Should Bitcoin Freeze Quantum-Vulnerable UTXOs? The Great Debate

Roughly 6.9 million BTC sit in addresses whose public keys are already visible on-chain. If a cryptographically relevant quantum computer (CRQC) arrives before those coins move, whoever controls that machine could derive the private keys and sweep the funds. That number includes an estimated 1.1 million BTC widely attributed to Satoshi Nakamoto. The question of what to do about these coins has become one of the most contentious governance debates in Bitcoin's history: should the network freeze quantum-vulnerable UTXOs before a CRQC can steal them, or would doing so violate the property rights that make Bitcoin worth protecting in the first place?

Why Some UTXOs Are Quantum-Vulnerable

Bitcoin's security rests on elliptic curve cryptography (ECC), specifically the secp256k1 curve used for both ECDSA and Schnorr signatures. A classical computer cannot feasibly reverse a public key into its private key. A quantum computer running Shor's algorithm could do so in polynomial time, given enough stable qubits.

Not all Bitcoin addresses are equally exposed. The vulnerability depends on whether the public key is visible on-chain before the owner wants to spend.

Hash-Protected vs. Exposed Addresses

Modern address formats like P2PKH and P2WPKH store a hash of the public key, not the key itself. The actual public key only appears on-chain when the owner signs a transaction to spend from that address. As long as the address is used only once, the public key is exposed only briefly in the mempool (roughly 10 minutes before confirmation), creating a narrow quantum attack window.

Other output types expose the public key from the moment of creation:

• P2PK outputs (used in Bitcoin's earliest blocks) store the raw public key in the output script
• P2TR (Taproot) outputs embed the public key directly in the witness program
• Bare multisig outputs list all participant public keys in the script

Address reuse is the primary driver: According to Project Eleven's research, address reuse accounts for 72.3% of the quantum-exposed supply (about 4.99 million BTC). Legacy P2PK outputs make up another 24.8%. Every time a user receives funds to an address they have already spent from, the public key remains permanently visible on the blockchain.

Scale of Exposure

Project Eleven's 110-page report published in May 2026 catalogued approximately 6.9 million BTC across 13.9 million addresses with exposed public keys. That represents roughly 33% of the circulating supply. A separate Glassnode analysis classified 1.92 million BTC (9.6% of issued supply) as "structurally unsafe," meaning it sits in output types that expose public keys by design, regardless of user behavior.

How Close Is the Quantum Threat?

No CRQC exists today. The largest quantum processors in 2026 operate with around 1,100 to 1,200 physical qubits without meaningful error correction. Breaking secp256k1 would require an estimated 1,200 logical qubits, translating to roughly 500,000 physical qubits with current error correction overhead, according to a 2026 study building on optimized circuit designs. That is a roughly 20-fold improvement over the 2023 Litinski estimate of 9 million physical qubits, which means the timeline is compressing.

Timeline Estimates

Expert surveys and modeling produce different forecasts, but they converge on the 2030 to 2040 window as the critical planning horizon:

• The Global Risk Institute survey (led by Michele Mosca) estimates roughly a 25% probability of a CRQC by 2030 and about 50% by 2035
• The "Quantum Horizon" paper on arXiv is more conservative: roughly one-in-six chance by 2035, near 30% by 2040, and about 60% by 2050
• NIST guidance deprecates vulnerable algorithms by 2030 and disallows them by 2035
• Project Eleven's report warns of a greater than 50% likelihood by 2033 and suggests "Q-Day" could arrive as early as 2030

The credibility problem: The danger may not require an actual CRQC. If the market believes one is imminent, holders of quantum-vulnerable coins face a harvest-now-decrypt-later dynamic: rational actors could begin acquiring vulnerable UTXOs at a discount, betting on future quantum capabilities. The mere perception of risk can cause sell pressure long before any key is actually cracked.

The Case for Freezing Vulnerable UTXOs

Proponents of a freeze argue that allowing a CRQC operator to sweep millions of BTC would be catastrophic for the entire network, not just for the affected holders.

