Quantum Bitcoin Attack Could Lock Out Some Owners

Nic Carter outlined a scenario in an Oct. 13 interview with Luke Martin in which a future quantum attacker recovers private keys linked to exposed Bitcoin and broadcasts transactions across 10 blocks. The movement of early coins could affect confidence in the network. No quantum computer has demonstrated the ability to recover Bitcoin keys.

The risk applies to coins whose public keys are visible on the blockchain. A May 20 Glassnode analysis counted 6.04 million BTC, or 30.2% of the then-issued supply, with exposed public keys. The figure includes coins spent from reused addresses, early pay-to-public-key outputs and some Taproot-related exposure.

Using Shor’s algorithm, a sufficiently powerful quantum computer could derive private keys from exposed public keys. An attacker could prepare transactions privately and broadcast them after recovering enough keys. Carter’s scenario assumes the transactions are released across 10 blocks.

A hypothetical sweep of 50,000 early outputs holding 50 BTC each would involve 2.5 million BTC. Using the Bitcoin developer reference’s example for pay-to-public-key inputs, the transactions would require about 5.7 million bytes, or 22.8 million weight units, before transaction overhead. Ten blocks have a combined limit of 40 million weight units.

The transactions would still need to comply with Bitcoin Core’s standard transaction-size limits, pay competitive fees and be selected by miners. Bitcoin produces a block approximately every 10 minutes, so 10 blocks would take about 100 minutes on average. The actual time could vary.

A quantum sweep would transfer existing coins rather than create new Bitcoin. Any market effect would depend on whether exchanges restricted the transactions, how much liquidity was available and whether holders sold before or after the transfers.

Several proposed changes address the risk. Draft BIP-360 would introduce Pay-to-Merkle-Root outputs that do not expose the same Taproot key-spending path. BIP-361 proposes restricting new vulnerable destinations about three years after activation and later limiting legacy-signature spending through rescue conditions. Neither proposal has been adopted.

Restricting legacy signatures could create a separate ownership issue. Under Bitcoin’s current rules, anyone with a valid private key can spend the associated coins, including an attacker who later recovers the same key with a quantum computer. Owners who fail to move their coins or meet new rescue requirements could lose access if the rules change.

One proposed rescue method uses a parent secret from a wallet with hardened key derivation. An attacker who recovers an individual spending key would normally not have that parent secret. The method does not readily establish ownership of bare pay-to-public-key outputs. Dan Robinson’s PACT concept explores private timestamp evidence that could show earlier control of an address.

In a May 21 analysis, Jameson Lopp estimated that about 2.6 million exposed BTC might be unable to migrate, using inactivity and known-entity labels as proxies. That estimate differs from the broader count of exposed coins. Neither figure establishes whether the coins belong to Satoshi Nakamoto or are permanently lost.

The Hourglass V2 draft proposes allowing one spend from each pay-to-public-key output and limiting net spending to 1 BTC per block. The restriction could slow a large transfer while applying to legitimate holders under the same rules. The proposals remain drafts and would require adoption by Bitcoin software users, miners, exchanges and other network participants.