Whalesbook
A New Approach to Quantum Threats
New proposals for defending Bitcoin against future quantum computing threats are moving away from pre-scheduled freezes toward a reactive, incentive-based system. Spearheaded by a BitMEX Research paper, this shift relies heavily on assumptions about potential attackers' intentions, changing the overall risk assessment.
The Canary and the Bounty
The core of this new strategy is a 'canary' system. It would trigger network-wide restrictions on older, quantum-vulnerable Bitcoin wallets only after clear, on-chain proof of a quantum attack. This 'wait and react' method differs from proactive, fixed-timeline freezes like BIP-361. Instead, it places a small amount of Bitcoin into a special address. Spending these funds would signal an alert, freezing legacy wallets. A bounty system encourages users to fund this address, aiming to reward anyone who publicly demonstrates quantum capability instead of secretly using it for theft. The proposal also includes a 'safety window' of about a year, during which coins moved from vulnerable addresses would be unspendable, intended to deter stealth attacks. The system fundamentally assumes a powerful quantum attacker would choose to claim a bounty rather than attempt what could be history's largest financial theft. This reliance on an attacker's ethics contrasts sharply with Bitcoin's traditional design, which prioritizes preventing worst-case scenarios.
Assessing the Quantum Threat
Estimates for when quantum computers could break Bitcoin's cryptographic standards, like the Elliptic Curve Digital Signature Algorithm (ECDSA), have been lowered. While earlier forecasts predicted 10-15 years, recent research from Google Quantum AI suggests that breaking secp256k1 cryptography might require under 500,000 physical qubits – about 20 times fewer than previously thought. This implies a viable threat could emerge as early as 2029, or within the next three to five years. Quantum attacks do not threaten Bitcoin's proof-of-work mining directly; the vulnerability is in the digital signatures authorizing transactions. Over a third of Bitcoin in circulation, worth billions of dollars, is in addresses where public keys are already exposed, making them prime targets. Approximately 6.9 million BTC are considered immediately vulnerable. Other blockchain ecosystems are taking different routes: Ethereum is focusing on Account Abstraction and native post-quantum signature support, while Solana is exploring optional quantum-safe vaults. Bitcoin has previously adopted major upgrades, like the Taproot soft fork in 2021, showing its ability to evolve.
Criticism and Risks
Critics argue the proposed system is a dangerous gamble, fundamentally diverging from Bitcoin's security principles. If the bounty system fails and an attacker chooses theft, the network could face massive losses. This 'wait and react' approach risks both the disaster it aims to prevent and missing out on a proactive, though potentially restrictive, defense. The 'safety window' also adds friction for legitimate users, as coins moved during this period would be unspendable. Furthermore, past proposals for mandatory freezes, like BIP-361, faced criticism for being forceful and potentially confiscatory, impacting user control over private keys, especially for long-dormant funds. The urgency for solutions is amplified not just by quantum capabilities, but by the complex challenges of coordinating upgrades across a decentralized network for billions of dollars in assets.
Future Outlook and Industry Views
The debate over quantum threats and Bitcoin's defenses is heating up. Some analysts, such as those at Bernstein, see it as a standard upgrade challenge. Michael Saylor believes Bitcoin has plenty of time to adapt. However, revised qubit estimates and shorter attack timelines are increasing urgency, pushing the industry from theory to practical solutions. Developing and adopting post-quantum cryptography, alongside network upgrades and user migrations, will be key. The future path will require technical innovation, community agreement, and balancing proactive security with user freedom.