Network Integrity

If 6.9 million BTC (worth over $580 billion at current prices) were suddenly moved by a quantum attacker, the resulting sell pressure could collapse the price and destroy confidence in Bitcoin's security model. Supporters of a freeze view it as protecting the network's monetary integrity: the coins are not being confiscated, they are being preserved until their rightful owners can prove ownership through a quantum-safe mechanism.

Precedent in Other Systems

Traditional finance routinely freezes accounts when security is compromised. Banks freeze cards after breaches; exchanges freeze accounts during suspicious activity. Proponents argue that a proactive freeze is better than a reactive crisis. BIP 361, a draft proposal published in April 2026 by Jameson Lopp and co-authors, outlines a three-phase migration plan that culminates in invalidating ECDSA and Schnorr signatures, effectively freezing any unmigrated quantum-vulnerable UTXOs.

Recovery Pathways

BIP 361's Phase C proposes allowing frozen coin owners to recover their funds using zero-knowledge proofs of ownership: for example, proving knowledge of a BIP-39 seed phrase without revealing it. This would allow legitimate owners to reclaim frozen coins through a quantum-safe verification method, even after ECDSA signatures are disabled.

The Case Against Freezing

Opponents argue that freezing coins sets a precedent that fundamentally undermines Bitcoin's value proposition. The objections are both philosophical and practical.

Property Rights and Immutability

Bitcoin's social contract has always been that valid spending conditions, once set, remain valid. A UTXO locked to a public key is spendable by whoever holds the corresponding private key: that is the protocol's promise. Retroactively invalidating those spending conditions changes the rules after the fact. Critics point out that if the community can freeze coins for "security reasons," the same mechanism could later be used for sanctions compliance, regulatory pressure, or political motivations.

The Slippery Slope

Opponents warn that a quantum freeze creates a template for future confiscation. Today the justification is quantum safety. Tomorrow it could be OFAC compliance, environmental concerns, or pressure from governments that disagree with specific holders. The censorship resistance property that makes Bitcoin valuable depends on the inability of any coalition to selectively disable spending rights.

Governance Fragmentation

A soft fork to freeze coins would require overwhelming consensus among miners, node operators, and the broader community. A contentious activation could split the chain, creating two competing versions of Bitcoin: one with frozen coins and one without. The TFTC editorial on the newly formed Quantum Alliance noted that no Bitcoin Core contributors are among its members, raising questions about whether any freeze proposal could gain the technical consensus needed for activation.

BIP-360 and BIP-361: The Migration Framework

Rather than debating whether to freeze, much of the technical community is focused on building the tools that make migration possible. Two complementary proposals form the emerging framework:

BIP-360: Pay-to-Quantum-Resistant-Hash

BIP-360 (originally called P2QRH, later renamed P2MR) was merged into the official BIP repository in February 2026. It introduces a new output type that removes the quantum-vulnerable key-spend path from Taproot while preserving tapscript functionality. BIP-360 does not add post-quantum signature algorithms directly: those are deferred to a future BIP. The structure is designed to support candidates like FALCON-512 (666-byte signatures) or SPHINCS+ (over 7,800 bytes) once standards and community consensus emerge.

BIP-361: Phased Deprecation

BIP-361 builds on BIP-360 by defining a timeline for phasing out vulnerable signature schemes:

• Phase A (three years after activation): blocks new sends to vulnerable address formats, forcing all new outputs into quantum-resistant types
• Phase B (five years after activation): invalidates ECDSA and Schnorr signatures entirely, freezing any UTXOs that have not migrated to quantum-safe addresses
• Phase C (timeline TBD): allows frozen UTXO owners to recover funds via zero-knowledge proofs of seed phrase knowledge

The Satoshi Problem

The most politically charged subset of the debate involves Satoshi Nakamoto's estimated 1.1 million BTC. These coins sit in early P2PK outputs spread across roughly 22,000 addresses, each protecting about 50 BTC. The public keys are permanently visible on-chain.

These coins present a unique challenge: they cannot be migrated to quantum-safe addresses without the private keys. If Satoshi is deceased or has lost access, those keys may be permanently unavailable. Under BIP 361's Phase B, these coins would be frozen. Under Phase C, recovery would require proving knowledge of the original seed, which may not exist in BIP-39 format since it predates that standard.

