every admin multi‑sig requires its own development team and governance body to proactively perform the migration.

This makes Ethereum’s PQC migration into a highly decentralized effort.The problem faced is not that a single upgrade from the Ethereum Foundation makes the entire system secure. The base layer can migrate, but legacy contracts may still leave attack surfaces.

Layer 4: If a quantum attack penetrates PoS consensus, affecting not only assets but the blockchain itself.

Ethereum has a problem that Bitcoin doesn’t,which isits PoS consensus itself also uses cryptographic techniques that are quantum‑vulnerable.

Ethereum validators use BLS signatures on the BLS12-381 curve for voting and signature aggregation. This mechanism is efficient because it can compress a large number of validator signatures into a few aggregate signatures.

But BLS is also based on the elliptic curve discrete logarithm problem. Therefore, as long as CRQC can solve the ECDLP for the corresponding curve, the verifier’s private key may also become a target of attack.

The consequences of a validator’s key being compromised will escalate as the attacker controls a larger share of the stake.

The paper presents several key thresholds:

• If more than 1/3, the attacker can prevent Ethereum from reaching finality;

• More than 1/2, the attacker can control fork selection, and even perform deep chain reorganization;

• More than 2/3, the attacker can cause conflicting chains to each obtain final confirmation.

At this point, the problemcould evolve intothe entire Ethereum ledgercan still be trusted?

Of course, the paper does not exaggerate the practical difficulty of large‑scale quantum consensus attacks.Ethereum has roughly 1 million validators. The validator count is huge, and they participate in consensus randomly according to staking weight, which itself provides an important layer of security margin.

The paper made an estimate: even assuming an attacker has 20 fast‑clock CRQCs, and each machine attacks the speed of BLS12-381 is comparable to breaking secp256k1; to derive the private key needed to control a 2/3 super‑majority of validators also requiresover 9 months.

So, compared to attacking regular accounts, large‑scale control of Ethereum consensus is much harder.

But the paper also notes that this safety margin assumes validators are sufficiently distributed. If an increasing number of ETH becomes concentrated among a few large staking service providers, an attacker may not need to compromise hundreds of thousands of validators individually, but could instead target the administrators and key‑management systems of those critical providers.

Layer 5: The most unique risk is“a single quantum attack that creates a long‑term reusable backdoor”.

The paper notes In the analysis of Ethereum, the most distinctive risk comes from the data availability mechanism. Modern Ethereum Layer 2 solutions heavily rely on blobs and data availability sampling, i.e., DAS. DAS uses KZG polynomial commitments on the BLS12-381 elliptic curve.

When building the KZG system, a “trusted setup”. The trusted setup generates a secret random number and encodes the relevant information into a set of public elliptic‑curve points.

Under normal circumstances, that secret value must be completely destroyed, so it is called“toxic waste”.

If it still exists, it is equivalent to leaving a backdoor in the entire password system. The paper points out that, mathematically, this“toxic waste” can be expressed as the discrete logarithm between two public elliptic‑curve points. In other words,CRQC could potentially recompute this secret that should have been destroyed.

This differs from cracking wallets in a very important way. The attacker does not need to attack each blob, nor does he need to use a quantum computer again for every attack.

He only needs to successfully use CRQC once. Once this secret is recovered, it is equivalent to obtaining a permanent backdoor. In the future, even a regular classical computer can be used to cheaply forge data availability proofs.

The paper refers to this type of attack asOn‑Setup Attack).The most dangerous aspect of this type of attackis thata single quantum attack can become a repeatedly usable, even transmissible and tradable, classical attack tool.

An attacker can make validators mistakenly believe that certain data actually exists, when in fact the data cannot be recovered at all, causing the  Layer 2 to stall, and even use this for extortion.

According to the paper estimate, as of  February 2026, the TVS directly affected by this data availability vulnerability alone is about 15 million ETH.

This also shows that,Ethereum’s overall quantum attack surface is broader than Bitcoin’s.

The core issues facing Bitcoin can be understood relatively concisely asPublic key exposure,thenprivate key recovery,finallyassets are stolen.

And the risk of Ethereum spreads layer by layer outward,firstordinary accounts may be stolen,thenthe admin key being compromised could control a protocol,thenold password primitives in smart contracts may leave long‑term vulnerabilities,validator private key compromise could affect PoS consensus.After KZG and other public parameters are broken, system‑level backdoors that can be reused long‑term may even emerge.

So,when the entire blockchain economy is built on layer after layer of cryptographic trust, quantum computing may follow these cryptographic dependenciesand spread layer by layer to accounts, protocols, assets, and infrastructure.

