Bitcoin Magazine
The Quantum Issue: To Freeze Coins Or Not
Bitcoin’s quantum debate is quite a quagmire. This is not merely a technical debate regarding the trade-offs of different types of cryptography and their strengths against a theoretical quantum computer. It is a debate about which properties of Bitcoin’s ethos are strongest when it is faced with a difficult dilemma: uphold the promise that valid coins remain spendable by their owners, or favor supporting the security of the system by not allowing a significant portion of its monetary supply to be raided via a vulnerability that was well known for many years.
The conundrum at the crux of this controversy is that every serious option violates a principle that Bitcoin users care about. Doing nothing may preserve today’s consensus rules while allowing future quantum-capable actors to take coins whose owners never consented. Freezing vulnerable coins may prevent that theft, but it retroactively invalidates long-standing spending conditions. A forced migration to quantum-resistant signatures may be prudent engineering, but it can also look like a deadline-backed confiscation regime. The debate is ugly because there is no clean path that perfectly preserves property rights, economic predictability, censorship resistance, backward compatibility, and user sovereignty all at once.
This is why I consider the problem to be fascinating. It’s multifaceted: simultaneously technical, sociological, philosophical, and economic in nature. Thus any serious discussion of the problem must consider every angle.
Throughout this essay I’ll be making the case that the quantum migration debate is far more nuanced than just a question between freezing or not freezing vulnerable bitcoin. Rather, it’s a question of how to minimize total property-rights violations once elliptic curve signatures no longer reliably authenticate rightful ownership.
The Quantum Threat
Bitcoin’s current authorization scheme to ensure that funds are only spent by their rightful owners depends on elliptic-curve cryptography. Legacy ECDSA signatures and Schnorr signatures both use the secp256k1 elliptic curve. Under ordinary classical computing assumptions, deriving a private key from a public key is computationally infeasible. A cryptographically relevant quantum computer running Shor’s algorithm changes that assumption: once a public key is available, a sufficiently capable quantum attacker could derive the corresponding private key and sign a transaction to spend the funds that would be accepted as valid by the network. Quantum computers threaten to break the public-key-to-private-key hardness assumption behind ECDSA and Schnorr.
That distinction matters because not all Bitcoin outputs expose the same information at the same time. Some output types reveal a public key immediately and remain vulnerable indefinitely. Others hide the public key behind a hash until the owner spends. This creates two broad attack classes. A long-range attack targets outputs whose public keys are already visible on-chain, such as old pay-to-public-key outputs and Taproot outputs. A short-range attack targets coins at the moment of spending: the owner broadcasts a transaction, the public key becomes visible, and a fast quantum attacker attempts to derive the private key quickly enough to replace or front-run the transaction.
The mining threat is different. Grover’s algorithm can in theory speed up brute-force searching for a valid block hash, but it only provides a quadratic speedup while Shor’s algorithm provides a superpolynomial speedup. Thus the competitive advantage is far less practical to bother using a quantum computer for mining.
The Quantum Quantum Threat
Amusingly, the threat of quantum computers is itself in a quantum state of superposition. A quantum computer worth worrying about may or may not be built and no one can prove or disprove that it will happen. Quantum skeptics don’t dispute that Shor’s algorithm could break ECC. They claim there is no good reason to believe we will ever build the kind of powerful, fault-tolerant quantum computer needed to run Shor’s algorithm at a cryptographically relevant scale.
Everyone agrees that breaking ECC isn’t possible with today’s noisy quantum processors. It requires many reliable logical qubits, extremely low error rates, lengthy computations with high coherence, and quantum error correction running successfully at scale.
A strong skeptical argument is that the quantum fault-tolerance threshold theorem depends on assumptions that may not be physically satisfiable with the required precision. Such assumptions include sufficiently independent noise, sufficiently accurate gates, limited unwanted interactions, and the ability to keep errors below an acceptable threshold across a huge system. Mikhail Dyakonov argues that the theorem assumes idealized conditions and does not tell us the real engineering precision needed to satisfy every assumption in an actual device.
