The Quantum Lockout: Who Gets to Decide Which Bitcoin Still Counts?
Somewhere in Bitcoin's UTXO set, roughly 1.7 million coins sit inside pay-to-public-key outputs β wallets from the earliest era whose public keys have been visible on-chain for sixteen years. A further, larger tranche lives in Taproot outputs, where the key is exposed by design rather than by accident. Nobody wants to talk about this in a bear market. The market is busy watching liquidations, ETF outflows, and whether the miners finally capitulate. Then Nic Carter said one sentence that cut through all of it: a more secure signature scheme might not save everyone. It might lock them out.
That single sentence is doing more work than any price chart this week. It takes a topic the industry filed under "someday" β post-quantum cryptography β and reframes it as something much older and much more dangerous. Not a math problem. A property rights problem. And property rights are the only thing that has ever genuinely frightened Bitcoin.
Two Clocks, Running at Different Speeds
To understand why Carter's framing lands, you have to hold two clocks in your head at once.
The first clock is cryptographic. Bitcoin secures ownership with ECDSA over the secp256k1 curve. Its safety rests on the elliptic curve discrete logarithm problem β something classical computers cannot solve in any practical timeframe, but that Shor's algorithm can, given a sufficiently large and sufficiently error-corrected quantum machine. That machine has a name in the literature: a cryptographically relevant quantum computer, or CRQC. It does not exist. It may not exist for a decade. But the gap between "does not exist" and "cannot exist" has narrowed with every laboratory announcement of the past several years.
The second clock is institutional. Carter is not a protocol developer and has never pretended to be. He co-founded Coin Metrics, he is a partner at Castle Island Ventures, and his commentary travels through the part of the industry that allocates capital. When he raises a hypothetical, funds discuss it. So when he describes a scenario in which stronger signatures create an "ownership selection problem" β a fork in the road where some holders can migrate and others cannot β the discussion stops being academic and starts being scheduled.
The recurring nature of this narrative is itself worth noting. Quantum scares are not continuous. They are pulses, triggered by headlines from the big research labs, lasting weeks, then fading as the market remembers that nobody has built the machine. Each pulse carries the same shape: a milestone is announced, a wave of explainers follows, and a subset of holders quietly wonders whether their coins are the vulnerable kind. Most never find out that the answer depends entirely on which address format they used.
The Asymmetry Nobody Prices
Here is the fact that gets flattened into a single sentence and should not be. Not all bitcoin is equally exposed to a quantum adversary, and the difference is written into the address format itself.
Consider pay-to-public-key outputs. In these, the public key sits in plaintext on the blockchain. That was fine in 2009, because deriving a private key from a public key requires solving the discrete log problem, and no classical machine can do that. But a CRQC running Shor's algorithm could. For P2PK outputs, the coin is exposed the moment the machine exists β no transaction required, no user action needed, nothing to defend.
Now consider pay-to-public-key-hash and its SegWit descendant. Here the public key is hashed. The hash hides the key until the coin is spent. A quantum adversary cannot attack a public key that is not on the chain. So long as these coins sit still, they are comparatively safe.
Taproot sits in between, and it is the uncomfortable middle. P2TR outputs were designed with a key-path spend that reveals the tweaked public key by default. The design bought privacy and efficiency. It also, inadvertently, recreated a version of the 2009 exposure across a much larger and much more modern slice of the supply.
The consequence is that the urgency of migration is not uniform. It is a gradient, and the gradient runs the wrong way: the oldest coins, held by the people least likely to be reachable, are the most exposed; the newest, most active coins are the least. Any migration policy that treats "Bitcoin" as a single undifferentiated pool will get this wrong, and it will get it wrong in the direction of punishing the holders who did nothing.
There is a second layer to the asymmetry that almost never makes it into the coverage: exposure is not static. Every time an exposed-key coin moves, it is exposed. But every time a hashed-key coin moves, it becomes exposed too β because spending reveals the public key in the witness or script. A holder who waits for the quantum threat to become real before moving their coins is a holder who reveals their key at exactly the worst moment. The migration window and the exposure window are the same window, and nobody has reconciled that yet.
