Against Allowing Quantum Recovery of Bitcoin

Against Allowing Quantum Recovery of Bitcoin
2025-03-16 18:03 ` Chris Riley
                   ` (4 more replies)
  
From: Jameson Lopp @ 2025-03-16 14:15 UTC (permalink / raw)
  To: Bitcoin Development Mailing List

[-- Attachment #1: Type: text/plain, Size: 31531 bytes --]

The quantum computing debate is heating up. There are many controversial
aspects to this debate, including whether or not quantum computers will
ever actually become a practical threat.

I won't tread into the unanswerable question of how worried we should be
about quantum computers. I think it's far from a crisis, but given the
difficulty in changing Bitcoin it's worth starting to seriously discuss.
Today I wish to focus on a philosophical quandary related to one of the
decisions that would need to be made if and when we implement a quantum
safe signature scheme.

Several Scenarios
Because this essay will reference game theory a fair amount, and there are
many variables at play that could change the nature of the game, I think
it's important to clarify the possible scenarios up front.

1. Quantum computing never materializes, never becomes a threat, and thus
everything discussed in this essay is moot.
2. A quantum computing threat materializes suddenly and Bitcoin does not
have quantum safe signatures as part of the protocol. In this scenario it
would likely make the points below moot because Bitcoin would be
fundamentally broken and it would take far too long to upgrade the
protocol, wallet software, and migrate user funds in order to restore
confidence in the network.
3. Quantum computing advances slowly enough that we come to consensus about
how to upgrade Bitcoin and post quantum security has been minimally adopted
by the time an attacker appears.
4. Quantum computing advances slowly enough that we come to consensus about
how to upgrade Bitcoin and post quantum security has been highly adopted by
the time an attacker appears.

For the purposes of this post, I'm envisioning being in situation 3 or 4.

To Freeze or not to Freeze?
I've started seeing more people weighing in on what is likely the most
contentious aspect of how a quantum resistance upgrade should be handled in
terms of migrating user funds. Should quantum vulnerable funds be left open
to be swept by anyone with a sufficiently powerful quantum computer OR
should they be permanently locked?

"I don't see why old coins should be confiscated. The better option is to
> let those with quantum computers free up old coins. While this might have
> an inflationary impact on bitcoin's price, to use a turn of phrase, the
> inflation is transitory. Those with low time preference should support
> returning lost coins to circulation."

- Hunter Beast


On the other hand:

"Of course they have to be confiscated. If and when (and that's a big if)
> the existence of a cryptography-breaking QC becomes a credible threat, the
> Bitcoin ecosystem has no other option than softforking out the ability to
> spend from signature schemes (including ECDSA and BIP340) that are
> vulnerable to QCs. The alternative is that millions of BTC become
> vulnerable to theft; I cannot see how the currency can maintain any value
> at all in such a setting. And this affects everyone; even those which
> diligently moved their coins to PQC-protected schemes."
> - Pieter Wuille


I don't think "confiscation" is the most precise term to use, as the funds
are not being seized and reassigned. Rather, what we're really discussing
would be better described as "burning" - placing the funds *out of reach of
everyone*.

Not freezing user funds is one of Bitcoin's inviolable properties. However,
if quantum computing becomes a threat to Bitcoin's elliptic curve
cryptography, *an inviolable property of Bitcoin will be violated one way
or another*.

Fundamental Properties at Risk
5 years ago I attempted to comprehensively categorize all of Bitcoin's
fundamental properties that give it value.
https://nakamoto.com/what-are-the-key-properties-of-bitcoin/

The particular properties in play with regard to this issue seem to be:

*Censorship Resistance* - No one should have the power to prevent others
from using their bitcoin or interacting with the network.

*Forward Compatibility* - changing the rules such that certain valid
transactions become invalid could undermine confidence in the protocol.

*Conservatism* - Users should not be expected to be highly responsive to
system issues.

As a result of the above principles, we have developed a strong meme (kudos
to Andreas Antonopoulos) that goes as follows:

Not your keys, not your coins.


I posit that the corollary to this principle is:

Your keys, only your coins.


A quantum capable entity breaks the corollary of this foundational
principle. We secure our bitcoin with the mathematical probabilities
related to extremely large random numbers. Your funds are only secure
because truly random large numbers should not be guessable or discoverable
by anyone else in the world.

This is the principle behind the motto *vires in numeris* - strength in
numbers. In a world with quantum enabled adversaries, this principle is
null and void for many types of cryptography, including the elliptic curve
digital signatures used in Bitcoin.

Who is at Risk?
There has long been a narrative that Satoshi's coins and others from the
Satoshi era of P2PK locking scripts that exposed the public key directly on
the blockchain will be those that get scooped up by a quantum "miner." But
unfortunately it's not that simple. If I had a powerful quantum computer,
which coins would I target? I'd go to the Bitcoin rich list and find the
wallets that have exposed their public keys due to re-using addresses that
have previously been spent from. You can easily find them at
https://bitinfocharts.com/top-100-richest-bitcoin-addresses.html

Note that a few of these wallets, like Bitfinex / Kraken / Tether, would be
slightly harder to crack because they are multisig wallets. So a quantum
attacker would need to reverse engineer 2 keys for Kraken or 3 for Bitfinex
/ Tether in order to spend funds. But many are single signature.

Point being, it's not only the really old lost BTC that are at risk to a
quantum enabled adversary, at least at time of writing. If we add a quantum
safe signature scheme, we should expect those wallets to be some of the
first to upgrade given their incentives.

The Ethical Dilemma: Quantifying Harm
Which decision results in the most harm?

By making quantum vulnerable funds unspendable we potentially harm some
Bitcoin users who were not paying attention and neglected to migrate their
funds to a quantum safe locking script. This violates the "conservativism"
principle stated earlier. On the flip side, we prevent those funds plus far
more lost funds from falling into the hands of the few privileged folks who
gain early access to quantum computers.

By leaving quantum vulnerable funds available to spend, the same set of
users who would otherwise have funds frozen are likely to see them stolen.
And many early adopters who lost their keys will eventually see their
unreachable funds scooped up by a quantum enabled adversary.

Imagine, for example, being James Howells, who accidentally threw away a
hard drive with 8,000 BTC on it, currently worth over $600M USD. He has
spent a decade trying to retrieve it from the landfill where he knows it's
buried, but can't get permission to excavate. I suspect that, given the
choice, he'd prefer those funds be permanently frozen rather than fall into
someone else's possession - I know I would.

Allowing a quantum computer to access lost funds doesn't make those users
any worse off than they were before, however it *would* have a negative
impact upon everyone who is currently holding bitcoin.

It's prudent to expect significant economic disruption if large amounts of
coins fall into new hands. Since a quantum computer is going to have a
massive up front cost, expect those behind it to desire to recoup their
investment. We also know from experience that when someone suddenly finds
themselves in possession of 9+ figures worth of highly liquid assets, they
tend to diversify into other things by selling.

Allowing quantum recovery of bitcoin is *tantamount to wealth
redistribution*. What we'd be allowing is for bitcoin to be redistributed
from those who are ignorant of quantum computers to those who have won the
technological race to acquire quantum computers. It's hard to see a bright
side to that scenario.

Is Quantum Recovery Good for Anyone?

Does quantum recovery HELP anyone? I've yet to come across an argument that
it's a net positive in any way. It certainly doesn't add any security to
the network. If anything, it greatly decreases the security of the network
by allowing funds to be claimed by those who did not earn them.

But wait, you may be thinking, wouldn't quantum "miners" have earned their
coins by all the work and resources invested in building a quantum
computer? I suppose, in the same sense that a burglar earns their spoils by
the resources they invest into surveilling targets and learning the skills
needed to break into buildings. What I say "earned" I mean through
productive mutual trade.

For example:

* Investors earn BTC by trading for other currencies.
* Merchants earn BTC by trading for goods and services.
* Miners earn BTC by trading thermodynamic security.
* Quantum miners don't trade anything, they are vampires feeding upon the
system.

There's no reason to believe that allowing quantum adversaries to recover
vulnerable bitcoin will be of benefit to anyone other than the select few
organizations that win the technological arms race to build the first such
computers. Probably nation states and/or the top few largest tech companies.

One could certainly hope that an organization with quantum supremacy is
benevolent and acts in a "white hat" manner to return lost coins to their
owners, but that's incredibly optimistic and foolish to rely upon. Such a
situation creates an insurmountable ethical dilemma of only recovering lost
bitcoin rather than currently owned bitcoin. There's no way to precisely
differentiate between the two; anyone can claim to have lost their bitcoin
but if they have lost their keys then proving they ever had the keys
becomes rather difficult. I imagine that any such white hat recovery
efforts would have to rely upon attestations from trusted third parties
like exchanges.

Even if the first actor with quantum supremacy is benevolent, we must
assume the technology could fall into adversarial hands and thus think
adversarially about the potential worst case outcomes. Imagine, for
example, that North Korea continues scooping up billions of dollars from
hacking crypto exchanges and decides to invest some of those proceeds into
building a quantum computer for the biggest payday ever...

Downsides to Allowing Quantum Recovery
Let's think through an exhaustive list of pros and cons for allowing or
preventing the seizure of funds by a quantum adversary.

Historical Precedent
Previous protocol vulnerabilities weren’t celebrated as "fair game" but
rather were treated as failures to be remediated. Treating quantum theft
differently risks rewriting Bitcoin’s history as a free-for-all rather than
a system that seeks to protect its users.

Violation of Property Rights
Allowing a quantum adversary to take control of funds undermines the
fundamental principle of cryptocurrency - if you keep your keys in your
possession, only you should be able to access your money. Bitcoin is built
on the idea that private keys secure an individual’s assets, and
unauthorized access (even via advanced tech) is theft, not a legitimate
transfer.

Erosion of Trust in Bitcoin
If quantum attackers can exploit vulnerable addresses, confidence in
Bitcoin as a secure store of value would collapse. Users and investors rely
on cryptographic integrity, and widespread theft could drive adoption away
from Bitcoin, destabilizing its ecosystem.

This is essentially the counterpoint to claiming the burning of vulnerable
funds is a violation of property rights. While some will certainly see it
as such, others will find the apathy toward stopping quantum theft to be
similarly concerning.

Unfair Advantage
Quantum attackers, likely equipped with rare and expensive technology,
would have an unjust edge over regular users who lack access to such tools.
This creates an inequitable system where only the technologically elite can
exploit others, contradicting Bitcoin’s ethos of decentralized power.

Bitcoin is designed to create an asymmetric advantage for DEFENDING one's
wealth. It's supposed to be impractically expensive for attackers to crack
the entropy and cryptography protecting one's coins. But now we find
ourselves discussing a situation where this asymmetric advantage is
compromised in favor of a specific class of attackers.

Economic Disruption
Large-scale theft from vulnerable addresses could crash Bitcoin’s price as
quantum recovered funds are dumped on exchanges. This would harm all
holders, not just those directly targeted, leading to broader financial
chaos in the markets.

Moral Responsibility
Permitting theft via quantum computing sets a precedent that technological
superiority justifies unethical behavior. This is essentially taking a
"code is law" stance in which we refuse to admit that both code and laws
can be modified to adapt to previously unforeseen situations.

Burning of coins can certainly be considered a form of theft, thus I think
it's worth differentiating the two different thefts being discussed:

1. self-enriching & likely malicious
2. harm prevention & not necessarily malicious

Both options lack the consent of the party whose coins are being burnt or
transferred, thus I think the simple argument that theft is immoral becomes
a wash and it's important to drill down into the details of each.

Incentives Drive Security
I can tell you from a decade of working in Bitcoin security - the average
user is lazy and is a procrastinator. If Bitcoiners are given a "drop dead
date" after which they know vulnerable funds will be burned, this pressure
accelerates the adoption of post-quantum cryptography and strengthens
Bitcoin long-term. Allowing vulnerable users to delay upgrading
indefinitely will result in more laggards, leaving the network more exposed
when quantum tech becomes available.

Steel Manning
Clearly this is a complex and controversial topic, thus it's worth thinking
through the opposing arguments.

Protecting Property Rights
Allowing quantum computers to take vulnerable bitcoin could potentially be
spun as a hard money narrative - we care so greatly about not violating
someone's access to their coins that we allow them to be stolen!

But I think the flip side to the property rights narrative is that burning
vulnerable coins prevents said property from falling into undeserving
hands. If the entire Bitcoin ecosystem just stands around and allows
quantum adversaries to claim funds that rightfully belong to other users,
is that really a "win" in the "protecting property rights" category? It
feels more like apathy to me.

As such, I think the "protecting property rights" argument is a wash.

Quantum Computers Won't Attack Bitcoin
There is a great deal of skepticism that sufficiently powerful quantum
computers will ever exist, so we shouldn't bother preparing for a
non-existent threat. Others have argued that even if such a computer was
built, a quantum attacker would not go after bitcoin because they wouldn't
want to reveal their hand by doing so, and would instead attack other
infrastructure.

It's quite difficult to quantify exactly how valuable attacking other
infrastructure would be. It also really depends upon when an entity gains
quantum supremacy and thus if by that time most of the world's systems have
already been upgraded. While I think you could argue that certain entities
gaining quantum capability might not attack Bitcoin, it would only delay
the inevitable - eventually somebody will achieve the capability who
decides to use it for such an attack.

Quantum Attackers Would Only Steal Small Amounts
Some have argued that even if a quantum attacker targeted bitcoin, they'd
only go after old, likely lost P2PK outputs so as to not arouse suspicion
and cause a market panic.

I'm not so sure about that; why go after 50 BTC at a time when you could
take 250,000 BTC with the same effort as 50 BTC? This is a classic "zero
day exploit" game theory in which an attacker knows they have a limited
amount of time before someone else discovers the exploit and either
benefits from it or patches it. Take, for example, the recent ByBit attack
- the highest value crypto hack of all time. Lazarus Group had compromised
the Safe wallet front end JavaScript app and they could have simply had it
reassign ownership of everyone's Safe wallets as they were interacting with
their wallet. But instead they chose to only specifically target ByBit's
wallet with $1.5 billion in it because they wanted to maximize their
extractable value. If Lazarus had started stealing from every wallet, they
would have been discovered quickly and the Safe web app would likely have
been patched well before any billion dollar wallets executed the malicious
code.

I think the "only stealing small amounts" argument is strongest for
Situation #2 described earlier, where a quantum attacker arrives before
quantum safe cryptography has been deployed across the Bitcoin ecosystem.
Because if it became clear that Bitcoin's cryptography was broken AND there
was nowhere safe for vulnerable users to migrate, the only logical option
would be for everyone to liquidate their bitcoin as quickly as possible. As
such, I don't think it applies as strongly for situations in which we have
a migration path available.

The 21 Million Coin Supply Should be in Circulation
Some folks are arguing that it's important for the "circulating /
spendable" supply to be as close to 21M as possible and that having a
significant portion of the supply out of circulation is somehow undesirable.

While the "21M BTC" attribute is a strong memetic narrative, I don't think
anyone has ever expected that it would all be in circulation. It has always
been understood that many coins will be lost, and that's actually part of
the game theory of owning bitcoin!

And remember, the 21M number in and of itself is not a particularly
important detail - it's not even mentioned in the whitepaper. What's
important is that the supply is well known and not subject to change.

Self-Sovereignty and Personal Responsibility
Bitcoin’s design empowers individuals to control their own wealth, free
from centralized intervention. This freedom comes with the burden of
securing one's private keys. If quantum computing can break obsolete
cryptography, the fault lies with users who didn't move their funds to
quantum safe locking scripts. Expecting the network to shield users from
their own negligence undermines the principle that you, and not a third
party, are accountable for your assets.

I think this is generally a fair point that "the community" doesn't owe you
anything in terms of helping you. I think that we do, however, need to
consider the incentives and game theory in play with regard to quantum safe
Bitcoiners vs quantum vulnerable Bitcoiners. More on that later.

Code is Law
Bitcoin operates on transparent, immutable rules embedded in its protocol.
If a quantum attacker uses superior technology to derive private keys from
public keys, they’re not "hacking" the system - they're simply following
what's mathematically permissible within the current code. Altering the
protocol to stop this introduces subjective human intervention, which
clashes with the objective, deterministic nature of blockchain.

While I tend to agree that code is law, one of the entire points of laws is
that they can be amended to improve their efficacy in reducing harm.
Leaning on this point seems more like a pro-ossification stance that it's
better to do nothing and allow harm to occur rather than take action to
stop an attack that was foreseen far in advance.

Technological Evolution as a Feature, Not a Bug
It's well known that cryptography tends to weaken over time and eventually
break. Quantum computing is just the next step in this progression. Users
who fail to adapt (e.g., by adopting quantum-resistant wallets when
available) are akin to those who ignored technological advancements like
multisig or hardware wallets. Allowing quantum theft incentivizes
innovation and keeps Bitcoin’s ecosystem dynamic, punishing complacency
while rewarding vigilance.

Market Signals Drive Security
If quantum attackers start stealing funds, it sends a clear signal to the
market: upgrade your security or lose everything. This pressure accelerates
the adoption of post-quantum cryptography and strengthens Bitcoin
long-term. Coddling vulnerable users delays this necessary evolution,
potentially leaving the network more exposed when quantum tech becomes
widely accessible. Theft is a brutal but effective teacher.

Centralized Blacklisting Power
Burning vulnerable funds requires centralized decision-making - a soft fork
to invalidate certain transactions. This sets a dangerous precedent for
future interventions, eroding Bitcoin’s decentralization. If quantum theft
is blocked, what’s next - reversing exchange hacks? The system must remain
neutral, even if it means some lose out.

I think this could be a potential slippery slope if the proposal was to
only burn specific addresses. Rather, I'd expect a neutral proposal to burn
all funds in locking script types that are known to be quantum vulnerable.
Thus, we could eliminate any subjectivity from the code.

Fairness in Competition
Quantum attackers aren't cheating; they're using publicly available physics
and math. Anyone with the resources and foresight can build or access
quantum tech, just as anyone could mine Bitcoin in 2009 with a CPU. Early
adopters took risks and reaped rewards; quantum innovators are doing the
same. Calling it “unfair” ignores that Bitcoin has never promised equality
of outcome - only equality of opportunity within its rules.

I find this argument to be a mischaracterization because we're not talking
about CPUs. This is more akin to talking about ASICs, except each ASIC
costs millions if not billions of dollars. This is out of reach from all
but the wealthiest organizations.

Economic Resilience
Bitcoin has weathered thefts before (MTGOX, Bitfinex, FTX, etc) and emerged
stronger. The market can absorb quantum losses, with unaffected users
continuing to hold and new entrants buying in at lower prices. Fear of
economic collapse overestimates the impact - the network’s antifragility
thrives on such challenges.

This is a big grey area because we don't know when a quantum computer will
come online and we don't know how quickly said computers would be able to
steal bitcoin. If, for example, the first generation of sufficiently
powerful quantum computers were stealing less volume than the current block
reward then of course it will have minimal economic impact. But if they're
taking thousands of BTC per day and bringing them back into circulation,
there will likely be a noticeable market impact as it absorbs the new
supply.

This is where the circumstances will really matter. If a quantum attacker
appears AFTER the Bitcoin protocol has been upgraded to support quantum
resistant cryptography then we should expect the most valuable active
wallets will have upgraded and the juiciest target would be the 31,000 BTC
in the address 12ib7dApVFvg82TXKycWBNpN8kFyiAN1dr which has been dormant
since 2010. In general I'd expect that the amount of BTC re-entering the
circulating supply would look somewhat similar to the mining emission
curve: volume would start off very high as the most valuable addresses are
drained and then it would fall off as quantum computers went down the list
targeting addresses with less and less BTC.

Why is economic impact a factor worth considering? Miners and businesses in
general. More coins being liquidated will push down the price, which will
negatively impact miner revenue. Similarly, I can attest from working in
the industry for a decade, that lower prices result in less demand from
businesses across the entire industry. As such, burning quantum vulnerable
bitcoin is good for the entire industry.

Practicality & Neutrality of Non-Intervention
There’s no reliable way to distinguish “theft” from legitimate "white hat"
key recovery. If someone loses their private key and a quantum computer
recovers it, is that stealing or reclaiming? Policing quantum actions
requires invasive assumptions about intent, which Bitcoin’s trustless
design can’t accommodate. Letting the chips fall where they may avoids this
mess.

Philosophical Purity
Bitcoin rejects bailouts. It’s a cold, hard system where outcomes reflect
preparation and skill, not sentimentality. If quantum computing upends the
game, that’s the point - Bitcoin isn’t meant to be safe or fair in a
nanny-state sense; it’s meant to be free. Users who lose funds to quantum
attacks are casualties of liberty and their own ignorance, not victims of
injustice.

Bitcoin's DAO Moment
This situation has some similarities to The DAO hack of an Ethereum smart
contract in 2016, which resulted in a fork to stop the attacker and return
funds to their original owners. The game theory is similar because it's a
situation where a threat is known but there's some period of time before
the attacker can actually execute the theft. As such, there's time to
mitigate the attack by changing the protocol.

It also created a schism in the community around the true meaning of "code
is law," resulting in Ethereum Classic, which decided to allow the attacker
to retain control of the stolen funds.

A soft fork to burn vulnerable bitcoin could certainly result in a hard
fork if there are enough miners who reject the soft fork and continue
including transactions.

Incentives Matter
We can wax philosophical until the cows come home, but what are the actual
incentives for existing Bitcoin holders regarding this decision?

"Lost coins only make everyone else's coins worth slightly more. Think of
> it as a donation to everyone." - Satoshi Nakamoto


If true, the corollary is:

"Quantum recovered coins only make everyone else's coins worth less. Think
> of it as a theft from everyone." - Jameson Lopp


Thus, assuming we get to a point where quantum resistant signatures are
supported within the Bitcoin protocol, what's the incentive to let
vulnerable coins remain spendable?

* It's not good for the actual owners of those coins. It disincentivizes
owners from upgrading until perhaps it's too late.
* It's not good for the more attentive / responsible owners of coins who
have quantum secured their stash. Allowing the circulating supply to
balloon will assuredly reduce the purchasing power of all bitcoin holders.

Forking Game Theory
From a game theory point of view, I see this as incentivizing users to
upgrade their wallets. If you disagree with the burning of vulnerable
coins, all you have to do is move your funds to a quantum safe signature
scheme. Point being, I don't see there being an economic majority (or even
more than a tiny minority) of users who would fight such a soft fork. Why
expend significant resources fighting a fork when you can just move your
coins to a new address?

Remember that blocking spending of certain classes of locking scripts is a
tightening of the rules - a soft fork. As such, it can be meaningfully
enacted and enforced by a mere majority of hashpower. If miners generally
agree that it's in their best interest to burn vulnerable coins, are other
users going to care enough to put in the effort to run new node software
that resists the soft fork? Seems unlikely to me.

How to Execute Burning
In order to be as objective as possible, the goal would be to announce to
the world that after a specific block height / timestamp, Bitcoin nodes
will no longer accept transactions (or blocks containing such transactions)
that spend funds from any scripts other than the newly instituted quantum
safe schemes.

It could take a staggered approach to first freeze funds that are
susceptible to long-range attacks such as those in P2PK scripts or those
that exposed their public keys due to previously re-using addresses, but I
expect the additional complexity would drive further controversy.

How long should the grace period be in order to give the ecosystem time to
upgrade? I'd say a minimum of 1 year for software wallets to upgrade. We
can only hope that hardware wallet manufacturers are able to implement post
quantum cryptography on their existing hardware with only a firmware update.

Beyond that, it will take at least 6 months worth of block space for all
users to migrate their funds, even in a best case scenario. Though if you
exclude dust UTXOs you could probably get 95% of BTC value migrated in 1
month. Of course this is a highly optimistic situation where everyone is
completely focused on migrations - in reality it will take far longer.

Regardless, I'd think that in order to reasonably uphold Bitcoin's
conservatism it would be preferable to allow a 4 year migration window. In
the meantime, mining pools could coordinate emergency soft forking logic
such that if quantum attackers materialized, they could accelerate the
countdown to the quantum vulnerable funds burn.

Random Tangential Benefits
On the plus side, burning all quantum vulnerable bitcoin would allow us to
prune all of those UTXOs out of the UTXO set, which would also clean up a
lot of dust. Dust UTXOs are a bit of an annoyance and there has even been a
recent proposal for how to incentivize cleaning them up.

We should also expect that incentivizing migration of the entire UTXO set
will create substantial demand for block space that will sustain a fee
market for a fairly lengthy amount of time.

In Summary
While the moral quandary of violating any of Bitcoin's inviolable
properties can make this a very complex issue to discuss, the game theory
and incentives between burning vulnerable coins versus allowing them to be
claimed by entities with quantum supremacy appears to be a much simpler
issue.

I, for one, am not interested in rewarding quantum capable entities by
inflating the circulating money supply just because some people lost their
keys long ago and some laggards are not upgrading their bitcoin wallet's
security.

We can hope that this scenario never comes to pass, but hope is not a
strategy.

I welcome your feedback upon any of the above points, and contribution of
any arguments I failed to consider.

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups•com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/CADL_X_cF%3DUKVa7CitXReMq8nA_4RadCF%3D%3DkU4YG%2B0GYN97P6hQ%40mail.gmail.com.

[-- Attachment #2: Type: text/html, Size: 34442 bytes --]

 permalink raw reply	[|nested]
2025-03-16 18:03 ` 
                   ` 
  
From: Jameson Lopp @ 2025-03-16 14:15 UTC (permalink / raw)
  To: Bitcoin Development Mailing List

[-- Attachment #1: Type: text/plain, Size: 31531 bytes --]

The quantum computing debate is heating up. There are many controversial
aspects to this debate, including whether or not quantum computers will
ever actually become a practical threat.

I won't tread into the unanswerable question of how worried we should be
about quantum computers. I think it's far from a crisis, but given the
difficulty in changing Bitcoin it's worth starting to seriously discuss.
Today I wish to focus on a philosophical quandary related to one of the
decisions that would need to be made if and when we implement a quantum
safe signature scheme.

Several Scenarios
Because this essay will reference game theory a fair amount, and there are
many variables at play that could change the nature of the game, I think
it's important to clarify the possible scenarios up front.

1. Quantum computing never materializes, never becomes a threat, and thus
everything discussed in this essay is moot.
2. A quantum computing threat materializes suddenly and Bitcoin does not
have quantum safe signatures as part of the protocol. In this scenario it
would likely make the points below moot because Bitcoin would be
fundamentally broken and it would take far too long to upgrade the
protocol, wallet software, and migrate user funds in order to restore
confidence in the network.
3. Quantum computing advances slowly enough that we come to consensus about
how to upgrade Bitcoin and post quantum security has been minimally adopted
by the time an attacker appears.
4. Quantum computing advances slowly enough that we come to consensus about
how to upgrade Bitcoin and post quantum security has been highly adopted by
the time an attacker appears.

For the purposes of this post, I'm envisioning being in situation 3 or 4.

To Freeze or not to Freeze?
I've started seeing more people weighing in on what is likely the most
contentious aspect of how a quantum resistance upgrade should be handled in
terms of migrating user funds. Should quantum vulnerable funds be left open
to be swept by anyone with a sufficiently powerful quantum computer OR
should they be permanently locked?

"I don't see why old coins should be confiscated. The better option is to
> let those with quantum computers free up old coins. While this might have
> an inflationary impact on bitcoin's price, to use a turn of phrase, the
> inflation is transitory. Those with low time preference should support
> returning lost coins to circulation."

- Hunter Beast


On the other hand:

"Of course they have to be confiscated. If and when (and that's a big if)
> the existence of a cryptography-breaking QC becomes a credible threat, the
> Bitcoin ecosystem has no other option than softforking out the ability to
> spend from signature schemes (including ECDSA and BIP340) that are
> vulnerable to QCs. The alternative is that millions of BTC become
> vulnerable to theft; I cannot see how the currency can maintain any value
> at all in such a setting. And this affects everyone; even those which
> diligently moved their coins to PQC-protected schemes."
> - Pieter Wuille


I don't think "confiscation" is the most precise term to use, as the funds
are not being seized and reassigned. Rather, what we're really discussing
would be better described as "burning" - placing the funds *out of reach of
everyone*.

Not freezing user funds is one of Bitcoin's inviolable properties. However,
if quantum computing becomes a threat to Bitcoin's elliptic curve
cryptography, *an inviolable property of Bitcoin will be violated one way
or another*.

Fundamental Properties at Risk
5 years ago I attempted to comprehensively categorize all of Bitcoin's
fundamental properties that give it value.
https://nakamoto.com/what-are-the-key-properties-of-bitcoin/

The particular properties in play with regard to this issue seem to be:

*Censorship Resistance* - No one should have the power to prevent others
from using their bitcoin or interacting with the network.

*Forward Compatibility* - changing the rules such that certain valid
transactions become invalid could undermine confidence in the protocol.