However, the paper also notes thatEthereum is not without advantages. Although its attack surface is broader than Bitcoin’s, the Ethereum Foundation has relatively stronger research and community coordination capabilities. In the past, the Ethereum community has also driven large‑scale protocol coordination during extreme security incidents.

Therefore, the paper argues that, from an organizational capability perspective, Ethereum may actually find it easier than the more decentralized Bitcoin to drive PQC migration and the necessary mitigation measures.

 

05

All problems stem from ECDLP, so why doesn’t everyone just switch to PQC?

If the preceding quantum risks can ultimately be traced back to the same root,that is massive blockchain reliance ECDLP.Then a very natural question is,Why not directly replace these cryptographic algorithms with post‑quantum cryptography (PQC)?

The paper’s answer to this is actually very clear.

In the long run, PQC is indeed the fundamental solution. The author directly points out that to continuously and thoroughly address these quantum vulnerabilities, the “only lasting solution” is to upgrade the underlying cryptographic protocols to post‑quantum alternatives.

The difficulty lies in,knowing where to go and actually completing the migration are two completely different things.

The first level issue is PQC itself is not yet as mature as traditional elliptic curve cryptography.

Existing Post‑quantum cryptography (PQC) roughly includes various approaches based on lattices, hashes, codes, multivariate polynomials, isogeny maps, and others. However, these schemes are generally younger than the ECDLP cryptosystem and have undergone less cryptanalysis, real‑world attacks, and engineering deployment. The paper especially notes thatsome once‑promising post‑quantum schemes later encountered issues, for example SIDH has already been broken by classical attacks.

So, for blockchain, migration PQC is not as simple as “replacing the old algorithm with a completely vetted new one.” The new cryptographic system itself still needs to undergo continuous attacks and scrutiny.

The second-level issue is the performance cost is significantly higher.

Long‑term use of blockchain ECDLP, a very practical reason is that it is sufficiently efficient.Small public keys, small signatures, fast verification, and lower pressure on storage, bandwidth, and computation.

The paper points out that currently there is no a PQC signature that can fully meet these performance characteristics. Post‑quantum cryptography’s storage and computation costs are usually one or several orders of magnitude higher than traditional ECDLP.

The paper gives a very intuitive example:Algorand’s Falcon post‑quantum signature is about 1280 bytes, whereas  Bitcoin currently uses ECDSA signatures that are typically only  64‑73 bytes.

This means that once  Bitcoin switches to larger post‑quantum signatures, if the block size remains unchanged, each block will be able to contain fewer transactions, and throughput will decrease.

But expanding the block to accommodate larger signatures would increase the computational and storage resources required to run full nodes, raising the risk of network centralization. The paper specifically notes thatthe 2017 controversy over block size ultimately led to the Bitcoin Cash hard fork, showing how seemingly technical resource choices can easily become governance issues.

The third-level issue isblockchain has some special requirements for cryptographic protocols, so you can’t just pick any PQC algorithm replacement.

For example Ethereum’s PoS consensus requires efficient signature aggregation; some scaling solutions also rely on recursive proof aggregation. In other words, new PQC schemes must not only be “quantum‑resistant” but also meetbe fast enough, small enough, aggregatable, and compatible with existing consensus and scaling mechanisms.

This makes migration much more difficult than ordinary software systems.The Ethereum Foundation is currently researching post‑quantum signature schemes that can meet these requirements.

The fourth-level issue is After a protocol upgrade, assets do not automatically become safer.This is the point most easily overlooked.

Even Bitcoin and Ethereum already support PQC, but users still must proactively transfer assets from old quantum‑vulnerable addresses to new post‑quantum addresses.

Regarding Bitcoin, the migration scale is enormous. The paper estimates that, at the current transaction throughput, even if the entire Bitcoin network stopped processing other transactions and all blocks were used solely for moving assets, the migration could still takeseveral months.

So, the PQC migration cannot wait until quantum computers are already imminent to start.

The paper’s conclusion is,Ideally, migration should begin several years before a real quantum threat emerges.Otherwise, a large number of users will migrate assets simultaneously at the final stage, causing network congestion.

The fifth‑level issue is this is not just a technical upgrade, but a massive social coordination.

Millions of users need to know why they should migrate, wallets and exchanges also need to update their products; At the same time, PQC addresses and signatures need to be supported by default, and developers, miners, validators, node operators, and asset holders also need to reach a sufficiently broad consensus.

The paper therefore concludes,the technical and societal complexities involved in switching blockchain to post‑quantum signatures, which means the entire process is likely to take many years.

This is also why the author explicitly opposes“Wait until the timing of CRQC is completely clear before taking action.”

Because by the time that day arrives, it may already be too late. Moreover, the true capabilities of the most advanced quantum computers may not even be disclosed.

