Who Can Freeze 6.4 Million BTC, and by What Right?
On 16 October, nine crypto companies —among them Hacken, Charles Hoskinson’s Midnight Foundation, Quantus and Postquant Labs— launched the Quantum Alliance with one hard number attached: 6.4 million bitcoin, 30.2% of the supply, already have their public key exposed on chain. Roughly 1.1 million of those are attributed to Satoshi Nakamoto. At the $81,600 BTC was trading at that same week, that’s some $520 billion which, the day a cryptographically relevant quantum computer exists, will be mathematically available to whoever owns it.
The interesting part of the launch wasn’t the consensus, it was the disagreement. Members don’t agree on timing —Richard Carback, CTO of Postquant Labs, argues 2028 is a realistic horizon; others put it at 2035 or declare it unknowable— but that’s the least relevant dispute. The one that matters is the other: whether those vulnerable coins should be frozen, forcibly moved, or placed in a trust from which owners could reclaim them by proving ownership. In other words, whether a private consortium can propose expropriating other people’s assets for their own good.
Nobody owns the problem
Bryn Bennett, chief revenue officer at The Vault, put it with a precision most of the coverage skipped over:
Nobody owns that problem, and that’s the problem. A custodian protects its clients’ assets, not abandoned ones. Freezing coins is a governance decision for the Bitcoin network, not for the industry. Any freeze would trade quantum risk for a precedent on property rights and neutrality.
That sentence describes an institutional hole, not a technical one. Post-quantum cryptography exists: NIST has standardised resistant signature algorithms and there are proposals on the table for Bitcoin. What doesn’t exist is anyone with the legitimacy to decide what happens to UTXOs whose owners can’t or won’t respond. Changpeng Zhao has suggested freezing Satoshi’s 1.1 million if they remain untouched as the technology advances. Jameson Lopp has floated restrictions on vulnerable coins. Both proposals are defensible from the standpoint of system security, and both violate the promise that defines the asset: that nobody can confiscate your bitcoin.
There’s a cruel asymmetry baked into the design. Modern payment formats hide the public key behind a hash until the moment of spending, which offers some protection. But the oldest coins —the Satoshi-era ones, paid directly to public key— have had their key exposed since they were mined. And moving them to a quantum-resistant scheme requires the current private key. If it was lost, the owner can’t migrate even if they want to. For that subset, the vulnerability is structurally irreparable without outside intervention. That’s the point where a technical decision becomes a decision about property.
The hardware is moving without sending a price signal
That same day, Google published a result in Science on its Willow chip that the crypto industry read far too quickly: a roughly 40-fold error reduction in preparing so-called magic states, with fidelity around 99.99% among the states that passed inspection.
It’s worth understanding what that means, because it does not make attacking Bitcoin forty times cheaper. A quantum computer bundles many physical qubits into logical qubits capable of detecting and correcting errors. For certain operations, those logical qubits consume magic states, which are spent on use and have to be manufactured continuously throughout the computation. The original article’s analogy is a good one: a kitchen where every dish needs a sauce that can’t be reused, and part of the staff never cooks at all, they only make sauce. Hardware dedicated to producing magic states is hardware that isn’t running the attack.
That’s why the real bottleneck in a modelled attack isn’t just qubit count, but sustaining something like 500,000 reliable magic states per second. Google’s experiment had a preparation success rate of just 8%. We’re a long way off. But the advance is one of method, not scale: it improves precisely the part almost nobody was counting when estimating how big the machine needs to be. Resource estimates have been falling, and they’re falling from the direction nobody was watching.
Here’s where the epistemic problem turns this into a geopolitical matter and not merely an engineering one. Markets price in public information. A state that reached cryptographically relevant capability before anyone else would have every incentive not to announce it: the value of that capability lies in its secrecy. Christopher Smith, CEO of Quantus, said it bluntly: whoever gets the first CRQC will most likely keep those coins, “probably with the blessing of whichever national government applies.” His coda —”hopefully it’s a government that likes bitcoin”— is less a joke than a description of the risk regime: protection of the asset would come to depend on the political preferences of a state actor.
