Quantum Fixes Could Protect Bitcoin but Lock Out Legitimate Owners

Bitcoin's quantum debate goes beyond safer signatures

Plans to protect Bitcoin from future quantum computers may also create a problem for legitimate owners. A CryptoSlate analysis published Oct. 15, 2026, says that some proposed fixes could lock out holders who cannot move their coins or prove ownership in time.

The article is based on a worst-case scenario described by crypto investor Nic Carter in an Oct. 13 interview. In that scenario, a hostile actor uses a powerful quantum computer to recover keys to dormant Bitcoin and then spends those coins over 10 blocks.

Quantum computers do not pose this threat today. The scenario assumes a future machine able to break Bitcoin's key cryptography. Bitcoin key recovery has not been demonstrated by the research cited in the article.

Key numbers behind the scenario

• A modeled set of 50,000 early Bitcoin outputs, each holding 50 BTC and totaling 2.5 million BTC, could fit into 10 blocks under Bitcoin's block-weight rules, assuming key recovery and miner inclusion.
• Glassnode's May 20 analysis identified 6.04 million BTC, or 30.2% of then-issued supply, with public keys already exposed.
• Security researcher Jameson Lopp estimated in a May 21 analysis that about 2.6 million exposed BTC might be unable to migrate, using inactivity and known-entity labels as proxies.
• Ten blocks average roughly 100 minutes at Bitcoin's approximately 10-minute block interval, with substantial variation.

How a quantum sweep could work

A sufficiently powerful quantum computer could use Shor's algorithm to recover private keys from exposed public keys. A private key is the secret code that lets someone spend Bitcoin. Early pay-to-public-key outputs reveal those keys directly, and BIP-361 explains that an attacker could work privately and withhold transactions until ready.

Bitcoin tracks funds in individual unspent outputs, each with its own spending conditions. The article's 50,000-output example is explicitly hypothetical. Using the Bitcoin developer reference's P2PK input example, those inputs would need about 5.7 million bytes, or 22.8 million weight units before transaction overhead. Ten blocks have a ceiling of 40 million weight units. The illustrative set fits under that ceiling when split into transactions below Bitcoin Core's 400,000-unit standard weight limit.

An actual sweep would depend on its specific outputs and spending requirements. Fees, competing traffic, and miner decisions still determine whether transactions are included.

Exposure does not equal loss

Glassnode's exposure measure counts active holdings whose keys became visible through earlier spending or address reuse, along with structurally exposed outputs such as P2PK and Taproot. The article notes that public-key exposure, holder inactivity, and permanent key loss are separate questions, as is any attribution to Satoshi Nakamoto.

A quantum sweep would transfer control of existing coins without creating new issuance. A visible transfer could unsettle holders before a sale, while exchange responses and liquidity conditions would determine any market disruption.

Who could still prove ownership

Keeping existing spending rules intact preserves the ability to spend with a valid key, including one a future attacker recovers. Restricting legacy signatures changes that trade-off: owners who cannot migrate or meet rescue conditions could lose access.

Draft BIP-360 proposes Pay-to-Merkle-Root, a new output type without Taproot's exposed key spending path, which would reduce long-exposure risk when keys stay hidden. BIP-361 proposes phases that would restrict new vulnerable destinations about three years after activation, then tighten legacy-signature spending through rescue conditions about two years later.

One possible rescue relies on a parent secret in a wallet that uses hardened key derivation. An attacker recovering an individual spending key would normally lack that extra secret. For bare P2PK outputs, the draft's authors describe that kind of ownership proof as an unresolved problem.

For comparison, Google has set its own precautionary migration deadline of 2029.

What is still unclear

No quantum machine capable of breaking Bitcoin's key cryptography is known to exist, and no key recovery has been demonstrated. The article treats the 10-block sweep as a model, not a confirmed event. Whether specific owners could prove ownership or migrate in time remains an open question, especially for bare P2PK outputs.

Why it matters

The debate is not only about choosing stronger cryptography. The article says recovery would depend on holders' evidence and on how widely proposed protections are adopted. That means some legitimate owners could lose access even if the network itself is protected.

Sources

• CryptoSlate