There's a number in Bitcoin that never makes it onto the podcasts: somewhere between 10 and 20 percent of circulating supply sits in outputs that expose their public keys on-chain. P2PK. Early Taproot. The Satoshi-era coins. Every one of them becomes a target the moment a cryptographically relevant quantum computer can run Shor's algorithm.
Nic Carter recently floated a hypothetical attack on Bitcoin. It has nothing to do with cracking ECDSA in real time. The scenario is simpler and uglier. A "more secure signature scheme" arrives, and with it an ownership-selection problem. Holders who can't migrate — or can't prove they control their coins — get locked out.
The code does not lie, only the audits do. Nobody has audited the social layer yet.
Bitcoin signs with ECDSA over the secp256k1 curve. Its security assumption is the elliptic-curve discrete logarithm problem. Shor's algorithm solves that in polynomial time on a sufficiently large quantum machine. That's not a debate. It's arithmetic.
The timing is the debatable part. A cryptographically relevant quantum computer — enough stable, error-corrected qubits — is generally treated as years away. The market prices that tail risk at close to zero. I've watched this cycle repeat. A Google or IBM qubit headline drops. Quantum FUD pulses for 72 hours. Liquidity rotates back into whatever narrative was already working.
The engineering problem isn't the algorithm swap. Post-quantum signatures exist and are standardized. Lattice-based schemes like Dilithium. Hash-based schemes like SPHINCS+. They're larger and slower than ECDSA, but they function.
The problem is that a signature scheme lives in the consensus layer. Changing it means a soft fork or hard fork, coordinated across miners, nodes, wallets, hardware wallet firmware, exchanges, and custodians. And every address type behaves differently under migration. P2PK and P2TR outputs expose the public key directly — crackable once Shor's is practical. P2PKH and P2WPKH hide the public key behind a hash. Unspent, they're comparatively safe.
That asymmetry is where the debate turns ugly. Migration urgency is wildly uneven across the UTXO set. A rule that forces migration creates winners and losers by construction.
Start with the taxonomy, because the analysis lives there.
Four categories of coins can't migrate cleanly. Each has different remediation logic. Most coverage lumps them together, which destroys the analysis.
First, coins whose private keys are permanently lost. Industry estimates run 3 to 4 million BTC. Nobody can prove control because nobody holds the key.
Second, coins whose holders are dead with no inheritance arrangement. Same practical outcome as the first category, different legal texture.
Third, coins whose holders won't expose identity for compliance or sanctions reasons. These holders have keys. They simply won't surface to migrate through a KYC-gated process.
Fourth, the Satoshi coins. Roughly 1 million BTC in early P2PK outputs. Social convention says they never move. A migration rule treating them as unmigrated and therefore invalid would be the most politically explosive decision in Bitcoin's history.
The lockout risk isn't a cryptography problem. It's a property-rights problem wearing a cryptography costume.
Here's the mechanism. If a quantum threat materializes, the community faces a forced choice. Do nothing, and exposed-key coins get stolen. Or set a migration deadline and invalidate everything that doesn't move. The first option transfers wealth to whoever owns the quantum machine. The second transfers wealth away from anyone who missed the window. Neither is neutral. Both are governance acts.
Now the part that rarely gets modeled. What happens to effective supply. If a lockout executes, those coins leave circulation permanently. Nominally deflationary. Supply-side bullish on the spreadsheet.
The spreadsheet is wrong. Bitcoin's core proposition is that your key is your coin — no third party revokes ownership. The moment the protocol demonstrates it can invalidate unmigrated outputs, that proposition becomes conditional. The asset stops being property and becomes a claim on a protocol's good behavior. Repricing that is not a supply question. It's a discount-rate question, and it moves the wrong way.
Run the numbers a different way. If 10 to 20 percent of supply is exposed-key and a lockout invalidates even half of it, that's roughly 1 to 2 million BTC removed from the effective float. On a supply-shock thesis, that's enormous. But supply shocks only work when demand is stable and property rights are intact. Remove the second condition and the first becomes irrelevant. You can't bull-case a supply cut that arrives through confiscation.