Gil Kalai’s criticism is more structural. His argument is that realistic quantum systems may suffer from correlated noise and noise accumulation that prevent the formation of high-quality quantum error-correcting codes. In his 2011 paper, he proposes that physical realizations of quantum codes, correlations in stochastic systems, and accumulated noise could lead to failure of scalable quantum computers.
This may be the strongest skeptic argument: quantum error correction works only if the noise is tameable. If real high-qubit systems generate adversarially correlated errors, then adding more qubits may very well make the computer more fragile and unreliable.
Quantum scalability is a major unknown. Skeptics argue that progress from 50, 100, or 1,000 physical qubits does not automatically extrapolate to millions of physical qubits or thousands of logical qubits. Quantum systems are analog, delicate, and coupled to their environment. The engineering challenge is not just “make more qubits”; it is “make more qubits while suppressing crosstalk, leakage, correlated errors, calibration drift, thermal effects, measurement errors, fabrication variation, and control noise.” This is why critics reject simple timeline extrapolations. They view “we increased qubit count by X this decade, so we will break ECC by year Y” as weak reasoning.
Finally, quantum computer demonstrations have shown that current devices can only outperform classical simulations on carefully selected sampling tasks. Critics have a good point that this says little about executing long, structured algorithms like Shor’s algorithm with enough reliability to recover a 256-bit ECC private key.
Why Post-Quantum Migration Matters
Assuming that a cryptographically relevant quantum computer appears, merely adding the option for Bitcoiners to use post-quantum cryptography won’t be sufficient to stop a quantum attack. The total set of quantum-vulnerable bitcoin includes early pay-to-public-key coins, coins controlled by reused public keys, Taproot outputs, and cases where public keys or extended public keys have been revealed outside the chain. One striking figure is the concentration of BTC in old P2PK outputs, which are a tiny fraction of UTXOs by count but represent a much larger share of value, about 1.7 million BTC. Broader estimates via on-chain analysis of output types, activity patterns, and known ownership lead us to believe that at least 2.6 million BTC would remain vulnerable even if all active Bitcoin users migrated their wallets to post-quantum cryptography.
As such, even with opt-in post-quantum (PQ) cryptography, we should expect there to be a systemic risk sized pool of vulnerable coins lingering indefinitely. These coins could be employed by a quantum attacker to harm the system in a wide variety of ways – not just via selling them and dropping the spot price of BTC. Thus, protecting those vulnerable coins from a quantum threat requires some sort of rule changes that would effectively “lock out” a quantum attacker.
The rhetoric around this issue often uses terms like “confiscation,” “burning,” “freezing,” “stealing,” or “recovery,” but these describe different mechanisms. A freeze would not transfer coins to the state, miners, developers, or some recovery fund. In its most basic form, it would mean changing consensus rules so that certain outputs can no longer be spent using vulnerable ECDSA or Schnorr signatures. That is why advocates sometimes say “burn” rather than “confiscate”: the coins are not reassigned; they become unspendable via their private key. But for a rightful owner who still has the original key, the practical effect can still feel confiscatory: a spend that used to be valid is no longer valid.
BIP-361 divides the migration concept into phases. First, once a quantum-resistant address type exists, the Bitcoin network would stop allowing new coins to be sent to quantum-vulnerable addresses. Later, after a multi-year window, legacy ECDSA and Schnorr spends would become invalid. Finally, there remains the question of recovery options for users who can prove, without solely relying upon broken ECC, that they are the legitimate owner – such as through a zero-knowledge proof derived from a seed phrase or HD wallet structure. The proposal’s primary purpose is not to pick a post-quantum signature algorithm; rather the goal is to create incentives and deadlines so that users, exchanges, custodians, wallets, and institutions actually migrate in a timely fashion and thus allow us to deprecate ECC in order to prevent a quantum attack.
