- Bitcoin developer Cory Fields has floated a scheme that would make a future quantum attacker lock up bitcoin as a bond before spending coins out of vulnerable addresses, with prepared owners able to claim the coins back and the bond with them.
- Most bitcoin is not exposed. The risk sits with addresses whose public key is already published on the : addresses that have been spent from, reused addresses, and the very old coins that paid straight to a public key, including Satoshi-era holdings.
- It is one person’s proposal. No consensus, no code in a Bitcoin Core release, no timetable, and no sign it has moved through the formal proposal process yet.
A quantum computer capable of breaking a bitcoin key doesn’t exist yet, and might not for years. One of bitcoin’s developers has been thinking about the day it does. His answer is unusual: don’t try to stop the attacker, make the attack a bet they can lose.
Nearly every quantum story you read is about timing, and timing is the one part nobody can give you a straight answer on. This proposal is about something you can act on now. Whether your coins would be exposed at all depends on a single thing: whether the public key behind your address has ever been published on the blockchain. For most people holding bitcoin in a wallet they’ve spent from, it has.
Knowing which of your coins sit in that category, and what moving them does and doesn’t fix, is worth more than any prediction about when the machines arrive.
What a quantum computer would actually break
Owning bitcoin means holding a : a secret number so large that guessing it is not a realistic activity. From that private key, a piece of maths produces a public key. From the public key, two rounds of hashing produce the address you hand out to receive coins.
Each step runs easily in one direction and not at all in the other. Going from private key to public key takes a fraction of a second. Going back the other way, with the computers we have, would take longer than the universe has been running.
A sufficiently large quantum computer running Shor’s algorithm would collapse that second direction. Given a public key, it could derive the private key. That is the whole of the threat, and it is narrower than the headlines suggest. Hashing is not affected in the same way. The best known quantum attack on a hash function, Grover’s algorithm, roughly halves the effective strength, which for bitcoin’s 256-bit hashing still leaves security margins nobody is worried about. is not the problem. Keys are.
Why most bitcoin is not exposed
Because an address is a hash of the public key rather than the key itself, coins sitting at an address that has never been spent from are hidden behind a wall quantum computers don’t climb. The attacker would see a hash, and no amount of quantum hardware turns a hash back into the thing that produced it.
The public key appears the moment you spend. Every ordinary bitcoin transaction publishes it as part of the proof that you were allowed to move the coins, and once published it is on the blockchain permanently. So an address you have spent from, and then left a balance in or sent coins back to, has its key on open display.
That is why address reuse, which is mostly discussed as a privacy problem, turns into an exposure problem here. The same applies to the oldest coins on the network. In 2009 and 2010 the common output type paid directly to a public key rather than to a hash of one, so those keys have been visible from the day they were created. The roughly one million coins attributed to Satoshi Nakamoto, attributed by pattern analysis rather than by anyone confirming it, mostly sit in exactly that form.
Published counts of how much of the supply is exposed vary quite a lot, because researchers draw the boundary differently. The direction is consistent: millions of coins, not a rounding error, and not the whole supply either.
The proposal, and what it tries to do
Fields’ suggestion, as reported, is that a future attacker wanting to spend from one of these vulnerable addresses would first have to post bitcoin as collateral. If the genuine owner has prepared in advance, they get a window in which to prove ownership, recover their coins, and take the attacker’s stake as well. The attacker is then gambling: every exposed address might be an empty one or might be a trap, and they cannot tell which from the outside.
We worked from Decrypt’s write-up rather than the original proposal, which we were unable to locate, so what we can describe is the shape of the idea rather than its specification. The economics are the point regardless. A quantum attack becomes a cost-benefit calculation rather than free money, and the more owners who prepare, the worse that calculation gets.
It is a different instinct from the other proposals circulating. BIP-360, a separate draft, goes at the problem from the front by defining new quantum-resistant address types for coins going forward. Other developers have argued for eventually making exposed coins unspendable, which protects the network’s supply at the price of freezing other people’s property, including Satoshi’s. Fields’ version confiscates nothing and asks nobody to be frozen out. It just makes the theft expensive.
An idea is not a plan
Bitcoin changes slowly and on purpose. A change is written up as a Bitcoin Improvement Proposal, argued over on the developer mailing list, implemented in client software, and then activated only if a large majority of miners and node operators choose to run it. Taproot, the last significant upgrade and a broadly uncontroversial one, was proposed in January 2018 and activated in November 2021.
Nothing in the reporting suggests this proposal has a BIP number moving through that process, code in a release, or a date attached to it. The gap between “a developer has published an idea” and “bitcoin is doing this” is where most crypto headlines quietly go wrong, and it is a gap measured in years even when everyone agrees.
Our own inference, labelled as such: the resistance would come from the parts of the ecosystem that carry the operational cost. Miners would be validating a more complicated class of transaction with delay windows attached, and large custodians sitting on exposed addresses would face a migration programme across they have deliberately designed to be slow to touch. Neither group gains anything from it today against a threat with no date on it. That is usually enough to stall a proposal.
What a UK holder can actually do
The practical step is unglamorous. Move coins to an address that has never been spent from, and don’t reuse it. That puts the hash back between your public key and the world.
Be clear about the limit, though. The protection ends at the moment you spend, because spending publishes the key. If the attack ever becomes real, the vulnerable window is the gap between broadcasting a transaction and it being confirmed, which is a much harder problem and one nobody has solved cleanly. Fresh addresses buy you the long-term protection, not the instant one. Most modern wallets already generate a new address for every receive, which is why people who haven’t thought about this at all may already be in reasonable shape. Our self-custody guide covers how that works in practice.
One UK-specific point, since it stops people doing anything at all: moving coins between wallets you own is not a disposal for capital gains tax purposes, so shuffling your own holdings to fresh addresses isn’t a taxable event. Network fees are the only cost. Our tax guide goes into the detail.
What to watch
Whether this acquires a BIP number and sustained mailing-list discussion, which is the first real signal that developers are taking a proposal seriously rather than finding it clever. Whether hardware and software wallet makers start treating address reuse as a security default rather than a privacy preference.
And the hardware itself, measured in logical qubits with error correction rather than the raw physical qubit counts that make the press releases. The cost estimates keep falling: we covered research recently that cut the estimated resources for breaking a key by roughly seventeen times on paper, which you can find in our earlier coverage. Nothing in that work put a machine in a room. It moved the goalposts, which over enough years is the same thing.