However, the paper does not consider  PQC migration to be impossible. On the contrary, there are already some real-world cases, such as QRL, Abelian, Mochimo, which have used PQC from the outset; Algorand, Solana, and XRP Ledger have also begun deploying or testing post‑quantum signature capabilities.

The real tricky part is,even if all active users have completed the migration, the problem is not completely resolved.

Because there is still a portion of assets that no one can proactively migrate.

The paper specifically mentions Bitcoin’s P2PK assets. Approximately 1.7 million BTC Long-term locked in such addresses, with a substantial portion not moved for years, leading to widespread speculation that some private keys may have been lost.

If the private key has truly been lost, the original holder cannot transfer these BTC to a PQC address,but future quantum computers may be able to reconstruct the private key from the public key.

This gives rise to a contradiction that is hard to resolve through pure technical upgrades:How can we let the true original owners retain their assets while preventing quantum attackers from recomputing private keys to take the assets?

The paper clearly states that there is currently no obvious Bitcoin upgrade proposal that can simultaneously meet both goals.

So,PQC addresses the cryptographic side, but the migration itself is a lengthy systems engineering effort.

It involves whether the new algorithm is reliable enough, whether the network can handle larger signatures, whether the protocol is compatible, whether users can migrate in time, whether the community can reach consensus, and what should ultimately be done with those dormant assets that can never be actively migrated.

Precisely because of this, the paper truly emphasizes that,The later the migration starts, the fewer real choices will ultimately be left for the blockchain community.

06

If millions of dormant BTC cannot be moved, what should be done in the end?

This is the part of the paper that finally delves into governance and property rights issues.

PQC can protect assets that are still in normal use and can be actively migrated, butif a BTC private key was lost long ago, who will complete the migration for it?

The paper notes that inevitably some quantum‑vulnerable assets cannot be migrated in time, and may even be impossible to migrate forever. This may be because the owners are unaware of the risk, or because the private keys have been lost.

These assets look like“sleep‑dead” on-chain. But once CRQC appears, the situation changes.

The current ownership logic of Bitcoin is essentially based on one premise:Anyone who knows the private key can control the asset, and others cannot derive the private key from the public key.

But quantum computing could precisely break this premise. In the future, the  main body of CRQC, could derive the private key from a public key. At that point, the Bitcoin protocol itself would be unable to determine:

Who signed this deal— the true original owner from decades ago, or the person who just computed the private key with a quantum computer?

So the essence of the dormant asset issue becomes amore challenging problem.After cryptography fails, how should digital property rights be redefined?

The paper’s judgment is quite straightforward.If If the Bitcoin protocol remains unchanged, these quantum‑vulnerable assets are likely to be cracked and transferred by entities possessing quantum capabilities. Simply relying on legal provisions that “quantum theft of coins is a crime” cannot truly prevent this from happening.

Therefore, the paper proposes that there are actually only a few types of choices for the community.

Method 1: Doing nothing is the simplest approach, just maintain the existing Bitcoin rules.

Whoever can ultimately compute the private key can spend these coins according to the protocol rules. The paper calls this Do Nothing. Its biggest advantage is that it does not change Bitcoin’s property‑rights rules at all, nor does it set a precedent that the community can confiscate private assets. 

But the consequences are equally obvious.Once CRQC emerges, a large amount of dormant BTC may eventually be seized by quantum computing owners. This could also cause market shock

If BTC that has not been circulating for a long time suddenly re‑enters the market, the increase in supply could put downward pressure on the price. 

However, the paper also notes that this does not mean millions of BTC would flood the market within a day. According to the paper’s resource estimates, even restoring all P2PK assets one by one could take months for a fast‑clock quantum computer and years for a slow‑clock machine.

Method Two: Direct Destruction

Another extreme approach is Burn.

The Bitcoin community can modify the protocol and set a deadline.If you have not migrated your old assets to quantum‑secure addresses before a certain time, then after the deadline, those old UTXOs will be permanently unspendable.

Doing this can fundamentally solve the problem of quantum attackers“picking up” dormant BTC,but the cost is also very high.

Because the protocol cannot determine whether a wallet that hasn’t moved in 20 years has truly lost its private key, or if a long‑term holder deliberately never moved it.

So Burn has a contradictory point:To prevent future quantum attackers from stealing assets, the protocol announces today that these assets are invalid.That is its biggest controversy.

It may protect Bitcoin’s monetary supply, but it would directly infringe on the property rights of some genuine holders and establish a precedent that the protocol can freeze private assets.

Third method: Do not destroy, but limit the rate at which they appear.

The third solution discussed in the paper is called Hourglass, the hourglass solution.

The idea is simple.Do not prohibit sleeping BTC is spent, but its re‑entry into circulation is limited in speed.

