This article was first published on TurkishNY Radio.
Michael Saylor has a talent for turning technical debates into simple slogans. On December 16, he did it again, arguing that quantum computing will not break Bitcoin, it will strengthen it. In his words,
“The Bitcoin Quantum Leap: Quantum computing won’t break Bitcoin, it will harden it. The network upgrades, active coins migrate, lost coins stay frozen. Security goes up. Supply comes down. Bitcoin grows stronger.”
It is a clean message, the kind that fits neatly into a social feed and lands well with long-term believers. The problem is that Bitcoin’s security is not a motivational poster. It is a stack of cryptography choices, wallet behaviors, and governance realities that do not bend to confidence.
Quantum computing may not be an immediate threat, but the parts of Bitcoin that would be hit first are not theoretical, and a meaningful chunk of supply is already sitting in address types where public keys are visible today.
The argument is not that Bitcoin is doomed. The argument is that “it will harden” skips the messy middle, where the network must coordinate a migration that is expensive, politically difficult, and likely to take years. Even some of the most thoughtful voices responding to Saylor are not disputing the direction of travel. They are disputing the timeline, the feasibility, and the idea that “lost coins” simply stay frozen as if physics politely waits for a soft fork.
What Quantum Actually Threatens in Bitcoin
Bitcoin rests on two major cryptographic pillars that get mixed up in casual conversations: hashing and signatures.
Hashing is used in proof-of-work mining and in address construction. Bitcoin mining relies on SHA-256. Quantum algorithms can speed up brute-force style searches with Grover’s algorithm, but that speedup is quadratic, not the exponential cliff people imagine.
Mihailo Bjelic, a co-founder of Polygon, went even more direct about timelines and network friction:
“The upgrade takes ~2 years (~6 months if all regular txs stop, which is unrealistic). And this is assuming this major upgrade goes through smoothly, without contention (which is hard to imagine).”
That matters because quadratic speedups can often be offset by parameter changes, or, in the case of proof-of-work, by acknowledging that the network adjusts difficulty and miners compete under economic constraints anyway. That does not mean “no risk,” but it is not the first domino.
The 1.7 Million BTC Problem Saylor Did Not Solve With a Slogan
Saylor’s line, “lost coins stay frozen,” is where the conversation stops being philosophical and becomes dangerously literal. Coins do not freeze themselves. They are frozen only in the mundane sense that they have not moved, but if an attacker gains the ability to produce valid signatures for those outputs, the coins are not frozen at all. They are loot.
A widely cited estimate in the current debate is that roughly 1.7 million BTC sit in early pay-to-public-key outputs that expose the public key on-chain by design. Those outputs are vulnerable the entire time they remain unspent, because the attacker does not have to wait for the owner to reveal anything.
This is not a fringe address type either. Pay-to-public-key is part of Bitcoin’s earliest history. It was used in early mining rewards and early wallet behavior before best practices evolved. Technical write-ups describing P2PK make the key point in plain terms: the locking script contains the public key itself, not a hash of it.
In other words, if a cryptographically relevant quantum computer arrives, these outputs are already standing in the open.
So when Saylor frames the future as “active coins migrate, lost coins stay frozen,” he is assuming not just that migration happens, but that it happens before any meaningful adversary can act, and that the network will treat stolen legacy coins as if they were ethically untouchable. That is not how attackers behave, and it is not how incentives work.
Taproot Adds a Twist: Modern Bitcoin Also Exposes Keys
One of the more uncomfortable details in this debate is that “old coins are vulnerable” is not the full story. Taproot, introduced to improve privacy and efficiency, uses a structure where a public key is embedded in the output. That is part of how pay-to-Taproot works.
This does not mean Taproot “caused” the problem, because Bitcoin already relies on elliptic curve signatures. But it changes the exposure profile. With Taproot, the public key is visible earlier, which changes the theoretical attacker’s job if quantum capability ever reaches the threshold where Shor-style extraction is practical.
The practical takeaway is not that Taproot was a mistake. The practical takeaway is that the Bitcoin UTXO set is a patchwork of eras and address behaviors, and “just migrate” is harder when the vulnerability is not limited to ancient artifacts.
The Governance Trap: A Bitcoin Upgrade Is Not a Switch Flip
Here is the part that separates hopeful threads from real-world engineering. Bitcoin has no CEO, no emergency committee, and no mandatory update mechanism. The network can upgrade, but it upgrades through rough consensus and coordinated adoption across developers, node operators, miners, exchanges, custodians, and wallet providers.
That coordination challenge is exactly what a16z’s recent analysis emphasizes. It argues that the most common misconceptions about quantum risk lead to the wrong urgency, and that planning migrations is about matching urgency to actual threats while respecting the costs and bug risks of premature moves.
In plain terms, even if everyone agreed tomorrow on the “right” post-quantum signature scheme, getting it deployed broadly enough, with user behavior aligned and custodians ready, is not a six-week sprint. The response to Saylor from Ben-Sasson was not about math. It was about ossification, the real phenomenon where it becomes politically and operationally harder to change a system the more valuable and widely used it becomes.
