The Quantum Lockout: When Bitcoin's Safest Upgrade Becomes Its Hardest Governance Question

In late 2025, Nic Carter described a hypothetical attack on Bitcoin that most of the industry skimmed past within a single news cycle. The premise was not that quantum computers would one day break ECDSA. The premise was subtler, and considerably more corrosive: that the act of defending Bitcoin — migrating to quantum-resistant signatures — would itself create a population of holders who can never prove ownership of their coins, and a smaller population who get to decide what happens to those coins.

I have been sitting with that framing for weeks now. The more I return to it, the more certain I am that Carter was not talking about cryptography at all. He was talking about property. He was sketching a scenario in which the tool built to protect the network becomes the instrument that dispossesses part of its own user base — not through malice, but through the sheer mechanical difficulty of proving that a coin is yours when the only proof has decayed.

The narrative isn't that quantum is coming. The narrative is that we have already begun designing the response, and the people who will be affected have not been consulted.

To understand why, you have to understand something about Bitcoin's address architecture that almost no user ever thinks about, because the wallet hides it. Bitcoin has no accounts. It has outputs, each locked by a script, and the security of that script against a quantum adversary depends entirely on whether the public key is exposed on-chain.

This is the part the market glosses over. ECDSA on secp256k1 is safe against classical machines because recovering a private key from a public key requires solving the elliptic curve discrete logarithm problem — infeasible at any realistic scale, even with nation-state resources. Shor's algorithm dissolves that assumption. But the exposure is not uniform. In P2PKH and P2WPKH outputs, the public key is hashed and revealed only at the moment of spending, which means an attacker with a cryptographically relevant quantum computer — a CRQC — has only the narrow window between broadcast and confirmation. In early P2PK outputs, the format that dominates the Satoshi-era coins, the public key sits in plain sight for all of history. So does the key in every Taproot output, because key-path spending requires it.

The quantum risk to Bitcoin is not one risk. It is a gradient, and the gradient runs along address type, not along wealth.

That single distinction reorganizes the entire debate. It means the coins most vulnerable are also the coins least likely to move, because they are precisely the coins whose owners are gone, incapacitated, or deliberately invisible.

It also explains why the industry keeps recycling this fear. Quantum FUD is not new. It surfaced during the 2017 bull run, again in 2019 when Google claimed quantum supremacy, again in 2022 when researchers kept publishing error-correction milestones. Each cycle followed the same arc: a headline, a wave of explainer threads, a brief dip, and then collective amnesia. The reason the pattern repeats is that the threat is genuinely real and genuinely distant at the same time — the worst possible combination for rational pricing, because it is too serious to dismiss and too slow to hedge.

Meanwhile, the actual defensive tooling has been maturing quietly. NIST finalized its first post-quantum standards, and the candidates that matter here are lattice-based schemes like Dilithium and hash-based schemes like SPHINCS+. Both are considered resistant to Shor's algorithm. Neither is a drop-in replacement for ECDSA. That is where the engineering reality collides with the governance fantasy, and it is where I want to spend the bulk of this analysis.

Let me be concrete about who cannot migrate, because the discourse collapses four very different populations into one vague category of "lost coins," and that collapse is the source of every bad policy proposal I have seen.

The first population is genuinely lost — private keys destroyed, drives wiped, passwords forgotten, hardware burned in a house fire. Long-standing chain analysis estimates place this at roughly three to four million BTC. The second is deceased holders with no inheritance arrangement, a number that grows every single year and that no one can measure with any precision. The third is holders who will not migrate because migrating means exposing identity: sanctioned entities, privacy maximalists, anyone with a legal or personal reason to stay invisible. The fourth, and the one that will decide the politics of this entire question, is the Satoshi coins — roughly one million BTC that the community has, by unwritten convention, agreed never to touch.

Each population demands a completely different response. The lost coins need a technical solution that does not exist. The deceased need a legal framework that no one has written. The invisible need a privacy-preserving proof that would contradict the entire purpose of the migration. The Satoshi coins need a social consensus that will never be reached. Treating them as one category guarantees a rule that is wrong for all four.