The Case for Freezing
The strongest pro-freeze argument starts from a simple claim: a quantum attacker who derives a private key from a public key is not the legitimate owner in any morally meaningful sense. Under this view, “just let vulnerable coins be taken” is not neutrality; it is allowing a new class of actors to loot old outputs because the protocol failed to strengthen a lock that is known to be weak. Freeze advocates argue that the resulting harm from allowing quantum theft is not just to negligent owners but to all holders, because a successful quantum sweep would redistribute wealth to whoever possesses early quantum capability. This is problematic because that amount of bitcoin in a single actor’s hands who spent relatively little resources to obtain them can be quite dangerous for the ecosystem’s security. Bitcoin’s security model assumes economically rational participants that are incentivized to protect the value of their coins, but a quantum-capable actor has the potential to break that assumption. The pro-freeze position is that Bitcoin should not reward the first entities to break ECC with ammunition that could be leveraged to harm the system.
This argument is especially true for coins believed to be lost. If lost coins are suddenly recoverable by quantum attackers, the circulating supply effectively increases. That does not violate the formal 21 million cap, but it does change the economic landscape: coins that the market may have treated as inert can re-enter circulation, possibly rapidly and in concentrated hands.
The pro-freeze side also argues that the threat is not limited to ordinary profit-seeking. A quantum-capable adversary could attack Bitcoin politically, destabilize markets, undermine public confidence, grief the network for many years, or even acquire enough hashrate to 51% attack the network. Analysis of the game theory in play shows that we can’t simply assume an attacker sweeps vulnerable BTC to sell it and ride off into the sunset; there is a far wider range of strategies and undesirable outcomes.
A related argument is about market panic. Pieter Wuille’s comments in the mailing-list debate sharpen this point: the medium-term danger may be not only an actual cryptographically relevant quantum computer, but the credible belief that one may exist soon. If markets come to believe that a large share of Bitcoin’s supply can be seized at any moment, merely offering voluntary post-quantum outputs may not be enough to restore confidence. A credible plan to disable vulnerable spends could itself be a sufficient reassurance mechanism.
The pro-freeze camp also sees deadlines as necessary because voluntary migration is likely to be slow. People procrastinate; institutions move slowly; hardware wallets, exchanges, custodians, estate plans, multisig coordinators, and cold-storage procedures all need time to implement changes and plan for migrations. Matt Corallo has argued that Bitcoin should add a simple post-quantum capability well in advance of it being necessary, because wallets need to start embedding or committing to quantum-resistant public keys long before any later emergency decision about freezing vulnerable UTXOs becomes credible.
There is also a fiduciary responsibility argument. Public companies, ETFs, custodians, and exchanges will be unable to ignore a known migration deadline. A locked-in consensus change gives compliance departments and risk committees something concrete to act on. It also turns an abstract future threat into a project plan: upgrade software, generate new addresses, move funds, verify backups, communicate with customers, and complete migrations before a known date. BIP-361 explicitly argues that exchanges and custodians would face fiduciary and legal pressure to act once a deadline exists.
It’s also worth noting that all of this migration planning is applicable to more situations than just the emergence of a cryptographically relevant quantum computer. Most of the arguments in this debate apply to ANY situation where ECC is known to have been weakened. Generally speaking, cryptography tends not to withstand the test of time and any given cryptographic algorithm tends to be weakened over long time frames (decades) as researchers find flaws and develop new techniques that break prior assumptions.
Finally, freezing advocates argue that Bitcoin has always depended on users enforcing rules that protect the system as a whole. A soft fork that objectively disables a known-insecure spend path is not the same as arbitrary political confiscation, in their view. The proposed line is not “these people are disfavored” but “these script types require cryptography that no longer meets the bar for Bitcoin’s security assumptions.” If the rule is mechanical, objective, announced years in advance, and paired with a viable migration path, proponents argue that it is more akin to replacing a broken lock than blacklisting an owner.
