Nine firms form a Quantum Alliance as 6.4 million bitcoin sit in wallets with exposed public keys

What happened

Nine crypto companies unveiled a Quantum Alliance on Thursday to develop common security standards for bitcoin, Ethereum and other blockchain networks against a threat that does not yet exist. The group's concern is specific. Bitcoin spending is authorized by a digital signature tied to a pair of keys, one secret and one public. For a large set of older wallets, the public key is already visible on the blockchain. A sufficiently powerful quantum computer could, in theory, work backwards from that exposed public key to the secret key and spend the coins. The alliance estimates that 6.4 million bitcoin, or 30.2 percent of the supply, sit in wallets whose public keys have already been exposed. That figure includes about 1.1 million coins attributed to the network's creator, which have not moved in well over a decade.

The members named in the launch coverage include a security auditing firm, a foundation linked to a major blockchain founder's privacy network, a quantum resistant layer 1 blockchain and a post quantum research firm. The alliance plans to publish common security tests and guidance for moving existing networks to quantum resistant systems, so that a claim of being post quantum ready can be checked against a shared standard rather than taken on trust.

Two points in the launch were stated as plainly as the estimate itself. First, no existing quantum computer can do any of this today. The exposed coins cannot be stolen this way with any machine that now exists. Second, the members do not agree on when that changes. One alliance technologist said 2028 is a realistic date for a machine capable of breaking today's cryptography. Another said nobody knows the date, that the estimates keep falling, and that the right question for custodians is not whether the date is 2028 or 2035 but whether they could complete a migration in time if it arrives early. Recent research has reduced the estimates of the computing power an attack on bitcoin and Ethereum would need, which is part of why the timeline estimates keep moving closer.

The hardest question raised at the launch is not technical. If a capable machine is coming, what should happen to coins whose owners cannot or will not move them, including the creator's 1.1 million? One launch voice argued that whoever builds the first cryptographically relevant quantum computer will likely take those coins, potentially with a government's backing. Others have previously proposed freezing vulnerable coins before a machine can reach them, or placing them in a trust from which owners who can prove ownership could recover them. One alliance member said a preference for moving coins rather than freezing them, while another said freezing is a governance decision for the Bitcoin network rather than for the industry, and that any freeze would trade quantum risk for a precedent on property rights and neutrality. Critics of freezing argue it breaks the core promise that no one can confiscate a holder's bitcoin.

Why it matters

The value of the alliance is that it separates a narrow, real risk from a loose, false one. A future quantum computer would not break bitcoin in general. It would not change the supply rules, rewrite the transaction history or create coins. The exposed surface is the signature system protecting particular addresses, and within that surface only the addresses whose public keys are already visible. That is still a very large surface. At 6.4 million coins, it is nearly a third of all bitcoin that will ever exist, and it includes the most watched dormant holdings in the system. A theft of even a fraction of those coins, by whoever reaches the capability first, would be a market event and a legitimacy event at the same time.

The reason an alliance forms now, years before any capable machine, is that the fix is slow for reasons that have little to do with cryptography. Making bitcoin quantum resistant means replacing the signatures used to authorize transactions. That requires agreement among developers, miners, wallet providers, exchanges, custodians and users, the same coordination problem as any major protocol change, plus a physical migration in which holders move coins from exposed addresses to protected ones. One member put the cost question directly: there is no credible single number for what the migration costs, and the real cost is not the mathematics, it is coordinating the wallets, exchanges, custodians and protocol developers. Replacement signatures may also be larger, which would take more block space and could raise fees or reduce how many transactions the network processes. Researchers are already working on limiting that impact, but the trade off is part of the design problem, not a detail to settle later.

The freeze debate matters because it cannot be settled by the alliance, and the launch participants said so. A custodian protects its own clients' assets, not abandoned ones. Dormant coins have no custodian and, in the creator's case, no known living claimant who can move them. Any decision to freeze, move or place those coins in a trust is a decision about whether the network's rules can be changed to override a holder who has not consented, made by a community whose founding claim is that they cannot. That argument will be harder than the engineering, and it gets harder the longer it is postponed, because postponement is itself a decision to leave the coins exposed.

What to watch

Watch for the alliance's first published tests and guidance. A shared definition of post quantum readiness, with tests other projects can be measured against, is the concrete output that separates a standards body from a press release. Which networks submit to the tests, and how the largest ones score, will show whether the standard has weight.

Watch the research estimates. The timeline argument inside the alliance, 2028 against an unknown date, turns on how fast the estimated computing power needed for an attack keeps falling. Each new research result that lowers that requirement shortens the planning window the industry is assuming it has.

Watch for any formal proposal on vulnerable coins. Freeze, move and trust designs have all been discussed informally. The first proposal written as actual protocol text, with a rule for dormant holdings, is when the governance argument becomes real and when holders of old addresses will have to decide whether to move their coins while moving is still cheap and unhurried.

And watch the custodians. The alliance framed the practical question as whether a custodian could complete a migration in time if the threat arrives early. Public migration timelines, or their absence, from the largest custodians and exchanges will show how seriously the operational side of the industry is taking a risk that is, by everyone's account, not here yet.