Should Bitcoin freeze coins to stop quantum theft?

Why an attacker could look like the owner

A private keyPrivate keyThe secret number that lets you spend your bitcoin. Whoever knows it controls the coins, so it must never be shared. lets its holder sign a payment. The corresponding public keyPublic keyThe partner of a private key. It lets anyone check a signature without revealing the private key under current computing assumptions. lets everyone else check the signature. Bitcoin checks that proof; it does not ask who is at the keyboard. A thief who obtains the same private key can pass the same check.

A sufficiently capable quantum computerQuantum computer (qubit)A computer that uses quantum physics to solve some problems far faster than ordinary ones. Its working parts are called qubits. could derive a private key from its public key using Shor's algorithmShor's algorithmA method, published by Peter Shor in 1994, that would let a large quantum computer work out a private key from its public key.. No known machine can do that to Bitcoin's keys today. In March 2026, Google's quantum team estimated that it could take fewer than 500,000 physical qubits and a few minutes on a future machine. The estimate depends on assumptions about the hardware; it is not a demonstration or an arrival date.

The difficulty is what to do before such a machine exists. Leaving old coins spendable could let an attacker take them. Restricting them could also stop a legitimate owner who missed an upgrade. The Hourglass discussion makes the problem explicit: a rule cannot directly distinguish those two people from the old key alone.

Hiding a key buys time

Some coins expose their public keys while they sit unspent. These include P2PKPay-to-public-key (P2PK)The earliest kind of Bitcoin payment, which locked coins straight to a public key and left that key on show., an early payment format, and TaprootTaprootA 2021 upgrade that added Schnorr signatures and addresses starting bc1p, making complex payments cheaper and more private. outputs, whose addresses begin bc1p. An attacker could work on a visible key without waiting for its owner to spend.

Other payment formats hide the key behind a hashHash (SHA-256)The fingerprint of some data: a fixed-length output of the SHA-256 function, which Bitcoin uses for addresses, transaction IDs and mining., a fingerprint of the original data, until a spend reveals it. That protection depends on the key not having been exposed already, including through address reuseAddress reuseReceiving bitcoin more than once to the same address. It links those payments together publicly and can harm your privacy.. Once a payment is broadcast, a fast enough attacker might recover the key before it confirms.

BIP-360, a draft Bitcoin Improvement ProposalBIPA public document describing a proposed change to Bitcoin, or a standard that wallets can follow., would bring a version of Taproot's spending system without its exposed public key. Its authors explicitly limit that protection to keys that would otherwise be exposed for a long time. Protecting the short interval during a spend requires further changes, such as new signatures designed to withstand quantum attacks. BIP-360 does not supply those signatures by itself.

A deadline, with an unfinished way back

BIP-361 addresses migration. This draft by Jameson Lopp, a Bitcoin developer, and five co-authors assumes a future quantum-safe payment format is available. Its proposed timetable would stop new payments to vulnerable formats about three years after activation, then restrict spending with the old signatures about two years later. Neither countdown has started.

A possible rescue would ask for a different secret. In April 2026 developer Olaoluwa Osuntokun demonstrated a prototype in which an owner proves that a wallet seed generated a Taproot key, without revealing the seed. Recovering an exposed spending key does not automatically recover that seed. The approach depends on how the wallet derived its keys, including hardened derivation, which protects a parent key if a child key is exposed. It cannot cover every old standalone key.

No rescue rule has been adopted. BIP-361 leaves coverage unresolved, so its deadline raises two questions: whether wallets can migrate in time, and what happens to owners whose coins cannot use a rescue route. Having recovery words is not, by itself, an available procedure for claiming coins under these proposed rules.

Why developers disagree about a deadline

BIP-361's authors argue that waiting for a visible theft could mean waiting too long. An attacker could recover keys quietly and spend later, while exchanges, wallets and other services would need time to change their software. A deadline would give that work a common target.

Adam Back, who runs the Bitcoin company Blockstream, favours optional upgrades. He called existing quantum machines “essentially lab experiments”, CoinDesk reported, and pointed to Bitcoin's record of fixing urgent bugs quickly. A compulsory deadline would also affect owners who were away, ill or unaware of the upgrade, even if nobody had attacked their keys.

The two approaches put the risk in different places. Waiting preserves access under the existing rules but leaves exposed coins available to a future attacker. A deadline could prevent that theft while excluding some owners. Faster hardware would make the choice more urgent without resolving that disagreement.

Would slowing withdrawals solve it?

Hourglass offers another approach for P2PK coins: limit how quickly they can move. Its second version proposes a net limit of one bitcoin per block. It would leave a route to spend instead of imposing a complete freeze, but that route would also be available to a quantum attacker.

In the proposal's discussion, a participant calculated that moving 1.7 million bitcoins at that rate would take about 32 years. Competition for the limited space could drive up fees for genuine owners. The proposer expects informed owners to move before activation; coins left afterwards would still face the owner-versus-thief problem. A throttle limits the rate at which coins can leave. It does not establish who deserves them.

The work that can proceed before agreement

The bitcoin exchange Coinbase argues that developers can work on new signatures and ways to upgrade wallets while continuing to debate old coins. That separates two decisions: making a safer destination available, and deciding whether anyone should be compelled to use it.

The drafts have not changed Bitcoin's spending rules. Their unresolved question is what proof an owner should have to give once knowledge of an old private key may no longer distinguish them from a thief.