Anti-freeze Arguments
The strongest anti-freeze argument starts with the opposite premise: Bitcoin’s social contract is that a valid coin remains spendable by the holder of the corresponding key under the consensus rules accepted when the coin was received. Retroactively invalidating that spend path crosses an inviolable line. It turns “not your keys, not your coins” into “not your upgraded-by-deadline, not your coins.” Even if no one else receives the frozen coins, the original owner loses practical control. That is why critics describe forced freezing as confiscatory, not merely protective.
This objection is not just sentimental. Bitcoin’s credibility depends heavily on the expectation that developers and node operators will not pick winners and losers among UTXO owners. A freeze aimed at “vulnerable coins” may be technically objective, but it still targets a subset of owners based on past address choices, wallet design, dormancy, or inability to act. Critics worry that once the network accepts retroactive invalidation for one reason, future coalitions may find other reasons: sanctions, theft recovery, inheritance disputes, state pressure, “obviously” lost coins, or other emergencies.
A second objection is that freezing cannot distinguish between lost coins, careless owners, dormant owners, imprisoned owners, dead owners with heirs, users in hostile jurisdictions, timelocked arrangements, forgotten cold storage, and deliberately long-term savers. Bitcoin has many users whose goal is to avoid being forced to stay online and responsive to policy changes. A person who stored coins safely for decades should not necessarily lose them because the rest of the network later declared their storage method obsolete. It’s worth noting that there is an incentive conflict between active current holders who benefit from reducing the effective supply and inactive rightful owners who may be unable to take action to defend themselves.
A third objection is uncertainty. A cryptographically relevant quantum computer may arrive later than expected, may not arrive in the form feared, may remain secret for some time, or may be countered by less drastic tools. If Bitcoin permanently burns millions of coins and the threat does not materialize on the assumed timeline, the network will have committed an irreversible self-inflicted property-rights violation. Critics therefore argue that premature freezing is worse than measured preparation.
A fourth objection is governance and legitimacy. Freezing vulnerable coins would be one of the most controversial consensus changes in Bitcoin’s history. Some have warned that announcing a freeze of old UTXOs could damage Bitcoin’s image more than a quantum attack itself and could produce a major fork in which one side accepts the freeze and another preserves old spendability. In that scenario, the “solution” creates a new political attack surface: exchanges, custodians, miners, and users must choose which chain’s property-rights model they prefer.
A fifth objection is legal risk. Some participants in the mailing-list debate warned that developers, companies, or miners involved in consciously changing code to freeze funds could face liability claims from owners whose coins become unspendable. Even if those claims ultimately fail, the legal process itself could chill development, divide institutions, and make consensus coordination harder.
A sixth objection is technical humility. Post-quantum cryptography is real, but not free. NIST has standardized ML-DSA, SLH-DSA, and ML-KEM, with more work continuing, yet Bitcoin has unusual constraints: every byte matters, verification cost matters, wallet compatibility matters, and consensus failures are catastrophic. Chaincode’s comparison of candidate schemes in their quantum deep dive report shows why the choice is not trivial: post-quantum signatures and keys can be much larger than Schnorr or ECDSA, and schemes differ sharply in maturity, signature size, public-key size, signing cost, verification cost, and assumptions.
That makes critics wary of forcing migration before the destination is mature. A bad post-quantum migration could reduce throughput, raise fees, bloat the UTXO or witness data burden, introduce new cryptographic assumptions, or force another migration later if the chosen algorithm weakens. Conventional Schnorr signatures are tiny compared with many hash-based post-quantum signatures, while lattice based cryptography has other trade-offs and maturity questions. On a related note, given the larger data sizes of signatures, this will increase the cost of transacting on chain and could price out less wealthy users.
Doing Nothing vs Doing Something
As I stated over a year ago in my first essay on this topic: if quantum computing becomes a threat to Bitcoin’s elliptic curve cryptography (ECC), an inviolable property of Bitcoin will be violated one way or another.
You’re probably familiar with the fundamental principle coined by Andreas Antonopoulos:
“Not your keys, not your coins.”
I posit that the corollary to this principle is:
“Your keys, only your coins.”