*Conservatism* - Users should not be expected to be highly responsive to
system issues.

As a result of the above principles, we have developed a strong meme (kudos
to Andreas Antonopoulos) that goes as follows:

Not your keys, not your coins.


I posit that the corollary to this principle is:

Your keys, only your coins.


A quantum capable entity breaks the corollary of this foundational
principle. We secure our bitcoin with the mathematical probabilities
related to extremely large random numbers. Your funds are only secure
because truly random large numbers should not be guessable or discoverable
by anyone else in the world.

This is the principle behind the motto *vires in numeris* - strength in
numbers. In a world with quantum enabled adversaries, this principle is
null and void for many types of cryptography, including the elliptic curve
digital signatures used in Bitcoin.

Who is at Risk?
There has long been a narrative that Satoshi's coins and others from the
Satoshi era of P2PK locking scripts that exposed the public key directly on
the blockchain will be those that get scooped up by a quantum "miner." But
unfortunately it's not that simple. If I had a powerful quantum computer,
which coins would I target? I'd go to the Bitcoin rich list and find the
wallets that have exposed their public keys due to re-using addresses that
have previously been spent from. You can easily find them at
https://bitinfocharts.com/top-100-richest-bitcoin-addresses.html

Note that a few of these wallets, like Bitfinex / Kraken / Tether, would be
slightly harder to crack because they are multisig wallets. So a quantum
attacker would need to reverse engineer 2 keys for Kraken or 3 for Bitfinex
/ Tether in order to spend funds. But many are single signature.

Point being, it's not only the really old lost BTC that are at risk to a
quantum enabled adversary, at least at time of writing. If we add a quantum
safe signature scheme, we should expect those wallets to be some of the
first to upgrade given their incentives.

The Ethical Dilemma: Quantifying Harm
Which decision results in the most harm?

By making quantum vulnerable funds unspendable we potentially harm some
Bitcoin users who were not paying attention and neglected to migrate their
funds to a quantum safe locking script. This violates the "conservativism"
principle stated earlier. On the flip side, we prevent those funds plus far
more lost funds from falling into the hands of the few privileged folks who
gain early access to quantum computers.

By leaving quantum vulnerable funds available to spend, the same set of
users who would otherwise have funds frozen are likely to see them stolen.
And many early adopters who lost their keys will eventually see their
unreachable funds scooped up by a quantum enabled adversary.

Imagine, for example, being James Howells, who accidentally threw away a
hard drive with 8,000 BTC on it, currently worth over $600M USD. He has
spent a decade trying to retrieve it from the landfill where he knows it's
buried, but can't get permission to excavate. I suspect that, given the
choice, he'd prefer those funds be permanently frozen rather than fall into
someone else's possession - I know I would.

Allowing a quantum computer to access lost funds doesn't make those users
any worse off than they were before, however it *would* have a negative
impact upon everyone who is currently holding bitcoin.

It's prudent to expect significant economic disruption if large amounts of
coins fall into new hands. Since a quantum computer is going to have a
massive up front cost, expect those behind it to desire to recoup their
investment. We also know from experience that when someone suddenly finds
themselves in possession of 9+ figures worth of highly liquid assets, they
tend to diversify into other things by selling.

Allowing quantum recovery of bitcoin is *tantamount to wealth
redistribution*. What we'd be allowing is for bitcoin to be redistributed
from those who are ignorant of quantum computers to those who have won the
technological race to acquire quantum computers. It's hard to see a bright
side to that scenario.

Is Quantum Recovery Good for Anyone?

Does quantum recovery HELP anyone? I've yet to come across an argument that
it's a net positive in any way. It certainly doesn't add any security to
the network. If anything, it greatly decreases the security of the network
by allowing funds to be claimed by those who did not earn them.

But wait, you may be thinking, wouldn't quantum "miners" have earned their
coins by all the work and resources invested in building a quantum
computer? I suppose, in the same sense that a burglar earns their spoils by
the resources they invest into surveilling targets and learning the skills
needed to break into buildings. What I say "earned" I mean through
productive mutual trade.

For example:

* Investors earn BTC by trading for other currencies.
* Merchants earn BTC by trading for goods and services.
* Miners earn BTC by trading thermodynamic security.
* Quantum miners don't trade anything, they are vampires feeding upon the
system.

There's no reason to believe that allowing quantum adversaries to recover
vulnerable bitcoin will be of benefit to anyone other than the select few
organizations that win the technological arms race to build the first such
computers. Probably nation states and/or the top few largest tech companies.

One could certainly hope that an organization with quantum supremacy is
benevolent and acts in a "white hat" manner to return lost coins to their
owners, but that's incredibly optimistic and foolish to rely upon. Such a
situation creates an insurmountable ethical dilemma of only recovering lost
bitcoin rather than currently owned bitcoin. There's no way to precisely
differentiate between the two; anyone can claim to have lost their bitcoin
but if they have lost their keys then proving they ever had the keys
becomes rather difficult. I imagine that any such white hat recovery
efforts would have to rely upon attestations from trusted third parties
like exchanges.

Even if the first actor with quantum supremacy is benevolent, we must
assume the technology could fall into adversarial hands and thus think
adversarially about the potential worst case outcomes. Imagine, for
example, that North Korea continues scooping up billions of dollars from
hacking crypto exchanges and decides to invest some of those proceeds into
building a quantum computer for the biggest payday ever...

Downsides to Allowing Quantum Recovery
Let's think through an exhaustive list of pros and cons for allowing or
preventing the seizure of funds by a quantum adversary.

Historical Precedent
Previous protocol vulnerabilities weren’t celebrated as "fair game" but
rather were treated as failures to be remediated. Treating quantum theft
differently risks rewriting Bitcoin’s history as a free-for-all rather than
a system that seeks to protect its users.

Violation of Property Rights
Allowing a quantum adversary to take control of funds undermines the
fundamental principle of cryptocurrency - if you keep your keys in your
possession, only you should be able to access your money. Bitcoin is built
on the idea that private keys secure an individual’s assets, and
unauthorized access (even via advanced tech) is theft, not a legitimate
transfer.

Erosion of Trust in Bitcoin
If quantum attackers can exploit vulnerable addresses, confidence in
Bitcoin as a secure store of value would collapse. Users and investors rely
on cryptographic integrity, and widespread theft could drive adoption away
from Bitcoin, destabilizing its ecosystem.

This is essentially the counterpoint to claiming the burning of vulnerable
funds is a violation of property rights. While some will certainly see it
as such, others will find the apathy toward stopping quantum theft to be
similarly concerning.

Unfair Advantage
Quantum attackers, likely equipped with rare and expensive technology,
would have an unjust edge over regular users who lack access to such tools.
This creates an inequitable system where only the technologically elite can
exploit others, contradicting Bitcoin’s ethos of decentralized power.

Bitcoin is designed to create an asymmetric advantage for DEFENDING one's
wealth. It's supposed to be impractically expensive for attackers to crack
the entropy and cryptography protecting one's coins. But now we find
ourselves discussing a situation where this asymmetric advantage is
compromised in favor of a specific class of attackers.

Economic Disruption
Large-scale theft from vulnerable addresses could crash Bitcoin’s price as
quantum recovered funds are dumped on exchanges. This would harm all
holders, not just those directly targeted, leading to broader financial
chaos in the markets.

Moral Responsibility
Permitting theft via quantum computing sets a precedent that technological
superiority justifies unethical behavior. This is essentially taking a
"code is law" stance in which we refuse to admit that both code and laws
can be modified to adapt to previously unforeseen situations.

Burning of coins can certainly be considered a form of theft, thus I think
it's worth differentiating the two different thefts being discussed:

1. self-enriching & likely malicious
2. harm prevention & not necessarily malicious

Both options lack the consent of the party whose coins are being burnt or
transferred, thus I think the simple argument that theft is immoral becomes
a wash and it's important to drill down into the details of each.

Incentives Drive Security
I can tell you from a decade of working in Bitcoin security - the average
user is lazy and is a procrastinator. If Bitcoiners are given a "drop dead
date" after which they know vulnerable funds will be burned, this pressure
accelerates the adoption of post-quantum cryptography and strengthens
Bitcoin long-term. Allowing vulnerable users to delay upgrading
indefinitely will result in more laggards, leaving the network more exposed
when quantum tech becomes available.

Steel Manning
Clearly this is a complex and controversial topic, thus it's worth thinking
through the opposing arguments.

Protecting Property Rights
Allowing quantum computers to take vulnerable bitcoin could potentially be
spun as a hard money narrative - we care so greatly about not violating
someone's access to their coins that we allow them to be stolen!

But I think the flip side to the property rights narrative is that burning
vulnerable coins prevents said property from falling into undeserving
hands. If the entire Bitcoin ecosystem just stands around and allows
quantum adversaries to claim funds that rightfully belong to other users,
is that really a "win" in the "protecting property rights" category? It
feels more like apathy to me.

As such, I think the "protecting property rights" argument is a wash.

Quantum Computers Won't Attack Bitcoin
There is a great deal of skepticism that sufficiently powerful quantum
computers will ever exist, so we shouldn't bother preparing for a
non-existent threat. Others have argued that even if such a computer was
built, a quantum attacker would not go after bitcoin because they wouldn't
want to reveal their hand by doing so, and would instead attack other
infrastructure.

It's quite difficult to quantify exactly how valuable attacking other
infrastructure would be. It also really depends upon when an entity gains
quantum supremacy and thus if by that time most of the world's systems have
already been upgraded. While I think you could argue that certain entities
gaining quantum capability might not attack Bitcoin, it would only delay
the inevitable - eventually somebody will achieve the capability who
decides to use it for such an attack.

Quantum Attackers Would Only Steal Small Amounts
Some have argued that even if a quantum attacker targeted bitcoin, they'd
only go after old, likely lost P2PK outputs so as to not arouse suspicion
and cause a market panic.

I'm not so sure about that; why go after 50 BTC at a time when you could
take 250,000 BTC with the same effort as 50 BTC? This is a classic "zero
day exploit" game theory in which an attacker knows they have a limited
amount of time before someone else discovers the exploit and either
benefits from it or patches it. Take, for example, the recent ByBit attack
- the highest value crypto hack of all time. Lazarus Group had compromised
the Safe wallet front end JavaScript app and they could have simply had it
reassign ownership of everyone's Safe wallets as they were interacting with
their wallet. But instead they chose to only specifically target ByBit's
wallet with $1.5 billion in it because they wanted to maximize their
extractable value. If Lazarus had started stealing from every wallet, they
would have been discovered quickly and the Safe web app would likely have
been patched well before any billion dollar wallets executed the malicious
code.

I think the "only stealing small amounts" argument is strongest for
Situation #2 described earlier, where a quantum attacker arrives before
quantum safe cryptography has been deployed across the Bitcoin ecosystem.
Because if it became clear that Bitcoin's cryptography was broken AND there
was nowhere safe for vulnerable users to migrate, the only logical option
would be for everyone to liquidate their bitcoin as quickly as possible. As
such, I don't think it applies as strongly for situations in which we have
a migration path available.

The 21 Million Coin Supply Should be in Circulation
Some folks are arguing that it's important for the "circulating /
spendable" supply to be as close to 21M as possible and that having a
significant portion of the supply out of circulation is somehow undesirable.

While the "21M BTC" attribute is a strong memetic narrative, I don't think
anyone has ever expected that it would all be in circulation. It has always
been understood that many coins will be lost, and that's actually part of
the game theory of owning bitcoin!

And remember, the 21M number in and of itself is not a particularly
important detail - it's not even mentioned in the whitepaper. What's
important is that the supply is well known and not subject to change.

Self-Sovereignty and Personal Responsibility
Bitcoin’s design empowers individuals to control their own wealth, free
from centralized intervention. This freedom comes with the burden of
securing one's private keys. If quantum computing can break obsolete
cryptography, the fault lies with users who didn't move their funds to
quantum safe locking scripts. Expecting the network to shield users from
their own negligence undermines the principle that you, and not a third
party, are accountable for your assets.

I think this is generally a fair point that "the community" doesn't owe you
anything in terms of helping you. I think that we do, however, need to
consider the incentives and game theory in play with regard to quantum safe
Bitcoiners vs quantum vulnerable Bitcoiners. More on that later.

Code is Law
Bitcoin operates on transparent, immutable rules embedded in its protocol.
If a quantum attacker uses superior technology to derive private keys from
public keys, they’re not "hacking" the system - they're simply following
what's mathematically permissible within the current code. Altering the
protocol to stop this introduces subjective human intervention, which
clashes with the objective, deterministic nature of blockchain.

While I tend to agree that code is law, one of the entire points of laws is
that they can be amended to improve their efficacy in reducing harm.
Leaning on this point seems more like a pro-ossification stance that it's
better to do nothing and allow harm to occur rather than take action to
stop an attack that was foreseen far in advance.

Technological Evolution as a Feature, Not a Bug
It's well known that cryptography tends to weaken over time and eventually
break. Quantum computing is just the next step in this progression. Users
who fail to adapt (e.g., by adopting quantum-resistant wallets when
available) are akin to those who ignored technological advancements like
multisig or hardware wallets. Allowing quantum theft incentivizes
innovation and keeps Bitcoin’s ecosystem dynamic, punishing complacency
while rewarding vigilance.

Market Signals Drive Security
If quantum attackers start stealing funds, it sends a clear signal to the
market: upgrade your security or lose everything. This pressure accelerates
the adoption of post-quantum cryptography and strengthens Bitcoin
long-term. Coddling vulnerable users delays this necessary evolution,
potentially leaving the network more exposed when quantum tech becomes
widely accessible. Theft is a brutal but effective teacher.

Centralized Blacklisting Power
Burning vulnerable funds requires centralized decision-making - a soft fork
to invalidate certain transactions. This sets a dangerous precedent for
future interventions, eroding Bitcoin’s decentralization. If quantum theft
is blocked, what’s next - reversing exchange hacks? The system must remain
neutral, even if it means some lose out.

I think this could be a potential slippery slope if the proposal was to
only burn specific addresses. Rather, I'd expect a neutral proposal to burn
all funds in locking script types that are known to be quantum vulnerable.
Thus, we could eliminate any subjectivity from the code.

Fairness in Competition
Quantum attackers aren't cheating; they're using publicly available physics
and math. Anyone with the resources and foresight can build or access
quantum tech, just as anyone could mine Bitcoin in 2009 with a CPU. Early
adopters took risks and reaped rewards; quantum innovators are doing the
same. Calling it “unfair” ignores that Bitcoin has never promised equality
of outcome - only equality of opportunity within its rules.

I find this argument to be a mischaracterization because we're not talking
about CPUs. This is more akin to talking about ASICs, except each ASIC
costs millions if not billions of dollars. This is out of reach from all
but the wealthiest organizations.

Economic Resilience
Bitcoin has weathered thefts before (MTGOX, Bitfinex, FTX, etc) and emerged
stronger. The market can absorb quantum losses, with unaffected users
continuing to hold and new entrants buying in at lower prices. Fear of
economic collapse overestimates the impact - the network’s antifragility
thrives on such challenges.

This is a big grey area because we don't know when a quantum computer will
come online and we don't know how quickly said computers would be able to
steal bitcoin. If, for example, the first generation of sufficiently
powerful quantum computers were stealing less volume than the current block
reward then of course it will have minimal economic impact. But if they're
taking thousands of BTC per day and bringing them back into circulation,
there will likely be a noticeable market impact as it absorbs the new
supply.

This is where the circumstances will really matter. If a quantum attacker
appears AFTER the Bitcoin protocol has been upgraded to support quantum
resistant cryptography then we should expect the most valuable active
wallets will have upgraded and the juiciest target would be the 31,000 BTC
in the address 12ib7dApVFvg82TXKycWBNpN8kFyiAN1dr which has been dormant
since 2010. In general I'd expect that the amount of BTC re-entering the
circulating supply would look somewhat similar to the mining emission
curve: volume would start off very high as the most valuable addresses are
drained and then it would fall off as quantum computers went down the list
targeting addresses with less and less BTC.

Why is economic impact a factor worth considering? Miners and businesses in
general. More coins being liquidated will push down the price, which will
negatively impact miner revenue. Similarly, I can attest from working in
the industry for a decade, that lower prices result in less demand from
businesses across the entire industry. As such, burning quantum vulnerable
bitcoin is good for the entire industry.

Practicality & Neutrality of Non-Intervention
There’s no reliable way to distinguish “theft” from legitimate "white hat"
key recovery. If someone loses their private key and a quantum computer
recovers it, is that stealing or reclaiming? Policing quantum actions
requires invasive assumptions about intent, which Bitcoin’s trustless
design can’t accommodate. Letting the chips fall where they may avoids this
mess.

Philosophical Purity
Bitcoin rejects bailouts. It’s a cold, hard system where outcomes reflect
preparation and skill, not sentimentality. If quantum computing upends the
game, that’s the point - Bitcoin isn’t meant to be safe or fair in a
nanny-state sense; it’s meant to be free. Users who lose funds to quantum
attacks are casualties of liberty and their own ignorance, not victims of
injustice.

Bitcoin's DAO Moment
This situation has some similarities to The DAO hack of an Ethereum smart
contract in 2016, which resulted in a fork to stop the attacker and return
funds to their original owners. The game theory is similar because it's a
situation where a threat is known but there's some period of time before
the attacker can actually execute the theft. As such, there's time to
mitigate the attack by changing the protocol.

It also created a schism in the community around the true meaning of "code
is law," resulting in Ethereum Classic, which decided to allow the attacker
to retain control of the stolen funds.

A soft fork to burn vulnerable bitcoin could certainly result in a hard
fork if there are enough miners who reject the soft fork and continue
including transactions.

Incentives Matter
We can wax philosophical until the cows come home, but what are the actual
incentives for existing Bitcoin holders regarding this decision?

"Lost coins only make everyone else's coins worth slightly more. Think of
> it as a donation to everyone." - Satoshi Nakamoto


If true, the corollary is:

"Quantum recovered coins only make everyone else's coins worth less. Think
> of it as a theft from everyone." - Jameson Lopp


Thus, assuming we get to a point where quantum resistant signatures are
supported within the Bitcoin protocol, what's the incentive to let
vulnerable coins remain spendable?

* It's not good for the actual owners of those coins. It disincentivizes
owners from upgrading until perhaps it's too late.
* It's not good for the more attentive / responsible owners of coins who
have quantum secured their stash. Allowing the circulating supply to
balloon will assuredly reduce the purchasing power of all bitcoin holders.

Forking Game Theory
From a game theory point of view, I see this as incentivizing users to
upgrade their wallets. If you disagree with the burning of vulnerable
coins, all you have to do is move your funds to a quantum safe signature
scheme. Point being, I don't see there being an economic majority (or even
more than a tiny minority) of users who would fight such a soft fork. Why
expend significant resources fighting a fork when you can just move your
coins to a new address?

Remember that blocking spending of certain classes of locking scripts is a
tightening of the rules - a soft fork. As such, it can be meaningfully
enacted and enforced by a mere majority of hashpower. If miners generally
agree that it's in their best interest to burn vulnerable coins, are other
users going to care enough to put in the effort to run new node software
that resists the soft fork? Seems unlikely to me.

How to Execute Burning
In order to be as objective as possible, the goal would be to announce to
the world that after a specific block height / timestamp, Bitcoin nodes
will no longer accept transactions (or blocks containing such transactions)
that spend funds from any scripts other than the newly instituted quantum
safe schemes.

It could take a staggered approach to first freeze funds that are
susceptible to long-range attacks such as those in P2PK scripts or those
that exposed their public keys due to previously re-using addresses, but I
expect the additional complexity would drive further controversy.

How long should the grace period be in order to give the ecosystem time to
upgrade? I'd say a minimum of 1 year for software wallets to upgrade. We
can only hope that hardware wallet manufacturers are able to implement post
quantum cryptography on their existing hardware with only a firmware update.

Beyond that, it will take at least 6 months worth of block space for all
users to migrate their funds, even in a best case scenario. Though if you
exclude dust UTXOs you could probably get 95% of BTC value migrated in 1
month. Of course this is a highly optimistic situation where everyone is
completely focused on migrations - in reality it will take far longer.

Regardless, I'd think that in order to reasonably uphold Bitcoin's
conservatism it would be preferable to allow a 4 year migration window. In
the meantime, mining pools could coordinate emergency soft forking logic
such that if quantum attackers materialized, they could accelerate the
countdown to the quantum vulnerable funds burn.

Random Tangential Benefits
On the plus side, burning all quantum vulnerable bitcoin would allow us to
prune all of those UTXOs out of the UTXO set, which would also clean up a
lot of dust. Dust UTXOs are a bit of an annoyance and there has even been a
recent proposal for how to incentivize cleaning them up.

We should also expect that incentivizing migration of the entire UTXO set
will create substantial demand for block space that will sustain a fee
market for a fairly lengthy amount of time.

In Summary
While the moral quandary of violating any of Bitcoin's inviolable
properties can make this a very complex issue to discuss, the game theory
and incentives between burning vulnerable coins versus allowing them to be
claimed by entities with quantum supremacy appears to be a much simpler
issue.

I, for one, am not interested in rewarding quantum capable entities by
inflating the circulating money supply just because some people lost their
keys long ago and some laggards are not upgrading their bitcoin wallet's
security.

We can hope that this scenario never comes to pass, but hope is not a
strategy.

I welcome your feedback upon any of the above points, and contribution of
any arguments I failed to consider.

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups•com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/CADL_X_cF%3DUKVa7CitXReMq8nA_4RadCF%3D%3DkU4YG%2B0GYN97P6hQ%40mail.gmail.com.

[-- Attachment #2: Type: text/html, Size: 34442 bytes --]

 permalink raw reply	[|nested]
* 
  2025-03-16 14:15 [bitcoindev] Against Allowing Quantum Recovery of Bitcoin Jameson Lopp

  2025-03-16 19:44 ` 
                   ` 
  4 siblings, 0 replies; 17+ messages in thread
From: Chris Riley @ 2025-03-16 18:03 UTC (permalink / raw)
  To: Jameson Lopp;  Bitcoin Development Mailing List

[-- Attachment #1: Type: text/plain, Size: 34626 bytes --]

This makes a lot of sense.  One would think that prior to an attack on
bitcoin other coins would be attacked first, e.g. Ethereum given the way I
understand that public keys are exposed vs bitcoin, so there could be some
warning from softer, vulnerable and valuable targets to attack such as alt
coins, governments, and financial institutions.

However, none of this changes the points you made and the importance of
looking at the issue sooner versus later given the long lead time that will
be necessary since there could be little warning.  I have seen estimates in
the 2030-2035 range for a potential attack and the US Federal government
tells agencies they must transition by 2035 to a quantum safe scheme
further emphasizing the potential urgency.

Of course, some argue it could take "decades" or even longer—if it ever
happens at all—so there is significant uncertainty about when a successful
attack might occur. To me, this is a "prepare for the worst and hope for
the best" scenario. As you noted, whether coins are "burned" or "stolen,"
the outcome is the same for their owners: they lose control of their
assets. Logically, they might even prefer for their coins to be burned
rather than stolen, as it would prevent dilution of any remaining holdings
and help mitigate systemic damage to the ecosystem.

Thanks :-)



On Sun, Mar 16, 2025 at 11:22 AM Jameson Lopp <jameson.lopp@gmail•com>
wrote:

> The quantum computing debate is heating up. There are many controversial
> aspects to this debate, including whether or not quantum computers will
> ever actually become a practical threat.
>
> I won't tread into the unanswerable question of how worried we should be
> about quantum computers. I think it's far from a crisis, but given the
> difficulty in changing Bitcoin it's worth starting to seriously discuss.
> Today I wish to focus on a philosophical quandary related to one of the
> decisions that would need to be made if and when we implement a quantum
> safe signature scheme.
>
> Several Scenarios
> Because this essay will reference game theory a fair amount, and there are
> many variables at play that could change the nature of the game, I think
> it's important to clarify the possible scenarios up front.
>
> 1. Quantum computing never materializes, never becomes a threat, and thus
> everything discussed in this essay is moot.
> 2. A quantum computing threat materializes suddenly and Bitcoin does not
> have quantum safe signatures as part of the protocol. In this scenario it
> would likely make the points below moot because Bitcoin would be
> fundamentally broken and it would take far too long to upgrade the
> protocol, wallet software, and migrate user funds in order to restore
> confidence in the network.
> 3. Quantum computing advances slowly enough that we come to consensus
> about how to upgrade Bitcoin and post quantum security has been minimally
> adopted by the time an attacker appears.
> 4. Quantum computing advances slowly enough that we come to consensus
> about how to upgrade Bitcoin and post quantum security has been highly
> adopted by the time an attacker appears.
>
> For the purposes of this post, I'm envisioning being in situation 3 or 4.
>
> To Freeze or not to Freeze?
> I've started seeing more people weighing in on what is likely the most
> contentious aspect of how a quantum resistance upgrade should be handled in
> terms of migrating user funds. Should quantum vulnerable funds be left open
> to be swept by anyone with a sufficiently powerful quantum computer OR
> should they be permanently locked?
>
> "I don't see why old coins should be confiscated. The better option is to
>> let those with quantum computers free up old coins. While this might have
>> an inflationary impact on bitcoin's price, to use a turn of phrase, the
>> inflation is transitory. Those with low time preference should support
>> returning lost coins to circulation."
>
> - Hunter Beast
>
>
> On the other hand:
>
> "Of course they have to be confiscated. If and when (and that's a big if)
>> the existence of a cryptography-breaking QC becomes a credible threat, the
>> Bitcoin ecosystem has no other option than softforking out the ability to
>> spend from signature schemes (including ECDSA and BIP340) that are
>> vulnerable to QCs. The alternative is that millions of BTC become
>> vulnerable to theft; I cannot see how the currency can maintain any value
>> at all in such a setting. And this affects everyone; even those which
>> diligently moved their coins to PQC-protected schemes."
>> - Pieter Wuille
>
>
> I don't think "confiscation" is the most precise term to use, as the funds
> are not being seized and reassigned. Rather, what we're really discussing
> would be better described as "burning" - placing the funds *out of reach
> of everyone*.
>
> Not freezing user funds is one of Bitcoin's inviolable properties.
> However, if quantum computing becomes a threat to Bitcoin's elliptic curve
> cryptography, *an inviolable property of Bitcoin will be violated one way
> or another*.
>
> Fundamental Properties at Risk
> 5 years ago I attempted to comprehensively categorize all of Bitcoin's
> fundamental properties that give it value.
> https://nakamoto.com/what-are-the-key-properties-of-bitcoin/
>
> The particular properties in play with regard to this issue seem to be:
>
> *Censorship Resistance* - No one should have the power to prevent others
> from using their bitcoin or interacting with the network.
>
> *Forward Compatibility* - changing the rules such that certain valid
> transactions become invalid could undermine confidence in the protocol.
>
> *Conservatism* - Users should not be expected to be highly responsive to
> system issues.
>
> As a result of the above principles, we have developed a strong meme
> (kudos to Andreas Antonopoulos) that goes as follows:
>
> Not your keys, not your coins.
>
>
> I posit that the corollary to this principle is:
>
> Your keys, only your coins.
>
>
> A quantum capable entity breaks the corollary of this foundational
> principle. We secure our bitcoin with the mathematical probabilities
> related to extremely large random numbers. Your funds are only secure
> because truly random large numbers should not be guessable or discoverable
> by anyone else in the world.
>
> This is the principle behind the motto *vires in numeris* - strength in
> numbers. In a world with quantum enabled adversaries, this principle is
> null and void for many types of cryptography, including the elliptic curve
> digital signatures used in Bitcoin.
>
> Who is at Risk?
> There has long been a narrative that Satoshi's coins and others from the
> Satoshi era of P2PK locking scripts that exposed the public key directly on
> the blockchain will be those that get scooped up by a quantum "miner." But
> unfortunately it's not that simple. If I had a powerful quantum computer,
> which coins would I target? I'd go to the Bitcoin rich list and find the
> wallets that have exposed their public keys due to re-using addresses that
> have previously been spent from. You can easily find them at
> https://bitinfocharts.com/top-100-richest-bitcoin-addresses.html
>
> Note that a few of these wallets, like Bitfinex / Kraken / Tether, would
> be slightly harder to crack because they are multisig wallets. So a quantum
> attacker would need to reverse engineer 2 keys for Kraken or 3 for Bitfinex
> / Tether in order to spend funds. But many are single signature.
>
> Point being, it's not only the really old lost BTC that are at risk to a
> quantum enabled adversary, at least at time of writing. If we add a quantum
> safe signature scheme, we should expect those wallets to be some of the
> first to upgrade given their incentives.
>
> The Ethical Dilemma: Quantifying Harm
> Which decision results in the most harm?
>
> By making quantum vulnerable funds unspendable we potentially harm some
> Bitcoin users who were not paying attention and neglected to migrate their
> funds to a quantum safe locking script. This violates the "conservativism"
> principle stated earlier. On the flip side, we prevent those funds plus far
> more lost funds from falling into the hands of the few privileged folks who
> gain early access to quantum computers.
>
> By leaving quantum vulnerable funds available to spend, the same set of
> users who would otherwise have funds frozen are likely to see them stolen.
> And many early adopters who lost their keys will eventually see their
> unreachable funds scooped up by a quantum enabled adversary.
>
> Imagine, for example, being James Howells, who accidentally threw away a
> hard drive with 8,000 BTC on it, currently worth over $600M USD. He has
> spent a decade trying to retrieve it from the landfill where he knows it's
> buried, but can't get permission to excavate. I suspect that, given the
> choice, he'd prefer those funds be permanently frozen rather than fall into
> someone else's possession - I know I would.
>
> Allowing a quantum computer to access lost funds doesn't make those users
> any worse off than they were before, however it *would* have a negative
> impact upon everyone who is currently holding bitcoin.
>
> It's prudent to expect significant economic disruption if large amounts of
> coins fall into new hands. Since a quantum computer is going to have a
> massive up front cost, expect those behind it to desire to recoup their
> investment. We also know from experience that when someone suddenly finds
> themselves in possession of 9+ figures worth of highly liquid assets, they
> tend to diversify into other things by selling.
>
> Allowing quantum recovery of bitcoin is *tantamount to wealth
> redistribution*. What we'd be allowing is for bitcoin to be redistributed
> from those who are ignorant of quantum computers to those who have won the
> technological race to acquire quantum computers. It's hard to see a bright
> side to that scenario.
>
> Is Quantum Recovery Good for Anyone?
>
> Does quantum recovery HELP anyone? I've yet to come across an argument
> that it's a net positive in any way. It certainly doesn't add any security
> to the network. If anything, it greatly decreases the security of the
> network by allowing funds to be claimed by those who did not earn them.
>
> But wait, you may be thinking, wouldn't quantum "miners" have earned their
> coins by all the work and resources invested in building a quantum
> computer? I suppose, in the same sense that a burglar earns their spoils by
> the resources they invest into surveilling targets and learning the skills
> needed to break into buildings. What I say "earned" I mean through
> productive mutual trade.
>
> For example:
>
> * Investors earn BTC by trading for other currencies.
> * Merchants earn BTC by trading for goods and services.
> * Miners earn BTC by trading thermodynamic security.
> * Quantum miners don't trade anything, they are vampires feeding upon the
> system.
>
> There's no reason to believe that allowing quantum adversaries to recover
> vulnerable bitcoin will be of benefit to anyone other than the select few
> organizations that win the technological arms race to build the first such
> computers. Probably nation states and/or the top few largest tech companies.
>
> One could certainly hope that an organization with quantum supremacy is
> benevolent and acts in a "white hat" manner to return lost coins to their
> owners, but that's incredibly optimistic and foolish to rely upon. Such a
> situation creates an insurmountable ethical dilemma of only recovering lost
> bitcoin rather than currently owned bitcoin. There's no way to precisely
> differentiate between the two; anyone can claim to have lost their bitcoin
> but if they have lost their keys then proving they ever had the keys
> becomes rather difficult. I imagine that any such white hat recovery
> efforts would have to rely upon attestations from trusted third parties
> like exchanges.
>
> Even if the first actor with quantum supremacy is benevolent, we must
> assume the technology could fall into adversarial hands and thus think
> adversarially about the potential worst case outcomes. Imagine, for
> example, that North Korea continues scooping up billions of dollars from
> hacking crypto exchanges and decides to invest some of those proceeds into
> building a quantum computer for the biggest payday ever...
>
> Downsides to Allowing Quantum Recovery
> Let's think through an exhaustive list of pros and cons for allowing or
> preventing the seizure of funds by a quantum adversary.
>
> Historical Precedent
> Previous protocol vulnerabilities weren’t celebrated as "fair game" but
> rather were treated as failures to be remediated. Treating quantum theft
> differently risks rewriting Bitcoin’s history as a free-for-all rather than
> a system that seeks to protect its users.
>
> Violation of Property Rights
> Allowing a quantum adversary to take control of funds undermines the
> fundamental principle of cryptocurrency - if you keep your keys in your
> possession, only you should be able to access your money. Bitcoin is built
> on the idea that private keys secure an individual’s assets, and
> unauthorized access (even via advanced tech) is theft, not a legitimate
> transfer.
>
> Erosion of Trust in Bitcoin
> If quantum attackers can exploit vulnerable addresses, confidence in
> Bitcoin as a secure store of value would collapse. Users and investors rely
> on cryptographic integrity, and widespread theft could drive adoption away
> from Bitcoin, destabilizing its ecosystem.
>
> This is essentially the counterpoint to claiming the burning of vulnerable
> funds is a violation of property rights. While some will certainly see it
> as such, others will find the apathy toward stopping quantum theft to be
> similarly concerning.
>
> Unfair Advantage
> Quantum attackers, likely equipped with rare and expensive technology,
> would have an unjust edge over regular users who lack access to such tools.
> This creates an inequitable system where only the technologically elite can
> exploit others, contradicting Bitcoin’s ethos of decentralized power.
>
> Bitcoin is designed to create an asymmetric advantage for DEFENDING one's
> wealth. It's supposed to be impractically expensive for attackers to crack
> the entropy and cryptography protecting one's coins. But now we find
> ourselves discussing a situation where this asymmetric advantage is
> compromised in favor of a specific class of attackers.
>
> Economic Disruption
> Large-scale theft from vulnerable addresses could crash Bitcoin’s price as
> quantum recovered funds are dumped on exchanges. This would harm all
> holders, not just those directly targeted, leading to broader financial
> chaos in the markets.
>
> Moral Responsibility
> Permitting theft via quantum computing sets a precedent that technological
> superiority justifies unethical behavior. This is essentially taking a
> "code is law" stance in which we refuse to admit that both code and laws
> can be modified to adapt to previously unforeseen situations.
>
> Burning of coins can certainly be considered a form of theft, thus I think
> it's worth differentiating the two different thefts being discussed:
>
> 1. self-enriching & likely malicious
> 2. harm prevention & not necessarily malicious
>
> Both options lack the consent of the party whose coins are being burnt or
> transferred, thus I think the simple argument that theft is immoral becomes
> a wash and it's important to drill down into the details of each.
>
> Incentives Drive Security
> I can tell you from a decade of working in Bitcoin security - the average
> user is lazy and is a procrastinator. If Bitcoiners are given a "drop dead
> date" after which they know vulnerable funds will be burned, this pressure
> accelerates the adoption of post-quantum cryptography and strengthens
> Bitcoin long-term. Allowing vulnerable users to delay upgrading
> indefinitely will result in more laggards, leaving the network more exposed
> when quantum tech becomes available.
>
> Steel Manning
> Clearly this is a complex and controversial topic, thus it's worth
> thinking through the opposing arguments.
>
> Protecting Property Rights
> Allowing quantum computers to take vulnerable bitcoin could potentially be
> spun as a hard money narrative - we care so greatly about not violating
> someone's access to their coins that we allow them to be stolen!
>
> But I think the flip side to the property rights narrative is that burning
> vulnerable coins prevents said property from falling into undeserving
> hands. If the entire Bitcoin ecosystem just stands around and allows
> quantum adversaries to claim funds that rightfully belong to other users,
> is that really a "win" in the "protecting property rights" category? It
> feels more like apathy to me.
>
> As such, I think the "protecting property rights" argument is a wash.
>
> Quantum Computers Won't Attack Bitcoin
> There is a great deal of skepticism that sufficiently powerful quantum
> computers will ever exist, so we shouldn't bother preparing for a
> non-existent threat. Others have argued that even if such a computer was
> built, a quantum attacker would not go after bitcoin because they wouldn't
> want to reveal their hand by doing so, and would instead attack other
> infrastructure.
>
> It's quite difficult to quantify exactly how valuable attacking other
> infrastructure would be. It also really depends upon when an entity gains
> quantum supremacy and thus if by that time most of the world's systems have
> already been upgraded. While I think you could argue that certain entities
> gaining quantum capability might not attack Bitcoin, it would only delay
> the inevitable - eventually somebody will achieve the capability who
> decides to use it for such an attack.
>
> Quantum Attackers Would Only Steal Small Amounts
> Some have argued that even if a quantum attacker targeted bitcoin, they'd
> only go after old, likely lost P2PK outputs so as to not arouse suspicion
> and cause a market panic.
>
> I'm not so sure about that; why go after 50 BTC at a time when you could
> take 250,000 BTC with the same effort as 50 BTC? This is a classic "zero
> day exploit" game theory in which an attacker knows they have a limited
> amount of time before someone else discovers the exploit and either
> benefits from it or patches it. Take, for example, the recent ByBit attack
> - the highest value crypto hack of all time. Lazarus Group had compromised
> the Safe wallet front end JavaScript app and they could have simply had it
> reassign ownership of everyone's Safe wallets as they were interacting with
> their wallet. But instead they chose to only specifically target ByBit's
> wallet with $1.5 billion in it because they wanted to maximize their
> extractable value. If Lazarus had started stealing from every wallet, they
> would have been discovered quickly and the Safe web app would likely have
> been patched well before any billion dollar wallets executed the malicious
> code.
>
> I think the "only stealing small amounts" argument is strongest for
> Situation #2 described earlier, where a quantum attacker arrives before
> quantum safe cryptography has been deployed across the Bitcoin ecosystem.
> Because if it became clear that Bitcoin's cryptography was broken AND there
> was nowhere safe for vulnerable users to migrate, the only logical option
> would be for everyone to liquidate their bitcoin as quickly as possible. As
> such, I don't think it applies as strongly for situations in which we have
> a migration path available.
>
> The 21 Million Coin Supply Should be in Circulation
> Some folks are arguing that it's important for the "circulating /
> spendable" supply to be as close to 21M as possible and that having a
> significant portion of the supply out of circulation is somehow undesirable.
>
> While the "21M BTC" attribute is a strong memetic narrative, I don't think
> anyone has ever expected that it would all be in circulation. It has always
> been understood that many coins will be lost, and that's actually part of
> the game theory of owning bitcoin!
>
> And remember, the 21M number in and of itself is not a particularly
> important detail - it's not even mentioned in the whitepaper. What's
> important is that the supply is well known and not subject to change.
>
> Self-Sovereignty and Personal Responsibility
> Bitcoin’s design empowers individuals to control their own wealth, free
> from centralized intervention. This freedom comes with the burden of
> securing one's private keys. If quantum computing can break obsolete
> cryptography, the fault lies with users who didn't move their funds to
> quantum safe locking scripts. Expecting the network to shield users from
> their own negligence undermines the principle that you, and not a third
> party, are accountable for your assets.
>
> I think this is generally a fair point that "the community" doesn't owe
> you anything in terms of helping you. I think that we do, however, need to
> consider the incentives and game theory in play with regard to quantum safe
> Bitcoiners vs quantum vulnerable Bitcoiners. More on that later.
>
> Code is Law
> Bitcoin operates on transparent, immutable rules embedded in its protocol.
> If a quantum attacker uses superior technology to derive private keys from
> public keys, they’re not "hacking" the system - they're simply following
> what's mathematically permissible within the current code. Altering the
> protocol to stop this introduces subjective human intervention, which
> clashes with the objective, deterministic nature of blockchain.
>
> While I tend to agree that code is law, one of the entire points of laws
> is that they can be amended to improve their efficacy in reducing harm.
> Leaning on this point seems more like a pro-ossification stance that it's
> better to do nothing and allow harm to occur rather than take action to
> stop an attack that was foreseen far in advance.
>
> Technological Evolution as a Feature, Not a Bug
> It's well known that cryptography tends to weaken over time and eventually
> break. Quantum computing is just the next step in this progression. Users
> who fail to adapt (e.g., by adopting quantum-resistant wallets when
> available) are akin to those who ignored technological advancements like
> multisig or hardware wallets. Allowing quantum theft incentivizes
> innovation and keeps Bitcoin’s ecosystem dynamic, punishing complacency
> while rewarding vigilance.
>
> Market Signals Drive Security
> If quantum attackers start stealing funds, it sends a clear signal to the
> market: upgrade your security or lose everything. This pressure accelerates
> the adoption of post-quantum cryptography and strengthens Bitcoin
> long-term. Coddling vulnerable users delays this necessary evolution,
> potentially leaving the network more exposed when quantum tech becomes
> widely accessible. Theft is a brutal but effective teacher.
>
> Centralized Blacklisting Power
> Burning vulnerable funds requires centralized decision-making - a soft
> fork to invalidate certain transactions. This sets a dangerous precedent
> for future interventions, eroding Bitcoin’s decentralization. If quantum
> theft is blocked, what’s next - reversing exchange hacks? The system must
> remain neutral, even if it means some lose out.
>
> I think this could be a potential slippery slope if the proposal was to
> only burn specific addresses. Rather, I'd expect a neutral proposal to burn
> all funds in locking script types that are known to be quantum vulnerable.
> Thus, we could eliminate any subjectivity from the code.
>
> Fairness in Competition
> Quantum attackers aren't cheating; they're using publicly available
> physics and math. Anyone with the resources and foresight can build or
> access quantum tech, just as anyone could mine Bitcoin in 2009 with a CPU.
> Early adopters took risks and reaped rewards; quantum innovators are doing
> the same. Calling it “unfair” ignores that Bitcoin has never promised
> equality of outcome - only equality of opportunity within its rules.
>
> I find this argument to be a mischaracterization because we're not talking
> about CPUs. This is more akin to talking about ASICs, except each ASIC
> costs millions if not billions of dollars. This is out of reach from all
> but the wealthiest organizations.
>
> Economic Resilience
> Bitcoin has weathered thefts before (MTGOX, Bitfinex, FTX, etc) and
> emerged stronger. The market can absorb quantum losses, with unaffected
> users continuing to hold and new entrants buying in at lower prices. Fear
> of economic collapse overestimates the impact - the network’s antifragility
> thrives on such challenges.
>
> This is a big grey area because we don't know when a quantum computer will
> come online and we don't know how quickly said computers would be able to
> steal bitcoin. If, for example, the first generation of sufficiently
> powerful quantum computers were stealing less volume than the current block
> reward then of course it will have minimal economic impact. But if they're
> taking thousands of BTC per day and bringing them back into circulation,
> there will likely be a noticeable market impact as it absorbs the new
> supply.
>
> This is where the circumstances will really matter. If a quantum attacker
> appears AFTER the Bitcoin protocol has been upgraded to support quantum
> resistant cryptography then we should expect the most valuable active
> wallets will have upgraded and the juiciest target would be the 31,000 BTC
> in the address 12ib7dApVFvg82TXKycWBNpN8kFyiAN1dr which has been dormant
> since 2010. In general I'd expect that the amount of BTC re-entering the
> circulating supply would look somewhat similar to the mining emission
> curve: volume would start off very high as the most valuable addresses are
> drained and then it would fall off as quantum computers went down the list
> targeting addresses with less and less BTC.
>
> Why is economic impact a factor worth considering? Miners and businesses
> in general. More coins being liquidated will push down the price, which
> will negatively impact miner revenue. Similarly, I can attest from working
> in the industry for a decade, that lower prices result in less demand from
> businesses across the entire industry. As such, burning quantum vulnerable
> bitcoin is good for the entire industry.
>
> Practicality & Neutrality of Non-Intervention
> There’s no reliable way to distinguish “theft” from legitimate "white hat"
> key recovery. If someone loses their private key and a quantum computer
> recovers it, is that stealing or reclaiming? Policing quantum actions
> requires invasive assumptions about intent, which Bitcoin’s trustless
> design can’t accommodate. Letting the chips fall where they may avoids this
> mess.
>
> Philosophical Purity
> Bitcoin rejects bailouts. It’s a cold, hard system where outcomes reflect
> preparation and skill, not sentimentality. If quantum computing upends the
> game, that’s the point - Bitcoin isn’t meant to be safe or fair in a
> nanny-state sense; it’s meant to be free. Users who lose funds to quantum
> attacks are casualties of liberty and their own ignorance, not victims of
> injustice.
>
> Bitcoin's DAO Moment
> This situation has some similarities to The DAO hack of an Ethereum smart
> contract in 2016, which resulted in a fork to stop the attacker and return
> funds to their original owners. The game theory is similar because it's a
> situation where a threat is known but there's some period of time before
> the attacker can actually execute the theft. As such, there's time to
> mitigate the attack by changing the protocol.
>
> It also created a schism in the community around the true meaning of "code
> is law," resulting in Ethereum Classic, which decided to allow the attacker
> to retain control of the stolen funds.
>
> A soft fork to burn vulnerable bitcoin could certainly result in a hard
> fork if there are enough miners who reject the soft fork and continue
> including transactions.
>
> Incentives Matter
> We can wax philosophical until the cows come home, but what are the actual
> incentives for existing Bitcoin holders regarding this decision?
>
> "Lost coins only make everyone else's coins worth slightly more. Think of
>> it as a donation to everyone." - Satoshi Nakamoto
>
>
> If true, the corollary is:
>
> "Quantum recovered coins only make everyone else's coins worth less. Think
>> of it as a theft from everyone." - Jameson Lopp
>
>
> Thus, assuming we get to a point where quantum resistant signatures are
> supported within the Bitcoin protocol, what's the incentive to let
> vulnerable coins remain spendable?
>
> * It's not good for the actual owners of those coins. It disincentivizes
> owners from upgrading until perhaps it's too late.
> * It's not good for the more attentive / responsible owners of coins who
> have quantum secured their stash. Allowing the circulating supply to
> balloon will assuredly reduce the purchasing power of all bitcoin holders.
>
> Forking Game Theory
> From a game theory point of view, I see this as incentivizing users to
> upgrade their wallets. If you disagree with the burning of vulnerable
> coins, all you have to do is move your funds to a quantum safe signature
> scheme. Point being, I don't see there being an economic majority (or even
> more than a tiny minority) of users who would fight such a soft fork. Why
> expend significant resources fighting a fork when you can just move your
> coins to a new address?
>
> Remember that blocking spending of certain classes of locking scripts is a
> tightening of the rules - a soft fork. As such, it can be meaningfully
> enacted and enforced by a mere majority of hashpower. If miners generally
> agree that it's in their best interest to burn vulnerable coins, are other
> users going to care enough to put in the effort to run new node software
> that resists the soft fork? Seems unlikely to me.
>
> How to Execute Burning
> In order to be as objective as possible, the goal would be to announce to
> the world that after a specific block height / timestamp, Bitcoin nodes
> will no longer accept transactions (or blocks containing such transactions)
> that spend funds from any scripts other than the newly instituted quantum
> safe schemes.
>
> It could take a staggered approach to first freeze funds that are
> susceptible to long-range attacks such as those in P2PK scripts or those
> that exposed their public keys due to previously re-using addresses, but I
> expect the additional complexity would drive further controversy.
>
> How long should the grace period be in order to give the ecosystem time to
> upgrade? I'd say a minimum of 1 year for software wallets to upgrade. We
> can only hope that hardware wallet manufacturers are able to implement post
> quantum cryptography on their existing hardware with only a firmware update.
>
> Beyond that, it will take at least 6 months worth of block space for all
> users to migrate their funds, even in a best case scenario. Though if you
> exclude dust UTXOs you could probably get 95% of BTC value migrated in 1
> month. Of course this is a highly optimistic situation where everyone is
> completely focused on migrations - in reality it will take far longer.
>
> Regardless, I'd think that in order to reasonably uphold Bitcoin's
> conservatism it would be preferable to allow a 4 year migration window. In
> the meantime, mining pools could coordinate emergency soft forking logic
> such that if quantum attackers materialized, they could accelerate the
> countdown to the quantum vulnerable funds burn.
>
> Random Tangential Benefits
> On the plus side, burning all quantum vulnerable bitcoin would allow us to
> prune all of those UTXOs out of the UTXO set, which would also clean up a
> lot of dust. Dust UTXOs are a bit of an annoyance and there has even been a
> recent proposal for how to incentivize cleaning them up.
>
> We should also expect that incentivizing migration of the entire UTXO set
> will create substantial demand for block space that will sustain a fee
> market for a fairly lengthy amount of time.
>
> In Summary
> While the moral quandary of violating any of Bitcoin's inviolable
> properties can make this a very complex issue to discuss, the game theory
> and incentives between burning vulnerable coins versus allowing them to be
> claimed by entities with quantum supremacy appears to be a much simpler
> issue.
>
> I, for one, am not interested in rewarding quantum capable entities by
> inflating the circulating money supply just because some people lost their
> keys long ago and some laggards are not upgrading their bitcoin wallet's
> security.
>
> We can hope that this scenario never comes to pass, but hope is not a
> strategy.
>
> I welcome your feedback upon any of the above points, and contribution of
> any arguments I failed to consider.
>
> --
> You received this message because you are subscribed to the Google Groups
> "Bitcoin Development Mailing List" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to bitcoindev+unsubscribe@googlegroups•com.
> To view this discussion visit
> https://groups.google.com/d/msgid/bitcoindev/CADL_X_cF%3DUKVa7CitXReMq8nA_4RadCF%3D%3DkU4YG%2B0GYN97P6hQ%40mail.gmail.com
> <https://groups.google.com/d/msgid/bitcoindev/CADL_X_cF%3DUKVa7CitXReMq8nA_4RadCF%3D%3DkU4YG%2B0GYN97P6hQ%40mail.gmail.com?utm_medium=email&utm_source=footer>
> .
>

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups•com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/CAL5BAw2c6T_CiV%3DVO8vwUgo6rnFsv013UrbK_nKAakO1MLaoag%40mail.gmail.com.

[-- Attachment #2: Type: text/html, Size: 37371 bytes --]

^ permalink raw reply	[|nested] 17+ messages in thread
2025-03-16 19:44 ` Nagaev Boris

  
From: Jameson Lopp @ 2025-03-16 21:25 UTC (permalink / raw)
  To: Nagaev Boris;  Bitcoin Development Mailing List

[-- Attachment #1: Type: text/plain, Size: 35159 bytes --]

It's certainly an edge case worth considering. If timelocked coins are
being spent that haven't previously exposed their public keys, it could be
considered safe to allow them to be spent. Quantum computers would have to
become extremely powerful in order to reverse engineer a key and RBF a
transaction just during the time it's in the mempool.

I think this does bring up an often overlooked aspect of extremely long
time locks: preventing yourself from spending funds does expose you to edge
case protocol weaknesses that require migration of funds. Personally I'd
get a bit nervous locking funds for more than a year or two.

Another downside to long timelocks is that you could potentially miss out
on the ability to economically "vote with your feet" in the case of a
controversial chain fork.

On Sun, Mar 16, 2025 at 3:45 PM Nagaev Boris <bnagaev@gmail•com> wrote:

> Hi!
>
> What is your perspective on time-locked coins that become spendable
> only after a set deadline? Unlike regular holders who can migrate
> their funds in advance, owners of time-locked coins, such as those set
> to unlock through an inheritance or a smart contract, have no way to
> react before the deadline. Imagine you received an inheritance set to
> unlock in 2030, only to find that the deadline for migration is set
> for 2029. Would such cases be considered an acceptable loss, or is
> there a way to account for them without violating Bitcoin’s
> principles?
>
> Boris
>
> On Sun, Mar 16, 2025 at 12:22 PM Jameson Lopp <jameson.lopp@gmail•com>
> wrote:
> >
> > The quantum computing debate is heating up. There are many controversial
> aspects to this debate, including whether or not quantum computers will
> ever actually become a practical threat.
> >
> > I won't tread into the unanswerable question of how worried we should be
> about quantum computers. I think it's far from a crisis, but given the
> difficulty in changing Bitcoin it's worth starting to seriously discuss.
> Today I wish to focus on a philosophical quandary related to one of the
> decisions that would need to be made if and when we implement a quantum
> safe signature scheme.
> >
> > Several Scenarios
> > Because this essay will reference game theory a fair amount, and there
> are many variables at play that could change the nature of the game, I
> think it's important to clarify the possible scenarios up front.
> >
> > 1. Quantum computing never materializes, never becomes a threat, and
> thus everything discussed in this essay is moot.
> > 2. A quantum computing threat materializes suddenly and Bitcoin does not
> have quantum safe signatures as part of the protocol. In this scenario it
> would likely make the points below moot because Bitcoin would be
> fundamentally broken and it would take far too long to upgrade the
> protocol, wallet software, and migrate user funds in order to restore
> confidence in the network.
> > 3. Quantum computing advances slowly enough that we come to consensus
> about how to upgrade Bitcoin and post quantum security has been minimally
> adopted by the time an attacker appears.
> > 4. Quantum computing advances slowly enough that we come to consensus
> about how to upgrade Bitcoin and post quantum security has been highly
> adopted by the time an attacker appears.
> >
> > For the purposes of this post, I'm envisioning being in situation 3 or 4.
> >
> > To Freeze or not to Freeze?
> > I've started seeing more people weighing in on what is likely the most
> contentious aspect of how a quantum resistance upgrade should be handled in
> terms of migrating user funds. Should quantum vulnerable funds be left open
> to be swept by anyone with a sufficiently powerful quantum computer OR
> should they be permanently locked?
> >
> >> "I don't see why old coins should be confiscated. The better option is
> to let those with quantum computers free up old coins. While this might
> have an inflationary impact on bitcoin's price, to use a turn of phrase,
> the inflation is transitory. Those with low time preference should support
> returning lost coins to circulation."
> >>
> >> - Hunter Beast
> >
> >
> > On the other hand:
> >
> >> "Of course they have to be confiscated. If and when (and that's a big
> if) the existence of a cryptography-breaking QC becomes a credible threat,
> the Bitcoin ecosystem has no other option than softforking out the ability
> to spend from signature schemes (including ECDSA and BIP340) that are
> vulnerable to QCs. The alternative is that millions of BTC become
> vulnerable to theft; I cannot see how the currency can maintain any value
> at all in such a setting. And this affects everyone; even those which
> diligently moved their coins to PQC-protected schemes."
> >> - Pieter Wuille
> >
> >
> > I don't think "confiscation" is the most precise term to use, as the
> funds are not being seized and reassigned. Rather, what we're really
> discussing would be better described as "burning" - placing the funds out
> of reach of everyone.
> >
> > Not freezing user funds is one of Bitcoin's inviolable properties.
> However, if quantum computing becomes a threat to Bitcoin's elliptic curve
> cryptography, an inviolable property of Bitcoin will be violated one way or
> another.
> >
> > Fundamental Properties at Risk
> > 5 years ago I attempted to comprehensively categorize all of Bitcoin's
> fundamental properties that give it value.
> https://nakamoto.com/what-are-the-key-properties-of-bitcoin/
> >
> > The particular properties in play with regard to this issue seem to be:
> >
> > Censorship Resistance - No one should have the power to prevent others
> from using their bitcoin or interacting with the network.
> >
> > Forward Compatibility - changing the rules such that certain valid
> transactions become invalid could undermine confidence in the protocol.
> >
> > Conservatism - Users should not be expected to be highly responsive to
> system issues.
> >
> > As a result of the above principles, we have developed a strong meme
> (kudos to Andreas Antonopoulos) that goes as follows:
> >
> >> Not your keys, not your coins.
> >
> >
> > I posit that the corollary to this principle is:
> >
> >> Your keys, only your coins.
> >
> >
> > A quantum capable entity breaks the corollary of this foundational
> principle. We secure our bitcoin with the mathematical probabilities
> related to extremely large random numbers. Your funds are only secure
> because truly random large numbers should not be guessable or discoverable
> by anyone else in the world.
> >
> > This is the principle behind the motto vires in numeris - strength in
> numbers. In a world with quantum enabled adversaries, this principle is
> null and void for many types of cryptography, including the elliptic curve
> digital signatures used in Bitcoin.
> >
> > Who is at Risk?
> > There has long been a narrative that Satoshi's coins and others from the
> Satoshi era of P2PK locking scripts that exposed the public key directly on
> the blockchain will be those that get scooped up by a quantum "miner." But
> unfortunately it's not that simple. If I had a powerful quantum computer,
> which coins would I target? I'd go to the Bitcoin rich list and find the
> wallets that have exposed their public keys due to re-using addresses that
> have previously been spent from. You can easily find them at
> https://bitinfocharts.com/top-100-richest-bitcoin-addresses.html
> >
> > Note that a few of these wallets, like Bitfinex / Kraken / Tether, would
> be slightly harder to crack because they are multisig wallets. So a quantum
> attacker would need to reverse engineer 2 keys for Kraken or 3 for Bitfinex
> / Tether in order to spend funds. But many are single signature.
> >
> > Point being, it's not only the really old lost BTC that are at risk to a
> quantum enabled adversary, at least at time of writing. If we add a quantum
> safe signature scheme, we should expect those wallets to be some of the
> first to upgrade given their incentives.
> >
> > The Ethical Dilemma: Quantifying Harm
> > Which decision results in the most harm?
> >
> > By making quantum vulnerable funds unspendable we potentially harm some
> Bitcoin users who were not paying attention and neglected to migrate their
> funds to a quantum safe locking script. This violates the "conservativism"
> principle stated earlier. On the flip side, we prevent those funds plus far
> more lost funds from falling into the hands of the few privileged folks who
> gain early access to quantum computers.
> >
> > By leaving quantum vulnerable funds available to spend, the same set of
> users who would otherwise have funds frozen are likely to see them stolen.
> And many early adopters who lost their keys will eventually see their
> unreachable funds scooped up by a quantum enabled adversary.
> >
> > Imagine, for example, being James Howells, who accidentally threw away a
> hard drive with 8,000 BTC on it, currently worth over $600M USD. He has
> spent a decade trying to retrieve it from the landfill where he knows it's
> buried, but can't get permission to excavate. I suspect that, given the
> choice, he'd prefer those funds be permanently frozen rather than fall into
> someone else's possession - I know I would.
> >
> > Allowing a quantum computer to access lost funds doesn't make those
> users any worse off than they were before, however it would have a negative
> impact upon everyone who is currently holding bitcoin.
> >
> > It's prudent to expect significant economic disruption if large amounts
> of coins fall into new hands. Since a quantum computer is going to have a
> massive up front cost, expect those behind it to desire to recoup their
> investment. We also know from experience that when someone suddenly finds
> themselves in possession of 9+ figures worth of highly liquid assets, they
> tend to diversify into other things by selling.
> >
> > Allowing quantum recovery of bitcoin is tantamount to wealth
> redistribution. What we'd be allowing is for bitcoin to be redistributed
> from those who are ignorant of quantum computers to those who have won the
> technological race to acquire quantum computers. It's hard to see a bright
> side to that scenario.
> >
> > Is Quantum Recovery Good for Anyone?
> >
> > Does quantum recovery HELP anyone? I've yet to come across an argument
> that it's a net positive in any way. It certainly doesn't add any security
> to the network. If anything, it greatly decreases the security of the
> network by allowing funds to be claimed by those who did not earn them.
> >
> > But wait, you may be thinking, wouldn't quantum "miners" have earned
> their coins by all the work and resources invested in building a quantum
> computer? I suppose, in the same sense that a burglar earns their spoils by
> the resources they invest into surveilling targets and learning the skills
> needed to break into buildings. What I say "earned" I mean through
> productive mutual trade.
> >
> > For example:
> >
> > * Investors earn BTC by trading for other currencies.
> > * Merchants earn BTC by trading for goods and services.
> > * Miners earn BTC by trading thermodynamic security.
> > * Quantum miners don't trade anything, they are vampires feeding upon
> the system.
> >
> > There's no reason to believe that allowing quantum adversaries to
> recover vulnerable bitcoin will be of benefit to anyone other than the
> select few organizations that win the technological arms race to build the
> first such computers. Probably nation states and/or the top few largest
> tech companies.
> >
> > One could certainly hope that an organization with quantum supremacy is
> benevolent and acts in a "white hat" manner to return lost coins to their
> owners, but that's incredibly optimistic and foolish to rely upon. Such a
> situation creates an insurmountable ethical dilemma of only recovering lost
> bitcoin rather than currently owned bitcoin. There's no way to precisely
> differentiate between the two; anyone can claim to have lost their bitcoin
> but if they have lost their keys then proving they ever had the keys
> becomes rather difficult. I imagine that any such white hat recovery
> efforts would have to rely upon attestations from trusted third parties
> like exchanges.
> >
> > Even if the first actor with quantum supremacy is benevolent, we must
> assume the technology could fall into adversarial hands and thus think
> adversarially about the potential worst case outcomes. Imagine, for
> example, that North Korea continues scooping up billions of dollars from
> hacking crypto exchanges and decides to invest some of those proceeds into
> building a quantum computer for the biggest payday ever...
> >
> > Downsides to Allowing Quantum Recovery
> > Let's think through an exhaustive list of pros and cons for allowing or
> preventing the seizure of funds by a quantum adversary.
> >
> > Historical Precedent
> > Previous protocol vulnerabilities weren’t celebrated as "fair game" but
> rather were treated as failures to be remediated. Treating quantum theft
> differently risks rewriting Bitcoin’s history as a free-for-all rather than
> a system that seeks to protect its users.
> >
> > Violation of Property Rights
> > Allowing a quantum adversary to take control of funds undermines the
> fundamental principle of cryptocurrency - if you keep your keys in your
> possession, only you should be able to access your money. Bitcoin is built
> on the idea that private keys secure an individual’s assets, and
> unauthorized access (even via advanced tech) is theft, not a legitimate
> transfer.
> >
> > Erosion of Trust in Bitcoin
> > If quantum attackers can exploit vulnerable addresses, confidence in
> Bitcoin as a secure store of value would collapse. Users and investors rely
> on cryptographic integrity, and widespread theft could drive adoption away
> from Bitcoin, destabilizing its ecosystem.
> >
> > This is essentially the counterpoint to claiming the burning of
> vulnerable funds is a violation of property rights. While some will
> certainly see it as such, others will find the apathy toward stopping
> quantum theft to be similarly concerning.
> >
> > Unfair Advantage
> > Quantum attackers, likely equipped with rare and expensive technology,
> would have an unjust edge over regular users who lack access to such tools.
> This creates an inequitable system where only the technologically elite can
> exploit others, contradicting Bitcoin’s ethos of decentralized power.
> >
> > Bitcoin is designed to create an asymmetric advantage for DEFENDING
> one's wealth. It's supposed to be impractically expensive for attackers to
> crack the entropy and cryptography protecting one's coins. But now we find
> ourselves discussing a situation where this asymmetric advantage is
> compromised in favor of a specific class of attackers.
> >
> > Economic Disruption
> > Large-scale theft from vulnerable addresses could crash Bitcoin’s price
> as quantum recovered funds are dumped on exchanges. This would harm all
> holders, not just those directly targeted, leading to broader financial
> chaos in the markets.
> >
> > Moral Responsibility
> > Permitting theft via quantum computing sets a precedent that
> technological superiority justifies unethical behavior. This is essentially
> taking a "code is law" stance in which we refuse to admit that both code
> and laws can be modified to adapt to previously unforeseen situations.
> >
> > Burning of coins can certainly be considered a form of theft, thus I
> think it's worth differentiating the two different thefts being discussed:
> >
> > 1. self-enriching & likely malicious
> > 2. harm prevention & not necessarily malicious
> >
> > Both options lack the consent of the party whose coins are being burnt
> or transferred, thus I think the simple argument that theft is immoral
> becomes a wash and it's important to drill down into the details of each.
> >
> > Incentives Drive Security
> > I can tell you from a decade of working in Bitcoin security - the
> average user is lazy and is a procrastinator. If Bitcoiners are given a
> "drop dead date" after which they know vulnerable funds will be burned,
> this pressure accelerates the adoption of post-quantum cryptography and
> strengthens Bitcoin long-term. Allowing vulnerable users to delay upgrading
> indefinitely will result in more laggards, leaving the network more exposed
> when quantum tech becomes available.
> >
> > Steel Manning
> > Clearly this is a complex and controversial topic, thus it's worth
> thinking through the opposing arguments.
> >
> > Protecting Property Rights
> > Allowing quantum computers to take vulnerable bitcoin could potentially
> be spun as a hard money narrative - we care so greatly about not violating
> someone's access to their coins that we allow them to be stolen!
> >
> > But I think the flip side to the property rights narrative is that
> burning vulnerable coins prevents said property from falling into
> undeserving hands. If the entire Bitcoin ecosystem just stands around and
> allows quantum adversaries to claim funds that rightfully belong to other
> users, is that really a "win" in the "protecting property rights" category?
> It feels more like apathy to me.
> >
> > As such, I think the "protecting property rights" argument is a wash.
> >
> > Quantum Computers Won't Attack Bitcoin
> > There is a great deal of skepticism that sufficiently powerful quantum
> computers will ever exist, so we shouldn't bother preparing for a
> non-existent threat. Others have argued that even if such a computer was
> built, a quantum attacker would not go after bitcoin because they wouldn't
> want to reveal their hand by doing so, and would instead attack other
> infrastructure.
> >
> > It's quite difficult to quantify exactly how valuable attacking other
> infrastructure would be. It also really depends upon when an entity gains
> quantum supremacy and thus if by that time most of the world's systems have
> already been upgraded. While I think you could argue that certain entities
> gaining quantum capability might not attack Bitcoin, it would only delay
> the inevitable - eventually somebody will achieve the capability who
> decides to use it for such an attack.
> >
> > Quantum Attackers Would Only Steal Small Amounts
> > Some have argued that even if a quantum attacker targeted bitcoin,
> they'd only go after old, likely lost P2PK outputs so as to not arouse
> suspicion and cause a market panic.
> >
> > I'm not so sure about that; why go after 50 BTC at a time when you could
> take 250,000 BTC with the same effort as 50 BTC? This is a classic "zero
> day exploit" game theory in which an attacker knows they have a limited
> amount of time before someone else discovers the exploit and either
> benefits from it or patches it. Take, for example, the recent ByBit attack
> - the highest value crypto hack of all time. Lazarus Group had compromised
> the Safe wallet front end JavaScript app and they could have simply had it
> reassign ownership of everyone's Safe wallets as they were interacting with
> their wallet. But instead they chose to only specifically target ByBit's
> wallet with $1.5 billion in it because they wanted to maximize their
> extractable value. If Lazarus had started stealing from every wallet, they
> would have been discovered quickly and the Safe web app would likely have
> been patched well before any billion dollar wallets executed the malicious
> code.
> >
> > I think the "only stealing small amounts" argument is strongest for
> Situation #2 described earlier, where a quantum attacker arrives before
> quantum safe cryptography has been deployed across the Bitcoin ecosystem.
> Because if it became clear that Bitcoin's cryptography was broken AND there
> was nowhere safe for vulnerable users to migrate, the only logical option
> would be for everyone to liquidate their bitcoin as quickly as possible. As
> such, I don't think it applies as strongly for situations in which we have
> a migration path available.
> >
> > The 21 Million Coin Supply Should be in Circulation
> > Some folks are arguing that it's important for the "circulating /
> spendable" supply to be as close to 21M as possible and that having a
> significant portion of the supply out of circulation is somehow undesirable.
> >
> > While the "21M BTC" attribute is a strong memetic narrative, I don't
> think anyone has ever expected that it would all be in circulation. It has
> always been understood that many coins will be lost, and that's actually
> part of the game theory of owning bitcoin!
> >
> > And remember, the 21M number in and of itself is not a particularly
> important detail - it's not even mentioned in the whitepaper. What's
> important is that the supply is well known and not subject to change.
> >
> > Self-Sovereignty and Personal Responsibility
> > Bitcoin’s design empowers individuals to control their own wealth, free
> from centralized intervention. This freedom comes with the burden of
> securing one's private keys. If quantum computing can break obsolete
> cryptography, the fault lies with users who didn't move their funds to
> quantum safe locking scripts. Expecting the network to shield users from
> their own negligence undermines the principle that you, and not a third
> party, are accountable for your assets.
> >
> > I think this is generally a fair point that "the community" doesn't owe
> you anything in terms of helping you. I think that we do, however, need to
> consider the incentives and game theory in play with regard to quantum safe
> Bitcoiners vs quantum vulnerable Bitcoiners. More on that later.
> >
> > Code is Law
> > Bitcoin operates on transparent, immutable rules embedded in its
> protocol. If a quantum attacker uses superior technology to derive private
> keys from public keys, they’re not "hacking" the system - they're simply
> following what's mathematically permissible within the current code.
> Altering the protocol to stop this introduces subjective human
> intervention, which clashes with the objective, deterministic nature of
> blockchain.
> >
> > While I tend to agree that code is law, one of the entire points of laws
> is that they can be amended to improve their efficacy in reducing harm.
> Leaning on this point seems more like a pro-ossification stance that it's
> better to do nothing and allow harm to occur rather than take action to
> stop an attack that was foreseen far in advance.
> >
> > Technological Evolution as a Feature, Not a Bug
> > It's well known that cryptography tends to weaken over time and
> eventually break. Quantum computing is just the next step in this
> progression. Users who fail to adapt (e.g., by adopting quantum-resistant
> wallets when available) are akin to those who ignored technological
> advancements like multisig or hardware wallets. Allowing quantum theft
> incentivizes innovation and keeps Bitcoin’s ecosystem dynamic, punishing
> complacency while rewarding vigilance.
> >
> > Market Signals Drive Security
> > If quantum attackers start stealing funds, it sends a clear signal to
> the market: upgrade your security or lose everything. This pressure
> accelerates the adoption of post-quantum cryptography and strengthens
> Bitcoin long-term. Coddling vulnerable users delays this necessary
> evolution, potentially leaving the network more exposed when quantum tech
> becomes widely accessible. Theft is a brutal but effective teacher.
> >
> > Centralized Blacklisting Power
> > Burning vulnerable funds requires centralized decision-making - a soft
> fork to invalidate certain transactions. This sets a dangerous precedent
> for future interventions, eroding Bitcoin’s decentralization. If quantum
> theft is blocked, what’s next - reversing exchange hacks? The system must
> remain neutral, even if it means some lose out.
> >
> > I think this could be a potential slippery slope if the proposal was to
> only burn specific addresses. Rather, I'd expect a neutral proposal to burn
> all funds in locking script types that are known to be quantum vulnerable.
> Thus, we could eliminate any subjectivity from the code.
> >
> > Fairness in Competition
> > Quantum attackers aren't cheating; they're using publicly available
> physics and math. Anyone with the resources and foresight can build or
> access quantum tech, just as anyone could mine Bitcoin in 2009 with a CPU.
> Early adopters took risks and reaped rewards; quantum innovators are doing
> the same. Calling it “unfair” ignores that Bitcoin has never promised
> equality of outcome - only equality of opportunity within its rules.
> >
> > I find this argument to be a mischaracterization because we're not
> talking about CPUs. This is more akin to talking about ASICs, except each
> ASIC costs millions if not billions of dollars. This is out of reach from
> all but the wealthiest organizations.
> >
> > Economic Resilience
> > Bitcoin has weathered thefts before (MTGOX, Bitfinex, FTX, etc) and
> emerged stronger. The market can absorb quantum losses, with unaffected
> users continuing to hold and new entrants buying in at lower prices. Fear
> of economic collapse overestimates the impact - the network’s antifragility
> thrives on such challenges.
> >
> > This is a big grey area because we don't know when a quantum computer
> will come online and we don't know how quickly said computers would be able
> to steal bitcoin. If, for example, the first generation of sufficiently
> powerful quantum computers were stealing less volume than the current block
> reward then of course it will have minimal economic impact. But if they're
> taking thousands of BTC per day and bringing them back into circulation,
> there will likely be a noticeable market impact as it absorbs the new
> supply.
> >
> > This is where the circumstances will really matter. If a quantum
> attacker appears AFTER the Bitcoin protocol has been upgraded to support
> quantum resistant cryptography then we should expect the most valuable
> active wallets will have upgraded and the juiciest target would be the
> 31,000 BTC in the address 12ib7dApVFvg82TXKycWBNpN8kFyiAN1dr which has been
> dormant since 2010. In general I'd expect that the amount of BTC
> re-entering the circulating supply would look somewhat similar to the
> mining emission curve: volume would start off very high as the most
> valuable addresses are drained and then it would fall off as quantum
> computers went down the list targeting addresses with less and less BTC.
> >
> > Why is economic impact a factor worth considering? Miners and businesses
> in general. More coins being liquidated will push down the price, which
> will negatively impact miner revenue. Similarly, I can attest from working
> in the industry for a decade, that lower prices result in less demand from
> businesses across the entire industry. As such, burning quantum vulnerable
> bitcoin is good for the entire industry.
> >
> > Practicality & Neutrality of Non-Intervention
> > There’s no reliable way to distinguish “theft” from legitimate "white
> hat" key recovery. If someone loses their private key and a quantum
> computer recovers it, is that stealing or reclaiming? Policing quantum
> actions requires invasive assumptions about intent, which Bitcoin’s
> trustless design can’t accommodate. Letting the chips fall where they may
> avoids this mess.
> >
> > Philosophical Purity
> > Bitcoin rejects bailouts. It’s a cold, hard system where outcomes
> reflect preparation and skill, not sentimentality. If quantum computing
> upends the game, that’s the point - Bitcoin isn’t meant to be safe or fair
> in a nanny-state sense; it’s meant to be free. Users who lose funds to
> quantum attacks are casualties of liberty and their own ignorance, not
> victims of injustice.
> >
> > Bitcoin's DAO Moment
> > This situation has some similarities to The DAO hack of an Ethereum
> smart contract in 2016, which resulted in a fork to stop the attacker and
> return funds to their original owners. The game theory is similar because
> it's a situation where a threat is known but there's some period of time
> before the attacker can actually execute the theft. As such, there's time
> to mitigate the attack by changing the protocol.
> >
> > It also created a schism in the community around the true meaning of
> "code is law," resulting in Ethereum Classic, which decided to allow the
> attacker to retain control of the stolen funds.
> >
> > A soft fork to burn vulnerable bitcoin could certainly result in a hard
> fork if there are enough miners who reject the soft fork and continue
> including transactions.
> >
> > Incentives Matter
> > We can wax philosophical until the cows come home, but what are the
> actual incentives for existing Bitcoin holders regarding this decision?
> >
> >> "Lost coins only make everyone else's coins worth slightly more. Think
> of it as a donation to everyone." - Satoshi Nakamoto
> >
> >
> > If true, the corollary is:
> >
> >> "Quantum recovered coins only make everyone else's coins worth less.
> Think of it as a theft from everyone." - Jameson Lopp
> >
> >
> > Thus, assuming we get to a point where quantum resistant signatures are
> supported within the Bitcoin protocol, what's the incentive to let
> vulnerable coins remain spendable?
> >
> > * It's not good for the actual owners of those coins. It disincentivizes
> owners from upgrading until perhaps it's too late.
> > * It's not good for the more attentive / responsible owners of coins who
> have quantum secured their stash. Allowing the circulating supply to
> balloon will assuredly reduce the purchasing power of all bitcoin holders.
> >
> > Forking Game Theory
> > From a game theory point of view, I see this as incentivizing users to
> upgrade their wallets. If you disagree with the burning of vulnerable
> coins, all you have to do is move your funds to a quantum safe signature
> scheme. Point being, I don't see there being an economic majority (or even
> more than a tiny minority) of users who would fight such a soft fork. Why
> expend significant resources fighting a fork when you can just move your
> coins to a new address?
> >
> > Remember that blocking spending of certain classes of locking scripts is
> a tightening of the rules - a soft fork. As such, it can be meaningfully
> enacted and enforced by a mere majority of hashpower. If miners generally
> agree that it's in their best interest to burn vulnerable coins, are other
> users going to care enough to put in the effort to run new node software
> that resists the soft fork? Seems unlikely to me.
> >
> > How to Execute Burning
> > In order to be as objective as possible, the goal would be to announce
> to the world that after a specific block height / timestamp, Bitcoin nodes
> will no longer accept transactions (or blocks containing such transactions)
> that spend funds from any scripts other than the newly instituted quantum
> safe schemes.
> >
> > It could take a staggered approach to first freeze funds that are
> susceptible to long-range attacks such as those in P2PK scripts or those
> that exposed their public keys due to previously re-using addresses, but I
> expect the additional complexity would drive further controversy.
> >
> > How long should the grace period be in order to give the ecosystem time
> to upgrade? I'd say a minimum of 1 year for software wallets to upgrade. We
> can only hope that hardware wallet manufacturers are able to implement post
> quantum cryptography on their existing hardware with only a firmware update.
> >
> > Beyond that, it will take at least 6 months worth of block space for all
> users to migrate their funds, even in a best case scenario. Though if you
> exclude dust UTXOs you could probably get 95% of BTC value migrated in 1
> month. Of course this is a highly optimistic situation where everyone is
> completely focused on migrations - in reality it will take far longer.
> >
> > Regardless, I'd think that in order to reasonably uphold Bitcoin's
> conservatism it would be preferable to allow a 4 year migration window. In
> the meantime, mining pools could coordinate emergency soft forking logic
> such that if quantum attackers materialized, they could accelerate the
> countdown to the quantum vulnerable funds burn.
> >
> > Random Tangential Benefits
> > On the plus side, burning all quantum vulnerable bitcoin would allow us
> to prune all of those UTXOs out of the UTXO set, which would also clean up
> a lot of dust. Dust UTXOs are a bit of an annoyance and there has even been
> a recent proposal for how to incentivize cleaning them up.
> >
> > We should also expect that incentivizing migration of the entire UTXO
> set will create substantial demand for block space that will sustain a fee
> market for a fairly lengthy amount of time.
> >
> > In Summary
> > While the moral quandary of violating any of Bitcoin's inviolable
> properties can make this a very complex issue to discuss, the game theory
> and incentives between burning vulnerable coins versus allowing them to be
> claimed by entities with quantum supremacy appears to be a much simpler
> issue.
> >
> > I, for one, am not interested in rewarding quantum capable entities by
> inflating the circulating money supply just because some people lost their
> keys long ago and some laggards are not upgrading their bitcoin wallet's
> security.
> >
> > We can hope that this scenario never comes to pass, but hope is not a
> strategy.
> >
> > I welcome your feedback upon any of the above points, and contribution
> of any arguments I failed to consider.
> >
> > --
> > You received this message because you are subscribed to the Google
> Groups "Bitcoin Development Mailing List" group.
> > To unsubscribe from this group and stop receiving emails from it, send
> an email to bitcoindev+unsubscribe@googlegroups•com.
> > To view this discussion visit
> https://groups.google.com/d/msgid/bitcoindev/CADL_X_cF%3DUKVa7CitXReMq8nA_4RadCF%3D%3DkU4YG%2B0GYN97P6hQ%40mail.gmail.com
> .
>
>
>
> --
> Best regards,
> Boris Nagaev
>

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups•com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/CADL_X_f267CaqbvtU2rLWoW7hLCv2NAHLnk59eS2Oz0GjL1HeA%40mail.gmail.com.

[-- Attachment #2: Type: text/html, Size: 37288 bytes --]

 permalink raw reply	[|nested]
* 
  2025-03-16 14:15 [bitcoindev] Against Allowing Quantum Recovery of Bitcoin Jameson Lopp
  2025-03-16 18:03 ` Chris Riley

  2025-03-16 21:25   ` Jameson Lopp
  2025-03-16 22:56 ` 
                   ` 
  4 siblings, 1 reply; 17+ messages in thread
From: Nagaev Boris @ 2025-03-16 19:44 UTC (permalink / raw)
  To: Jameson Lopp;  Bitcoin Development Mailing List

Hi!

What is your perspective on time-locked coins that become spendable
only after a set deadline? Unlike regular holders who can migrate
their funds in advance, owners of time-locked coins, such as those set
to unlock through an inheritance or a smart contract, have no way to
react before the deadline. Imagine you received an inheritance set to
unlock in 2030, only to find that the deadline for migration is set
for 2029. Would such cases be considered an acceptable loss, or is
there a way to account for them without violating Bitcoin’s
principles?