Four Kinds of Coins That Cannot Move
The second thing the coverage glosses over is that "cannot migrate" is not one problem. It is four, and each demands a different answer.
There are coins whose private keys are simply gone. Estimates of permanently lost supply have ranged between three and four million coins for years, and the methodology behind those estimates is famously soft. But the direction is not in dispute. These coins have no owner who can sign.
There are coins whose owners are dead. No inheritance plan, no seed phrase in a safe deposit box, no executor with the technical literacy to sweep an output. From the protocol's point of view this is identical to the first category. From a legal point of view it is not, and the difference matters enormously the moment someone proposes a rule.
There are coins held by people who will not, under any circumstance, prove control. This includes holders under sanctions, holders in jurisdictions where self-custody is treated as evidence of something, and holders who built their position on the promise that Bitcoin does not ask who you are. A migration that requires identity attestation is, for them, a confiscation dressed as an upgrade.
And then there are the Satoshi coins β roughly a million, sitting in early P2PK outputs, exposed, unmoved, and governed by a social convention so strong that even discussing their movement feels like a violation.
Lumping these four together is how a technical discussion turns into a political one. Each category has a different legitimate claim on the network, and a different answer to the question "what should happen to you." A rule built for the first category will be read as a weapon by the fourth. That is not a design flaw in the proposal. It is a design flaw in the premise that there is a single proposal at all.
The Supply Argument Is a Trap
The tempting reading of a lockout is bullish. Locked coins leave circulation. Effective supply falls. Scarcity increases. On a spreadsheet, forced lockout is a deflationary event, and in a bear market a deflationary story is a seductive thing.
This is the kind of reasoning that looks clever for about ninety seconds. The value of bitcoin does not come from its supply schedule. It comes from the credible promise that holding a key means owning a coin. Break that promise and you have not reduced supply β you have reduced demand.
I have watched this pattern from a different angle. In 2017, I analyzed forty-two whitepapers for the Buenos Aires Crypto Circle, and the projects that failed were never the ones with weak tokenomics. They were the ones whose story did not survive contact with a single skeptical question. Bitcoin's story is unusually durable because it is unusually short: your key, your coin. A migration rule that introduces a committee to decide which keys count is not a technical footnote. It is a rewrite of the first sentence.
What makes the trap sharper is that the supply argument is arithmetically correct. The locked coins really would leave circulation. The scarcity really would increase. That is exactly why the argument is dangerous β it gives a genuine numerical case for an outcome that destroys the thing the number was supposed to measure. Alchemy fails when the intent is hollow, and a supply chart is the most hollow intent of all.
The Migration Chain Runs Uphill
There is a structural reason the lockout risk is real and not theoretical, and it has nothing to do with quantum physics.
Any signature change propagates through a chain of dependencies. At the bottom sit users. Above them sit wallets. Above that sit hardware wallet vendors, whose secure elements have to be reflashed and whose firmware pipelines have to be rebuilt from scratch. Above that sit exchanges and custodians, who hold a meaningful share of the supply and will need to decide whether to migrate on behalf of clients, and under what authority. At the top sits the protocol, which can only change if the rest of the chain agrees.
The dependency direction is inverted from how people usually describe it. Core developers do not force migration downward. Users and custodians, confronted with a migration tool they cannot use, push demand upward until a proposal becomes politically unavoidable.
Which means the bottlenecks that matter are unglamorous. Can a hardware wallet vendor ship a firmware update to a device that has been sitting in a drawer for six years? Can an exchange migrate coins for a client who last logged in during the previous cycle? Can a custody provider prove it has the right to move assets it holds on behalf of an estate?
The quantum threat is a physics problem. The lockout is a logistics problem. The second one is closer.