When I audited the Zeepin token distribution algorithm in 2017, I learned something that has stayed with me through every protocol review since. The flaw is almost never where the team is looking. They audit the transfer function. They forget the mint authority. Here, the industry is auditing the quantum threat and forgetting the migration authority — who holds the power to declare a coin invalid, and under what procedure.

The threat isn't cryptographic. It was always procedural. A quantum computer that does not yet exist cannot take your coins. A governance rule passed in a panic can.

Think about what a mandatory migration actually requires. It requires a deadline. It requires a definition of "proven control." It requires someone — miners, node operators, a foundation, a consortium — to decide that coins not migrated by block height X are no longer spendable. And the moment you write that rule, you have created a mechanism for confiscation, whether or not you intended one. The same rule that locks out a dead holder's coins also locks out anyone the rule-writers choose to exclude. That is the attack Carter was pointing at, and it does not require a quantum computer at all. It requires only a sufficiently frightening news cycle.

There is a second, quieter problem that nobody is modeling: the performance cost of the migration itself. Post-quantum signatures are not free. Dilithium public keys run into the low thousands of bytes; SPHINCS+ signatures can exceed ten kilobytes. Compared to the roughly seventy-one bytes of an ECDSA signature on secp256k1, that is an order-of-magnitude expansion of witness data for every input. In a low-fee environment this is tolerable. In a congested block space environment, it is a structural tax on every transaction, and it lands hardest on the smallest holders — the exact people least equipped to migrate. I have written before about how proving costs bleed operators dry in the Layer2 world, and the same logic applies here in reverse: the security upgrade is real, but somebody has to pay for the bytes, and the fee market does not distribute that cost fairly.

During the DeFi Summer of 2020, I spent months tracking MakerDAO's collateralized debt positions through the Dai peg crisis. What struck me then, and what returns to me now, is how quickly a transparent protocol can be steered by a small number of large holders when the system is under stress. Bitcoin's governance is not MakerDAO's, but the pressure dynamics rhyme. Under existential-sounding threat, communities trade deliberation for speed. And speed, in a system with no formal voting and no legal personality, means whoever shows up first writes the rule.

Now run the supply math, because this is where the economic story gets genuinely strange.

Roughly ten to twenty percent of circulating supply sits in quantum-exposed outputs, depending on whose estimate you accept — a range that includes the Satoshi coins and a meaningful share of early-adopter wallets. Another three to four million BTC are plausibly unrecoverable. If a migration regime were to permanently lock the unmigrated portion, the effective float would contract sharply. On a naive reading, that is deflationary, and deflationary is bullish.

I do not buy the naive reading. A supply contraction that arrives through confiscation is not a supply shock. It is a repricing of property rights, and property rights are the entire product. Bitcoin's value proposition has never been its block time or its issuance schedule in isolation. It is the claim that no one can take your coins — not a government, not a majority, not a committee. The moment that claim acquires an asterisk reading "unless a migration deadline passes," the asset is no longer the same asset. The holders who understand this are not the ones who panic-sell on quantum headlines. They are the ones who quietly re-evaluate the entire thesis.

The value wasn't in the coins that migrate. The value was in the promise that migration would never be mandatory.

There is a second-order consequence that almost nobody is modeling, and it is the one that keeps me up at night: fork risk. Ethereum and Ethereum Classic split over a much smaller question — whether to reverse a single exploit that affected a few thousand holders. A rule that invalidates millions of coins belonging to identifiable holders is a far larger constitutional rupture. The plausible outcome is not one chain but two: a freeze chain that enforces migration and a no-freeze chain that honors every existing key. Which one inherits the ticker is not a technical question. It is a market and legal question, and the answer will be decided in the messiest possible way, over months, with exchanges as the arbiters.