I spent three weeks in 2022 pulling apart the Terra death spiral on-chain, watching the peg break in real time. The lesson that stuck wasn't about algorithmic stablecoins. It was that the failure mode is never where the marketing points. Terra's risk lived in its liquidity structure, not its mechanism design. Bitcoin's quantum risk lives in its governance structure, not its curve parameters.
I audited smart contracts during the 2017 ICO boom — manually reviewed more than fifteen, found reentrancy holes in two live fundraising campaigns. My reports forced those teams to pause launches and patch. The lesson wasn't about Solidity. It was that trust is a technical variable, not a marketing claim. Every we're-audited claim I've verified personally turned out to be narrower than the dashboard implied. Bitcoin's quantum migration will run on the same dynamic. The community will be told the migration is safe and optional right up until the deadline makes it mandatory.
Risk Exposure
Counterparty risk: any custodian or exchange granted authority to prove control on behalf of users becomes a new center of power. Centralization disguised as convenience.
Smart contract risk: minimal in the direct sense. Bitcoin isn't a contract platform. But wrapped BTC on other chains inherits the trust assumption. If Bitcoin's security gets publicly questioned, WBTC-style assets reprice on the same doubt.
Governance risk: the dominant exposure. Bitcoin has no formal decision mechanism. Rough consensus works for fee policy and soft forks with clear technical merit. It has never been stress-tested against a rule that takes coins from identifiable holders.
Migration-tooling risk: hardware wallet firmware is a hard dependency. Ledger and Trezor determine how many retail users can actually migrate. That's a single point of failure nobody voted for.
So what is Carter actually describing? The phrasing — hypothetical attack — points at the social layer, not the silicon. The plausible mechanism: an actor weaponizes the quantum narrative to push a migration rule that either freezes unmigrated coins or races to migrate coins whose public keys are already exposed. Both use consensus rules as the weapon. No qubits required.
That's the insight most readers will miss. The threat model isn't a quantum computer stealing Satoshi's coins. It's the fear of quantum computers convincing the community to do something it can't undo.
Now the fork scenario. If a forced-migration rule gets pushed through without broad consensus, expect an Ethereum/ETC-style split. One chain invalidates unmigrated coins. One doesn't. Miners, nodes, and exchanges pick sides. Liquidity fragments. There's precedent. That outcome was decided by exchanges, not by developers. The market's memory of it is short.
The exchange layer decides this in practice, not in theory. If Binance and Coinbase announce migration tooling, retail follows. If they stay silent, the deadline is unenforceable for most holders. Custodians become de facto policy-makers. That's the centralization that never makes the governance slide.
Post-quantum chains have a structural advantage — no legacy UTXO set, no migration problem. They also have no liquidity, no hashrate, and no Lindy effect. Smart contracts execute logic, not intentions. And safety narratives don't beat network effects on any timeline that matters.
The consensus read is that quantum risk is a technical problem with a technical solution. Standardize a post-quantum scheme, ship a BIP, coordinate the fork, done.
That read is wrong, and it's wrong in a specific way. Bitcoin has solved hard technical problems before. SegWit, Taproot, difficulty adjustment. Each had clear technical merit and no distributional conflict. Quantum migration has both technical merit and a massive distributional conflict, because unmigrated and lost and deliberately dormant are indistinguishable at the protocol level.
The protocol can't tell the difference between a coin whose owner died and a coin whose owner is hiding. It sees an output. It sees a deadline. It executes.
Smart contracts execute logic, not intentions. A migration rule is a smart contract in the loosest sense — a deterministic rule applied to a state set. It will do exactly what it says. If the rule says invalid after block N, it means it. The intent behind the rule — protect holders — is irrelevant to execution.
The contrarian position: the safest quantum strategy might be the one that looks reckless. Voluntary migration with incentives, no deadline, no invalidation. Let exposed-key coins carry their own risk. Accept that some coins get stolen in a quantum scenario rather than build a rule that can take coins from anyone. The downside is bounded and individual. The alternative is unbounded and systemic.
Watch the BIP repository and the developer mailing lists. The signal isn't a quantum breakthrough. It's the first formal post-quantum signature proposal entering discussion. That's the moment the ownership question stops being hypothetical and becomes a governance fight with a deadline attached. Positions built on the assumption that Bitcoin's property rights are absolute need stress-testing now, not after the deadline.
The quantum computer isn't the threat. The rule we write to defend against it is.