Bitcoin’s 1.7M Legacy Coins Face Permanent Loss From Quantum Threat

Published by James Harris on June 12, 2026June 12, 2026

Coinbase’s quantum advisory board is not warning that quantum computers can break Bitcoin today. It is warning that the window to prepare is shorter than most blockchain developers are treating it, and that millions of coins sitting in old address formats may never be safely migrated at all.

The board, which includes cryptographers from Stanford, UT Austin, and the Ethereum Foundation, puts the number of Bitcoin with publicly exposed keys at approximately 6.9 million, of which roughly 1.7 million sit in legacy P2PK addresses where the public key is permanently visible and cannot be rotated. The actual attack vector is not mining or proof-of-work, which quantum algorithms can only marginally accelerate, but digital signature schemes built on elliptic curves. The Project Eleven 2026 Quantum Threat Report lays out how a sufficiently capable machine running Shor’s algorithm could theoretically derive a private key from its public counterpart. NIST has set 2035 as its target for completing post-quantum cryptography standards adoption, but the board notes that deadline reflects policy planning, not a technical guarantee about when a dangerous machine arrives.

The math for post-quantum cryptography exists. The coordination problem does not have a clean solution.

Post-quantum signature schemes like Dilithium-3 carry public keys of roughly 1.9 KB and signatures of around 3.3 KB, compared to approximately 64 bytes each under current ECDSA standards. That size difference compounds across every transaction, every node, and every block, translating into real fee pressure and storage costs that fall unevenly on networks with the highest throughput demands. Ethereum has a published migration roadmap; Solana, Algorand, and Aptos have begun work; Bitcoin’s developer community is exploring new address formats without a committed upgrade path, which is consistent with Bitcoin’s historically slow, consensus-heavy governance but creates a specific exposure given how much dormant supply sits in vulnerable legacy addresses.

The sharpest unresolved question in the board’s June 11 report is what happens to wallets that will never migrate: lost keys, dead holders, abandoned accounts. Each chain will eventually face a governance decision about whether to freeze those assets after a deadline, leave them as a long-term attack surface, or implement mechanisms like rate-limiting vulnerable coin movements per block. That decision is not technical. It is political, and on Bitcoin it will be contentious given that some of those dormant coins almost certainly belong to Satoshi Nakamoto.

Google, which began its own post-quantum migration in 2016 and is targeting NIST-aligned completion, offers a useful reference point: a decade-long internal migration for a centralized company with full control over its own infrastructure. Decentralized networks with heterogeneous wallet software, no forced upgrade mechanism, and significant dormant supply face a structurally harder version of the same problem, and they are starting later.