This article envisions a future where quantum technology could potentially compromise Bitcoin’s cryptographic security. Research released by Google outlines the resources required for such an attack, although the recovery of Bitcoin keys has not been demonstrated in their findings. Nonetheless, large initial outputs could enable swift transfers based on block-space constraints.
Can millions of $BTC fit into 10 blocks?
A sufficiently advanced quantum computer could implement Shor’s algorithm to reverse-engineer private keys from public keys, granting unauthorized spending capabilities. Early pay-to-public-key (P2PK) outputs reveal these keys directly.
An assailant may execute an attack discreetly, withholding transactions until they are prepared, as outlined in Bitcoin Improvement Proposal 361 (BIP-361).
Bitcoin tracks assets through individual unspent outputs, each governed by specific spending conditions. The size of a transfer is influenced by the quantity and type of outputs involved.
Imagine a purely theoretical example involving 50,000 early outputs, each containing 50 $BTC, culminating in a total of 2.5 million $BTC. According to the Bitcoin developer documentation’s P2PK input example, these inputs would consume around 5.7 million bytes, translating to 22.8 million weight units prior to adding transaction overhead.
In Bitcoin’s framework, a maximum of 40 million weight units can be processed across ten blocks, adhering to its block-weight standards. Utilizing one compact receiving output per transaction batch means this theoretical collection could remain within limits, including overhead, when divided into transactions that comply with Bitcoin Core’s 400,000-unit weight maximum.
The actual space required for a transfer would hinge on its unique outputs and their spending requirements.
Fees, network traffic, and miners’ choices still govern transaction inclusion. Confirmation occurs only once miners add the transactions to blocks. With an average block generation time of about 10 minutes, ten blocks typically take around 100 minutes, but this time can vary significantly.
Glassnode’s exposure metric includes active holdings whose keys have been revealed through previous spending or address reuse, along with outputs that are structurally exposed, like P2PK and Taproot.
The issues of public-key exposure, inactive holders, and irreversible key loss are distinct subjects, as are questions surrounding Satoshi Nakamoto’s identity.
In an analysis conducted on May 21, security analyst Jameson Lopp estimated that approximately 2.6 million exposed $BTC could be immobile, utilizing inactivity and known-entity identifiers as indicators.
A quantum sweep would reassign control over existing coins without generating new ones. Such a visible transaction might unsettle holders before any direct sale, while responses from exchanges and market liquidity factors would shape any resulting market shifts.
Who could still affirm Bitcoin ownership?
Maintaining existing spending protocols enables transactions with valid keys, including ones potentially recovered by future attackers. Altering legacy signatures could jeopardize that arrangement: owners unable to migrate or meet recovery conditions may lose access to their assets.
Draft BIP-360 introduces Pay-to-Merkle-Root, a new output form excluding the exposed key spending pathway of Taproot, aiming to mitigate long-term exposure risks by keeping keys concealed.
BIP-361 suggests phased restrictions on new vulnerable recipients around three years post-activation, followed by tightening legacy-signature spending conditions through recovery measures approximately two years after.
In contrast, Google’s timeline aims for a migration deadline by 2029.
One potential recovery solution involves a parent secret stored in a wallet leveraging hardened key derivation. An attacker identifying a single spending key generally would not possess that additional secret. For bare P2PK outputs, the authors of the draft identify ownership verification as an unresolved challenge.
Dan Robinson’s PACT concept, proposed on May 1, investigates advanced, private timestamps as proof of address control. Future regulations could acknowledge this proof after the sunset of legacy systems, depending on the holder’s preparedness before quantum key recovery becomes viable and their ability to maintain the proof while adopting future verification rules.
The February Hourglass V2 draft suggests another method: one P2PK spend along with one $BTC of net spending per block. This throttling would limit the outflow while holding legitimate users to the same regulations.
These proposals and research concepts remain in development, each presenting trade-offs such as ongoing exposure, restricted access, and uneven recovery opportunities.
Through the BIP process, Bitcoin participants assess and adopt proposed amendments via software updates and support within the community.
Carter’s scenario highlights a critical decision: enabling safer destinations can safeguard holders capable of transferring assets. Ultimately, the Bitcoin community must choose which claims to uphold when standard signatures no longer differentiate between original holders and quantum attackers.