Boris

On Sun, Mar 16, 2025 at 12:22 PM Jameson Lopp <jameson.lopp@gmail•com> wrote:
>
> The quantum computing debate is heating up. There are many controversial aspects to this debate, including whether or not quantum computers will ever actually become a practical threat.
>
> I won't tread into the unanswerable question of how worried we should be about quantum computers. I think it's far from a crisis, but given the difficulty in changing Bitcoin it's worth starting to seriously discuss. Today I wish to focus on a philosophical quandary related to one of the decisions that would need to be made if and when we implement a quantum safe signature scheme.
>
> Several Scenarios
> Because this essay will reference game theory a fair amount, and there are many variables at play that could change the nature of the game, I think it's important to clarify the possible scenarios up front.
>
> 1. Quantum computing never materializes, never becomes a threat, and thus everything discussed in this essay is moot.
> 2. A quantum computing threat materializes suddenly and Bitcoin does not have quantum safe signatures as part of the protocol. In this scenario it would likely make the points below moot because Bitcoin would be fundamentally broken and it would take far too long to upgrade the protocol, wallet software, and migrate user funds in order to restore confidence in the network.
> 3. Quantum computing advances slowly enough that we come to consensus about how to upgrade Bitcoin and post quantum security has been minimally adopted by the time an attacker appears.
> 4. Quantum computing advances slowly enough that we come to consensus about how to upgrade Bitcoin and post quantum security has been highly adopted by the time an attacker appears.
>
> For the purposes of this post, I'm envisioning being in situation 3 or 4.
>
> To Freeze or not to Freeze?
> I've started seeing more people weighing in on what is likely the most contentious aspect of how a quantum resistance upgrade should be handled in terms of migrating user funds. Should quantum vulnerable funds be left open to be swept by anyone with a sufficiently powerful quantum computer OR should they be permanently locked?
>
>> "I don't see why old coins should be confiscated. The better option is to let those with quantum computers free up old coins. While this might have an inflationary impact on bitcoin's price, to use a turn of phrase, the inflation is transitory. Those with low time preference should support returning lost coins to circulation."
>>
>> - Hunter Beast
>
>
> On the other hand:
>
>> "Of course they have to be confiscated. If and when (and that's a big if) the existence of a cryptography-breaking QC becomes a credible threat, the Bitcoin ecosystem has no other option than softforking out the ability to spend from signature schemes (including ECDSA and BIP340) that are vulnerable to QCs. The alternative is that millions of BTC become vulnerable to theft; I cannot see how the currency can maintain any value at all in such a setting. And this affects everyone; even those which diligently moved their coins to PQC-protected schemes."
>> - Pieter Wuille
>
>
> I don't think "confiscation" is the most precise term to use, as the funds are not being seized and reassigned. Rather, what we're really discussing would be better described as "burning" - placing the funds out of reach of everyone.
>
> Not freezing user funds is one of Bitcoin's inviolable properties. However, if quantum computing becomes a threat to Bitcoin's elliptic curve cryptography, an inviolable property of Bitcoin will be violated one way or another.
>
> Fundamental Properties at Risk
> 5 years ago I attempted to comprehensively categorize all of Bitcoin's fundamental properties that give it value. https://nakamoto.com/what-are-the-key-properties-of-bitcoin/
>
> The particular properties in play with regard to this issue seem to be:
>
> Censorship Resistance - No one should have the power to prevent others from using their bitcoin or interacting with the network.
>
> Forward Compatibility - changing the rules such that certain valid transactions become invalid could undermine confidence in the protocol.
>
> Conservatism - Users should not be expected to be highly responsive to system issues.
>
> As a result of the above principles, we have developed a strong meme (kudos to Andreas Antonopoulos) that goes as follows:
>
>> Not your keys, not your coins.
>
>
> I posit that the corollary to this principle is:
>
>> Your keys, only your coins.
>
>
> A quantum capable entity breaks the corollary of this foundational principle. We secure our bitcoin with the mathematical probabilities related to extremely large random numbers. Your funds are only secure because truly random large numbers should not be guessable or discoverable by anyone else in the world.
>
> This is the principle behind the motto vires in numeris - strength in numbers. In a world with quantum enabled adversaries, this principle is null and void for many types of cryptography, including the elliptic curve digital signatures used in Bitcoin.
>
> Who is at Risk?
> There has long been a narrative that Satoshi's coins and others from the Satoshi era of P2PK locking scripts that exposed the public key directly on the blockchain will be those that get scooped up by a quantum "miner." But unfortunately it's not that simple. If I had a powerful quantum computer, which coins would I target? I'd go to the Bitcoin rich list and find the wallets that have exposed their public keys due to re-using addresses that have previously been spent from. You can easily find them at https://bitinfocharts.com/top-100-richest-bitcoin-addresses.html
>
> Note that a few of these wallets, like Bitfinex / Kraken / Tether, would be slightly harder to crack because they are multisig wallets. So a quantum attacker would need to reverse engineer 2 keys for Kraken or 3 for Bitfinex / Tether in order to spend funds. But many are single signature.
>
> Point being, it's not only the really old lost BTC that are at risk to a quantum enabled adversary, at least at time of writing. If we add a quantum safe signature scheme, we should expect those wallets to be some of the first to upgrade given their incentives.
>
> The Ethical Dilemma: Quantifying Harm
> Which decision results in the most harm?
>
> By making quantum vulnerable funds unspendable we potentially harm some Bitcoin users who were not paying attention and neglected to migrate their funds to a quantum safe locking script. This violates the "conservativism" principle stated earlier. On the flip side, we prevent those funds plus far more lost funds from falling into the hands of the few privileged folks who gain early access to quantum computers.
>
> By leaving quantum vulnerable funds available to spend, the same set of users who would otherwise have funds frozen are likely to see them stolen. And many early adopters who lost their keys will eventually see their unreachable funds scooped up by a quantum enabled adversary.
>
> Imagine, for example, being James Howells, who accidentally threw away a hard drive with 8,000 BTC on it, currently worth over $600M USD. He has spent a decade trying to retrieve it from the landfill where he knows it's buried, but can't get permission to excavate. I suspect that, given the choice, he'd prefer those funds be permanently frozen rather than fall into someone else's possession - I know I would.
>
> Allowing a quantum computer to access lost funds doesn't make those users any worse off than they were before, however it would have a negative impact upon everyone who is currently holding bitcoin.
>
> It's prudent to expect significant economic disruption if large amounts of coins fall into new hands. Since a quantum computer is going to have a massive up front cost, expect those behind it to desire to recoup their investment. We also know from experience that when someone suddenly finds themselves in possession of 9+ figures worth of highly liquid assets, they tend to diversify into other things by selling.
>
> Allowing quantum recovery of bitcoin is tantamount to wealth redistribution. What we'd be allowing is for bitcoin to be redistributed from those who are ignorant of quantum computers to those who have won the technological race to acquire quantum computers. It's hard to see a bright side to that scenario.
>
> Is Quantum Recovery Good for Anyone?
>
> Does quantum recovery HELP anyone? I've yet to come across an argument that it's a net positive in any way. It certainly doesn't add any security to the network. If anything, it greatly decreases the security of the network by allowing funds to be claimed by those who did not earn them.
>
> But wait, you may be thinking, wouldn't quantum "miners" have earned their coins by all the work and resources invested in building a quantum computer? I suppose, in the same sense that a burglar earns their spoils by the resources they invest into surveilling targets and learning the skills needed to break into buildings. What I say "earned" I mean through productive mutual trade.
>
> For example:
>
> * Investors earn BTC by trading for other currencies.
> * Merchants earn BTC by trading for goods and services.
> * Miners earn BTC by trading thermodynamic security.
> * Quantum miners don't trade anything, they are vampires feeding upon the system.
>
> There's no reason to believe that allowing quantum adversaries to recover vulnerable bitcoin will be of benefit to anyone other than the select few organizations that win the technological arms race to build the first such computers. Probably nation states and/or the top few largest tech companies.
>
> One could certainly hope that an organization with quantum supremacy is benevolent and acts in a "white hat" manner to return lost coins to their owners, but that's incredibly optimistic and foolish to rely upon. Such a situation creates an insurmountable ethical dilemma of only recovering lost bitcoin rather than currently owned bitcoin. There's no way to precisely differentiate between the two; anyone can claim to have lost their bitcoin but if they have lost their keys then proving they ever had the keys becomes rather difficult. I imagine that any such white hat recovery efforts would have to rely upon attestations from trusted third parties like exchanges.
>
> Even if the first actor with quantum supremacy is benevolent, we must assume the technology could fall into adversarial hands and thus think adversarially about the potential worst case outcomes. Imagine, for example, that North Korea continues scooping up billions of dollars from hacking crypto exchanges and decides to invest some of those proceeds into building a quantum computer for the biggest payday ever...
>
> Downsides to Allowing Quantum Recovery
> Let's think through an exhaustive list of pros and cons for allowing or preventing the seizure of funds by a quantum adversary.
>
> Historical Precedent
> Previous protocol vulnerabilities weren’t celebrated as "fair game" but rather were treated as failures to be remediated. Treating quantum theft differently risks rewriting Bitcoin’s history as a free-for-all rather than a system that seeks to protect its users.
>
> Violation of Property Rights
> Allowing a quantum adversary to take control of funds undermines the fundamental principle of cryptocurrency - if you keep your keys in your possession, only you should be able to access your money. Bitcoin is built on the idea that private keys secure an individual’s assets, and unauthorized access (even via advanced tech) is theft, not a legitimate transfer.
>
> Erosion of Trust in Bitcoin
> If quantum attackers can exploit vulnerable addresses, confidence in Bitcoin as a secure store of value would collapse. Users and investors rely on cryptographic integrity, and widespread theft could drive adoption away from Bitcoin, destabilizing its ecosystem.
>
> This is essentially the counterpoint to claiming the burning of vulnerable funds is a violation of property rights. While some will certainly see it as such, others will find the apathy toward stopping quantum theft to be similarly concerning.
>
> Unfair Advantage
> Quantum attackers, likely equipped with rare and expensive technology, would have an unjust edge over regular users who lack access to such tools. This creates an inequitable system where only the technologically elite can exploit others, contradicting Bitcoin’s ethos of decentralized power.
>
> Bitcoin is designed to create an asymmetric advantage for DEFENDING one's wealth. It's supposed to be impractically expensive for attackers to crack the entropy and cryptography protecting one's coins. But now we find ourselves discussing a situation where this asymmetric advantage is compromised in favor of a specific class of attackers.
>
> Economic Disruption
> Large-scale theft from vulnerable addresses could crash Bitcoin’s price as quantum recovered funds are dumped on exchanges. This would harm all holders, not just those directly targeted, leading to broader financial chaos in the markets.
>
> Moral Responsibility
> Permitting theft via quantum computing sets a precedent that technological superiority justifies unethical behavior. This is essentially taking a "code is law" stance in which we refuse to admit that both code and laws can be modified to adapt to previously unforeseen situations.
>
> Burning of coins can certainly be considered a form of theft, thus I think it's worth differentiating the two different thefts being discussed:
>
> 1. self-enriching & likely malicious
> 2. harm prevention & not necessarily malicious
>
> Both options lack the consent of the party whose coins are being burnt or transferred, thus I think the simple argument that theft is immoral becomes a wash and it's important to drill down into the details of each.
>
> Incentives Drive Security
> I can tell you from a decade of working in Bitcoin security - the average user is lazy and is a procrastinator. If Bitcoiners are given a "drop dead date" after which they know vulnerable funds will be burned, this pressure accelerates the adoption of post-quantum cryptography and strengthens Bitcoin long-term. Allowing vulnerable users to delay upgrading indefinitely will result in more laggards, leaving the network more exposed when quantum tech becomes available.
>
> Steel Manning
> Clearly this is a complex and controversial topic, thus it's worth thinking through the opposing arguments.
>
> Protecting Property Rights
> Allowing quantum computers to take vulnerable bitcoin could potentially be spun as a hard money narrative - we care so greatly about not violating someone's access to their coins that we allow them to be stolen!
>
> But I think the flip side to the property rights narrative is that burning vulnerable coins prevents said property from falling into undeserving hands. If the entire Bitcoin ecosystem just stands around and allows quantum adversaries to claim funds that rightfully belong to other users, is that really a "win" in the "protecting property rights" category? It feels more like apathy to me.
>
> As such, I think the "protecting property rights" argument is a wash.
>
> Quantum Computers Won't Attack Bitcoin
> There is a great deal of skepticism that sufficiently powerful quantum computers will ever exist, so we shouldn't bother preparing for a non-existent threat. Others have argued that even if such a computer was built, a quantum attacker would not go after bitcoin because they wouldn't want to reveal their hand by doing so, and would instead attack other infrastructure.
>
> It's quite difficult to quantify exactly how valuable attacking other infrastructure would be. It also really depends upon when an entity gains quantum supremacy and thus if by that time most of the world's systems have already been upgraded. While I think you could argue that certain entities gaining quantum capability might not attack Bitcoin, it would only delay the inevitable - eventually somebody will achieve the capability who decides to use it for such an attack.
>
> Quantum Attackers Would Only Steal Small Amounts
> Some have argued that even if a quantum attacker targeted bitcoin, they'd only go after old, likely lost P2PK outputs so as to not arouse suspicion and cause a market panic.
>
> I'm not so sure about that; why go after 50 BTC at a time when you could take 250,000 BTC with the same effort as 50 BTC? This is a classic "zero day exploit" game theory in which an attacker knows they have a limited amount of time before someone else discovers the exploit and either benefits from it or patches it. Take, for example, the recent ByBit attack - the highest value crypto hack of all time. Lazarus Group had compromised the Safe wallet front end JavaScript app and they could have simply had it reassign ownership of everyone's Safe wallets as they were interacting with their wallet. But instead they chose to only specifically target ByBit's wallet with $1.5 billion in it because they wanted to maximize their extractable value. If Lazarus had started stealing from every wallet, they would have been discovered quickly and the Safe web app would likely have been patched well before any billion dollar wallets executed the malicious code.
>
> I think the "only stealing small amounts" argument is strongest for Situation #2 described earlier, where a quantum attacker arrives before quantum safe cryptography has been deployed across the Bitcoin ecosystem. Because if it became clear that Bitcoin's cryptography was broken AND there was nowhere safe for vulnerable users to migrate, the only logical option would be for everyone to liquidate their bitcoin as quickly as possible. As such, I don't think it applies as strongly for situations in which we have a migration path available.
>
> The 21 Million Coin Supply Should be in Circulation
> Some folks are arguing that it's important for the "circulating / spendable" supply to be as close to 21M as possible and that having a significant portion of the supply out of circulation is somehow undesirable.
>
> While the "21M BTC" attribute is a strong memetic narrative, I don't think anyone has ever expected that it would all be in circulation. It has always been understood that many coins will be lost, and that's actually part of the game theory of owning bitcoin!
>
> And remember, the 21M number in and of itself is not a particularly important detail - it's not even mentioned in the whitepaper. What's important is that the supply is well known and not subject to change.
>
> Self-Sovereignty and Personal Responsibility
> Bitcoin’s design empowers individuals to control their own wealth, free from centralized intervention. This freedom comes with the burden of securing one's private keys. If quantum computing can break obsolete cryptography, the fault lies with users who didn't move their funds to quantum safe locking scripts. Expecting the network to shield users from their own negligence undermines the principle that you, and not a third party, are accountable for your assets.
>
> I think this is generally a fair point that "the community" doesn't owe you anything in terms of helping you. I think that we do, however, need to consider the incentives and game theory in play with regard to quantum safe Bitcoiners vs quantum vulnerable Bitcoiners. More on that later.
>
> Code is Law
> Bitcoin operates on transparent, immutable rules embedded in its protocol. If a quantum attacker uses superior technology to derive private keys from public keys, they’re not "hacking" the system - they're simply following what's mathematically permissible within the current code. Altering the protocol to stop this introduces subjective human intervention, which clashes with the objective, deterministic nature of blockchain.
>
> While I tend to agree that code is law, one of the entire points of laws is that they can be amended to improve their efficacy in reducing harm. Leaning on this point seems more like a pro-ossification stance that it's better to do nothing and allow harm to occur rather than take action to stop an attack that was foreseen far in advance.
>
> Technological Evolution as a Feature, Not a Bug
> It's well known that cryptography tends to weaken over time and eventually break. Quantum computing is just the next step in this progression. Users who fail to adapt (e.g., by adopting quantum-resistant wallets when available) are akin to those who ignored technological advancements like multisig or hardware wallets. Allowing quantum theft incentivizes innovation and keeps Bitcoin’s ecosystem dynamic, punishing complacency while rewarding vigilance.
>
> Market Signals Drive Security
> If quantum attackers start stealing funds, it sends a clear signal to the market: upgrade your security or lose everything. This pressure accelerates the adoption of post-quantum cryptography and strengthens Bitcoin long-term. Coddling vulnerable users delays this necessary evolution, potentially leaving the network more exposed when quantum tech becomes widely accessible. Theft is a brutal but effective teacher.
>
> Centralized Blacklisting Power
> Burning vulnerable funds requires centralized decision-making - a soft fork to invalidate certain transactions. This sets a dangerous precedent for future interventions, eroding Bitcoin’s decentralization. If quantum theft is blocked, what’s next - reversing exchange hacks? The system must remain neutral, even if it means some lose out.
>
> I think this could be a potential slippery slope if the proposal was to only burn specific addresses. Rather, I'd expect a neutral proposal to burn all funds in locking script types that are known to be quantum vulnerable. Thus, we could eliminate any subjectivity from the code.
>
> Fairness in Competition
> Quantum attackers aren't cheating; they're using publicly available physics and math. Anyone with the resources and foresight can build or access quantum tech, just as anyone could mine Bitcoin in 2009 with a CPU. Early adopters took risks and reaped rewards; quantum innovators are doing the same. Calling it “unfair” ignores that Bitcoin has never promised equality of outcome - only equality of opportunity within its rules.
>
> I find this argument to be a mischaracterization because we're not talking about CPUs. This is more akin to talking about ASICs, except each ASIC costs millions if not billions of dollars. This is out of reach from all but the wealthiest organizations.
>
> Economic Resilience
> Bitcoin has weathered thefts before (MTGOX, Bitfinex, FTX, etc) and emerged stronger. The market can absorb quantum losses, with unaffected users continuing to hold and new entrants buying in at lower prices. Fear of economic collapse overestimates the impact - the network’s antifragility thrives on such challenges.
>
> This is a big grey area because we don't know when a quantum computer will come online and we don't know how quickly said computers would be able to steal bitcoin. If, for example, the first generation of sufficiently powerful quantum computers were stealing less volume than the current block reward then of course it will have minimal economic impact. But if they're taking thousands of BTC per day and bringing them back into circulation, there will likely be a noticeable market impact as it absorbs the new supply.
>
> This is where the circumstances will really matter. If a quantum attacker appears AFTER the Bitcoin protocol has been upgraded to support quantum resistant cryptography then we should expect the most valuable active wallets will have upgraded and the juiciest target would be the 31,000 BTC in the address 12ib7dApVFvg82TXKycWBNpN8kFyiAN1dr which has been dormant since 2010. In general I'd expect that the amount of BTC re-entering the circulating supply would look somewhat similar to the mining emission curve: volume would start off very high as the most valuable addresses are drained and then it would fall off as quantum computers went down the list targeting addresses with less and less BTC.
>
> Why is economic impact a factor worth considering? Miners and businesses in general. More coins being liquidated will push down the price, which will negatively impact miner revenue. Similarly, I can attest from working in the industry for a decade, that lower prices result in less demand from businesses across the entire industry. As such, burning quantum vulnerable bitcoin is good for the entire industry.
>
> Practicality & Neutrality of Non-Intervention
> There’s no reliable way to distinguish “theft” from legitimate "white hat" key recovery. If someone loses their private key and a quantum computer recovers it, is that stealing or reclaiming? Policing quantum actions requires invasive assumptions about intent, which Bitcoin’s trustless design can’t accommodate. Letting the chips fall where they may avoids this mess.
>
> Philosophical Purity
> Bitcoin rejects bailouts. It’s a cold, hard system where outcomes reflect preparation and skill, not sentimentality. If quantum computing upends the game, that’s the point - Bitcoin isn’t meant to be safe or fair in a nanny-state sense; it’s meant to be free. Users who lose funds to quantum attacks are casualties of liberty and their own ignorance, not victims of injustice.
>
> Bitcoin's DAO Moment
> This situation has some similarities to The DAO hack of an Ethereum smart contract in 2016, which resulted in a fork to stop the attacker and return funds to their original owners. The game theory is similar because it's a situation where a threat is known but there's some period of time before the attacker can actually execute the theft. As such, there's time to mitigate the attack by changing the protocol.
>
> It also created a schism in the community around the true meaning of "code is law," resulting in Ethereum Classic, which decided to allow the attacker to retain control of the stolen funds.
>
> A soft fork to burn vulnerable bitcoin could certainly result in a hard fork if there are enough miners who reject the soft fork and continue including transactions.
>
> Incentives Matter
> We can wax philosophical until the cows come home, but what are the actual incentives for existing Bitcoin holders regarding this decision?
>
>> "Lost coins only make everyone else's coins worth slightly more. Think of it as a donation to everyone." - Satoshi Nakamoto
>
>
> If true, the corollary is:
>
>> "Quantum recovered coins only make everyone else's coins worth less. Think of it as a theft from everyone." - Jameson Lopp
>
>
> Thus, assuming we get to a point where quantum resistant signatures are supported within the Bitcoin protocol, what's the incentive to let vulnerable coins remain spendable?
>
> * It's not good for the actual owners of those coins. It disincentivizes owners from upgrading until perhaps it's too late.
> * It's not good for the more attentive / responsible owners of coins who have quantum secured their stash. Allowing the circulating supply to balloon will assuredly reduce the purchasing power of all bitcoin holders.
>
> Forking Game Theory
> From a game theory point of view, I see this as incentivizing users to upgrade their wallets. If you disagree with the burning of vulnerable coins, all you have to do is move your funds to a quantum safe signature scheme. Point being, I don't see there being an economic majority (or even more than a tiny minority) of users who would fight such a soft fork. Why expend significant resources fighting a fork when you can just move your coins to a new address?
>
> Remember that blocking spending of certain classes of locking scripts is a tightening of the rules - a soft fork. As such, it can be meaningfully enacted and enforced by a mere majority of hashpower. If miners generally agree that it's in their best interest to burn vulnerable coins, are other users going to care enough to put in the effort to run new node software that resists the soft fork? Seems unlikely to me.
>
> How to Execute Burning
> In order to be as objective as possible, the goal would be to announce to the world that after a specific block height / timestamp, Bitcoin nodes will no longer accept transactions (or blocks containing such transactions) that spend funds from any scripts other than the newly instituted quantum safe schemes.
>
> It could take a staggered approach to first freeze funds that are susceptible to long-range attacks such as those in P2PK scripts or those that exposed their public keys due to previously re-using addresses, but I expect the additional complexity would drive further controversy.
>
> How long should the grace period be in order to give the ecosystem time to upgrade? I'd say a minimum of 1 year for software wallets to upgrade. We can only hope that hardware wallet manufacturers are able to implement post quantum cryptography on their existing hardware with only a firmware update.
>
> Beyond that, it will take at least 6 months worth of block space for all users to migrate their funds, even in a best case scenario. Though if you exclude dust UTXOs you could probably get 95% of BTC value migrated in 1 month. Of course this is a highly optimistic situation where everyone is completely focused on migrations - in reality it will take far longer.
>
> Regardless, I'd think that in order to reasonably uphold Bitcoin's conservatism it would be preferable to allow a 4 year migration window. In the meantime, mining pools could coordinate emergency soft forking logic such that if quantum attackers materialized, they could accelerate the countdown to the quantum vulnerable funds burn.
>
> Random Tangential Benefits
> On the plus side, burning all quantum vulnerable bitcoin would allow us to prune all of those UTXOs out of the UTXO set, which would also clean up a lot of dust. Dust UTXOs are a bit of an annoyance and there has even been a recent proposal for how to incentivize cleaning them up.
>
> We should also expect that incentivizing migration of the entire UTXO set will create substantial demand for block space that will sustain a fee market for a fairly lengthy amount of time.
>
> In Summary
> While the moral quandary of violating any of Bitcoin's inviolable properties can make this a very complex issue to discuss, the game theory and incentives between burning vulnerable coins versus allowing them to be claimed by entities with quantum supremacy appears to be a much simpler issue.
>
> I, for one, am not interested in rewarding quantum capable entities by inflating the circulating money supply just because some people lost their keys long ago and some laggards are not upgrading their bitcoin wallet's security.
>
> We can hope that this scenario never comes to pass, but hope is not a strategy.
>
> I welcome your feedback upon any of the above points, and contribution of any arguments I failed to consider.
>
> --
> You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups•com.
> To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/CADL_X_cF%3DUKVa7CitXReMq8nA_4RadCF%3D%3DkU4YG%2B0GYN97P6hQ%40mail.gmail.com.



-- 
Best regards,
Boris Nagaev

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups•com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/CAFC_Vt54W1RR6GJSSg1tVsLi1%3DYHCQYiTNLxMj%2BvypMtTHcUBQ%40mail.gmail.com.


^ permalink raw reply	[|nested] 17+ messages in thread
2025-03-16 14:15 [bitcoindev] Against Allowing Quantum Recovery of Bitcoin Jameson Lopp
                   ` (2 preceding siblings ...)
  2025-03-16 22:56 ` IdeA

  2025-03-18 12:48   ` Sjors Provoost
  2025-04-06 14:07 ` Nadav Ivgi
  
From: Matt Corallo @ 2025-03-17 12:00 UTC (permalink / raw)
  To: Jameson Lopp, Bitcoin Development Mailing List

Thanks for posting this Jameson,

I think this is a strong motivation to do "simple PQC" today - while we don't need to decide on the 
tough question of seizing non-PQC coins today, we want to have the option to do so in the future.

In order for that option to be practical, wallets need to be embedding PQC public keys in their 
outputs probably at least a decade before the seizure occurs, with any additional time giving us an 
important safety margin.

Thus it seems like time we add the simplest form of PQC we can - a trivial OP_HASHBASEDSIG (probably 
SPHINCS+) to tapscript to enable wallets to have hidden PQC keys (including multisig) in their taptrees.

