The Coinbase Quantum Advisory Council's June 2026 report, titled 'Post-Quantum Migration and Abandoned Coins,' has exposed a massive security challenge for digital asset investments. As researchers estimate that seven million Bitcoins are vulnerable to future quantum computing decryption, the industry faces an urgent debate over how to secure legacy, inactive addresses.
Quantum computing represents a major technological leap, promising to solve complex mathematical problems that are currently impossible for classical computers. However, this processing power also poses a significant threat to modern digital security systems, particularly the elliptic curve cryptography that secures the vast majority of blockchain networks. In June 2026, the Coinbase Independent Advisory Board on Quantum Computing and Blockchain released a detailed report titled "Post-Quantum Migration and Abandoned Coins." This paper addresses the long-term threat of quantum decryption, focusing on the difficult governance question of how to handle inactive or abandoned digital assets that are never migrated to quantum-safe addresses.
While the advisory board, composed of researchers from Stanford, UT Austin, and the Ethereum Foundation, reiterated that current quantum hardware does not pose an immediate threat, they argue that the time to prepare is now. Decentralized networks require significant coordination and time to implement updates, making early planning essential. The scope of the vulnerability is substantial, with the board estimating that approximately 7 million Bitcoin—representing over 33% of the total 21 million supply—are potentially vulnerable to future quantum attacks. This high percentage of vulnerable assets has raised concerns among institutional investors, who are beginning to assess the long-term risks to their digital portfolios.
The core challenge is not the technical migration itself, which is a solvable engineering task, but rather the governance of inactive coins. If a decentralized network updates its cryptographic standards to be quantum-resistant, active users can easily move their funds to new, secure addresses. However, millions of early or lost Bitcoins sit in legacy addresses where the owners may no longer have access to the keys or are unaware of the need to migrate. If these coins are left as-is, a future quantum computer could exploit their exposed public keys to steal the assets, potentially destabilizing the entire market. How the blockchain community decides to handle these abandoned coins will have significant implications for the future of digital asset investments.
Advanced quantum computing architectures present a long-term challenge to the elliptic curve signatures that secure modern cryptocurrency networks.
- Scale of Vulnerability: Approximately 7 million Bitcoin are quantum-vulnerable, representing over 33% of the total supply.
- Legacy Exposure: About 1.7 million BTC sit in early legacy P2PK addresses where public keys are directly exposed on-chain.
- Logical Qubit Benchmark: Breaking ECDSA-256 signatures requires between 1,200 and 26,000 fault-tolerant logical qubits.
- Primary Risk Timeline: Expert consensus places the emergence of a Cryptographically Relevant Quantum Computer in the 2030–2035 window.
- Governance Challenge: Blockchain communities must decide whether to freeze, protect, or rate-limit unmigrated legacy assets.
The 'Abandoned Coins' Dilemma: 7 Million BTC at Risk of Quantum Theft
To evaluate the scale of the quantum threat to Bitcoin, we must examine the distribution of vulnerable coins across the network. The Coinbase Quantum Advisory Council's report divides these vulnerable assets into two primary categories. The first consists of early legacy Pay-to-Public-Key (P2PK) addresses, which hold approximately 1.7 million BTC. In these early addresses, the public key is directly visible on the blockchain, making them highly vulnerable to a cryptographically relevant quantum computer. This category includes the oldest coins on the network, many of which belong to Bitcoin's founder, Satoshi Nakamoto, and are considered lost or abandoned.
The second category consists of approximately 5 million BTC that are vulnerable due to address reuse. Under Bitcoin's standard Pay-to-Public-Key-Hash (P2PKH) and newer output types, the public key is hidden behind a hash function until a transaction is made. If an address is used only once, a quantum computer cannot derive the private key because the public key is never exposed on-chain. However, if an address is reused to send multiple transactions, the public key is revealed during the first spend, leaving any remaining balance vulnerable to exploitation. This widespread practice of address reuse has exposed a significant portion of the Bitcoin supply to potential future theft.
“While implementing quantum-safe signatures is a solvable engineering challenge, the real dilemma lies in the governance of unmigrated coins. There is no correct answer here, and the Bitcoin community needs to be the one to decide.”
— Prof. Yehuda Lindell, Head of Cryptography at Coinbase, June 2026
This exposure highlights the governance challenges associated with a decentralized network. If the community decides to update the protocol to a post-quantum standard, active users can easily move their funds to new, quantum-safe addresses. However, unmigrated coins in inactive wallets represent a major security risk. If a quantum attacker were to compromise these addresses, they could dump millions of stolen Bitcoins onto the market, causing a price collapse. The community must balance the preservation of property rights with the need to protect the overall stability of the network, a debate that is likely to become more intense as quantum technology advances.