This is why timelines keep coming up. A multi-year migration window is not fearmongering. It is how long major protocol changes typically take in decentralized systems, especially when the change has to touch wallet infrastructure and key management for large pools of capital.
Post-Quantum Tools Exist, But Bitcoin Has to Choose How to Use Them
One reason this debate is louder now is that post-quantum cryptography is no longer a speculative research corner. The U.S. National Institute of Standards and Technology has published finalized standards for post-quantum cryptography, including two signature families: ML-DSA (based on Dilithium) and SLH-DSA (based on SPHINCS+).
That matters because Bitcoin needs post-quantum signatures more than it needs post-quantum encryption. Signatures are the weak spot in the quantum scenario, and even mainstream coverage quoting industry executives emphasizes that reality: once a public key is visible, a powerful quantum computer running the right algorithm could forge the signature to move funds.
Still, “standards exist” does not mean “Bitcoin can copy-paste them.” The constraints are brutal. Post-quantum signatures tend to be larger than ECDSA or Schnorr signatures. Larger signatures mean heavier transactions, higher fees, bigger blocks, and more pressure on node costs, which can tilt the network toward centralization if not handled carefully.
That is why research into optimizations and aggregation keeps surfacing. Bitcoin Optech has been tracking post-quantum topics and performance work in a Bitcoin context, including discussion around SLH-DSA optimizations.
There is also active industry research on making hash-based signatures more practical for Bitcoin-style use, including published work from named researchers at Blockstream Research that explores how to optimize hash-based schemes specifically for Bitcoin.
Key Indicators That Signal Whether Bitcoin Is Actually Getting Ready
If the quantum debate is treated as more than a headline, a few indicators give a clearer picture of readiness, and they are more informative than viral “Q-Day” charts.
The first indicator is exposed-key share over time. If the share of UTXOs with public keys visible keeps climbing, whether through Taproot adoption or address reuse, the theoretical attack surface expands, even if the timeline remains uncertain.
The second indicator is the maturity of Bitcoin-specific post-quantum proposals. It is one thing to point at NIST standards. It is another to show credible Bitcoin Improvement Proposal work that addresses signature size, verification costs, and migration mechanics without breaking backward compatibility.
The third indicator is governance alignment. When respected engineers and institutions start converging on a plan rather than arguing about whether a plan is necessary, the probability of timely migration rises.
The fourth indicator is operational behavior. If custodians and large holders begin treating key rotation and address hygiene as a formal risk control, it signals seriousness. That includes avoiding address reuse and reducing the time a spending transaction sits exposed in the mempool when fees spike.
The fifth indicator is the broader security timeline. NIST’s transition planning documents underline that quantum-vulnerable algorithms are expected to be deprecated on long timelines, but high-risk systems move earlier, and the migration effort itself is the hard part.
Conclusion: Bitcoin Can Harden, But It Has to Earn It
Saylor’s central instinct, that Bitcoin is built to survive technological change, is not crazy. Bitcoin has absorbed major upgrades before, and it has done so without losing its core properties. Quantum computing does not magically invalidate Bitcoin overnight, and much of the fear content online is sloppy.
But the confidence line, “lost coins stay frozen,” is where optimism drifts into a comforting story. If quantum capability reaches the point where Shor-style key recovery is feasible, coins in exposed-key outputs are not frozen, they are prizes. The “1.7 million BTC” sitting in early P2PK outputs is not an abstract debate prop. It is a live map of where the first serious attacker would look.
The path forward is not panic. It is preparation that matches the real threat, respects the cost of premature migration, and acknowledges governance as the true bottleneck. Post-quantum tools exist, standards are published, and research is moving.
If Bitcoin hardens, it will not be because a tweet said so. It will be because the ecosystem did the unglamorous work: agreeing on a design, shipping safe implementations, and migrating value at scale without tearing itself apart in the process.
Frequently Asked Questions
What did Michael Saylor claim about quantum and Bitcoin?
He said quantum computing will “harden” Bitcoin as the network upgrades and active coins migrate, while lost coins stay frozen.
Why are some coins considered “already at risk”?
Some older output types expose public keys directly on-chain, meaning they would be immediately vulnerable if a powerful quantum attacker could derive private keys from those public keys.
Why does the figure 1.7 million BTC matter?
It is an estimate for BTC sitting in early pay-to-public-key outputs, which expose public keys by default and are therefore vulnerable at all times if quantum key recovery becomes practical.
Glossary of Key Terms
Shor’s algorithm
A quantum algorithm that can break widely used public-key cryptography by deriving private keys from public keys under the right conditions.
Grover’s algorithm
A quantum algorithm that provides a quadratic speedup for brute-force searching, often discussed in the context of hashing and search problems.
ECDSA
The elliptic-curve signature scheme historically used to authorize Bitcoin spends, vulnerable to Shor’s algorithm at sufficient quantum scale.
Schnorr signatures
A signature scheme used in Taproot-related spends in Bitcoin, also based on elliptic-curve assumptions and therefore in the same quantum risk category for signatures.
P2PK
Pay-to-public-key, an early Bitcoin locking script type that embeds a public key directly in the output, exposing it on-chain.