Binance co-founder Changpeng Zhao has suggested that wallets (including Satoshi's) that have not moved within 12 months should be frozen after a migration window. Critics view this as a targeted seizure wearing a security justification. Supporters counter that leaving 1.1 million BTC as a quantum honeypot creates systemic risk for every other holder.

The Quantum Alliance

In October 2026, nine blockchain firms formed the Quantum Alliance in Lisbon, aiming to develop universal quantum-resistance standards for blockchain networks. The alliance estimates 6.4 million BTC with exposed public keys and plans to work with the IETF on open migration and testing guidelines.

The alliance itself is divided on the freeze question. Postquant Labs' CTO supports migrating funds from vulnerable addresses, citing 2028 as a realistic window. The Vault's Bryn Bennett opposes freezing, arguing it conflicts with Bitcoin's core principles. The group has no Bitcoin Core contributors among its members, which limits its ability to directly influence protocol changes.

Alternative Approaches

The freeze-or-not binary obscures a range of intermediate options that the community is exploring:

Voluntary Migration with Incentives

Rather than forcing migration, the network could make quantum-safe addresses the default while offering fee discounts or priority for migration transactions. This preserves property rights while creating strong economic incentives to move. The risk is that dormant coins (including Satoshi's) would never migrate.

Commit-Delay-Reveal Spending

A commit-reveal scheme would require quantum-vulnerable spends to first commit to the transaction (hiding the public key), wait a delay period, and then reveal. This prevents a quantum attacker from deriving the key in real-time during the mempool window but does not protect coins whose public keys are already exposed on-chain.

Layer 2 Migration Paths

Off-chain protocols can provide migration infrastructure that avoids the contentious on-chain freeze debate. Spark's statechain model keeps keys off-chain: transfers change who can authorize spending without broadcasting public keys to the blockchain. Users who move funds into Spark rotate into fresh key material managed through FROST threshold signatures, where no single party holds a complete key and old key shares are destroyed after each transfer. This architecture sidesteps the quantum-exposed UTXO problem entirely because the on-chain footprint does not reveal individual user public keys.

As post-quantum signature schemes mature, Layer 2 protocols can adopt them for their off-chain signing operations without requiring a Bitcoin L1 soft fork, providing a faster migration path than waiting for BIP-360 activation. Developers building on Spark can explore the Spark SDK documentation for integration details.

What Happens If We Do Nothing

The do-nothing scenario has its own risks. If a CRQC arrives without any migration framework in place:

• 6.9 million BTC (over $580 billion) becomes immediately vulnerable to theft
• The attacker does not need to steal it all at once: even a credible demonstration on a small amount of quantum-vulnerable BTC could trigger panic selling
• Market confidence in Bitcoin's security model collapses, potentially dragging the entire cryptocurrency ecosystem down
• Emergency response under crisis conditions is far more likely to produce a contentious hard fork than a planned, deliberate migration

The harvest-now-decrypt-later threat makes this worse. Nation-state actors with quantum research programs may already be recording transactions involving quantum-vulnerable addresses, planning to derive keys once hardware matures. The exposed public keys are permanently available on the blockchain: there is no way to un-expose them.

The Core Tradeoff

The debate ultimately reduces to a single question: which is the greater threat to Bitcoin's value proposition?

Neither option is cost-free. The honest framing is that Bitcoin faces a governance challenge with no clean answer, and the community's ability to navigate it will define the protocol's resilience for decades to come. The best outcome may be a migration framework that gives owners years to act voluntarily, with a credible but distant freeze as the backstop: not because freezing is desirable, but because the alternative of doing nothing is worse.

For a deeper look at BIP-360's quantum-resistant address format and the broader post-quantum cryptography landscape for Bitcoin, see our related research. You can also explore the post-quantum cryptography and hash-based signatures glossary entries for technical background.

This article is for educational purposes only. It does not constitute financial or investment advice. Bitcoin and Layer 2 protocols involve technical and financial risk. Always do your own research and understand the tradeoffs before using any protocol.