The point is that keys don’t merely authorize spending, but that signatures are supposed to be unforgeable evidence of control by the legitimate keyholder. A quantum-capable entity breaks the corollary of this foundational principle. We secure our bitcoin with the mathematical probabilities related to extremely large random numbers. Your funds are only secure because truly random large numbers are safe from being discovered by anyone else in the world.
The do-nothing position is often caricatured as “let quantum thieves steal everything.” Taking a noninterventionist stance against quantum theft is certainly principled: Bitcoin is a voluntary bearer asset governed by rules, and users are responsible for managing known risks. If a coin is encumbered by a script that becomes weak over decades, perhaps that is no different from losing a seed phrase, using weak entropy, trusting an insecure custodian, or failing to follow any number of other best practices. Under this view, the network’s job is not to guarantee the security of every historical locking script forever; rather it’s to enforce the rules as written.
This camp can also state that total supply is the only guarantee of the network, not effective circulating supply. The 21 million cap does not say “21 million minus coins assumed lost.” It says no more than 21 million coins will be issued. If a lost-looking coin later moves because its key is found, inherited, cracked through poor entropy, or recovered through quantum attack, the total issued supply has not changed. That argument is unsatisfying to people who see quantum funds sweeping as theft, but it is internally consistent: protocol rules define validity, not subjective moral beliefs about rightful ownership.
The do-nothing side also values operational simplicity. Any freezing rule requires defining what constitutes a vulnerable bitcoin redeem script, choosing activation dates, coordinating wallets and miners, communicating to users, handling edge cases, and absorbing political fallout. Doing nothing avoids a contentious consensus change. If post-quantum tools become available, users who care can migrate voluntarily, while users who do not migrate bear their own risk.
But the weakness of the “pure do-nothing” perspective is that it treats quantum theft as an individual-risk problem when it may actually become a system-risk problem. If enough coins are exposed, and if the market believes a capable attacker can use them to harm the ecosystem, the damage is not confined to owners who failed to migrate. It affects public confidence in the system which then cascades into negative pressure on the exchange rate, thermodynamic security (miner revenue,) and the revenue of many Bitcoin businesses. That is why even many people uncomfortable with freezing still support early preparation.
Apathetic “code is law” Bitcoiners are free to do nothing, but they should not delude themselves into thinking that they can stop others from trying to do something.
Alternative Proposals
Because “freeze all vulnerable UTXOs” and “do nothing” are both brutal in their own ways, much of the interesting work is in alternative proposals that would help users retain their property rights in the face of a quantum threat.
- We could prevent new vulnerable outputs while not yet freezing old ones. This is the least coercive part of forced migration. Once a safer output type exists, consensus or policy rules could discourage or even disallow sending bitcoin into vulnerable locking scripts. That reduces future damage without immediately invalidating old property claims. BIP-361 includes this as Phase A, and several critics are more open to this kind of forward-looking restriction than to permanent retroactive burns.
- Alternatively, the network could enforce a temporary lock rather than permanent burn. Boris Nagaev suggested that if old EC spends must be disabled, the lock could include a future re-enable height or some other mechanism that gives the community time to build recovery paths. Conduition explored how such a phase might interact with P2QRH/P2MR-like outputs and warned that simply banning all EC checks could accidentally affect hybrid constructions unless the rule is designed carefully. The appeal of a temporary lock is political as much as technical: it signals emergency containment rather than permanent confiscation.
- Another option is rate-limiting, represented by the Hourglass proposal. Hourglass V2 focuses on old P2PK coins and would restrict spending so that only one P2PK input could be spent per block, with a net limit of one BTC per block from those outputs. Its authors present it as a way to avoid both immediate burning and unconstrained quantum liquidation: coins are not destroyed, but their ability to flood the market is throttled. The proposal estimates that unconstrained P2PK sweeping could be extremely fast, while the one-BTC-per-block design would stretch full P2PK movement over decades.
Hourglass has its own critics. Opponents argue that it still violates permissionless spending by imposing special restrictions on a class of otherwise valid coins. It may also create a long-running race between legitimate owners and quantum attackers rather than resolving ownership. Some critics say that if the quantum threat is real, taking decades to clear exposed P2PK outputs gives attackers plenty of time; if the threat is not real, the rule is needless interference.