Logical vs. Physical Qubits: Deconstructing the Quantum Decryption Timeline
Understanding the timeline for the quantum threat requires distinguishing between logical and physical qubits. A cryptographically relevant quantum computer (CRQC) uses Shor's algorithm to calculate the prime factors of large integers, which allows it to break public-key signature systems like ECDSA. However, running these algorithms requires fault-tolerant logical qubits, which are constructed by combining multiple physical qubits to protect against noise and error. While current quantum processors possess between 1,000 and 1,500 physical qubits, they are not yet fault-tolerant, meaning they cannot perform the long calculations required to break cryptographic signatures.
Recent research has significantly reduced the estimated resources required to break ECDSA-256 signatures. Earlier models suggested that millions of physical qubits would be needed, placing the threat decades in the future. However, new circuit optimizations and error-correction protocols suggest that breaking ECDSA could be achieved with between 1,200 and 26,000 logical qubits. Depending on the physical-to-logical qubit ratio, this could require fewer than 500,000 physical qubits. This reduction in resource requirements has led many experts to narrow the expected window for a CRQC to 2030–2035, with some organizations recommending a migration target of 2029 to mitigate risks.
This technical timeline highlights the primary risks faced by digital asset investments:
- Harvest Now, Decrypt Later (HNDL): The practice where malicious actors store encrypted traffic today with the intention of decrypting it once quantum computers are available.
- Physical Scale Limits: Current hardware is limited by heat and error rates, though advances in superconducting qubits are accelerating progress.
- Algorithmic Optimizations: Continuous improvements in quantum software that reduce the number of qubits required to run Shor's algorithm.
While no quantum computer currently exists that can break Bitcoin's cryptography, the pace of development suggests that the threat is moving closer. For institutional investors, this timeline means that security measures must be implemented well before the mid-2030s. The risk of HNDL attacks is particularly relevant for sensitive financial data, making the transition to post-quantum standards an immediate priority for major financial institutions and digital asset custody providers.
Context: A "Harvest Now, Decrypt Later" (HNDL) attack represents an immediate threat even before a functional quantum computer exists. Because state actors and cybercriminals can record and store encrypted public data today, any information secured by classical algorithms could be decrypted retrospectively once quantum machines reach sufficient scale in the 2030s.
Technical Migration: How Blockchains Transition to NIST Post-Quantum Standards
Transitioning blockchain networks to quantum-resistant cryptography requires integrating new mathematical standards. In August 2024, the National Institute of Standards and Technology (NIST) finalized its first set of primary post-quantum cryptographic standards. These algorithms are based on mathematical problems that are believed to be difficult for both classical and quantum computers, such as lattice-based cryptography and hash-based signatures. The finalized standards include ML-DSA (formerly CRYSTALS-Dilithium) for digital signatures and ML-KEM (formerly CRYSTALS-Kyber) for secure key establishment, providing a foundation for post-quantum security.
Integrating these algorithms into existing blockchains presents significant engineering challenges. FQC signatures are much larger than legacy ECDSA signatures. For example, a standard ECDSA signature is roughly 64 bytes, whereas an ML-DSA signature is approximately 2,420 bytes, and an SLH-DSA signature is over 7,800 bytes. This increase in signature size means that transactions will require more data, reducing the throughput of the network and increasing transaction fees. Developers must design new compression techniques and block-space optimization protocols to prevent the transition from degrading network performance.
“We must begin technical migration to quantum-resistant cryptography immediately, independently of those governance decisions. Waiting is not an option for decentralized networks that require years to upgrade.”
— Justin Drake, Researcher at Ethereum Foundation and Board Member, June 2026
The table below compares the key characteristics of legacy and post-quantum cryptographic standards:
| Algorithm Standard | Quantum Resistance Efficacy | Signature Size (Bytes) | Public Key Size (Bytes) |
|---|---|---|---|
| Legacy ECDSA/Schnorr | Vulnerable to Shor's Algorithm | ~64 Bytes | ▲ Leading |
| NIST ML-DSA (Dilithium) | Lattice-Based Secure Efficacy | ~2,420 Bytes | ≈ Parity |
| NIST SLH-DSA (SPHINCS+) | Hash-Based Secure Backup | ~7,856 Bytes | ▼ Behind |
This comparison shows the trade-offs involved in the transition. While legacy ECDSA is highly efficient in terms of signature and key size, it lacks quantum resistance. ML-DSA provides strong quantum security but requires significantly larger signatures, while SLH-DSA offers a robust backup but is even bulkier. Developers must carefully balance these trade-offs to ensure that the updated blockchain networks remain efficient and cost-effective for users.