AI as an archaeologist of inherited trust
That state opacity around cryptographic capability is not a paranoid hypothesis was underlined this week by a third event. An internal Anthropic model solved in under half an hour a 25-year-old mystery: the origin of the five seeds the NSA handed NIST in the nineties to generate the elliptic curves that today protect much of the internet. The agency never explained where those numbers came from, and after the Snowden revelations the suspicion of a backdoor became hard to dismiss. Koblitz and Menezes devoted a paper to the question in 2015; Steve Weis filed freedom-of-information requests in 2018 with no result; Filippo Valsorda and others put up a $12,288 bounty that eventually topped $36,000. Jerry Solinas, the NSA mathematician who supplied the seeds, died in 2023 without clarifying it.
Claude traced the seeds back to lrand48, a random number generator from the old C libraries, fed with timestamps from 1997 and 1998. It reproduced the P-256 sequence and found an exact match on candidate 1,842. Anyone can re-run the program. Conclusion: the backdoor is far less likely.
The episode cuts both ways, and it’s worth resisting the temptation to keep only the convenient half. It confirms that for a quarter of a century global cryptographic infrastructure rested on numbers nobody could audit, and that the opacity was deliberate. But it also shows that when the audit finally happens, the result can be benign. Bitcoin, besides, was never affected: it uses secp256k1, a curve with far simpler parameters and little room to hide a weakness. The operational lesson is a different one: models are starting to become effective auditors of inherited cryptographic assumptions, and that capability is available to attackers as much as to defenders.
Where this reading could be wrong
The argument that the risk is institutional rather than cryptographic has several weak flanks. First: consensus may simply arrive on its own. If the next eighteen months produce a post-quantum signature BIP with broad backing from developers, miners, wallets and exchanges, and voluntary migration advances before the threat materialises, the freezing dilemma never goes to a vote. The market would have resolved by adoption what looked like it required a sovereign decision.
Second: movements of old coins prove nothing. On 7 October, 100.02 BTC dormant since July 2010 were moved, around $8.5 million; in August, six wallets inactive since 2011-2014 moved 553.59 BTC, roughly $40 million. It’s tempting to read this as pre-emptive migration, but moving coins can also mean a change of custody, a reorganisation or preparation for a sale. Attributing it to quantum fear is narrative, not evidence.
Third, and most serious: the leap from 8% success in magic state preparation to 500,000 reliable states per second spans several orders of magnitude, and the history of quantum computing is full of methodological advances that never translated into scale. If we still have no CRQC by 2029, this entire discussion will have been a reputational externality for those who pushed it, with the added cost of having normalised the idea that freezing coins is an option on the table.
What to do with this if you build or invest
There’s a tail risk here with no hedging instrument. A spot bitcoin ETF, a listed company with BTC on its balance sheet or an institutional custodian can hedge price volatility, but they cannot hedge protocol governance risk: the possibility that the asset’s rules change by social consensus in response to a technical threat. It isn’t a market risk; it’s binary and legal, and no option replicates it.
The actionable item is more mundane, and nobody is publishing it: knowing what percentage of your own reserves sits in addresses with exposed public keys, broken down by script type. That figure is calculable today from on-chain data, and it belongs in any serious proof-of-reserves report alongside an explicit policy of address non-reuse. A custodian who can’t answer that question in a due diligence process is admitting they haven’t looked.
For anyone building product, the cost of migration isn’t in the cryptography, as Bennett noted: it’s in coordinating wallets, exchanges, custodians and protocol developers. Post-quantum signatures take up more block space, which pressures fees and throughput. Any roadmap that currently assumes the size of an ECDSA signature stays constant through 2030 is making an implicit bet that ought to be made explicit. And it’s worth looking sceptically at every vendor already marketing itself as quantum-safe: the right question isn’t which algorithm they use, but how they plan to migrate keys that are already exposed on a public, immutable chain.