For example, it can be stipulatedthat each block can contain at mostonedormant‑asset spending transaction.

Thus, even if quantum computers could recover a large number of private keys, it would still be impossible to dump all millions of  BTC into the market at once.

It tries to strike a balance between two goals,one side is not directly confiscating assets,the other side is to avoid a massive release of dormant coins that could cause a severe supply shock.

But it still doesn’t solve the fundamental problem.If a quantum computer calculates a private key, why would it obtain these BTC?

Hourglass only controls the release rate and does not address ownership issues.

Method 4: Send these assets into a dedicated “recovery sidechain”

This is a more complex scheme proposed by the paper itself:Bad Sidechain—“Non‑performing Asset Sidechain”.

Its starting point is,the Bitcoin main chain cannot distinguish the original owner from a quantum attacker, butthe off‑chain world can sometimes provide additional proof of ownership.

For example, the true original holder may still retain the mnemonic, or may have previously registered some form of cryptographic proof of ownership.

Although a quantum attacker can derive the private key from the public key, they cannot recover the original mnemonic solely from that public key.Therefore, the paper proposes,the BTC recovered by a quantum computer does not go directly to the market but is first sent to a dedicated recovery sidechain. 

Handle ownership disputes there.

If someone can prove they are the original owner, the assets are returned to them; if no one claims them for a long time, they are handled according to pre‑established rules. This is actually very similar to the “bad debt bank” in traditional finance.

First isolate the problematic assets from the normal system, then gradually confirm the claims, ownership, and final attribution.

Compared to Do Nothing, Burn, and Hourglass, the paper argues that this approach theoretically has a better chance:Return assets to the true owners as much as possible while keeping value within the cryptocurrency ecosystem.

But the cost is that technical, legal, and political complexities will increase significantly.

So,What if the community never reaches a consensus? That’s why the second half of the paper starts discussing the government.

The author believes that relying solely on the Bitcoin community may not be able to fully solve the dormant asset problem. Because the internal interests of the community are highly misaligned,some people value property rights above all else, so they oppose Burn; whilelarge‑scale BTC holders worry that the release of dormant coins could cause a price shock; miners may prefer Do Nothing or Hourglass, because a large amount of dormant‑coin transactions means more fees.

So even though technically Burn and Hourglass can be implemented through a protocol upgrade, the biggest obstacle remains whetherthe Bitcoin community can reach consensus.

The paper even mentions that, in an informal poll at the 2025 Presidio Bitcoin Quantum Summit, the three proposals—Do Nothing, Burn, and Hourglass—received roughly comparable support.

This indicates that, so far, there is no answer that has been widely accepted by the industry.

The paper finally raises a more aggressive question: can it be treated as “digital dredging”?

If the Bitcoin protocol ultimately does not solve these assets,the paper argues that governments may have to face a reality:quantum computers will turn a large amount of previously immovable digital assets back into“movable assets”.

Thus the author proposesdigital salvage—数字打捞concept.It is analogous to shipwreck salvage, unclaimed property, or abandoned property regimes in the real world.

The government could design a regulated framework that allows quantum computers to recover these assets, after which the legal system would verify them:Which assets should be returned to their original owners; which can be deemed abandoned property; how much compensation the recoverer should receive; and how the remaining assets should ultimately be disposed of.

This system changes the rules.In the past Bitcoin’s rule is,private keyequivalent tocontrol.After entering the quantum era, it may have to becomeprivate keys can only prove“You can spend this money,” but it may not prove “you are the true legal owner.”

Because the original owner and a quantum attacker may both possess exactly the same valid private key. This is precisely what makes the dormant  BTC problem truly tricky.

So,the paper does not give a definitive answer,telling everyone“who should ultimately receive these 2.3 million BTC.”

But it actually provides four possible paths:

• Do nothing, let quantum capability determine the affiliation;

• Destroy in advance, completely block quantum recovery;

Limit the release speed to reduce market impact;

Establish a recovery mechanism to reassess true ownership using off-chain evidence.

If none of these solutions can reach a consensus before  CRQC is formed, then the paper concludes that the dormant asset problem is likely to remain unsolved even when the first truly attack-capable quantum computer appears.

By then, the truly difficult question may no longer be “Can a quantum computer break Bitcoin?”

InsteadWhen the mathematically defined private key for the first time no longer equals ownership in legal and social terms,should Bitcoin trust the code, or redefine property rights?

You might also want to see:

Is AI killing “traditional companies”?

What is it that 64% of people can never overcome in their lifetime?

A 6 billion acquisition that made a Suzhou father and son earn 94 billion

AI content enters the experience era—how does Loopit turn every idea into a playable world?