Bitcoin’s potential quantum-computing threat is not just a question of replacing cryptographic algorithms. On October 13, crypto investor Nick Carter described an extreme scenario in an interview with Luke Martin: a future quantum computer capable of breaking Bitcoin keys could recover private keys for dormant coins and broadcast a wave of transfers within roughly 10 blocks. Large movements of early bitcoin could shake confidence in who controls those coins and how the network handles settlement, even before any sale takes place.
About 6.04 million BTC have exposed public keys
A May 20 analysis by Glassnode estimated that about 6.04 million bitcoin, or 30.2% of the supply issued at the time, had exposed public keys. The estimate includes active coins whose keys became visible after being spent or after address reuse, early outputs that expose public keys by design, such as P2PK, and some Taproot-related outputs.
The risk scenario assumes a sufficiently powerful quantum computer could use Shor’s algorithm to derive a private key from a public key and then produce an apparently valid spending authorization. Google has published research modeling the computing resources such an attack might require. There is, however, no evidence that anyone has recovered Bitcoin keys this way. Quantum key attacks remain a future risk, not an event that has occurred on the network.
Block space could still allow an attacker to move a large volume in a short period. Consider 50,000 early outputs holding 50 BTC each, for a total of 2.5 million BTC. Using the P2PK input example in Bitcoin developer documentation, those inputs would require about 5.7 million bytes, or roughly 22.8 million weight units before transaction overhead. Bitcoin’s block-weight limit allows a total of 40 million weight units across 10 blocks. If the transactions were split into batches and each kept within Bitcoin Core’s standard limit of about 400,000 weight units, the transfers could theoretically fit within that 10-block capacity.
Ten blocks would not guarantee a completed transfer
Whether transactions were included would depend on fees, network congestion and miners’ selection decisions. Bitcoin produces a block about every 10 minutes on average, so 10 blocks would typically take around 100 minutes, though the actual time can vary considerably. Script types, spending conditions and the number of receiving outputs would also affect the space needed for a mass transfer.
A quantum attack would transfer control of existing bitcoin; it would not create new supply. Visible, large-scale transfers could unsettle holders before any coins were sold. Whether that led to broader market volatility would depend on exchange responses, available liquidity and how market participants interpreted the coins’ origin. Exposed public keys, inactive holders, permanently lost private keys and the question of whether some early coins belong to Satoshi Nakamoto are distinct issues.
Security researcher Jameson Lopp estimated in a May 21 analysis that about 2.6 million bitcoin with exposed public keys might be impossible to migrate. His estimate used indicators such as long periods of inactivity and known entity labels. It does not establish that the coins are definitely beyond the reach of their rightful owners.
Safeguards could also restrict legitimate holders
Keeping existing spending rules would mean that anyone able to provide a valid private key could still spend the associated coins, including keys recovered by a future attacker. Restricting older signatures could have the opposite effect: legitimate holders who cannot move their coins in time or meet new recovery conditions might lose access. That is the central trade-off facing quantum defenses—improving security for unmigrated coins could also narrow the remedies available to some genuine owners.
The current BIP-360 draft proposes a Pay-to-Merkle-Root output type intended to remove a potentially key-exposing spending path in Taproot and reduce long-term exposure when the public key remains hidden. BIP-361 proposes a phased approach: restrict new vulnerable receiving destinations about three years after activation, then tighten the use of older signatures through recovery conditions roughly two years later. Google’s own cryptographic migration timeline sets 2029 as a precautionary target; it is not a Bitcoin consensus rule.
Some recovery proposals rely on a hardened wallet parent secret. Even if an attacker recovered the key for a particular spend, they would generally not thereby obtain that additional parent secret. For P2PK outputs, however, the draft’s authors still regard proof of ownership as an unresolved problem.
Proposed responses remain under discussion
On May 1, Dan Robinson proposed the PACT concept, which explores using privacy-preserving timestamps to prove control of an address. If future rules recognized that evidence, holders would need to prepare and retain the relevant proof before quantum key recovery became feasible. Its protective value would depend on verification standards being established and adopted across the ecosystem.
The Hourglass V2 draft, published in February, takes a more direct rate-limiting approach: no more than one P2PK spend per block, with net spending capped at 1 bitcoin per block. Such limits could slow a potential attacker’s outflows, but would apply to legitimate holders as well and could make large-scale migrations take longer.
None of these proposals has become a uniform Bitcoin network rule. Under the BIP process, changes would still need to be implemented in software, run by nodes and accepted across the ecosystem. Carter’s scenario ultimately raises a question of ownership: when an ordinary signature cannot distinguish an original holder from a quantum attacker, what evidence of control should Bitcoin recognize, and how should legitimate holders who could not migrate in advance be protected?