Bitcoin Magazine

The Quantum Issue: To Freeze Coins Or Not

Bitcoin’s quantum debate is quite a quagmire. This is not merely a technical debate regarding the trade-offs of different types of cryptography and their strengths against a theoretical quantum computer. It is a debate about which properties of Bitcoin’s ethos are strongest when it is faced with a difficult dilemma: uphold the promise that valid coins remain spendable by their owners, or favor supporting the security of the system by not allowing a significant portion of its monetary supply to be raided via a vulnerability that was well known for many years.

The conundrum at the crux of this controversy is that every serious option violates a principle that Bitcoin users care about. Doing nothing may preserve today’s consensus rules while allowing future quantum-capable actors to take coins whose owners never consented. Freezing vulnerable coins may prevent that theft, but it retroactively invalidates long-standing spending conditions. A forced migration to quantum-resistant signatures may be prudent engineering, but it can also look like a deadline-backed confiscation regime. The debate is ugly because there is no clean path that perfectly preserves property rights, economic predictability, censorship resistance, backward compatibility, and user sovereignty all at once.

This is why I consider the problem to be fascinating. It’s multifaceted: simultaneously technical, sociological, philosophical, and economic in nature. Thus any serious discussion of the problem must consider every angle.

Throughout this essay I’ll be making the case that the quantum migration debate is far more nuanced than just a question between freezing or not freezing vulnerable bitcoin. Rather, it’s a question of how to minimize total property-rights violations once elliptic curve signatures no longer reliably authenticate rightful ownership.

The Quantum Threat

Bitcoin’s current authorization scheme to ensure that funds are only spent by their rightful owners depends on elliptic-curve cryptography. Legacy ECDSA signatures and Schnorr signatures both use the secp256k1 elliptic curve. Under ordinary classical computing assumptions, deriving a private key from a public key is computationally infeasible. A cryptographically relevant quantum computer running Shor’s algorithm changes that assumption: once a public key is available, a sufficiently capable quantum attacker could derive the corresponding private key and sign a transaction to spend the funds that would be accepted as valid by the network. Quantum computers threaten to break the public-key-to-private-key hardness assumption behind ECDSA and Schnorr.

That distinction matters because not all Bitcoin outputs expose the same information at the same time. Some output types reveal a public key immediately and remain vulnerable indefinitely. Others hide the public key behind a hash until the owner spends. This creates two broad attack classes. A long-range attack targets outputs whose public keys are already visible on-chain, such as old pay-to-public-key outputs and Taproot outputs. A short-range attack targets coins at the moment of spending: the owner broadcasts a transaction, the public key becomes visible, and a fast quantum attacker attempts to derive the private key quickly enough to replace or front-run the transaction.

The mining threat is different. Grover’s algorithm can in theory speed up brute-force searching for a valid block hash, but it only provides a quadratic speedup while Shor’s algorithm provides a superpolynomial speedup. Thus the competitive advantage is far less practical to bother using a quantum computer for mining.

The Quantum Quantum Threat

Amusingly, the threat of quantum computers is itself in a quantum state of superposition. A quantum computer worth worrying about may or may not be built and no one can prove or disprove that it will happen. Quantum skeptics don’t dispute that Shor’s algorithm could break ECC. They claim there is no good reason to believe we will ever build the kind of powerful, fault-tolerant quantum computer needed to run Shor’s algorithm at a cryptographically relevant scale.

Everyone agrees that breaking ECC isn’t possible with today’s noisy quantum processors. It requires many reliable logical qubits, extremely low error rates, lengthy computations with high coherence, and quantum error correction running successfully at scale.

A strong skeptical argument is that the quantum fault-tolerance threshold theorem depends on assumptions that may not be physically satisfiable with the required precision. Such assumptions include sufficiently independent noise, sufficiently accurate gates, limited unwanted interactions, and the ability to keep errors below an acceptable threshold across a huge system. Mikhail Dyakonov argues that the theorem assumes idealized conditions and does not tell us the real engineering precision needed to satisfy every assumption in an actual device.

Gil Kalai’s criticism is more structural. His argument is that realistic quantum systems may suffer from correlated noise and noise accumulation that prevent the formation of high-quality quantum error-correcting codes. In his 2011 paper, he proposes that physical realizations of quantum codes, correlations in stochastic systems, and accumulated noise could lead to failure of scalable quantum computers.

This may be the strongest skeptic argument: quantum error correction works only if the noise is tameable. If real high-qubit systems generate adversarially correlated errors, then adding more qubits may very well make the computer more fragile and unreliable.