Then there is the regulatory layer, and here I want to be precise, because I spent 2024 working alongside legal experts on the integration of BlackRock's BUIDL fund and I watched how quickly compliance language reshapes protocol design. The relevant legal question is not whether BTC is a security. It never was, and that is settled enough. The question is whether a protocol-level decision to invalidate coins constitutes a deprivation of private property, and in most jurisdictions, the answer is uncomfortably close to yes. If Bitcoin's rough consensus produces a rule that extinguishes a holder's coins, that holder has, in principle, a claim — against whom is unclear, since Bitcoin has no legal personality, which is precisely why the claim would metastasize into legislation rather than litigation.

There is a darker version of this. Sanctioned addresses are, by construction, among the most likely to be unmigratable — their holders have every reason not to surface. A migration regime that demands proof of control creates, in effect, a compliance filter on the entire UTXO set. Regulators will notice. Some will demand that the filter be used for purposes that have nothing to do with quantum security. And at that point, the quantum narrative has been repurposed into a surveillance instrument, with the enthusiastic participation of people who believed they were defending the network.

When I led narrative strategy for an AI-agent crypto project in 2026, my entire job was to build a framework that distinguished human-authored signal from machine-generated noise and to verify authenticity on-chain. The lesson I took from that work applies here with uncomfortable precision: the hardest problems are never about a technology's capability. They are about who controls the verification layer. Whoever defines "proven control" in a Bitcoin migration defines ownership itself. That is a more concentrated power than any mining pool has ever held, and it arrives wearing the costume of a security patch.

So what does the migration chain actually look like, practically? Because the governance abstraction hides a very concrete bottleneck. Any signature change requires coordination across the full stack: the core protocol, the wallet software, the hardware wallet firmware, the exchanges, the custodians, and the miners. Users cannot migrate to a scheme their hardware wallet does not support. In practice, that means the firmware update cadence of two or three hardware manufacturers becomes a rate-limiting step for the security of the entire network. I have watched this dynamic before, in smaller protocols, and the pattern is always the same: the entity that controls the migration tool acquires the power to decide who migrates first, and therefore who is protected and who is not.

Which brings me to custody, and to a grim irony the industry has not reckoned with. The holders who can migrate fastest are the ones who never held their own keys — the exchange customers, the ETF holders, the institutional accounts with dedicated operations teams. The holders who cannot migrate are the ones who did everything right: self-custody, cold storage, keys that have never touched a networked device. The migration regime, if designed carelessly, rewards custodial behavior and punishes self-sovereignty — the exact inversion of Bitcoin's founding ethic.

Now let me give you the contrarian read, because I do not think the pessimistic case is the whole story, and I refuse to write a piece that ends in fatalism.

The consensus fear is that quantum computing breaks Bitcoin. The more probable failure mode is that Bitcoin breaks itself defending against a threat that may not materialize for a decade or more — and that the panic, not the physics, does the damage. But flip it. If the community cannot agree to freeze Satoshi's coins — and it cannot, because the social cost of that decision would exceed any conceivable security benefit — then mandatory migration is dead on arrival. That is not a weakness. That is the immune system working. The Satoshi coins are, in effect, a constitutional tripwire: any rule that would confiscate them is a rule that cannot pass, and that tripwire protects the dead holder and the sanctioned address and the forgotten password along with it.

If that reasoning holds, the realistic path is voluntary migration with incentives, layered over a long horizon, with the quantum-exposed coins gradually becoming a known, priced, and socially accepted liability. Not a crisis. A discount. And there is a version of this that is genuinely bullish: a successful post-quantum migration, executed slowly and without confiscation, would be the strongest possible demonstration that Bitcoin can evolve without a leader. Taproot taught us that the market rewards credible, boring upgrades. This would be the boring upgrade to end all boring upgrades — the one where the network quietly survives its own worst-case scenario and nobody gets a trophy.

The question worth tracking is not whether a CRQC arrives. It is whether Bitcoin's informal constitution survives the argument about what to do when it does. Watch the BIP repository. Watch whether a post-quantum signature proposal acquires a number and enters serious discussion. Watch how the major custodians position themselves, because their stance will reveal whether migration becomes a public good or a private privilege. And watch the Satoshi coins, because they are the fulcrum on which the entire question turns. Those coins will tell you what Bitcoin is willing to become — long before a single qubit of it is threatened.