- There is the concept of commit-delay-reveal, sometimes discussed through Guy Fawkes-style constructions. The basic idea is that a user first commits to a future spend in a way that a quantum attacker cannot exploit immediately, waits for the commitment to become deeply confirmed, and later reveals the secret needed to validate the spend. This can prevent a short-exposure quantum attacker from seeing a public key and instantly stealing the coin before confirmation. Chaincode describes commit-delay-reveal as opt-in and potentially useful, while the Optech summary notes that these schemes can let safely spendable bitcoins avoid destruction and reduce migration urgency.
- Quantum safe funds recovery without EC signatures, especially for HD wallets, should be feasible. Or Sattath and others discussed “signature lifting” ideas where the owner proves knowledge of a seed or derivation path rather than proving control through the vulnerable public key. Olaoluwa Osuntokun built a proof-of-concept using zk-STARKs to prove that a Taproot BIP-86 output key was generated from a BIP-32 seed path. This would certainly be a last resort scenario for procrastinators to recover funds, given that the latest optimized version of the scheme requires a 200 KB proof. It would certainly price out recovery of small UTXOs, because a best case scenario would likely cost several hundred dollars in transaction fees but could easily run into the thousands or tens of thousands at higher transaction fee rates.
This recovery path is attractive because it changes the moral shape of the debate. If rightful owners can later recover frozen coins through non-EC proofs, freezing no longer has to mean permanent destruction. But the costs are serious: large proofs, complex verification, privacy leakage, wallet-derivation assumptions, inability to cover every historical wallet type, and the danger of adding novel cryptography to Bitcoin consensus. Critics of the zk-STARK approach emphasized that megabyte-scale proofs and multi-second verification times are difficult to reconcile with Bitcoin’s conservative design.Though further research is already finding optimizations that are more efficient.
- Dual-signature or market-driven migration. Marc Johnson and others suggested enabling quantum-resistant outputs, allowing optional dual signatures, giving fee or policy incentives, and letting users choose their own risk instead of imposing a hard loss deadline. This approach preserves property rights better than forced freezing, but it won’t solve the systemic-risk problem if too many high-value coins remain exposed.
Tricky Technical Trade-offs
The migration debate cannot be fully separated from the choice of quantum-resistant signatures because the size of signatures will affect the system throughput. NIST’s post-quantum standards provide a serious foundation: FIPS 204 standardizes ML-DSA, FIPS 205 standardizes SLH-DSA, and FIPS 203 covers ML-KEM for key establishment. But Bitcoin needs digital signatures and script-compatible ownership proofs, not just general-purpose cryptographic standards. A scheme suitable for TLS or government communications is not automatically ideal for a blockchain with limited block space and global verification requirements.
Hash-based signatures are conservative and appealing because their assumptions are simple, but they are large. Lamport-style signatures can be enabled in some form with script upgrades such as OP_CAT, but the Taproot key-path problem remains: if a Taproot output has a quantum-vulnerable key path, placing a Lamport signature in the script path does not make the whole output quantum safe unless the vulnerable key path is removed or disabled. BIP-347’s OP_CAT discussion explicitly notes this problem.
Lattice signatures such as ML-DSA offer more compact signatures than many hash-based options, but they bring different assumptions and implementation risks. Falcon-style signatures are compact but historically more delicate to implement. SPHINCS+/SLH-DSA is conservative but large. Experimental schemes may be attractive on paper but too immature for Bitcoin consensus. This is why a credible migration plan likely needs algorithm agility, test deployments, wallet experiments, careful fee modeling, and perhaps multiple acceptable post-quantum paths rather than a single rushed winner.
The block space problem is severe but not intractable. Chaincode estimates that migrating all UTXOs would take roughly 76 to 142 days if migration consumed all block space, and 305 to 568 days if it consumed 25% of block space. That is just raw migration throughput; it does not include human coordination, wallet upgrades, institutional approvals, support for air-gapped signing, hardware replacement, accounting workflows, etc.
