Quantum Alliance Reportedly Forms as Bitcoin Exposure Estimates Remain Unsettled
Nine crypto companies have reportedly formed a Quantum Alliance to prepare blockchains for future quantum threats. But the group’s membership and plans are still unclear, and there’s no evidence it has protected the 6.4 million BTC cited in the headline.
- The alliance reportedly aims to develop quantum-resistant security standards.
- Estimates of bitcoin with exposed public keys vary and aren’t directly comparable.
- No existing quantum computer is known to be capable of deriving Bitcoin private keys.
- Preparing Bitcoin would require protocol work and, in many cases, users to move their funds.
What the Quantum Alliance is, and what it isn’t
CoinDesk reporting reproduced by Newscord says nine crypto companies have formed a Quantum Alliance to develop standards for quantum-resistant blockchain security. The reporting available so far doesn’t name the members or provide a founding announcement, charter, or detailed account of the group’s commitments.
That leaves a big gap between preparing for a threat and “shielding” specific coins. There’s no evidence the alliance has moved or secured any bitcoin, or that it can protect funds on behalf of their owners.
The 6.4 million BTC figure also isn’t supported by the estimates discussed below. Until its source and methodology are clear, it shouldn’t be treated as a verified count of vulnerable bitcoin.
What quantum computing could threaten
Bitcoin uses digital signatures to prove that someone with control of a private key has authorized a transaction. A public key is linked to that private key, but it can’t be used on its own to spend funds. The concern is that a sufficiently powerful quantum computer could use Shor’s algorithm to derive a private key from its corresponding public key, potentially letting an attacker spend funds controlled by that key.
This is a concern about signature security, not proof that quantum computers can break every part of Bitcoin’s cryptography. It also doesn’t mean a quantum attacker can spend coins today. No existing machine has been shown to be capable of deriving Bitcoin private keys.
Some Bitcoin outputs reveal their public keys directly. Older pay-to-public-key (P2PK) outputs, for example, include the public key in the locking condition. Other common outputs, such as pay-to-public-key-hash (P2PKH), hide the key’s full form until the owner spends. Reusing an address can reveal the public key after a spend. Any funds still tied to that same key could then face a future risk.
“Harvest now, decrypt later” is sometimes used to describe the concern. In this case, an attacker would record public keys already visible on the blockchain and might try to derive their private keys if a capable quantum computer becomes available. The keys aren’t encrypted. What’s uncertain is whether and when an attacker could calculate the private key from the public one. For a broader look at quantum threats to cryptocurrencies, it’s crucial to distinguish present-day risk from future capability.
Why estimates of exposed bitcoin differ
Published estimates don’t give us a single, consistent count. Spark.money attributes a Glassnode analysis to an estimate of 6.04 million BTC with exposed public keys: 1.92 million BTC from structural exposure, such as P2PK outputs, and 4.12 million from operational exposure, including address reuse.
Postquant.com reports a higher estimate of 6.7 million BTC, including 1.7 million BTC in older P2PK outputs whose private keys are presumed lost. Spark.money also cites a Deloitte estimate of about 4 million BTC in P2PK or reused P2PKH addresses, as well as a Chaincode Labs paper that gives a broader range of 4 million to 10 million BTC across vulnerability categories.
The figures may be based on different blockchain snapshots and definitions of exposure. The cited summaries don’t provide enough methodological detail to reconcile them or determine whether their categories overlap. They also describe different situations: a public key may be exposed while its owner still controls the funds, while a key presumed lost may mean no known owner can move the coins.
“Exposed” doesn’t mean “already stolen, ” “certain to be stolen, ” or “recoverable by an alliance.” Treat these figures as separate analyses, not as reliable lower and upper bounds for one agreed total.
Quantum timelines are forecasts, not deadlines
A cryptographically relevant quantum computer, or CRQC, is a machine powerful enough to break commonly used public-key cryptography at practical scale. No such computer exists today, and forecasts for its arrival vary.