The logistics problem has a second-order effect that gets almost no attention. If custodians are granted the authority to migrate on behalf of absent holders, they acquire something they have never had: the power to decide which unmoved coins are still valid. That is a centralization vector that requires no quantum computer, no hard fork, and no conspiracy. It requires only a well-meaning rule and a helpful intermediary. And in a market where the largest custodians already hold a disproportionate share of supply, that is a shift worth watching far more closely than qubit counts.
Who Decides
Strip away the cryptography and the real question Carter is pointing at is this: Bitcoin has no mechanism for deciding who is a legitimate holder, and any migration rule that touches unmoved coins requires one.
Bitcoin governance runs on rough consensus β a term that works beautifully when the question is "should we add a new opcode" and breaks down completely when the question is "whose coins are still valid." Consensus can be measured among miners and node operators. It cannot be measured among people who have been dead since 2014.
There is no on-chain vote. There is no foundation with authority. There is no legal entity to sue. This is normally Bitcoin's greatest strength. In the face of a migration deadline, it becomes an acute liability, because a deadline is exactly the kind of thing that requires a decider. The protocol's refusal to have a decider is the same property that makes it worth holding. You cannot invoke one without damaging the other.
The Fork Nobody Is Modeling
If a migration proposal ever specifies a cutoff β coins unmoved by block height X are invalid β the response will not be a debate. It will be a split.
We have seen this movie. In 2016, a contested intervention produced two chains and two communities that have never reconciled. The freeze-versus-no-freeze question is a far more fundamental disagreement than a block size parameter, because it touches the definition of ownership itself. A chain that freezes unmoved coins and a chain that does not are not two versions of the same asset. They are two different assets with two different property regimes.
Exchanges would have to decide which chain to credit. Custodians would have to decide which one their legal obligations attach to. Miners would have to decide which one pays. And the market would have to decide, in real time, which one is "Bitcoin."
I have spent the last year building tooling that reads sentiment velocity across social channels, and one thing it has taught me is that markets price the things they can see and ignore the things they cannot. A fork is visible. A governance vacuum is not. Which is precisely why the vacuum is where the damage would happen β not in the block that triggers the split, but in the eighteen months of quiet rule-drafting that precede it.
The Contrarian Read
Now the part most quantum coverage gets backwards.
The industry keeps treating this as a cryptography story with a governance footnote. It is the reverse. The most plausible version of Carter's hypothetical attack is not a quantum computer at all β it is an adversary who weaponizes the fear of one.
The playbook is simple and requires no new hardware. Amplify a qubit milestone. Push a narrative that unmoved coins are a systemic risk. Let the urgency do the work. Then propose a rule, framed as protective, that either freezes exposed-key coins or grants some authority the power to migrate them on behalf of absent holders. Every step is defensible in isolation. The end state is a network that can, for the first time, decide that a valid key is no longer valid.
There is a second mispricing worth naming. The market assigns quantum risk a near-zero probability, on the reasonable grounds that a CRQC is years away. But the same market assigns governance risk a probability of exactly zero, and governance risk is not years away β it is one BIP away. The asymmetry is not between safe and unsafe. It is between a risk that is far and a risk that is close, and the market has them ranked backwards.
And there is a version of this story that ends well. A credible, voluntary, well-instrumented migration β one that ships tools instead of deadlines, incentives instead of mandates β would be read by the market as Bitcoin maturing, the same way Taproot was read as Bitcoin growing up. The upgrade is not the threat. The coercion is. A migration that protects holders is engineering. A migration that selects them is something else wearing engineering's clothes.
What to Watch
The signal is not a price level. It is a BIP number. The moment a post-quantum signature proposal gets an identifier and enters the mailing list, the governance question stops being hypothetical and starts being scheduled.
Track three things alongside it: qubit counts and error-correction milestones from the major labs, because those trigger the narrative pulses; the public posture of the large custodians, because they will end up holding the migration keys for everyone who cannot hold their own; and the miner and node stance on any rule that touches unmoved coins, because that is where a fork would actually begin.
The coins that matter most in this debate are the ones that have not moved in sixteen years. The question is whether the network that grew up around them still remembers how to leave them alone β or whether the first thing it does with its new quantum-proof armor is point it inward.