A full timeline for UTXO set migration is measured in years, not weeks. Chaincode’s high-level estimate sketches a best case of roughly five years and a worst case closer to fifteen years for research, BIP work, implementation, deployment, and migration. The same report notes that in an emergency the timeframe could potentially be accelerated to 2 years, but historical emergency protocol fixes are not really analogous because the quantum migration problem touches every layer of the ecosystem.
The Ethics of Property Rights
The moral disagreement comes from two competing definitions of ownership.
The anti-freeze side supports a “code is law” perspective: ownership means control under the consensus rules. If an output is spendable by an ECDSA or Schnorr signature, then disabling that spend path violates the owner’s property rights. The network does not know whether a coin is lost, abandoned, inherited, intentionally dormant, or inaccessible for temporary reasons. Therefore, freezing is collective punishment imposed on a subset of users for failing to follow a new migration demand.
The pro-freeze side says ownership cannot mean “anyone who can break the cryptography gets the coin.” Bitcoin’s signatures are intended to authenticate the legitimate keyholder, not to create a prize for whoever first builds a machine that defeats the authentication scheme. If quantum capability turns public keys into private keys, then an EC signature no longer carries the same moral information it carried before. Under this view, refusing to freeze is not neutrality; it is a security failure to knowingly allow a compromised authentication mechanism to transfer wealth.
Both positions are coherent. The first protects rule stability and bearer-asset finality. The second protects the deeper intent of the locking script. The painful point is that Bitcoin’s consensus rules are the only practical arbiter. The protocol cannot read intent. It can only accept or reject transactions according to rules. Any attempt to encode “rightful ownership” after ECC breaks either becomes overly broad, relies on new proofs, or leaves some victims behind.
I submit that property rights have been violated on Bitcoin before. Allow me to introduce you to the Value Overflow Incident as it is commonly known.
On August 15 2010, it was discovered that block 74,638 contained a transaction that created 184,467,440,737.09551616 bitcoin for three different addresses. Two addresses received 92.2 billion bitcoins each, and whoever solved the block got an extra 0.01 BTC that did not exist prior to the transaction. This was possible because the code used for checking transactions before including them in a block didn’t account for the case of outputs so large that they overflowed when summed.
A new version of the client was published within five hours of the discovery that contained a soft-forking change to the consensus rules that rejected output value overflow transactions. The blockchain was forked. Although many unpatched nodes continued to build on the “bad” blockchain, the “good” blockchain overtook it at a block height of 74,691 at which point all nodes accepted the “good” blockchain as the authoritative source of Bitcoin transaction history.
The bad transaction no longer exists for people using the chain with the greatest cumulative proof of work. Therefore, the bitcoins created by it do not exist either.
Thus, from a pure property rights perspective, the person who followed the rules of the network at the time had their property confiscated from them because the overwhelming majority of other actors on the network considered their action to be undesirable and a threat to the network.
Anti-freeze folks will likely say that this is not a problem because the INTENT of protocol rules is what matters, and the intent was for the network to guarantee a maximum supply of 21 million BTC. I would tend to agree, and make the counter-claim that the INTENT of using ECC to secure BTC is to ensure that it’s infeasible for anyone to guess your private key.
Economic Stakes
A sudden sweep of funds by a quantum-capable entity could affect Bitcoin through several channels.
- Coins thought dormant would re-enter circulation, increasing the effective bitcoin supply.
- Markets could panic before any actual sweep if credible evidence appears that a CRQC exists or is near.
- Miners could be affected if price falls sharply, because their budget is tied to block subsidies and fees in BTC terms converted into operating revenue.
- Exchanges and other businesses could face operational stress and massive drops in revenue if customer deposits are exposed or if market structure breaks under uncertainty.
“Lost coins only make everyone else’s coins worth slightly more. Think of it as a donation to everyone.” – Satoshi Nakamoto
If true, the corollary is:
<p