Quantum scalability is a major unknown. Skeptics argue that progress from 50, 100, or 1,000 physical qubits does not automatically extrapolate to millions of physical qubits or thousands of logical qubits. Quantum systems are analog, delicate, and coupled to their environment. The engineering challenge is not just “make more qubits”; it is “make more qubits while suppressing crosstalk, leakage, correlated errors, calibration drift, thermal effects, measurement errors, fabrication variation, and control noise.” This is why critics reject simple timeline extrapolations. They view “we increased qubit count by X this decade, so we will break ECC by year Y” as weak reasoning.

Finally, quantum computer demonstrations have shown that current devices can only outperform classical simulations on carefully selected sampling tasks. Critics have a good point that this says little about executing long, structured algorithms like Shor’s algorithm with enough reliability to recover a 256-bit ECC private key.

Why Post-Quantum Migration Matters

Assuming that a cryptographically relevant quantum computer appears, merely adding the option for Bitcoiners to use post-quantum cryptography won’t be sufficient to stop a quantum attack. The total set of quantum-vulnerable bitcoin includes early pay-to-public-key coins, coins controlled by reused public keys, Taproot outputs, and cases where public keys or extended public keys have been revealed outside the chain. One striking figure is the concentration of BTC in old P2PK outputs, which are a tiny fraction of UTXOs by count but represent a much larger share of value, about 1.7 million BTC. Broader estimates via on-chain analysis of output types, activity patterns, and known ownership lead us to believe that at least 2.6 million BTC would remain vulnerable even if all active Bitcoin users migrated their wallets to post-quantum cryptography.

As such, even with opt-in post-quantum (PQ) cryptography, we should expect there to be a systemic risk sized pool of vulnerable coins lingering indefinitely. These coins could be employed by a quantum attacker to harm the system in a wide variety of ways – not just via selling them and dropping the spot price of BTC. Thus, protecting those vulnerable coins from a quantum threat requires some sort of rule changes that would effectively “lock out” a quantum attacker.

The rhetoric around this issue often uses terms like “confiscation,” “burning,” “freezing,” “stealing,” or “recovery,” but these describe different mechanisms. A freeze would not transfer coins to the state, miners, developers, or some recovery fund. In its most basic form, it would mean changing consensus rules so that certain outputs can no longer be spent using vulnerable ECDSA or Schnorr signatures. That is why advocates sometimes say “burn” rather than “confiscate”: the coins are not reassigned; they become unspendable via their private key. But for a rightful owner who still has the original key, the practical effect can still feel confiscatory: a spend that used to be valid is no longer valid.

BIP-361 divides the migration concept into phases. First, once a quantum-resistant address type exists, the Bitcoin network would stop allowing new coins to be sent to quantum-vulnerable addresses. Later, after a multi-year window, legacy ECDSA and Schnorr spends would become invalid. Finally, there remains the question of recovery options for users who can prove, without solely relying upon broken ECC, that they are the legitimate owner – such as through a zero-knowledge proof derived from a seed phrase or HD wallet structure. The proposal’s primary purpose is not to pick a post-quantum signature algorithm; rather the goal is to create incentives and deadlines so that users, exchanges, custodians, wallets, and institutions actually migrate in a timely fashion and thus allow us to deprecate ECC in order to prevent a quantum attack.

The Case for Freezing

The strongest pro-freeze argument starts from a simple claim: a quantum attacker who derives a private key from a public key is not the legitimate owner in any morally meaningful sense. Under this view, “just let vulnerable coins be taken” is not neutrality; it is allowing a new class of actors to loot old outputs because the protocol failed to strengthen a lock that is known to be weak. Freeze advocates argue that the resulting harm from allowing quantum theft is not just to negligent owners but to all holders, because a successful quantum sweep would redistribute wealth to whoever possesses early quantum capability. This is problematic because that amount of bitcoin in a single actor’s hands who spent relatively little resources to obtain them can be quite dangerous for the ecosystem’s security. Bitcoin’s security model assumes economically rational participants that are incentivized to protect the value of their coins, but a quantum-capable actor has the potential to break that assumption. The pro-freeze position is that Bitcoin should not reward the first entities to break ECC with ammunition that could be leveraged to harm the system.

This argument is especially true for coins believed to be lost. If lost coins are suddenly recoverable by quantum attackers, the circulating supply effectively increases. That does not violate the formal 21 million cap, but it does change the economic landscape: coins that the market may have treated as inert can re-enter circulation, possibly rapidly and in concentrated hands.

The pro-freeze side also argues that the threat is not limited to ordinary profit-seeking. A quantum-capable adversary could attack Bitcoin politically, destabilize markets, undermine public confidence, grief the network for many years, or even acquire enough hashrate to 51% attack the network. Analysis of the game theory in play shows that we can’t simply assume an attacker sweeps vulnerable BTC to sell it and ride off into the sunset; there is a far wider range of strategies and undesirable outcomes.

Source: BitcoinMagazine