2.6 Million Bitcoin Can't Move, and Asia's Custodians Are Already Pricing That In

I spent last Tuesday on a call with a custody desk in Singapore, and the conversation drifted somewhere I didn't expect. Not price. Not ETF flows. Quantum. A compliance officer asked, only half joking, whether his firm should start modeling a five-year migration to post-quantum addresses for client assets. Nobody laughed. The licensing race in Hong Kong is accelerating, and the people writing those licenses now want to know what happens to frozen coins.

So let's talk about the number that should keep every custodian in Tokyo, Seoul, and Singapore up at night.

The 2.6 Million Coin Problem

Bitcoin's ownership model rests on elliptic curve cryptography. Your private key stays secret, your public key can't be reversed into it, and that's the whole game. Shor's algorithm, run on a fault-tolerant quantum computer, breaks that assumption. A public key that's already visible on-chain becomes a private key that a capable attacker can derive and sign with.

Here's the part most people skip. Not every output exposes its public key at the same time. Old pay-to-public-key outputs published their keys the moment they were created, and they've been sitting exposed ever since. Roughly 1.7 million BTC lives in those P2PK outputs alone. Count them as UTXOs and they're a rounding error. Count them in value and they're a serious chunk of the supply.

Now widen the lens. Add reused keys, Taproot outputs, and every wallet that leaked an extended public key to a block explorer or a portfolio tracker. The estimate lands at around 2.6 million BTC, or about 13% of total supply, that stays vulnerable even if every active user migrates to quantum-resistant signatures tomorrow. That's the real problem. Opt-in cryptography doesn't help the coins nobody can reach.

Which brings us to BIP-361. It works in phases. First, once a quantum-safe address type exists, the network stops accepting new deposits to vulnerable addresses. Later, after a multi-year window, legacy ECDSA and Schnorr spends simply become invalid. And then there's the recovery question, where an owner proves ownership through a zero-knowledge proof derived from a seed or derivation path instead of a broken signature.

On timing, the throughput math isn't the hard part. Migrating the entire UTXO set takes somewhere between 76 and 142 days if it consumed every block, or 305 to 568 days at a quarter of block space. Add human coordination, hardware swaps, multisig signers, estate plans, and institutional approvals, and you're looking at a best case near five years and a worst case closer to fifteen. In an emergency, maybe two. Maybe.

The recovery path is where this gets interesting. Olaoluwa Osuntokun built a proof of concept using zk-STARKs to show that a Taproot BIP-86 output key came from a specific BIP-32 seed path. That works. It also requires a 200 KB proof. Best case, that's a few hundred dollars in fees. At higher fee rates, it's thousands, or tens of thousands. Small UTXOs are priced out entirely.

And there's a genuinely clever middle option worth knowing about. The Hourglass proposal doesn't burn old P2PK coins at all. It caps them at one P2PK input and one BTC per block, which stretches a full drain across decades instead of letting a quantum attacker liquidate everything in a single afternoon.

Why This Lands Harder in Asia

Here's what Western coverage tends to miss. The 2.6 million vulnerable coins aren't an abstract property-rights debate for Asian institutions. They're a line item.

Hong Kong's licensed platforms operate under custody rules that demand they explain how client assets are protected. Japan's regulators have spent a decade building a framework around segregated cold storage. Korea's exchanges rebuilt their entire compliance stack after 2017. In every one of those jurisdictions, a known cryptographic weakness with a published migration deadline becomes an audit question, not a philosophy seminar. The licensing race in Hong Kong is accelerating, and quantum readiness is quietly becoming part of the paperwork.

Which means Asian exchanges and custodians will move first, whether or not the broader network has consensus. Why? Because the market forces them to. A fiduciary can't tell a pension fund that client coins might become unspendable with no plan on file. That's not a values question. That's a liability.

And this cuts the other way too. Jurisdictions with regulatory clarity will attract the migration flows. Ones without it will watch assets drift toward custodians that can actually answer the question. The capital isn't leaving crypto. It's leaving your jurisdiction.

For context on how markets price these rule changes, look back at Ethereum in 2016. After The DAO hack, the interventionist chain that rewrote the rules to return funds ended up worth well over ten times Ethereum Classic, which stuck with code-is-law and let the attacker keep 5% of the supply. Investors voted with their wallets for the version that protected owners. Same logic applies here, even if Bitcoin's culture is a different animal.

Bitcoin has a precedent too. On August 15, 2010, block 74,638 created 184,467,440,737.09551616 bitcoin out of thin air thanks to an integer overflow. A patched client shipped within five hours, the chain forked, and the good chain overtook the bad one at block 74,691. Someone followed the rules exactly and still lost their coins because the network decided the rules were wrong.

What I'd Actually Tell a Client

So where does that leave you?

If you're holding coins in Taproot addresses generated from a single seed and you've never reused a key, you're in decent shape. You'll migrate when a quantum-safe output type ships, and it'll be a software update plus a transaction. Annoying, not existential.

If you've shared an xpub with a tax tool or a portfolio app, or you've got coins sitting in an old wallet you haven't touched since 2014, you've real exposure and no deadline yet. Fix the easy stuff now. Kill your address reuse. Stop handing out xpubs. Move long-dormant balances into modern addresses while fees are low and nobody's in a hurry.

Here's my honest read. BIP-361 is a contingency plan, not a proposal anyone serious wants to activate today. It can't even activate until a post-quantum scheme exists and gets adopted. The whole point is to have the argument now, while it's cheap, instead of during a panic when the options are ugly.

The do-nothing camp frames itself as principled. But principle isn't a risk model when a sovereign fund in Seoul is asking its custodian for a written answer. Code is law until the market decides it isn't. We watched Ethereum learn that in 2016, and we watched Bitcoin learn it in 2010.

Asia moves first on custody rules, and this will be no different. The only question is whether your coins are reachable when the migration clock starts.