Spark.money reports that 2022 NSA guidance placed the possibility of a CRQC between 2030 and 2035. It also cites the Global Risk Institute’s 2024 Quantum Threat Timeline, which found that most specialists expected a CRQC in the 2030s and put the probability of one existing by 2035 above 50%.
Richard Carback, CTO of Postquant Labs, reportedly considers 2028 a realistic date for a machine capable of breaking today’s cryptography. That’s one expert’s estimate, not a consensus timeline. Forecasts of a potential threat by 2030 can help organizations plan, but they aren’t delivery schedules.
Migration takes more than choosing a new signature
NIST finalized three post-quantum cryptography standards on August 13, 2024. ML-DSA and SLH-DSA are digital-signature standards, while ML-KEM is a key-encapsulation standard. The first two are more directly relevant to replacing the signature schemes used to authorize Bitcoin transactions.
Bitcoin would need more than a choice of algorithm. Developers would have to design and test protocol changes, wallets would need to support new output types, and users might need to move funds into those outputs. Moving dormant coins and funds whose owners have lost their keys would be especially difficult. Software can’t make an absent owner act.
Post-quantum signatures can also be much larger than today’s signatures. Spark.money offers an illustrative comparison: a 2, 420-byte ML-DSA-44 signature versus a 64-byte Schnorr signature. That doesn’t predict transaction size or fees across the board. The practical impact would depend on transaction format and implementation. Larger signatures could increase transaction weight and fees, and reduce how many transactions fit in a block.
The hard question: should vulnerable coins be frozen?
One proposal raised in the reported debate is to freeze coins considered vulnerable to a future quantum attack. That wouldn’t be a routine security patch. It would change which funds can be spent and raise difficult questions about ownership, lost keys, and who has the authority to change Bitcoin’s rules.
Carback reportedly favors moving vulnerable coins rather than freezing them. Bryn Bennett, chief revenue officer at The Vault, argues that a freeze would be a decision for the Bitcoin network, not private companies:
“A custodian protects its clients’ assets, not abandoned ones. Freezing coins is a governance decision for the Bitcoin network, not for the industry.”
A freeze might be framed as a way to prevent theft, but it could also penalize owners who can’t or don’t move their funds. It would set a consequential precedent for old coins and network rules. The reporting doesn’t show that the alliance has endorsed a freeze or that Bitcoin has adopted one.
Key questions about Bitcoin and quantum risk
-
Has the Quantum Alliance protected 6.4 million BTC?
There’s no evidence it has secured specific coins. The alliance is reportedly working on preparation and standards, while the reporting discussed here doesn’t establish a methodology for the 6.4 million figure.
-
Can quantum computers break Bitcoin today?
No existing quantum computer is known to be capable of deriving Bitcoin private keys. The concern is a potential future threat to certain exposed public keys, not an attack that’s happening now.
-
How many bitcoin have exposed public keys?
Reported estimates include 4 million, 6.04 million, 6.7 million, and a broader range of 4 million to 10 million. They use different methods and categories, so they don’t add up to one reliable range or definitive count.
-
Does an exposed public key mean the coins are lost?
No. Exposure could create a future risk if a sufficiently capable quantum computer becomes available, but it doesn’t make the funds spendable by someone else today. Some estimates also include old outputs whose keys are presumed lost, which is different from exposure alone.
-
What would Bitcoin holders need to do if the network adopts quantum-resistant outputs?
They may need updated wallet software and to move funds to compatible outputs, following whatever migration process Bitcoin adopts. Developers would first need to design, test, and coordinate the necessary protocol changes.
Quantum readiness is a real engineering and coordination problem for Bitcoin. But a reported alliance, a disputed exposure estimate, and plans to prepare don’t mean millions of BTC are protected. The practical work is to clarify what’s at risk, develop and test migration options, and be honest about what remains uncertain.