Drafting the Future: Inside the Proposals for BIP-360 and BIP-361
The Bitcoin developer community is actively discussing several proposals to address the quantum threat. Two key drafts, BIP-360 and BIP-361, outline a potential migration pathway and legacy signature sunset protocol. BIP-360 introduces a new quantum-resistant output type known as Pay-to-Merkle-Root (P2MR), which utilizes lattice-based signatures to secure transactions. This proposal would allow users to voluntarily migrate their funds to new, quantum-safe addresses, establishing a technical framework for post-quantum security on the Bitcoin network.
BIP-361 addresses the more controversial issue of legacy signatures. The proposal outlines a three-phase sunset protocol designed to encourage migration and secure the network. Phase A would prevent users from sending new funds to quantum-vulnerable legacy addresses, stopping the growth of exposed outputs. Phase B would invalidate legacy ECDSA and Schnorr signatures after a set period, effectively freezing any funds remaining in legacy addresses that have not been migrated. This controversial step is designed to prevent a future quantum computer from stealing these inactive assets, but it has sparked intense debate regarding property rights and network immutability.
The proposed transition steps outlined in BIP-361 include:
- Voluntary Migration Period: Users are encouraged to move their assets from legacy P2PKH/P2PK addresses to new, quantum-safe P2MR outputs.
- Legacy Address Sunset: The protocol disables deposit paths to legacy addresses, preventing further accumulation of vulnerable assets.
- Signature Invalidation: Legacy signatures are invalidated, freezing unmigrated assets to protect the network from quantum-scale theft.
These proposals highlight the difficulty of implementing major updates on a decentralized network. While some developers argue that invalidating legacy signatures is necessary to protect the network's stability, others contend that freezing inactive coins violates Bitcoin's core principle of immutable ownership. Achieving consensus on these proposals will require significant technical and social coordination within the Bitcoin community, showing that the quantum threat is as much a governance challenge as it is a scientific one.
Investor Checklist: Hedging Portfolio Risk Against the Quantum Threat
For digital asset investors, managing the quantum threat requires a proactive approach to risk management. While the emergence of a cryptographically relevant quantum computer is estimated to be several years away, the potential impact is severe enough to warrant early action. Institutional investors should begin auditing their custody providers to ensure that they are developing post-quantum migration plans. Custody solutions that rely on classical cryptography will need to upgrade their systems to support NIST standards like ML-DSA to protect client assets from future decryption risks.
In addition to auditing custody providers, investors should review their personal address usage to minimize quantum vulnerability. Avoiding address reuse is a simple and effective measure that prevents public key exposure on-chain, protecting assets from early-stage quantum attacks. By utilizing HD (Hierarchical Deterministic) wallets that automatically generate a new address for every transaction, investors can ensure that their public keys remain hidden behind hash functions, significantly reducing their exposure to quantum decryption risks.
A structured checklist for investors to manage quantum risk includes:
- Audit Custody Providers: Confirm that your exchanges and custodians are actively developing post-quantum migration pathways and support NIST FIPS standards.
- Avoid Address Reuse: Use hardware wallets that generate unique addresses for every transaction, preventing public key exposure.
- Monitor Developer Consensus: Track the progress of proposals like BIP-360 and BIP-361 to understand the timeline for legacy signature sunsets.
By following these guidelines, investors can protect their digital portfolios from the long-term risks associated with quantum computing. The space is evolving rapidly, and staying informed about developer consensus and cryptographic standards is essential for maintaining portfolio security. While the quantum threat is a significant challenge, it also represents an opportunity for the industry to upgrade its infrastructure, establishing a more secure foundation for the future of digital finance.
Conclusion: The Path to Quantum Resilience
The Coinbase Quantum Advisory Council's report highlights the need for the digital asset industry to prepare for the quantum threat. While functional quantum computers capable of breaking elliptic curve signatures are still in development, the scale of the vulnerability—with 7 million Bitcoins at risk—makes early preparation essential. Coordinating major protocol upgrades across decentralized networks requires years of development and testing. By prioritizing technical migration to NIST post-quantum standards like ML-DSA today, the crypto community can ensure the long-term security and viability of digital asset investments, protecting the network from future exploitation and maintaining investor confidence.
Sources and References
- Coinbase Independent Advisory Board on Quantum Computing and Blockchain - Position Paper on Post-Quantum Migration and Abandoned Coins (Published June 11, 2026): coinbase.com
- NIST (National Institute of Standards and Technology) - Finalized Post-Quantum Cryptography Standards (FIPS 203, 204, 205) (Published August 2024): nist.gov
- Bitcoin Improvement Proposals - Drafts for BIP-360 (P2MR) and BIP-361 (Legacy Signature Sunset) (Published June 2026): bips.dev
- Quantum Zeitgeist - Technical Resource Projections for Shor's Algorithm Against ECDSA: quantumzeitgeist.com
Post a Comment