Bitcoin's Quantum Problem: 2 Million BTC Are Already Exposed, and BIP 360 Doesn't Fix It

Institutional allocators have a new line item on the diligence checklist. It isn't fees. It isn't custody. It isn't liquidity depth. It's quantum, and the awkward part is that nobody can hand them a clean answer yet.

Muneeb Ali, founder of Stacks, made that point this week and it landed harder than most quantum commentary does. His argument: the open question about Bitcoin's quantum resistance is already suppressing institutional demand. Not in some distant decade. Now.

That's a meaningful shift in framing. For years the quantum debate got filed under long-term existential, revisit later. Ali is saying it's a present-tense discount on the asset.

From a risk perspective, that's the more honest read.

The Quantum Handbrake

Start with the mechanics, because the mechanics explain the anxiety. Bitcoin's ownership model runs on elliptic curve signatures. A large enough quantum machine running Shor's algorithm breaks those signatures. Estimates for that machine range from ten years to thirty, and the range itself is the problem. Nobody underwriting a five-year position can model a tail risk with a two-decade error bar.

So the allocation gets trimmed. Or delayed. Or redirected into something with a published roadmap and a named committee.

Enter BIP 360, the most serious attempt so far to give Bitcoin a post-quantum migration path. The proposal adds a new output type built around hash-based signatures, a family of cryptography that's believed to resist quantum attack. It's real engineering from serious people, and it deserves the attention it's getting.

Here's what matters: a proposal isn't a defense. It's a document. Documents don't stop anything.

And there's a second issue Ali's warning points at, one the market hasn't fully absorbed. Bitcoin's quantum exposure isn't evenly distributed. It's concentrated in the oldest coins on the chain.

What BIP 360 Doesn't Fix

Pay-to-public-key outputs and reused addresses have a specific flaw. The public key is already sitting on the ledger. Any quantum-capable attacker doesn't need to break anything in real time. They can derive the private key offline, at leisure, and take the coins whenever the machine is ready.

The numbers tell the story. Roughly 1.7 million to 2 million BTC sit in that exposed state, including the roughly 1 million coins attributed to Satoshi's early mining. That's somewhere near a tenth of total supply.

A new address type does nothing for any of it. A soft fork can't move coins on someone's behalf. Someone has to sign. And the coins most exposed are precisely the ones whose keys are most likely lost, abandoned, or held by people who've been dead for a decade.

So what happens when a $500 million allocation gets held up by a mailing list argument over activation methods?

It goes somewhere else. That's the whole point.

Now for the part that gets skipped. Quantum-resistant signatures are enormous compared to what Bitcoin uses today. We're talking tens of kilobytes against roughly 70 bytes for a standard signature. Every wallet upgrade, every custody migration, every exchange integration inherits that weight. Block space gets tighter. The fee market reprices. Miners get a long-term revenue tail, and users get a permanent cost increase on the safest way to hold the asset.

Nobody's modeling that yet. They should be.

Who wins here? Custody providers and hardware wallet makers, first. They get to sell quantum-resilient vaults as a product line years before the base layer settles anything. Layers built on top of Bitcoin, Stacks included, get a similar opening. Exchanges that move early on address support get an institutional sales pitch. Miners win on fees if the migration ever happens at scale.

Who loses? Anyone holding through a passive ETF wrapper who assumes the issuer is handling it. And arguably the small self-custody holder, who faces a migration with real transaction costs and no clear deadline.

My first strong take: the quantum timeline is probably longer than the panic implies, and the migration timeline is almost certainly longer than any model assumes. Those two facts don't cancel out. They compound. A ten-year technical horizon and a fifteen-year coordination horizon is a bad combination when your investors rebalance every quarter.

My second: the real bottleneck was never cryptography. It's governance. Bitcoin has spent years arguing about how to change a single opcode. Now imagine coordinating a signature scheme migration across every wallet, exchange, custodian, and hardware vendor on earth, plus a social decision about what to do with two million exposed coins that includes Satoshi's. That's not a BIP. That's a constitutional convention.

Buying Time

So here's the trade to watch, and it isn't the one most people are watching.

The signal won't come from a BIP number getting merged into a repository. It'll come from a custodian publishing a quantum policy document with dates and client obligations in it. That's when institutional money starts treating the risk as handled rather than unhandled. Watch for the first major custodian to put a migration commitment on paper. Watch for hardware vendors shipping a quantum-resistant signing path. Watch whether BIP 360 discussion stays technical or turns into the usual activation fight.

And watch the coinbase data. If long-dormant P2PK coins start moving, someone with better models than yours has already done the math.

Look, the honest conclusion is uncomfortable for both camps. The quantum doomers are early. The quantum dismissers are complacent. Bitcoin doesn't need to be quantum-proof tomorrow. It does need a credible answer for the allocator sitting across the table with a five-year mandate and a checklist that has a box nobody can tick.

Right now, that box is empty. And empty boxes are expensive.