Matt

On 3/16/25 10:15 AM, Jameson Lopp wrote:
> The quantum computing debate is heating up. There are many controversial aspects to this debate, 
> including whether or not quantum computers will ever actually become a practical threat.
> 
> I won't tread into the unanswerable question of how worried we should be about quantum computers. I 
> think it's far from a crisis, but given the difficulty in changing Bitcoin it's worth starting to 
> seriously discuss. Today I wish to focus on a philosophical quandary related to one of the decisions 
> that would need to be made if and when we implement a quantum safe signature scheme.
> 
> Several Scenarios
> Because this essay will reference game theory a fair amount, and there are many variables at play 
> that could change the nature of the game, I think it's important to clarify the possible scenarios 
> up front.
> 
> 1. Quantum computing never materializes, never becomes a threat, and thus everything discussed in 
> this essay is moot.
> 2. A quantum computing threat materializes suddenly and Bitcoin does not have quantum safe 
> signatures as part of the protocol. In this scenario it would likely make the points below moot 
> because Bitcoin would be fundamentally broken and it would take far too long to upgrade the 
> protocol, wallet software, and migrate user funds in order to restore confidence in the network.
> 3. Quantum computing advances slowly enough that we come to consensus about how to upgrade Bitcoin 
> and post quantum security has been minimally adopted by the time an attacker appears.
> 4. Quantum computing advances slowly enough that we come to consensus about how to upgrade Bitcoin 
> and post quantum security has been highly adopted by the time an attacker appears.
> 
> For the purposes of this post, I'm envisioning being in situation 3 or 4.
> 
> To Freeze or not to Freeze?
> I've started seeing more people weighing in on what is likely the most contentious aspect of how a 
> quantum resistance upgrade should be handled in terms of migrating user funds. Should quantum 
> vulnerable funds be left open to be swept by anyone with a sufficiently powerful quantum computer OR 
> should they be permanently locked?
> 
>     "I don't see why old coins should be confiscated. The better option is to let those with quantum
>     computers free up old coins. While this might have an inflationary impact on bitcoin's price, to
>     use a turn of phrase, the inflation is transitory. Those with low time preference should support
>     returning lost coins to circulation." 
> 
>     - Hunter Beast
> 
> 
> On the other hand:
> 
>     "Of course they have to be confiscated. If and when (and that's a big if) the existence of a
>     cryptography-breaking QC becomes a credible threat, the Bitcoin ecosystem has no other option
>     than softforking out the ability to spend from signature schemes (including ECDSA and BIP340)
>     that are vulnerable to QCs. The alternative is that millions of BTC become vulnerable to theft;
>     I cannot see how the currency can maintain any value at all in such a setting. And this affects
>     everyone; even those which diligently moved their coins to PQC-protected schemes."
>     - Pieter Wuille
> 
> 
> I don't think "confiscation" is the most precise term to use, as the funds are not being seized and 
> reassigned. Rather, what we're really discussing would be better described as "burning" - placing 
> the funds *out of reach of everyone*.
> 
> Not freezing user funds is one of Bitcoin's inviolable properties. However, if quantum computing 
> becomes a threat to Bitcoin's elliptic curve cryptography, *an inviolable property of Bitcoin will 
> be violated one way or another*.
> 
> Fundamental Properties at Risk
> 5 years ago I attempted to comprehensively categorize all of Bitcoin's fundamental properties that 
> give it value. https://nakamoto.com/what-are-the-key-properties-of-bitcoin/
> <https://nakamoto.com/what-are-the-key-properties-of-bitcoin/>
> The particular properties in play with regard to this issue seem to be:
> 
> *Censorship Resistance* - No one should have the power to prevent others from using their bitcoin or 
> interacting with the network.
> 
> *Forward Compatibility* - changing the rules such that certain valid transactions become invalid 
> could undermine confidence in the protocol.
> 
> *Conservatism* - Users should not be expected to be highly responsive to system issues.
> 
> As a result of the above principles, we have developed a strong meme (kudos to Andreas Antonopoulos) 
> that goes as follows:
> 
>     Not your keys, not your coins.
> 
> 
> I posit that the corollary to this principle is:
> 
>     Your keys, only your coins.
> 
> 
> A quantum capable entity breaks the corollary of this foundational principle. We secure our bitcoin 
> with the mathematical probabilities related to extremely large random numbers. Your funds are only 
> secure because truly random large numbers should not be guessable or discoverable by anyone else in 
> the world.
> 
> This is the principle behind the motto /vires in numeris/ - strength in numbers. In a world with 
> quantum enabled adversaries, this principle is null and void for many types of cryptography, 
> including the elliptic curve digital signatures used in Bitcoin.
> 
> Who is at Risk?
> There has long been a narrative that Satoshi's coins and others from the Satoshi era of P2PK locking 
> scripts that exposed the public key directly on the blockchain will be those that get scooped up by 
> a quantum "miner." But unfortunately it's not that simple. If I had a powerful quantum computer, 
> which coins would I target? I'd go to the Bitcoin rich list and find the wallets that have exposed 
> their public keys due to re-using addresses that have previously been spent from. You can easily 
> find them at https://bitinfocharts.com/top-100-richest-bitcoin-addresses.html <https:// 
> bitinfocharts.com/top-100-richest-bitcoin-addresses.html>
> 
> Note that a few of these wallets, like Bitfinex / Kraken / Tether, would be slightly harder to crack 
> because they are multisig wallets. So a quantum attacker would need to reverse engineer 2 keys for 
> Kraken or 3 for Bitfinex / Tether in order to spend funds. But many are single signature.
> 
> Point being, it's not only the really old lost BTC that are at risk to a quantum enabled adversary, 
> at least at time of writing. If we add a quantum safe signature scheme, we should expect those 
> wallets to be some of the first to upgrade given their incentives.
> 
> The Ethical Dilemma: Quantifying Harm
> Which decision results in the most harm?
> 
> By making quantum vulnerable funds unspendable we potentially harm some Bitcoin users who were not 
> paying attention and neglected to migrate their funds to a quantum safe locking script. This 
> violates the "conservativism" principle stated earlier. On the flip side, we prevent those funds 
> plus far more lost funds from falling into the hands of the few privileged folks who gain early 
> access to quantum computers.
> 
> By leaving quantum vulnerable funds available to spend, the same set of users who would otherwise 
> have funds frozen are likely to see them stolen. And many early adopters who lost their keys will 
> eventually see their unreachable funds scooped up by a quantum enabled adversary.
> 
> Imagine, for example, being James Howells, who accidentally threw away a hard drive with 8,000 BTC 
> on it, currently worth over $600M USD. He has spent a decade trying to retrieve it from the landfill 
> where he knows it's buried, but can't get permission to excavate. I suspect that, given the choice, 
> he'd prefer those funds be permanently frozen rather than fall into someone else's possession - I 
> know I would.
> 
> Allowing a quantum computer to access lost funds doesn't make those users any worse off than they 
> were before, however it /would/ have a negative impact upon everyone who is currently holding bitcoin.
> 
> It's prudent to expect significant economic disruption if large amounts of coins fall into new 
> hands. Since a quantum computer is going to have a massive up front cost, expect those behind it to 
> desire to recoup their investment. We also know from experience that when someone suddenly finds 
> themselves in possession of 9+ figures worth of highly liquid assets, they tend to diversify into 
> other things by selling.
> 
> Allowing quantum recovery of bitcoin is /tantamount to wealth redistribution/. What we'd be allowing 
> is for bitcoin to be redistributed from those who are ignorant of quantum computers to those who 
> have won the technological race to acquire quantum computers. It's hard to see a bright side to that 
> scenario.
> 
> Is Quantum Recovery Good for Anyone?
> 
> Does quantum recovery HELP anyone? I've yet to come across an argument that it's a net positive in 
> any way. It certainly doesn't add any security to the network. If anything, it greatly decreases the 
> security of the network by allowing funds to be claimed by those who did not earn them.
> 
> But wait, you may be thinking, wouldn't quantum "miners" have earned their coins by all the work and 
> resources invested in building a quantum computer? I suppose, in the same sense that a burglar earns 
> their spoils by the resources they invest into surveilling targets and learning the skills needed to 
> break into buildings. What I say "earned" I mean through productive mutual trade.
> 
> For example:
> 
> * Investors earn BTC by trading for other currencies.
> * Merchants earn BTC by trading for goods and services.
> * Miners earn BTC by trading thermodynamic security.
> * Quantum miners don't trade anything, they are vampires feeding upon the system.
> 
> There's no reason to believe that allowing quantum adversaries to recover vulnerable bitcoin will be 
> of benefit to anyone other than the select few organizations that win the technological arms race to 
> build the first such computers. Probably nation states and/or the top few largest tech companies.
> 
> One could certainly hope that an organization with quantum supremacy is benevolent and acts in a 
> "white hat" manner to return lost coins to their owners, but that's incredibly optimistic and 
> foolish to rely upon. Such a situation creates an insurmountable ethical dilemma of only recovering 
> lost bitcoin rather than currently owned bitcoin. There's no way to precisely differentiate between 
> the two; anyone can claim to have lost their bitcoin but if they have lost their keys then proving 
> they ever had the keys becomes rather difficult. I imagine that any such white hat recovery efforts 
> would have to rely upon attestations from trusted third parties like exchanges.
> 
> Even if the first actor with quantum supremacy is benevolent, we must assume the technology could 
> fall into adversarial hands and thus think adversarially about the potential worst case outcomes. 
> Imagine, for example, that North Korea continues scooping up billions of dollars from hacking crypto 
> exchanges and decides to invest some of those proceeds into building a quantum computer for the 
> biggest payday ever...
> 
> Downsides to Allowing Quantum Recovery
> Let's think through an exhaustive list of pros and cons for allowing or preventing the seizure of 
> funds by a quantum adversary.
> 
> Historical Precedent
> Previous protocol vulnerabilities weren’t celebrated as "fair game" but rather were treated as 
> failures to be remediated. Treating quantum theft differently risks rewriting Bitcoin’s history as a 
> free-for-all rather than a system that seeks to protect its users.
> 
> Violation of Property Rights
> Allowing a quantum adversary to take control of funds undermines the fundamental principle of 
> cryptocurrency - if you keep your keys in your possession, only you should be able to access your 
> money. Bitcoin is built on the idea that private keys secure an individual’s assets, and 
> unauthorized access (even via advanced tech) is theft, not a legitimate transfer.
> 
> Erosion of Trust in Bitcoin
> If quantum attackers can exploit vulnerable addresses, confidence in Bitcoin as a secure store of 
> value would collapse. Users and investors rely on cryptographic integrity, and widespread theft 
> could drive adoption away from Bitcoin, destabilizing its ecosystem.
> 
> This is essentially the counterpoint to claiming the burning of vulnerable funds is a violation of 
> property rights. While some will certainly see it as such, others will find the apathy toward 
> stopping quantum theft to be similarly concerning.
> 
> Unfair Advantage
> Quantum attackers, likely equipped with rare and expensive technology, would have an unjust edge 
> over regular users who lack access to such tools. This creates an inequitable system where only the 
> technologically elite can exploit others, contradicting Bitcoin’s ethos of decentralized power.
> 
> Bitcoin is designed to create an asymmetric advantage for DEFENDING one's wealth. It's supposed to 
> be impractically expensive for attackers to crack the entropy and cryptography protecting one's 
> coins. But now we find ourselves discussing a situation where this asymmetric advantage is 
> compromised in favor of a specific class of attackers.
> 
> Economic Disruption
> Large-scale theft from vulnerable addresses could crash Bitcoin’s price as quantum recovered funds 
> are dumped on exchanges. This would harm all holders, not just those directly targeted, leading to 
> broader financial chaos in the markets.
> 
> Moral Responsibility
> Permitting theft via quantum computing sets a precedent that technological superiority justifies 
> unethical behavior. This is essentially taking a "code is law" stance in which we refuse to admit 
> that both code and laws can be modified to adapt to previously unforeseen situations.
> 
> Burning of coins can certainly be considered a form of theft, thus I think it's worth 
> differentiating the two different thefts being discussed:
> 
> 1. self-enriching & likely malicious
> 2. harm prevention & not necessarily malicious
> 
> Both options lack the consent of the party whose coins are being burnt or transferred, thus I think 
> the simple argument that theft is immoral becomes a wash and it's important to drill down into the 
> details of each.
> 
> Incentives Drive Security
> I can tell you from a decade of working in Bitcoin security - the average user is lazy and is a 
> procrastinator. If Bitcoiners are given a "drop dead date" after which they know vulnerable funds 
> will be burned, this pressure accelerates the adoption of post-quantum cryptography and strengthens 
> Bitcoin long-term. Allowing vulnerable users to delay upgrading indefinitely will result in more 
> laggards, leaving the network more exposed when quantum tech becomes available.
> 
> Steel Manning
> Clearly this is a complex and controversial topic, thus it's worth thinking through the opposing 
> arguments.
> 
> Protecting Property Rights
> Allowing quantum computers to take vulnerable bitcoin could potentially be spun as a hard money 
> narrative - we care so greatly about not violating someone's access to their coins that we allow 
> them to be stolen!
> 
> But I think the flip side to the property rights narrative is that burning vulnerable coins prevents 
> said property from falling into undeserving hands. If the entire Bitcoin ecosystem just stands 
> around and allows quantum adversaries to claim funds that rightfully belong to other users, is that 
> really a "win" in the "protecting property rights" category? It feels more like apathy to me.
> 
> As such, I think the "protecting property rights" argument is a wash.
> 
> Quantum Computers Won't Attack Bitcoin
> There is a great deal of skepticism that sufficiently powerful quantum computers will ever exist, so 
> we shouldn't bother preparing for a non-existent threat. Others have argued that even if such a 
> computer was built, a quantum attacker would not go after bitcoin because they wouldn't want to 
> reveal their hand by doing so, and would instead attack other infrastructure.
> 
> It's quite difficult to quantify exactly how valuable attacking other infrastructure would be. It 
> also really depends upon when an entity gains quantum supremacy and thus if by that time most of the 
> world's systems have already been upgraded. While I think you could argue that certain entities 
> gaining quantum capability might not attack Bitcoin, it would only delay the inevitable - eventually 
> somebody will achieve the capability who decides to use it for such an attack.
> 
> Quantum Attackers Would Only Steal Small Amounts
> Some have argued that even if a quantum attacker targeted bitcoin, they'd only go after old, likely 
> lost P2PK outputs so as to not arouse suspicion and cause a market panic.
> 
> I'm not so sure about that; why go after 50 BTC at a time when you could take 250,000 BTC with the 
> same effort as 50 BTC? This is a classic "zero day exploit" game theory in which an attacker knows 
> they have a limited amount of time before someone else discovers the exploit and either benefits 
> from it or patches it. Take, for example, the recent ByBit attack - the highest value crypto hack of 
> all time. Lazarus Group had compromised the Safe wallet front end JavaScript app and they could have 
> simply had it reassign ownership of everyone's Safe wallets as they were interacting with their 
> wallet. But instead they chose to only specifically target ByBit's wallet with $1.5 billion in it 
> because they wanted to maximize their extractable value. If Lazarus had started stealing from every 
> wallet, they would have been discovered quickly and the Safe web app would likely have been patched 
> well before any billion dollar wallets executed the malicious code.
> 
> I think the "only stealing small amounts" argument is strongest for Situation #2 described earlier, 
> where a quantum attacker arrives before quantum safe cryptography has been deployed across the 
> Bitcoin ecosystem. Because if it became clear that Bitcoin's cryptography was broken AND there was 
> nowhere safe for vulnerable users to migrate, the only logical option would be for everyone to 
> liquidate their bitcoin as quickly as possible. As such, I don't think it applies as strongly for 
> situations in which we have a migration path available.
> 
> The 21 Million Coin Supply Should be in Circulation
> Some folks are arguing that it's important for the "circulating / spendable" supply to be as close 
> to 21M as possible and that having a significant portion of the supply out of circulation is somehow 
> undesirable.
> 
> While the "21M BTC" attribute is a strong memetic narrative, I don't think anyone has ever expected 
> that it would all be in circulation. It has always been understood that many coins will be lost, and 
> that's actually part of the game theory of owning bitcoin!
> 
> And remember, the 21M number in and of itself is not a particularly important detail - it's not even 
> mentioned in the whitepaper. What's important is that the supply is well known and not subject to 
> change.
> 
> Self-Sovereignty and Personal Responsibility
> Bitcoin’s design empowers individuals to control their own wealth, free from centralized 
> intervention. This freedom comes with the burden of securing one's private keys. If quantum 
> computing can break obsolete cryptography, the fault lies with users who didn't move their funds to 
> quantum safe locking scripts. Expecting the network to shield users from their own negligence 
> undermines the principle that you, and not a third party, are accountable for your assets.
> 
> I think this is generally a fair point that "the community" doesn't owe you anything in terms of 
> helping you. I think that we do, however, need to consider the incentives and game theory in play 
> with regard to quantum safe Bitcoiners vs quantum vulnerable Bitcoiners. More on that later.
> 
> Code is Law
> Bitcoin operates on transparent, immutable rules embedded in its protocol. If a quantum attacker 
> uses superior technology to derive private keys from public keys, they’re not "hacking" the system - 
> they're simply following what's mathematically permissible within the current code. Altering the 
> protocol to stop this introduces subjective human intervention, which clashes with the objective, 
> deterministic nature of blockchain.
> 
> While I tend to agree that code is law, one of the entire points of laws is that they can be amended 
> to improve their efficacy in reducing harm. Leaning on this point seems more like a pro-ossification 
> stance that it's better to do nothing and allow harm to occur rather than take action to stop an 
> attack that was foreseen far in advance.
> 
> Technological Evolution as a Feature, Not a Bug
> It's well known that cryptography tends to weaken over time and eventually break. Quantum computing 
> is just the next step in this progression. Users who fail to adapt (e.g., by adopting quantum- 
> resistant wallets when available) are akin to those who ignored technological advancements like 
> multisig or hardware wallets. Allowing quantum theft incentivizes innovation and keeps Bitcoin’s 
> ecosystem dynamic, punishing complacency while rewarding vigilance.
> 
> Market Signals Drive Security
> If quantum attackers start stealing funds, it sends a clear signal to the market: upgrade your 
> security or lose everything. This pressure accelerates the adoption of post-quantum cryptography and 
> strengthens Bitcoin long-term. Coddling vulnerable users delays this necessary evolution, 
> potentially leaving the network more exposed when quantum tech becomes widely accessible. Theft is a 
> brutal but effective teacher.
> 
> Centralized Blacklisting Power
> Burning vulnerable funds requires centralized decision-making - a soft fork to invalidate certain 
> transactions. This sets a dangerous precedent for future interventions, eroding Bitcoin’s 
> decentralization. If quantum theft is blocked, what’s next - reversing exchange hacks? The system 
> must remain neutral, even if it means some lose out.
> 
> I think this could be a potential slippery slope if the proposal was to only burn specific 
> addresses. Rather, I'd expect a neutral proposal to burn all funds in locking script types that are 
> known to be quantum vulnerable. Thus, we could eliminate any subjectivity from the code.
> 
> Fairness in Competition
> Quantum attackers aren't cheating; they're using publicly available physics and math. Anyone with 
> the resources and foresight can build or access quantum tech, just as anyone could mine Bitcoin in 
> 2009 with a CPU. Early adopters took risks and reaped rewards; quantum innovators are doing the 
> same. Calling it “unfair” ignores that Bitcoin has never promised equality of outcome - only 
> equality of opportunity within its rules.
> 
> I find this argument to be a mischaracterization because we're not talking about CPUs. This is more 
> akin to talking about ASICs, except each ASIC costs millions if not billions of dollars. This is out 
> of reach from all but the wealthiest organizations.
> 
> Economic Resilience
> Bitcoin has weathered thefts before (MTGOX, Bitfinex, FTX, etc) and emerged stronger. The market can 
> absorb quantum losses, with unaffected users continuing to hold and new entrants buying in at lower 
> prices. Fear of economic collapse overestimates the impact - the network’s antifragility thrives on 
> such challenges.
> 
> This is a big grey area because we don't know when a quantum computer will come online and we don't 
> know how quickly said computers would be able to steal bitcoin. If, for example, the first 
> generation of sufficiently powerful quantum computers were stealing less volume than the current 
> block reward then of course it will have minimal economic impact. But if they're taking thousands of 
> BTC per day and bringing them back into circulation, there will likely be a noticeable market impact 
> as it absorbs the new supply.
> 
> This is where the circumstances will really matter. If a quantum attacker appears AFTER the Bitcoin 
> protocol has been upgraded to support quantum resistant cryptography then we should expect the most 
> valuable active wallets will have upgraded and the juiciest target would be the 31,000 BTC in the 
> address 12ib7dApVFvg82TXKycWBNpN8kFyiAN1dr which has been dormant since 2010. In general I'd expect 
> that the amount of BTC re-entering the circulating supply would look somewhat similar to the mining 
> emission curve: volume would start off very high as the most valuable addresses are drained and then 
> it would fall off as quantum computers went down the list targeting addresses with less and less BTC.
> 
> Why is economic impact a factor worth considering? Miners and businesses in general. More coins 
> being liquidated will push down the price, which will negatively impact miner revenue. Similarly, I 
> can attest from working in the industry for a decade, that lower prices result in less demand from 
> businesses across the entire industry. As such, burning quantum vulnerable bitcoin is good for the 
> entire industry.
> 
> Practicality & Neutrality of Non-Intervention
> There’s no reliable way to distinguish “theft” from legitimate "white hat" key recovery. If someone 
> loses their private key and a quantum computer recovers it, is that stealing or reclaiming? Policing 
> quantum actions requires invasive assumptions about intent, which Bitcoin’s trustless design can’t 
> accommodate. Letting the chips fall where they may avoids this mess.
> 
> Philosophical Purity
> Bitcoin rejects bailouts. It’s a cold, hard system where outcomes reflect preparation and skill, not 
> sentimentality. If quantum computing upends the game, that’s the point - Bitcoin isn’t meant to be 
> safe or fair in a nanny-state sense; it’s meant to be free. Users who lose funds to quantum attacks 
> are casualties of liberty and their own ignorance, not victims of injustice.
> 
> Bitcoin's DAO Moment
> This situation has some similarities to The DAO hack of an Ethereum smart contract in 2016, which 
> resulted in a fork to stop the attacker and return funds to their original owners. The game theory 
> is similar because it's a situation where a threat is known but there's some period of time before 
> the attacker can actually execute the theft. As such, there's time to mitigate the attack by 
> changing the protocol.
> 
> It also created a schism in the community around the true meaning of "code is law," resulting in 
> Ethereum Classic, which decided to allow the attacker to retain control of the stolen funds.
> 
> A soft fork to burn vulnerable bitcoin could certainly result in a hard fork if there are enough 
> miners who reject the soft fork and continue including transactions.
> 
> Incentives Matter
> We can wax philosophical until the cows come home, but what are the actual incentives for existing 
> Bitcoin holders regarding this decision?
> 
>     "Lost coins only make everyone else's coins worth slightly more. Think of it as a donation to
>     everyone." - Satoshi Nakamoto
> 
> 
> If true, the corollary is:
> 
>     "Quantum recovered coins only make everyone else's coins worth less. Think of it as a theft from
>     everyone." - Jameson Lopp
> 
> 
> Thus, assuming we get to a point where quantum resistant signatures are supported within the Bitcoin 
> protocol, what's the incentive to let vulnerable coins remain spendable?
> 
> * It's not good for the actual owners of those coins. It disincentivizes owners from upgrading until 
> perhaps it's too late.
> * It's not good for the more attentive / responsible owners of coins who have quantum secured their 
> stash. Allowing the circulating supply to balloon will assuredly reduce the purchasing power of all 
> bitcoin holders.
> 
> Forking Game Theory
>  From a game theory point of view, I see this as incentivizing users to upgrade their wallets. If 
> you disagree with the burning of vulnerable coins, all you have to do is move your funds to a 
> quantum safe signature scheme. Point being, I don't see there being an economic majority (or even 
> more than a tiny minority) of users who would fight such a soft fork. Why expend significant 
> resources fighting a fork when you can just move your coins to a new address?
> 
> Remember that blocking spending of certain classes of locking scripts is a tightening of the rules - 
> a soft fork. As such, it can be meaningfully enacted and enforced by a mere majority of hashpower. 
> If miners generally agree that it's in their best interest to burn vulnerable coins, are other users 
> going to care enough to put in the effort to run new node software that resists the soft fork? Seems 
> unlikely to me.
> 
> How to Execute Burning
> In order to be as objective as possible, the goal would be to announce to the world that after a 
> specific block height / timestamp, Bitcoin nodes will no longer accept transactions (or blocks 
> containing such transactions) that spend funds from any scripts other than the newly instituted 
> quantum safe schemes.
> 
> It could take a staggered approach to first freeze funds that are susceptible to long-range attacks 
> such as those in P2PK scripts or those that exposed their public keys due to previously re-using 
> addresses, but I expect the additional complexity would drive further controversy.
> 
> How long should the grace period be in order to give the ecosystem time to upgrade? I'd say a 
> minimum of 1 year for software wallets to upgrade. We can only hope that hardware wallet 
> manufacturers are able to implement post quantum cryptography on their existing hardware with only a 
> firmware update.
> 
> Beyond that, it will take at least 6 months worth of block space for all users to migrate their 
> funds, even in a best case scenario. Though if you exclude dust UTXOs you could probably get 95% of 
> BTC value migrated in 1 month. Of course this is a highly optimistic situation where everyone is 
> completely focused on migrations - in reality it will take far longer.
> 
> Regardless, I'd think that in order to reasonably uphold Bitcoin's conservatism it would be 
> preferable to allow a 4 year migration window. In the meantime, mining pools could coordinate 
> emergency soft forking logic such that if quantum attackers materialized, they could accelerate the 
> countdown to the quantum vulnerable funds burn.
> 
> Random Tangential Benefits
> On the plus side, burning all quantum vulnerable bitcoin would allow us to prune all of those UTXOs 
> out of the UTXO set, which would also clean up a lot of dust. Dust UTXOs are a bit of an annoyance 
> and there has even been a recent proposal for how to incentivize cleaning them up.
> 
> We should also expect that incentivizing migration of the entire UTXO set will create substantial 
> demand for block space that will sustain a fee market for a fairly lengthy amount of time.
> 
> In Summary
> While the moral quandary of violating any of Bitcoin's inviolable properties can make this a very 
> complex issue to discuss, the game theory and incentives between burning vulnerable coins versus 
> allowing them to be claimed by entities with quantum supremacy appears to be a much simpler issue.
> 
> I, for one, am not interested in rewarding quantum capable entities by inflating the circulating 
> money supply just because some people lost their keys long ago and some laggards are not upgrading 
> their bitcoin wallet's security.
> 
> We can hope that this scenario never comes to pass, but hope is not a strategy.
> 
> I welcome your feedback upon any of the above points, and contribution of any arguments I failed to 
> consider.
> 
> -- 
> You received this message because you are subscribed to the Google Groups "Bitcoin Development 
> Mailing List" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to 
> bitcoindev+unsubscribe@googlegroups•com <mailto:bitcoindev+unsubscribe@googlegroups•com>.
> To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/ 
> CADL_X_cF%3DUKVa7CitXReMq8nA_4RadCF%3D%3DkU4YG%2B0GYN97P6hQ%40mail.gmail.com <https:// 
> groups.google.com/d/msgid/bitcoindev/ 
> CADL_X_cF%3DUKVa7CitXReMq8nA_4RadCF%3D%3DkU4YG%2B0GYN97P6hQ%40mail.gmail.com? 
> utm_medium=email&utm_source=footer>.

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups•com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/43afd5bb-244e-4698-ba3d-139efa2c2058%40mattcorallo.com.


 permalink raw reply	[|nested]
2025-03-16 22:56 ` IdeA

  
From: Jameson Lopp @ 2025-03-17 13:28 UTC (permalink / raw)
  To: IdeA;  Bitcoin Development Mailing List

[-- Attachment #1: Type: text/plain, Size: 35048 bytes --]

> Could those who, for whatever reason, do not want to migrate to secure
addresses be allowed to do so if they sign with their keys, thus providing
proof of life and possession, and not participating in this update scheme?

While nearly anything is technically possible, I'm skeptical that folks
would be sufficiently motivated to build this functionality.

Ceasing support for vulnerable software and systems is a common concept.
For example, IIRC, Bitcoin Core provides support for 18 months, Ubuntu
provides long-term support for 5 years, Windows provides unpaid support for
5 years, etc. https://endoflife.date/

On Sun, Mar 16, 2025 at 6:56 PM IdeA <flazarte@gmail•com> wrote:

> Hi Jameson, Could those who, for whatever reason, do not want to migrate
> to secure addresses be allowed to do so if they sign with their keys, thus
> providing proof of life and possession, and not participating in this
> update scheme? This could be a way to not violate the principle of freedom
> and sovereignty of each individual over their addresses.
>
> Very interesting article, I completely agree.
>
>
> Sincerely, Fedebuyito. -
>
>
> El El dom, 16 mar 2025 a la(s) 12:22, Jameson Lopp <jameson.lopp@gmail•com>
> escribió:
>
>> The quantum computing debate is heating up. There are many controversial
>> aspects to this debate, including whether or not quantum computers will
>> ever actually become a practical threat.
>>
>> I won't tread into the unanswerable question of how worried we should be
>> about quantum computers. I think it's far from a crisis, but given the
>> difficulty in changing Bitcoin it's worth starting to seriously discuss.
>> Today I wish to focus on a philosophical quandary related to one of the
>> decisions that would need to be made if and when we implement a quantum
>> safe signature scheme.
>>
>> Several Scenarios
>> Because this essay will reference game theory a fair amount, and there
>> are many variables at play that could change the nature of the game, I
>> think it's important to clarify the possible scenarios up front.
>>
>> 1. Quantum computing never materializes, never becomes a threat, and thus
>> everything discussed in this essay is moot.
>> 2. A quantum computing threat materializes suddenly and Bitcoin does not
>> have quantum safe signatures as part of the protocol. In this scenario it
>> would likely make the points below moot because Bitcoin would be
>> fundamentally broken and it would take far too long to upgrade the
>> protocol, wallet software, and migrate user funds in order to restore
>> confidence in the network.
>> 3. Quantum computing advances slowly enough that we come to consensus
>> about how to upgrade Bitcoin and post quantum security has been minimally
>> adopted by the time an attacker appears.
>> 4. Quantum computing advances slowly enough that we come to consensus
>> about how to upgrade Bitcoin and post quantum security has been highly
>> adopted by the time an attacker appears.
>>
>> For the purposes of this post, I'm envisioning being in situation 3 or 4.
>>
>> To Freeze or not to Freeze?
>> I've started seeing more people weighing in on what is likely the most
>> contentious aspect of how a quantum resistance upgrade should be handled in
>> terms of migrating user funds. Should quantum vulnerable funds be left open
>> to be swept by anyone with a sufficiently powerful quantum computer OR
>> should they be permanently locked?
>>
>> "I don't see why old coins should be confiscated. The better option is to
>>> let those with quantum computers free up old coins. While this might have
>>> an inflationary impact on bitcoin's price, to use a turn of phrase, the
>>> inflation is transitory. Those with low time preference should support
>>> returning lost coins to circulation."
>>
>> - Hunter Beast
>>
>>
>> On the other hand:
>>
>> "Of course they have to be confiscated. If and when (and that's a big if)
>>> the existence of a cryptography-breaking QC becomes a credible threat, the
>>> Bitcoin ecosystem has no other option than softforking out the ability to
>>> spend from signature schemes (including ECDSA and BIP340) that are
>>> vulnerable to QCs. The alternative is that millions of BTC become
>>> vulnerable to theft; I cannot see how the currency can maintain any value
>>> at all in such a setting. And this affects everyone; even those which
>>> diligently moved their coins to PQC-protected schemes."
>>> - Pieter Wuille
>>
>>
>> I don't think "confiscation" is the most precise term to use, as the
>> funds are not being seized and reassigned. Rather, what we're really
>> discussing would be better described as "burning" - placing the funds *out
>> of reach of everyone*.
>>
>> Not freezing user funds is one of Bitcoin's inviolable properties.
>> However, if quantum computing becomes a threat to Bitcoin's elliptic curve
>> cryptography, *an inviolable property of Bitcoin will be violated one
>> way or another*.
>>
>> Fundamental Properties at Risk
>> 5 years ago I attempted to comprehensively categorize all of Bitcoin's
>> fundamental properties that give it value.
>> https://nakamoto.com/what-are-the-key-properties-of-bitcoin/
>>
>> The particular properties in play with regard to this issue seem to be:
>>
>> *Censorship Resistance* - No one should have the power to prevent others
>> from using their bitcoin or interacting with the network.
>>
>> *Forward Compatibility* - changing the rules such that certain valid
>> transactions become invalid could undermine confidence in the protocol.
>>
>> *Conservatism* - Users should not be expected to be highly responsive to
>> system issues.
>>
>> As a result of the above principles, we have developed a strong meme
>> (kudos to Andreas Antonopoulos) that goes as follows:
>>
>> Not your keys, not your coins.
>>
>>
>> I posit that the corollary to this principle is:
>>
>> Your keys, only your coins.
>>
>>
>> A quantum capable entity breaks the corollary of this foundational
>> principle. We secure our bitcoin with the mathematical probabilities
>> related to extremely large random numbers. Your funds are only secure
>> because truly random large numbers should not be guessable or discoverable
>> by anyone else in the world.
>>
>> This is the principle behind the motto *vires in numeris* - strength in
>> numbers. In a world with quantum enabled adversaries, this principle is
>> null and void for many types of cryptography, including the elliptic curve
>> digital signatures used in Bitcoin.
>>
>> Who is at Risk?
>> There has long been a narrative that Satoshi's coins and others from the
>> Satoshi era of P2PK locking scripts that exposed the public key directly on
>> the blockchain will be those that get scooped up by a quantum "miner." But
>> unfortunately it's not that simple. If I had a powerful quantum computer,
>> which coins would I target? I'd go to the Bitcoin rich list and find the
>> wallets that have exposed their public keys due to re-using addresses that
>> have previously been spent from. You can easily find them at
>> https://bitinfocharts.com/top-100-richest-bitcoin-addresses.html
>>
>> Note that a few of these wallets, like Bitfinex / Kraken / Tether, would
>> be slightly harder to crack because they are multisig wallets. So a quantum
>> attacker would need to reverse engineer 2 keys for Kraken or 3 for Bitfinex
>> / Tether in order to spend funds. But many are single signature.
>>
>> Point being, it's not only the really old lost BTC that are at risk to a
>> quantum enabled adversary, at least at time of writing. If we add a quantum
>> safe signature scheme, we should expect those wallets to be some of the
>> first to upgrade given their incentives.
>>
>> The Ethical Dilemma: Quantifying Harm
>> Which decision results in the most harm?
>>
>> By making quantum vulnerable funds unspendable we potentially harm some
>> Bitcoin users who were not paying attention and neglected to migrate their
>> funds to a quantum safe locking script. This violates the "conservativism"
>> principle stated earlier. On the flip side, we prevent those funds plus far
>> more lost funds from falling into the hands of the few privileged folks who
>> gain early access to quantum computers.
>>
>> By leaving quantum vulnerable funds available to spend, the same set of
>> users who would otherwise have funds frozen are likely to see them stolen.
>> And many early adopters who lost their keys will eventually see their
>> unreachable funds scooped up by a quantum enabled adversary.
>>
>> Imagine, for example, being James Howells, who accidentally threw away a
>> hard drive with 8,000 BTC on it, currently worth over $600M USD. He has
>> spent a decade trying to retrieve it from the landfill where he knows it's
>> buried, but can't get permission to excavate. I suspect that, given the
>> choice, he'd prefer those funds be permanently frozen rather than fall into
>> someone else's possession - I know I would.
>>
>> Allowing a quantum computer to access lost funds doesn't make those users
>> any worse off than they were before, however it *would* have a negative
>> impact upon everyone who is currently holding bitcoin.
>>
>> It's prudent to expect significant economic disruption if large amounts
>> of coins fall into new hands. Since a quantum computer is going to have a
>> massive up front cost, expect those behind it to desire to recoup their
>> investment. We also know from experience that when someone suddenly finds
>> themselves in possession of 9+ figures worth of highly liquid assets, they
>> tend to diversify into other things by selling.
>>
>> Allowing quantum recovery of bitcoin is *tantamount to wealth
>> redistribution*. What we'd be allowing is for bitcoin to be
>> redistributed from those who are ignorant of quantum computers to those who
>> have won the technological race to acquire quantum computers. It's hard to
>> see a bright side to that scenario.
>>
>> Is Quantum Recovery Good for Anyone?
>>
>> Does quantum recovery HELP anyone? I've yet to come across an argument
>> that it's a net positive in any way. It certainly doesn't add any security
>> to the network. If anything, it greatly decreases the security of the
>> network by allowing funds to be claimed by those who did not earn them.
>>
>> But wait, you may be thinking, wouldn't quantum "miners" have earned
>> their coins by all the work and resources invested in building a quantum
>> computer? I suppose, in the same sense that a burglar earns their spoils by
>> the resources they invest into surveilling targets and learning the skills
>> needed to break into buildings. What I say "earned" I mean through
>> productive mutual trade.
>>
>> For example:
>>
>> * Investors earn BTC by trading for other currencies.
>> * Merchants earn BTC by trading for goods and services.
>> * Miners earn BTC by trading thermodynamic security.
>> * Quantum miners don't trade anything, they are vampires feeding upon the
>> system.
>>
>> There's no reason to believe that allowing quantum adversaries to recover
>> vulnerable bitcoin will be of benefit to anyone other than the select few
>> organizations that win the technological arms race to build the first such
>> computers. Probably nation states and/or the top few largest tech companies.
>>
>> One could certainly hope that an organization with quantum supremacy is
>> benevolent and acts in a "white hat" manner to return lost coins to their
>> owners, but that's incredibly optimistic and foolish to rely upon. Such a
>> situation creates an insurmountable ethical dilemma of only recovering lost
>> bitcoin rather than currently owned bitcoin. There's no way to precisely
>> differentiate between the two; anyone can claim to have lost their bitcoin
>> but if they have lost their keys then proving they ever had the keys
>> becomes rather difficult. I imagine that any such white hat recovery
>> efforts would have to rely upon attestations from trusted third parties
>> like exchanges.
>>
>> Even if the first actor with quantum supremacy is benevolent, we must
>> assume the technology could fall into adversarial hands and thus think
>> adversarially about the potential worst case outcomes. Imagine, for
>> example, that North Korea continues scooping up billions of dollars from
>> hacking crypto exchanges and decides to invest some of those proceeds into
>> building a quantum computer for the biggest payday ever...
>>
>> Downsides to Allowing Quantum Recovery
>> Let's think through an exhaustive list of pros and cons for allowing or
>> preventing the seizure of funds by a quantum adversary.
>>
>> Historical Precedent
>> Previous protocol vulnerabilities weren’t celebrated as "fair game" but
>> rather were treated as failures to be remediated. Treating quantum theft
>> differently risks rewriting Bitcoin’s history as a free-for-all rather than
>> a system that seeks to protect its users.
>>
>> Violation of Property Rights
>> Allowing a quantum adversary to take control of funds undermines the
>> fundamental principle of cryptocurrency - if you keep your keys in your
>> possession, only you should be able to access your money. Bitcoin is built
>> on the idea that private keys secure an individual’s assets, and
>> unauthorized access (even via advanced tech) is theft, not a legitimate
>> transfer.
>>
>> Erosion of Trust in Bitcoin
>> If quantum attackers can exploit vulnerable addresses, confidence in
>> Bitcoin as a secure store of value would collapse. Users and investors rely
>> on cryptographic integrity, and widespread theft could drive adoption away
>> from Bitcoin, destabilizing its ecosystem.
>>
>> This is essentially the counterpoint to claiming the burning of
>> vulnerable funds is a violation of property rights. While some will
>> certainly see it as such, others will find the apathy toward stopping
>> quantum theft to be similarly concerning.
>>
>> Unfair Advantage
>> Quantum attackers, likely equipped with rare and expensive technology,
>> would have an unjust edge over regular users who lack access to such tools.
>> This creates an inequitable system where only the technologically elite can
>> exploit others, contradicting Bitcoin’s ethos of decentralized power.
>>
>> Bitcoin is designed to create an asymmetric advantage for DEFENDING one's
>> wealth. It's supposed to be impractically expensive for attackers to crack
>> the entropy and cryptography protecting one's coins. But now we find
>> ourselves discussing a situation where this asymmetric advantage is
>> compromised in favor of a specific class of attackers.
>>
>> Economic Disruption
>> Large-scale theft from vulnerable addresses could crash Bitcoin’s price
>> as quantum recovered funds are dumped on exchanges. This would harm all
>> holders, not just those directly targeted, leading to broader financial
>> chaos in the markets.
>>
>> Moral Responsibility
>> Permitting theft via quantum computing sets a precedent that
>> technological superiority justifies unethical behavior. This is essentially
>> taking a "code is law" stance in which we refuse to admit that both code
>> and laws can be modified to adapt to previously unforeseen situations.
>>
>> Burning of coins can certainly be considered a form of theft, thus I
>> think it's worth differentiating the two different thefts being discussed:
>>
>> 1. self-enriching & likely malicious
>> 2. harm prevention & not necessarily malicious
>>
>> Both options lack the consent of the party whose coins are being burnt or
>> transferred, thus I think the simple argument that theft is immoral becomes
>> a wash and it's important to drill down into the details of each.
>>
>> Incentives Drive Security
>> I can tell you from a decade of working in Bitcoin security - the average
>> user is lazy and is a procrastinator. If Bitcoiners are given a "drop dead
>> date" after which they know vulnerable funds will be burned, this pressure
>> accelerates the adoption of post-quantum cryptography and strengthens
>> Bitcoin long-term. Allowing vulnerable users to delay upgrading
>> indefinitely will result in more laggards, leaving the network more exposed
>> when quantum tech becomes available.
>>
>> Steel Manning
>> Clearly this is a complex and controversial topic, thus it's worth
>> thinking through the opposing arguments.
>>
>> Protecting Property Rights
>> Allowing quantum computers to take vulnerable bitcoin could potentially
>> be spun as a hard money narrative - we care so greatly about not violating
>> someone's access to their coins that we allow them to be stolen!
>>
>> But I think the flip side to the property rights narrative is that
>> burning vulnerable coins prevents said property from falling into
>> undeserving hands. If the entire Bitcoin ecosystem just stands around and
>> allows quantum adversaries to claim funds that rightfully belong to other
>> users, is that really a "win" in the "protecting property rights" category?
>> It feels more like apathy to me.
>>
>> As such, I think the "protecting property rights" argument is a wash.
>>
>> Quantum Computers Won't Attack Bitcoin
>> There is a great deal of skepticism that sufficiently powerful quantum
>> computers will ever exist, so we shouldn't bother preparing for a
>> non-existent threat. Others have argued that even if such a computer was
>> built, a quantum attacker would not go after bitcoin because they wouldn't
>> want to reveal their hand by doing so, and would instead attack other
>> infrastructure.
>>
>> It's quite difficult to quantify exactly how valuable attacking other
>> infrastructure would be. It also really depends upon when an entity gains
>> quantum supremacy and thus if by that time most of the world's systems have
>> already been upgraded. While I think you could argue that certain entities
>> gaining quantum capability might not attack Bitcoin, it would only delay
>> the inevitable - eventually somebody will achieve the capability who
>> decides to use it for such an attack.
>>
>> Quantum Attackers Would Only Steal Small Amounts
>> Some have argued that even if a quantum attacker targeted bitcoin, they'd
>> only go after old, likely lost P2PK outputs so as to not arouse suspicion
>> and cause a market panic.
>>
>> I'm not so sure about that; why go after 50 BTC at a time when you could
>> take 250,000 BTC with the same effort as 50 BTC? This is a classic "zero
>> day exploit" game theory in which an attacker knows they have a limited
>> amount of time before someone else discovers the exploit and either
>> benefits from it or patches it. Take, for example, the recent ByBit attack
>> - the highest value crypto hack of all time. Lazarus Group had compromised
>> the Safe wallet front end JavaScript app and they could have simply had it
>> reassign ownership of everyone's Safe wallets as they were interacting with
>> their wallet. But instead they chose to only specifically target ByBit's
>> wallet with $1.5 billion in it because they wanted to maximize their
>> extractable value. If Lazarus had started stealing from every wallet, they
>> would have been discovered quickly and the Safe web app would likely have
>> been patched well before any billion dollar wallets executed the malicious
>> code.
>>
>> I think the "only stealing small amounts" argument is strongest for
>> Situation #2 described earlier, where a quantum attacker arrives before
>> quantum safe cryptography has been deployed across the Bitcoin ecosystem.
>> Because if it became clear that Bitcoin's cryptography was broken AND there
>> was nowhere safe for vulnerable users to migrate, the only logical option
>> would be for everyone to liquidate their bitcoin as quickly as possible. As
>> such, I don't think it applies as strongly for situations in which we have
>> a migration path available.
>>
>> The 21 Million Coin Supply Should be in Circulation
>> Some folks are arguing that it's important for the "circulating /
>> spendable" supply to be as close to 21M as possible and that having a
>> significant portion of the supply out of circulation is somehow undesirable.
>>
>> While the "21M BTC" attribute is a strong memetic narrative, I don't
>> think anyone has ever expected that it would all be in circulation. It has
>> always been understood that many coins will be lost, and that's actually
>> part of the game theory of owning bitcoin!
>>
>> And remember, the 21M number in and of itself is not a particularly
>> important detail - it's not even mentioned in the whitepaper. What's
>> important is that the supply is well known and not subject to change.
>>
>> Self-Sovereignty and Personal Responsibility
>> Bitcoin’s design empowers individuals to control their own wealth, free
>> from centralized intervention. This freedom comes with the burden of
>> securing one's private keys. If quantum computing can break obsolete
>> cryptography, the fault lies with users who didn't move their funds to
>> quantum safe locking scripts. Expecting the network to shield users from
>> their own negligence undermines the principle that you, and not a third
>> party, are accountable for your assets.
>>
>> I think this is generally a fair point that "the community" doesn't owe
>> you anything in terms of helping you. I think that we do, however, need to
>> consider the incentives and game theory in play with regard to quantum safe
>> Bitcoiners vs quantum vulnerable Bitcoiners. More on that later.
>>
>> Code is Law
>> Bitcoin operates on transparent, immutable rules embedded in its
>> protocol. If a quantum attacker uses superior technology to derive private
>> keys from public keys, they’re not "hacking" the system - they're simply
>> following what's mathematically permissible within the current code.
>> Altering the protocol to stop this introduces subjective human
>> intervention, which clashes with the objective, deterministic nature of
>> blockchain.
>>
>> While I tend to agree that code is law, one of the entire points of laws
>> is that they can be amended to improve their efficacy in reducing harm.
>> Leaning on this point seems more like a pro-ossification stance that it's
>> better to do nothing and allow harm to occur rather than take action to
>> stop an attack that was foreseen far in advance.
>>
>> Technological Evolution as a Feature, Not a Bug
>> It's well known that cryptography tends to weaken over time and
>> eventually break. Quantum computing is just the next step in this
>> progression. Users who fail to adapt (e.g., by adopting quantum-resistant
>> wallets when available) are akin to those who ignored technological
>> advancements like multisig or hardware wallets. Allowing quantum theft
>> incentivizes innovation and keeps Bitcoin’s ecosystem dynamic, punishing
>> complacency while rewarding vigilance.
>>
>> Market Signals Drive Security
>> If quantum attackers start stealing funds, it sends a clear signal to the
>> market: upgrade your security or lose everything. This pressure accelerates
>> the adoption of post-quantum cryptography and strengthens Bitcoin
>> long-term. Coddling vulnerable users delays this necessary evolution,
>> potentially leaving the network more exposed when quantum tech becomes
>> widely accessible. Theft is a brutal but effective teacher.
>>
>> Centralized Blacklisting Power
>> Burning vulnerable funds requires centralized decision-making - a soft
>> fork to invalidate certain transactions. This sets a dangerous precedent
>> for future interventions, eroding Bitcoin’s decentralization. If quantum
>> theft is blocked, what’s next - reversing exchange hacks? The system must
>> remain neutral, even if it means some lose out.
>>
>> I think this could be a potential slippery slope if the proposal was to
>> only burn specific addresses. Rather, I'd expect a neutral proposal to burn
>> all funds in locking script types that are known to be quantum vulnerable.
>> Thus, we could eliminate any subjectivity from the code.
>>
>> Fairness in Competition
>> Quantum attackers aren't cheating; they're using publicly available
>> physics and math. Anyone with the resources and foresight can build or
>> access quantum tech, just as anyone could mine Bitcoin in 2009 with a CPU.
>> Early adopters took risks and reaped rewards; quantum innovators are doing
>> the same. Calling it “unfair” ignores that Bitcoin has never promised
>> equality of outcome - only equality of opportunity within its rules.
>>
>> I find this argument to be a mischaracterization because we're not
>> talking about CPUs. This is more akin to talking about ASICs, except each
>> ASIC costs millions if not billions of dollars. This is out of reach from
>> all but the wealthiest organizations.
>>
>> Economic Resilience
>> Bitcoin has weathered thefts before (MTGOX, Bitfinex, FTX, etc) and
>> emerged stronger. The market can absorb quantum losses, with unaffected
>> users continuing to hold and new entrants buying in at lower prices. Fear
>> of economic collapse overestimates the impact - the network’s antifragility
>> thrives on such challenges.
>>
>> This is a big grey area because we don't know when a quantum computer
>> will come online and we don't know how quickly said computers would be able
>> to steal bitcoin. If, for example, the first generation of sufficiently
>> powerful quantum computers were stealing less volume than the current block
>> reward then of course it will have minimal economic impact. But if they're
>> taking thousands of BTC per day and bringing them back into circulation,
>> there will likely be a noticeable market impact as it absorbs the new
>> supply.
>>
>> This is where the circumstances will really matter. If a quantum attacker
>> appears AFTER the Bitcoin protocol has been upgraded to support quantum
>> resistant cryptography then we should expect the most valuable active
>> wallets will have upgraded and the juiciest target would be the 31,000 BTC
>> in the address 12ib7dApVFvg82TXKycWBNpN8kFyiAN1dr which has been dormant
>> since 2010. In general I'd expect that the amount of BTC re-entering the
>> circulating supply would look somewhat similar to the mining emission
>> curve: volume would start off very high as the most valuable addresses are
>> drained and then it would fall off as quantum computers went down the list
>> targeting addresses with less and less BTC.
>>
>> Why is economic impact a factor worth considering? Miners and businesses
>> in general. More coins being liquidated will push down the price, which
>> will negatively impact miner revenue. Similarly, I can attest from working
>> in the industry for a decade, that lower prices result in less demand from
>> businesses across the entire industry. As such, burning quantum vulnerable
>> bitcoin is good for the entire industry.
>>
>> Practicality & Neutrality of Non-Intervention
>> There’s no reliable way to distinguish “theft” from legitimate "white
>> hat" key recovery. If someone loses their private key and a quantum
>> computer recovers it, is that stealing or reclaiming? Policing quantum
>> actions requires invasive assumptions about intent, which Bitcoin’s
>> trustless design can’t accommodate. Letting the chips fall where they may
>> avoids this mess.
>>
>> Philosophical Purity
>> Bitcoin rejects bailouts. It’s a cold, hard system where outcomes reflect
>> preparation and skill, not sentimentality. If quantum computing upends the
>> game, that’s the point - Bitcoin isn’t meant to be safe or fair in a
>> nanny-state sense; it’s meant to be free. Users who lose funds to quantum
>> attacks are casualties of liberty and their own ignorance, not victims of
>> injustice.
>>
>> Bitcoin's DAO Moment
>> This situation has some similarities to The DAO hack of an Ethereum smart
>> contract in 2016, which resulted in a fork to stop the attacker and return
>> funds to their original owners. The game theory is similar because it's a
>> situation where a threat is known but there's some period of time before
>> the attacker can actually execute the theft. As such, there's time to
>> mitigate the attack by changing the protocol.
>>
>> It also created a schism in the community around the true meaning of
>> "code is law," resulting in Ethereum Classic, which decided to allow the
>> attacker to retain control of the stolen funds.
>>
>> A soft fork to burn vulnerable bitcoin could certainly result in a hard
>> fork if there are enough miners who reject the soft fork and continue
>> including transactions.
>>
>> Incentives Matter
>> We can wax philosophical until the cows come home, but what are the
>> actual incentives for existing Bitcoin holders regarding this decision?
>>
>> "Lost coins only make everyone else's coins worth slightly more. Think of
>>> it as a donation to everyone." - Satoshi Nakamoto
>>
>>
>> If true, the corollary is:
>>
>> "Quantum recovered coins only make everyone else's coins worth less.
>>> Think of it as a theft from everyone." - Jameson Lopp
>>
>>
>> Thus, assuming we get to a point where quantum resistant signatures are
>> supported within the Bitcoin protocol, what's the incentive to let
>> vulnerable coins remain spendable?
>>
>> * It's not good for the actual owners of those coins. It disincentivizes
>> owners from upgrading until perhaps it's too late.
>> * It's not good for the more attentive / responsible owners of coins who
>> have quantum secured their stash. Allowing the circulating supply to
>> balloon will assuredly reduce the purchasing power of all bitcoin holders.
>>
>> Forking Game Theory
>> From a game theory point of view, I see this as incentivizing users to
>> upgrade their wallets. If you disagree with the burning of vulnerable
>> coins, all you have to do is move your funds to a quantum safe signature
>> scheme. Point being, I don't see there being an economic majority (or even
>> more than a tiny minority) of users who would fight such a soft fork. Why
>> expend significant resources fighting a fork when you can just move your
>> coins to a new address?
>>
>> Remember that blocking spending of certain classes of locking scripts is
>> a tightening of the rules - a soft fork. As such, it can be meaningfully
>> enacted and enforced by a mere majority of hashpower. If miners generally
>> agree that it's in their best interest to burn vulnerable coins, are other
>> users going to care enough to put in the effort to run new node software
>> that resists the soft fork? Seems unlikely to me.
>>
>> How to Execute Burning
>> In order to be as objective as possible, the goal would be to announce to
>> the world that after a specific block height / timestamp, Bitcoin nodes
>> will no longer accept transactions (or blocks containing such transactions)
>> that spend funds from any scripts other than the newly instituted quantum
>> safe schemes.
>>
>> It could take a staggered approach to first freeze funds that are
>> susceptible to long-range attacks such as those in P2PK scripts or those
>> that exposed their public keys due to previously re-using addresses, but I
>> expect the additional complexity would drive further controversy.
>>
>> How long should the grace period be in order to give the ecosystem time
>> to upgrade? I'd say a minimum of 1 year for software wallets to upgrade. We
>> can only hope that hardware wallet manufacturers are able to implement post
>> quantum cryptography on their existing hardware with only a firmware update.
>>
>> Beyond that, it will take at least 6 months worth of block space for all
>> users to migrate their funds, even in a best case scenario. Though if you
>> exclude dust UTXOs you could probably get 95% of BTC value migrated in 1
>> month. Of course this is a highly optimistic situation where everyone is
>> completely focused on migrations - in reality it will take far longer.
>>
>> Regardless, I'd think that in order to reasonably uphold Bitcoin's
>> conservatism it would be preferable to allow a 4 year migration window. In
>> the meantime, mining pools could coordinate emergency soft forking logic
>> such that if quantum attackers materialized, they could accelerate the
>> countdown to the quantum vulnerable funds burn.
>>
>> Random Tangential Benefits
>> On the plus side, burning all quantum vulnerable bitcoin would allow us
>> to prune all of those UTXOs out of the UTXO set, which would also clean up
>> a lot of dust. Dust UTXOs are a bit of an annoyance and there has even been
>> a recent proposal for how to incentivize cleaning them up.
>>
>> We should also expect that incentivizing migration of the entire UTXO set
>> will create substantial demand for block space that will sustain a fee
>> market for a fairly lengthy amount of time.
>>
>> In Summary
>> While the moral quandary of violating any of Bitcoin's inviolable
>> properties can make this a very complex issue to discuss, the game theory
>> and incentives between burning vulnerable coins versus allowing them to be
>> claimed by entities with quantum supremacy appears to be a much simpler
>> issue.
>>
>> I, for one, am not interested in rewarding quantum capable entities by
>> inflating the circulating money supply just because some people lost their
>> keys long ago and some laggards are not upgrading their bitcoin wallet's
>> security.
>>
>> We can hope that this scenario never comes to pass, but hope is not a
>> strategy.
>>
>> I welcome your feedback upon any of the above points, and contribution of
>> any arguments I failed to consider.
>>
>> --
>> You received this message because you are subscribed to the Google Groups
>> "Bitcoin Development Mailing List" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to bitcoindev+unsubscribe@googlegroups•com.
>> To view this discussion visit
>> https://groups.google.com/d/msgid/bitcoindev/CADL_X_cF%3DUKVa7CitXReMq8nA_4RadCF%3D%3DkU4YG%2B0GYN97P6hQ%40mail.gmail.com
>> <https://groups.google.com/d/msgid/bitcoindev/CADL_X_cF%3DUKVa7CitXReMq8nA_4RadCF%3D%3DkU4YG%2B0GYN97P6hQ%40mail.gmail.com?utm_medium=email&utm_source=footer>
>> .
>>
>

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups•com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/CADL_X_egHyS1K6evGKCwRaVY25jUE7K%2B6UjnDFh261j%2BXan0JQ%40mail.gmail.com.

[-- Attachment #2: Type: text/html, Size: 38104 bytes --]

 permalink raw reply	[|nested]
2025-03-17 12:00 ` Matt Corallo

  2025-03-25  1:06     ` Matt Corallo
  
From: Sjors Provoost @ 2025-03-18 12:48 UTC (permalink / raw)
  To: Bitcoin Development Mailing List;  Jameson Lopp, Matt Corallo


> Op 17 mrt 2025, om 13:00 heeft Matt Corallo <lf-lists@mattcorallo•com> het volgende geschreven:
> 
> I think this is a strong motivation to do "simple PQC" today - while we don't need to decide on the tough question of seizing non-PQC coins today, we want to have the option to do so in the future.
> 
> In order for that option to be practical, wallets need to be embedding PQC public keys in their outputs probably at least a decade before the seizure occurs, with any additional time giving us an important safety margin.

I don't think that in practice we can deploy a PCQ scheme without at the same time making a decision with regards to burn vs free-for-all. The best we can do is to have all that stuff well researched and tested long before on a signet.

Let's say the burn consensus rule is that no pk(), bare multisig,  pkh()*, wpkhk() output can be spent, in addition to any tr() key path. 
To be triggered at some point far enough in the future that people can migrate, but not too late. Let's ignore for now that this will be very hard to agree on, because people will disagree on the nature and timing of the threat until it's undeniable.

In principe a PQC (Post-quantum cryptography) tap leaf scheme could be proposed in a BIP and activated in a soft-fork, without having to decide on the burn issue. Any time your wallet needs to generate a new address, it could add such a tap leaf just in case. 
But this adds a bunch of complexity to wallets, makes descriptor backups longer, etc. So adoption might be minimal. And since no sane person spends from the PQC path, we'd have no idea how much adoption there is.

More importantly, the activation of a PQC tapleaf soft fork would not be sufficient to permanently migrate coins. That's because in a free-for-all quantum scenario it's the wrong approach. The quantum attacker would just spend from your key path.

In that scenario you'd need to use a NUMS point for the key path. Or maybe that's unsafe, in which case we'd need a new Taproot version without key path support (or BIP360). That's also not a difficult soft fork, but now again you have something that only a small set of users will want to use.

This new address type is only suitable for very long term storage since it's more expensive to use in a pre-quantum world (using the a regular Schnorr signature in a script path).

So now we'd have two soft forks that ~nobody uses, because it's a bunch of extra wallet complexity and you don't know if you should use the tapleaf or the taproot-without-keypath address for your cold storage.

I doubt that soft forks which nobody intends to use will be activated anytime soon.

- Sjors

---
* 

See appendix B of BIP380 for notation: https://github.com/bitcoin/bips/blob/master/bip-0380.mediawiki#appendix-b-index-of-script-expressions

Since we don't know which public keys are reused, the pkh() underlying public key can be brute force guessed by trying all known keys. There is also no alternative spending path. So it should be included in the burn.

sh() and wsh() would not be frozen. Some scripts may be guessable from context, but imo that doesn't outweigh the possibly that someone designed a quantum proof script - even a bad one.

Neither would any scriptPubKey that's different from the above standard templates. This allows implementing the freeze rule in a way that doesn't require deep / complicated inspection of the script

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups•com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/ED96C777-5BBD-4ACE-8821-A53FDE8FA128%40sprovoost.nl.


 permalink raw reply	[|nested]
2025-03-24 11:19 ` Agustin Cruz
  
From: AstroTown @ 2025-03-22 19:02 UTC (permalink / raw)
  To: bitcoindev

[-- Attachment #1: Type: text/html, Size: 36330 bytes --]

 permalink raw reply	[|nested]
2025-03-22 19:02 AstroTown

  
From: Agustin Cruz @ 2025-03-24 11:19 UTC (permalink / raw)
  To: AstroTown;  bitcoindev

[-- Attachment #1: Type: text/plain, Size: 36319 bytes --]

I’m against letting quantum computers scoop up funds from addresses that
don’t upgrade to quantum-resistant.
Saulo’s idea of a free-market approach, leaving old coins up for grabs if
people don’t move them, sounds fair at first. Let luck decide, right? But I
worry it’d turn into a mess. If quantum machines start cracking keys and
snagging coins, it’s not just lost Satoshi-era stuff at risk. Plenty of
active wallets, like those on the rich list Jameson mentioned, could get
hit too. Imagine millions of BTC flooding the market. Prices tank, trust in
Bitcoin takes a dive, and we all feel the pain. Freezing those vulnerable
funds keeps that chaos in check.
Plus, “your keys, your coins” is Bitcoin’s heart. If quantum tech can steal
from you just because you didn’t upgrade fast enough, that promise feels
shaky. Freezing funds after a heads-up period (say, four years) protects
that idea better than letting tech giants or rogue states play vampire with
our network. It also nudges people to get their act together and move to
safer addresses, which strengthens Bitcoin long-term.
Saulo’s right that freezing coins could confuse folks or spark a split like
Ethereum Classic. But I’d argue quantum theft would look worse. Bitcoin
would seem broken, not just strict. A clear plan and enough time to migrate
could smooth things over. History’s on our side too. Bitcoin’s fixed bugs
before, like SegWit. This feels like that, not a bailout.
So yeah, I’d rather see vulnerable coins locked than handed to whoever
builds the first quantum rig. It’s less about coddling people and more
about keeping Bitcoin solid for everyone. What do you all think?
Cheers,
Agustín


On Sun, Mar 23, 2025 at 10:29 PM AstroTown <saulo@astrotown•de> wrote:

> I believe that having some entity announce the decision to freeze old
> UTXOs would be more damaging to Bitcoin’s image (and its value) than having
> them gathered by QC. This would create another version of Bitcoin, similar
> to Ethereum Classic, causing confusion in the market.
>
> It would be better to simply implement the possibility of moving funds to
> a PQC address without a deadline, allowing those who fail to do so to rely
> on luck to avoid having their coins stolen. Most coins would be migrated to
> PQC anyway, and in most cases, only the lost ones would remain vulnerable.
> This is the free-market way to solve problems without imposing rules on
> everyone.
>
> Saulo Fonseca
>
>
> On 16. Mar 2025, at 15:15, Jameson Lopp <jameson.lopp@gmail•com> wrote:
>
> The quantum computing debate is heating up. There are many controversial
> aspects to this debate, including whether or not quantum computers will
> ever actually become a practical threat.
>
> I won't tread into the unanswerable question of how worried we should be
> about quantum computers. I think it's far from a crisis, but given the
> difficulty in changing Bitcoin it's worth starting to seriously discuss.
> Today I wish to focus on a philosophical quandary related to one of the
> decisions that would need to be made if and when we implement a quantum
> safe signature scheme.
>
> Several Scenarios
> Because this essay will reference game theory a fair amount, and there are
> many variables at play that could change the nature of the game, I think
> it's important to clarify the possible scenarios up front.
>
> 1. Quantum computing never materializes, never becomes a threat, and thus
> everything discussed in this essay is moot.
> 2. A quantum computing threat materializes suddenly and Bitcoin does not
> have quantum safe signatures as part of the protocol. In this scenario it
> would likely make the points below moot because Bitcoin would be
> fundamentally broken and it would take far too long to upgrade the
> protocol, wallet software, and migrate user funds in order to restore
> confidence in the network.
> 3. Quantum computing advances slowly enough that we come to consensus
> about how to upgrade Bitcoin and post quantum security has been minimally
> adopted by the time an attacker appears.
> 4. Quantum computing advances slowly enough that we come to consensus
> about how to upgrade Bitcoin and post quantum security has been highly
> adopted by the time an attacker appears.
>
> For the purposes of this post, I'm envisioning being in situation 3 or 4.
>
> To Freeze or not to Freeze?
> I've started seeing more people weighing in on what is likely the most
> contentious aspect of how a quantum resistance upgrade should be handled in
> terms of migrating user funds. Should quantum vulnerable funds be left open
> to be swept by anyone with a sufficiently powerful quantum computer OR
> should they be permanently locked?
>
> "I don't see why old coins should be confiscated. The better option is to
>> let those with quantum computers free up old coins. While this might have
>> an inflationary impact on bitcoin's price, to use a turn of phrase, the
>> inflation is transitory. Those with low time preference should support
>> returning lost coins to circulation."
>
> - Hunter Beast
>
>
> On the other hand:
>
> "Of course they have to be confiscated. If and when (and that's a big if)
>> the existence of a cryptography-breaking QC becomes a credible threat, the
>> Bitcoin ecosystem has no other option than softforking out the ability to
>> spend from signature schemes (including ECDSA and BIP340) that are
>> vulnerable to QCs. The alternative is that millions of BTC become
>> vulnerable to theft; I cannot see how the currency can maintain any value
>> at all in such a setting. And this affects everyone; even those which
>> diligently moved their coins to PQC-protected schemes."
>> - Pieter Wuille
>
>
> I don't think "confiscation" is the most precise term to use, as the funds
> are not being seized and reassigned. Rather, what we're really discussing
> would be better described as "burning" - placing the funds *out of reach
> of everyone*.
>
> Not freezing user funds is one of Bitcoin's inviolable properties.
> However, if quantum computing becomes a threat to Bitcoin's elliptic curve
> cryptography, *an inviolable property of Bitcoin will be violated one way
> or another*.
>
> Fundamental Properties at Risk
> 5 years ago I attempted to comprehensively categorize all of Bitcoin's
> fundamental properties that give it value.
> https://nakamoto.com/what-are-the-key-properties-of-bitcoin/
>
> The particular properties in play with regard to this issue seem to be:
>
> *Censorship Resistance* - No one should have the power to prevent others
> from using their bitcoin or interacting with the network.
>
> *Forward Compatibility* - changing the rules such that certain valid
> transactions become invalid could undermine confidence in the protocol.
>
> *Conservatism* - Users should not be expected to be highly responsive to
> system issues.
>
> As a result of the above principles, we have developed a strong meme
> (kudos to Andreas Antonopoulos) that goes as follows:
>
> Not your keys, not your coins.
>
>
> I posit that the corollary to this principle is:
>
> Your keys, only your coins.
>
>
> A quantum capable entity breaks the corollary of this foundational
> principle. We secure our bitcoin with the mathematical probabilities
> related to extremely large random numbers. Your funds are only secure
> because truly random large numbers should not be guessable or discoverable
> by anyone else in the world.
>
> This is the principle behind the motto *vires in numeris* - strength in
> numbers. In a world with quantum enabled adversaries, this principle is
> null and void for many types of cryptography, including the elliptic curve
> digital signatures used in Bitcoin.
>
> Who is at Risk?
> There has long been a narrative that Satoshi's coins and others from the
> Satoshi era of P2PK locking scripts that exposed the public key directly on
> the blockchain will be those that get scooped up by a quantum "miner." But
> unfortunately it's not that simple. If I had a powerful quantum computer,
> which coins would I target? I'd go to the Bitcoin rich list and find the
> wallets that have exposed their public keys due to re-using addresses that
> have previously been spent from. You can easily find them at
> https://bitinfocharts.com/top-100-richest-bitcoin-addresses.html
>
> Note that a few of these wallets, like Bitfinex / Kraken / Tether, would
> be slightly harder to crack because they are multisig wallets. So a quantum
> attacker would need to reverse engineer 2 keys for Kraken or 3 for Bitfinex
> / Tether in order to spend funds. But many are single signature.
>
> Point being, it's not only the really old lost BTC that are at risk to a
> quantum enabled adversary, at least at time of writing. If we add a quantum
> safe signature scheme, we should expect those wallets to be some of the
> first to upgrade given their incentives.
>
> The Ethical Dilemma: Quantifying Harm
> Which decision results in the most harm?
>
> By making quantum vulnerable funds unspendable we potentially harm some
> Bitcoin users who were not paying attention and neglected to migrate their
> funds to a quantum safe locking script. This violates the "conservativism"
> principle stated earlier. On the flip side, we prevent those funds plus far
> more lost funds from falling into the hands of the few privileged folks who
> gain early access to quantum computers.
>
> By leaving quantum vulnerable funds available to spend, the same set of
> users who would otherwise have funds frozen are likely to see them stolen.
> And many early adopters who lost their keys will eventually see their
> unreachable funds scooped up by a quantum enabled adversary.
>
> Imagine, for example, being James Howells, who accidentally threw away a
> hard drive with 8,000 BTC on it, currently worth over $600M USD. He has
> spent a decade trying to retrieve it from the landfill where he knows it's
> buried, but can't get permission to excavate. I suspect that, given the
> choice, he'd prefer those funds be permanently frozen rather than fall into
> someone else's possession - I know I would.
>
> Allowing a quantum computer to access lost funds doesn't make those users
> any worse off than they were before, however it *would*have a negative
> impact upon everyone who is currently holding bitcoin.
>
> It's prudent to expect significant economic disruption if large amounts of
> coins fall into new hands. Since a quantum computer is going to have a
> massive up front cost, expect those behind it to desire to recoup their
> investment. We also know from experience that when someone suddenly finds
> themselves in possession of 9+ figures worth of highly liquid assets, they
> tend to diversify into other things by selling.
>
> Allowing quantum recovery of bitcoin is *tantamount to wealth
> redistribution*. What we'd be allowing is for bitcoin to be redistributed
> from those who are ignorant of quantum computers to those who have won the
> technological race to acquire quantum computers. It's hard to see a bright
> side to that scenario.
>
> Is Quantum Recovery Good for Anyone?
>
> Does quantum recovery HELP anyone? I've yet to come across an argument
> that it's a net positive in any way. It certainly doesn't add any security
> to the network. If anything, it greatly decreases the security of the
> network by allowing funds to be claimed by those who did not earn them.
>
> But wait, you may be thinking, wouldn't quantum "miners" have earned their
> coins by all the work and resources invested in building a quantum
> computer? I suppose, in the same sense that a burglar earns their spoils by
> the resources they invest into surveilling targets and learning the skills
> needed to break into buildings. What I say "earned" I mean through
> productive mutual trade.
>
> For example:
>
> * Investors earn BTC by trading for other currencies.
> * Merchants earn BTC by trading for goods and services.
> * Miners earn BTC by trading thermodynamic security.
> * Quantum miners don't trade anything, they are vampires feeding upon the
> system.
>
> There's no reason to believe that allowing quantum adversaries to recover
> vulnerable bitcoin will be of benefit to anyone other than the select few
> organizations that win the technological arms race to build the first such
> computers. Probably nation states and/or the top few largest tech companies.
>
> One could certainly hope that an organization with quantum supremacy is
> benevolent and acts in a "white hat" manner to return lost coins to their
> owners, but that's incredibly optimistic and foolish to rely upon. Such a
> situation creates an insurmountable ethical dilemma of only recovering lost
> bitcoin rather than currently owned bitcoin. There's no way to precisely
> differentiate between the two; anyone can claim to have lost their bitcoin
> but if they have lost their keys then proving they ever had the keys
> becomes rather difficult. I imagine that any such white hat recovery
> efforts would have to rely upon attestations from trusted third parties
> like exchanges.
>
> Even if the first actor with quantum supremacy is benevolent, we must
> assume the technology could fall into adversarial hands and thus think
> adversarially about the potential worst case outcomes. Imagine, for
> example, that North Korea continues scooping up billions of dollars from
> hacking crypto exchanges and decides to invest some of those proceeds into
> building a quantum computer for the biggest payday ever...
>
> Downsides to Allowing Quantum Recovery
> Let's think through an exhaustive list of pros and cons for allowing or
> preventing the seizure of funds by a quantum adversary.
>
> Historical Precedent
> Previous protocol vulnerabilities weren’t celebrated as "fair game" but
> rather were treated as failures to be remediated. Treating quantum theft
> differently risks rewriting Bitcoin’s history as a free-for-all rather than
> a system that seeks to protect its users.
>
> Violation of Property Rights
> Allowing a quantum adversary to take control of funds undermines the
> fundamental principle of cryptocurrency - if you keep your keys in your
> possession, only you should be able to access your money. Bitcoin is built
> on the idea that private keys secure an individual’s assets, and
> unauthorized access (even via advanced tech) is theft, not a legitimate
> transfer.
>
> Erosion of Trust in Bitcoin
> If quantum attackers can exploit vulnerable addresses, confidence in
> Bitcoin as a secure store of value would collapse. Users and investors rely
> on cryptographic integrity, and widespread theft could drive adoption away
> from Bitcoin, destabilizing its ecosystem.
>
> This is essentially the counterpoint to claiming the burning of vulnerable
> funds is a violation of property rights. While some will certainly see it
> as such, others will find the apathy toward stopping quantum theft to be
> similarly concerning.
>
> Unfair Advantage
> Quantum attackers, likely equipped with rare and expensive technology,
> would have an unjust edge over regular users who lack access to such tools.
> This creates an inequitable system where only the technologically elite can
> exploit others, contradicting Bitcoin’s ethos of decentralized power.
>
> Bitcoin is designed to create an asymmetric advantage for DEFENDING one's
> wealth. It's supposed to be impractically expensive for attackers to crack
> the entropy and cryptography protecting one's coins. But now we find
> ourselves discussing a situation where this asymmetric advantage is
> compromised in favor of a specific class of attackers.
>
> Economic Disruption
> Large-scale theft from vulnerable addresses could crash Bitcoin’s price as
> quantum recovered funds are dumped on exchanges. This would harm all
> holders, not just those directly targeted, leading to broader financial
> chaos in the markets.
>
> Moral Responsibility
> Permitting theft via quantum computing sets a precedent that technological
> superiority justifies unethical behavior. This is essentially taking a
> "code is law" stance in which we refuse to admit that both code and laws
> can be modified to adapt to previously unforeseen situations.
>
> Burning of coins can certainly be considered a form of theft, thus I think
> it's worth differentiating the two different thefts being discussed:
>
> 1. self-enriching & likely malicious
> 2. harm prevention & not necessarily malicious
>
> Both options lack the consent of the party whose coins are being burnt or
> transferred, thus I think the simple argument that theft is immoral becomes
> a wash and it's important to drill down into the details of each.
>
> Incentives Drive Security
> I can tell you from a decade of working in Bitcoin security - the average
> user is lazy and is a procrastinator. If Bitcoiners are given a "drop dead
> date" after which they know vulnerable funds will be burned, this pressure
> accelerates the adoption of post-quantum cryptography and strengthens
> Bitcoin long-term. Allowing vulnerable users to delay upgrading
> indefinitely will result in more laggards, leaving the network more exposed
> when quantum tech becomes available.
>
> Steel Manning
> Clearly this is a complex and controversial topic, thus it's worth
> thinking through the opposing arguments.
>
> Protecting Property Rights
> Allowing quantum computers to take vulnerable bitcoin could potentially be
> spun as a hard money narrative - we care so greatly about not violating
> someone's access to their coins that we allow them to be stolen!
>
> But I think the flip side to the property rights narrative is that burning
> vulnerable coins prevents said property from falling into undeserving
> hands. If the entire Bitcoin ecosystem just stands around and allows
> quantum adversaries to claim funds that rightfully belong to other users,
> is that really a "win" in the "protecting property rights" category? It
> feels more like apathy to me.
>
> As such, I think the "protecting property rights" argument is a wash.
>
> Quantum Computers Won't Attack Bitcoin
> There is a great deal of skepticism that sufficiently powerful quantum
> computers will ever exist, so we shouldn't bother preparing for a
> non-existent threat. Others have argued that even if such a computer was
> built, a quantum attacker would not go after bitcoin because they wouldn't
> want to reveal their hand by doing so, and would instead attack other
> infrastructure.
>
> It's quite difficult to quantify exactly how valuable attacking other
> infrastructure would be. It also really depends upon when an entity gains
> quantum supremacy and thus if by that time most of the world's systems have
> already been upgraded. While I think you could argue that certain entities
> gaining quantum capability might not attack Bitcoin, it would only delay
> the inevitable - eventually somebody will achieve the capability who
> decides to use it for such an attack.
>
> Quantum Attackers Would Only Steal Small Amounts
> Some have argued that even if a quantum attacker targeted bitcoin, they'd
> only go after old, likely lost P2PK outputs so as to not arouse suspicion
> and cause a market panic.
>
> I'm not so sure about that; why go after 50 BTC at a time when you could
> take 250,000 BTC with the same effort as 50 BTC? This is a classic "zero
> day exploit" game theory in which an attacker knows they have a limited
> amount of time before someone else discovers the exploit and either
> benefits from it or patches it. Take, for example, the recent ByBit attack
> - the highest value crypto hack of all time. Lazarus Group had compromised
> the Safe wallet front end JavaScript app and they could have simply had it
> reassign ownership of everyone's Safe wallets as they were interacting with
> their wallet. But instead they chose to only specifically target ByBit's
> wallet with $1.5 billion in it because they wanted to maximize their
> extractable value. If Lazarus had started stealing from every wallet, they
> would have been discovered quickly and the Safe web app would likely have
> been patched well before any billion dollar wallets executed the malicious
> code.
>
> I think the "only stealing small amounts" argument is strongest for
> Situation #2 described earlier, where a quantum attacker arrives before
> quantum safe cryptography has been deployed across the Bitcoin ecosystem.
> Because if it became clear that Bitcoin's cryptography was broken AND there
> was nowhere safe for vulnerable users to migrate, the only logical option
> would be for everyone to liquidate their bitcoin as quickly as possible. As
> such, I don't think it applies as strongly for situations in which we have
> a migration path available.
>
> The 21 Million Coin Supply Should be in Circulation
> Some folks are arguing that it's important for the "circulating /
> spendable" supply to be as close to 21M as possible and that having a
> significant portion of the supply out of circulation is somehow undesirable.
>
> While the "21M BTC" attribute is a strong memetic narrative, I don't think
> anyone has ever expected that it would all be in circulation. It has always
> been understood that many coins will be lost, and that's actually part of
> the game theory of owning bitcoin!
>
> And remember, the 21M number in and of itself is not a particularly
> important detail - it's not even mentioned in the whitepaper. What's
> important is that the supply is well known and not subject to change.
>
> Self-Sovereignty and Personal Responsibility
> Bitcoin’s design empowers individuals to control their own wealth, free
> from centralized intervention. This freedom comes with the burden of
> securing one's private keys. If quantum computing can break obsolete
> cryptography, the fault lies with users who didn't move their funds to
> quantum safe locking scripts. Expecting the network to shield users from
> their own negligence undermines the principle that you, and not a third
> party, are accountable for your assets.
>
> I think this is generally a fair point that "the community" doesn't owe
> you anything in terms of helping you. I think that we do, however, need to
> consider the incentives and game theory in play with regard to quantum safe
> Bitcoiners vs quantum vulnerable Bitcoiners. More on that later.
>
> Code is Law
> Bitcoin operates on transparent, immutable rules embedded in its protocol.
> If a quantum attacker uses superior technology to derive private keys from
> public keys, they’re not "hacking" the system - they're simply following
> what's mathematically permissible within the current code. Altering the
> protocol to stop this introduces subjective human intervention, which
> clashes with the objective, deterministic nature of blockchain.
>
> While I tend to agree that code is law, one of the entire points of laws
> is that they can be amended to improve their efficacy in reducing harm.
> Leaning on this point seems more like a pro-ossification stance that it's
> better to do nothing and allow harm to occur rather than take action to
> stop an attack that was foreseen far in advance.
>
> Technological Evolution as a Feature, Not a Bug
> It's well known that cryptography tends to weaken over time and eventually
> break. Quantum computing is just the next step in this progression. Users
> who fail to adapt (e.g., by adopting quantum-resistant wallets when
> available) are akin to those who ignored technological advancements like
> multisig or hardware wallets. Allowing quantum theft incentivizes
> innovation and keeps Bitcoin’s ecosystem dynamic, punishing complacency
> while rewarding vigilance.
>
> Market Signals Drive Security
> If quantum attackers start stealing funds, it sends a clear signal to the
> market: upgrade your security or lose everything. This pressure accelerates
> the adoption of post-quantum cryptography and strengthens Bitcoin
> long-term. Coddling vulnerable users delays this necessary evolution,
> potentially leaving the network more exposed when quantum tech becomes
> widely accessible. Theft is a brutal but effective teacher.
>
> Centralized Blacklisting Power
> Burning vulnerable funds requires centralized decision-making - a soft
> fork to invalidate certain transactions. This sets a dangerous precedent
> for future interventions, eroding Bitcoin’s decentralization. If quantum
> theft is blocked, what’s next - reversing exchange hacks? The system must
> remain neutral, even if it means some lose out.
>
> I think this could be a potential slippery slope if the proposal was to
> only burn specific addresses. Rather, I'd expect a neutral proposal to burn
> all funds in locking script types that are known to be quantum vulnerable.
> Thus, we could eliminate any subjectivity from the code.
>
> Fairness in Competition
> Quantum attackers aren't cheating; they're using publicly available
> physics and math. Anyone with the resources and foresight can build or
> access quantum tech, just as anyone could mine Bitcoin in 2009 with a CPU.
> Early adopters took risks and reaped rewards; quantum innovators are doing
> the same. Calling it “unfair” ignores that Bitcoin has never promised
> equality of outcome - only equality of opportunity within its rules.
>
> I find this argument to be a mischaracterization because we're not talking
> about CPUs. This is more akin to talking about ASICs, except each ASIC
> costs millions if not billions of dollars. This is out of reach from all
> but the wealthiest organizations.
>
> Economic Resilience
> Bitcoin has weathered thefts before (MTGOX, Bitfinex, FTX, etc) and
> emerged stronger. The market can absorb quantum losses, with unaffected
> users continuing to hold and new entrants buying in at lower prices. Fear
> of economic collapse overestimates the impact - the network’s antifragility
> thrives on such challenges.
>
> This is a big grey area because we don't know when a quantum computer will
> come online and we don't know how quickly said computers would be able to
> steal bitcoin. If, for example, the first generation of sufficiently
> powerful quantum computers were stealing less volume than the current block
> reward then of course it will have minimal economic impact. But if they're
> taking thousands of BTC per day and bringing them back into circulation,
> there will likely be a noticeable market impact as it absorbs the new
> supply.
>
> This is where the circumstances will really matter. If a quantum attacker
> appears AFTER the Bitcoin protocol has been upgraded to support quantum
> resistant cryptography then we should expect the most valuable active
> wallets will have upgraded and the juiciest target would be the 31,000 BTC
> in the address 12ib7dApVFvg82TXKycWBNpN8kFyiAN1dr which has been dormant
> since 2010. In general I'd expect that the amount of BTC re-entering the
> circulating supply would look somewhat similar to the mining emission
> curve: volume would start off very high as the most valuable addresses are
> drained and then it would fall off as quantum computers went down the list
> targeting addresses with less and less BTC.
>
> Why is economic impact a factor worth considering? Miners and businesses
> in general. More coins being liquidated will push down the price, which
> will negatively impact miner revenue. Similarly, I can attest from working
> in the industry for a decade, that lower prices result in less demand from
> businesses across the entire industry. As such, burning quantum vulnerable
> bitcoin is good for the entire industry.
>
> Practicality & Neutrality of Non-Intervention
> There’s no reliable way to distinguish “theft” from legitimate "white hat"
> key recovery. If someone loses their private key and a quantum computer
> recovers it, is that stealing or reclaiming? Policing quantum actions
> requires invasive assumptions about intent, which Bitcoin’s trustless
> design can’t accommodate. Letting the chips fall where they may avoids this
> mess.
>
> Philosophical Purity
> Bitcoin rejects bailouts. It’s a cold, hard system where outcomes reflect
> preparation and skill, not sentimentality. If quantum computing upends the
> game, that’s the point - Bitcoin isn’t meant to be safe or fair in a
> nanny-state sense; it’s meant to be free. Users who lose funds to quantum
> attacks are casualties of liberty and their own ignorance, not victims of
> injustice.
>
> Bitcoin's DAO Moment
> This situation has some similarities to The DAO hack of an Ethereum smart
> contract in 2016, which resulted in a fork to stop the attacker and return
> funds to their original owners. The game theory is similar because it's a
> situation where a threat is known but there's some period of time before
> the attacker can actually execute the theft. As such, there's time to
> mitigate the attack by changing the protocol.
>
> It also created a schism in the community around the true meaning of "code
> is law," resulting in Ethereum Classic, which decided to allow the attacker
> to retain control of the stolen funds.
>
> A soft fork to burn vulnerable bitcoin could certainly result in a hard
> fork if there are enough miners who reject the soft fork and continue
> including transactions.
>
> Incentives Matter
> We can wax philosophical until the cows come home, but what are the actual
> incentives for existing Bitcoin holders regarding this decision?
>
> "Lost coins only make everyone else's coins worth slightly more. Think of
>> it as a donation to everyone." - Satoshi Nakamoto
>
>
> If true, the corollary is:
>
> "Quantum recovered coins only make everyone else's coins worth less. Think
>> of it as a theft from everyone." - Jameson Lopp
>
>
> Thus, assuming we get to a point where quantum resistant signatures are
> supported within the Bitcoin protocol, what's the incentive to let
> vulnerable coins remain spendable?
>
> * It's not good for the actual owners of those coins. It disincentivizes
> owners from upgrading until perhaps it's too late.
> * It's not good for the more attentive / responsible owners of coins who
> have quantum secured their stash. Allowing the circulating supply to
> balloon will assuredly reduce the purchasing power of all bitcoin holders.
>
> Forking Game Theory
> From a game theory point of view, I see this as incentivizing users to
> upgrade their wallets. If you disagree with the burning of vulnerable
> coins, all you have to do is move your funds to a quantum safe signature
> scheme. Point being, I don't see there being an economic majority (or even
> more than a tiny minority) of users who would fight such a soft fork. Why
> expend significant resources fighting a fork when you can just move your
> coins to a new address?
>
> Remember that blocking spending of certain classes of locking scripts is a
> tightening of the rules - a soft fork. As such, it can be meaningfully
> enacted and enforced by a mere majority of hashpower. If miners generally
> agree that it's in their best interest to burn vulnerable coins, are other
> users going to care enough to put in the effort to run new node software
> that resists the soft fork? Seems unlikely to me.
>
> How to Execute Burning
> In order to be as objective as possible, the goal would be to announce to
> the world that after a specific block height / timestamp, Bitcoin nodes
> will no longer accept transactions (or blocks containing such transactions)
> that spend funds from any scripts other than the newly instituted quantum
> safe schemes.
>
> It could take a staggered approach to first freeze funds that are
> susceptible to long-range attacks such as those in P2PK scripts or those
> that exposed their public keys due to previously re-using addresses, but I
> expect the additional complexity would drive further controversy.
>
> How long should the grace period be in order to give the ecosystem time to
> upgrade? I'd say a minimum of 1 year for software wallets to upgrade. We
> can only hope that hardware wallet manufacturers are able to implement post
> quantum cryptography on their existing hardware with only a firmware update.
>
> Beyond that, it will take at least 6 months worth of block space for all
> users to migrate their funds, even in a best case scenario. Though if you
> exclude dust UTXOs you could probably get 95% of BTC value migrated in 1
> month. Of course this is a highly optimistic situation where everyone is
> completely focused on migrations - in reality it will take far longer.
>
> Regardless, I'd think that in order to reasonably uphold Bitcoin's
> conservatism it would be preferable to allow a 4 year migration window. In
> the meantime, mining pools could coordinate emergency soft forking logic
> such that if quantum attackers materialized, they could accelerate the
> countdown to the quantum vulnerable funds burn.
>
> Random Tangential Benefits
> On the plus side, burning all quantum vulnerable bitcoin would allow us to
> prune all of those UTXOs out of the UTXO set, which would also clean up a
> lot of dust. Dust UTXOs are a bit of an annoyance and there has even been a
> recent proposal for how to incentivize cleaning them up.
>
> We should also expect that incentivizing migration of the entire UTXO set
> will create substantial demand for block space that will sustain a fee
> market for a fairly lengthy amount of time.
>
> In Summary
> While the moral quandary of violating any of Bitcoin's inviolable
> properties can make this a very complex issue to discuss, the game theory
> and incentives between burning vulnerable coins versus allowing them to be
> claimed by entities with quantum supremacy appears to be a much simpler
> issue.
>
> I, for one, am not interested in rewarding quantum capable entities by
> inflating the circulating money supply just because some people lost their
> keys long ago and some laggards are not upgrading their bitcoin wallet's
> security.
>
> We can hope that this scenario never comes to pass, but hope is not a
> strategy.
>
> I welcome your feedback upon any of the above points, and contribution of
> any arguments I failed to consider.
>
> --
> You received this message because you are subscribed to the Google Groups
> "Bitcoin Development Mailing List" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to bitcoindev+unsubscribe@googlegroups•com.
> To view this discussion visit
> https://groups.google.com/d/msgid/bitcoindev/CADL_X_cF%3DUKVa7CitXReMq8nA_4RadCF%3D%3DkU4YG%2B0GYN97P6hQ%40mail.gmail.com
> <https://groups.google.com/d/msgid/bitcoindev/CADL_X_cF%3DUKVa7CitXReMq8nA_4RadCF%3D%3DkU4YG%2B0GYN97P6hQ%40mail.gmail.com?utm_medium=email&utm_source=footer>
> .
>
> --
> You received this message because you are subscribed to the Google Groups
> "Bitcoin Development Mailing List" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to bitcoindev+unsubscribe@googlegroups•com.
> To view this discussion visit
> https://groups.google.com/d/msgid/bitcoindev/E8269A1A-1899-46D2-A7CD-4D9D2B732364%40astrotown.de
> <https://groups.google.com/d/msgid/bitcoindev/E8269A1A-1899-46D2-A7CD-4D9D2B732364%40astrotown.de?utm_medium=email&utm_source=footer>
> .
>

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups•com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/CAJDmzYxw%2BmXQKjS%2Bh%2Br6mCoe1rwWUpa_yZDwmwx6U_eO5JhZLg%40mail.gmail.com.

[-- Attachment #2: Type: text/html, Size: 39180 bytes --]

 permalink raw reply	[|nested]
2025-03-18 12:48   ` Sjors Provoost

  2025-03-25  8:16       ` Sjors Provoost
  
From: Matt Corallo @ 2025-03-25  1:06 UTC (permalink / raw)
  To: Sjors Provoost, Bitcoin Development Mailing List;  Jameson Lopp



On 3/18/25 8:48 AM, Sjors Provoost wrote:
> 
>> Op 17 mrt 2025, om 13:00 heeft Matt Corallo <lf-lists@mattcorallo•com> het volgende geschreven:
>>
>> I think this is a strong motivation to do "simple PQC" today - while we don't need to decide on the tough question of seizing non-PQC coins today, we want to have the option to do so in the future.
>>
>> In order for that option to be practical, wallets need to be embedding PQC public keys in their outputs probably at least a decade before the seizure occurs, with any additional time giving us an important safety margin.
> 
> I don't think that in practice we can deploy a PCQ scheme without at the same time making a decision with regards to burn vs free-for-all. The best we can do is to have all that stuff well researched and tested long before on a signet.

As Jameson describes, I don't think there's a decision to be made here. If, at some point, a QC 
becomes undeniable reality (or near-term reality), *not* doing a freeze fork is to allow Bitcoin to 
simply die. The only thing we can do is set ourselves up for success such that that freeze freezes 
the minimum possible number coins.

> Let's say the burn consensus rule is that no pk(), bare multisig,  pkh()*, wpkhk() output can be spent, in addition to any tr() key path.
> To be triggered at some point far enough in the future that people can migrate, but not too late. Let's ignore for now that this will be very hard to agree on, because people will disagree on the nature and timing of the threat until it's undeniable.
> 
> In principe a PQC (Post-quantum cryptography) tap leaf scheme could be proposed in a BIP and activated in a soft-fork, without having to decide on the burn issue. Any time your wallet needs to generate a new address, it could add such a tap leaf just in case.
> But this adds a bunch of complexity to wallets, makes descriptor backups longer, etc. So adoption might be minimal. And since no sane person spends from the PQC path, we'd have no idea how much adoption there is.

Indeed, adoption is a challenge. This is true for any PQ scheme, however. Still, I'm dubious that 
simply no wallets would actually do that - there is material dramaz over PQ Bitcoin these days, and 
for (somewhat) good reason. Those selecting a wallet for short-term use of course have no need to do 
this, but those selecting a long-term storage wallet might see PQC as a feature they want, and 
select a wallet accordingly.

> More importantly, the activation of a PQC tapleaf soft fork would not be sufficient to permanently migrate coins. That's because in a free-for-all quantum scenario it's the wrong approach. The quantum attacker would just spend from your key path.

As noted above I don't buy that this is a possible outcome.

> In that scenario you'd need to use a NUMS point for the key path. Or maybe that's unsafe, in which case we'd need a new Taproot version without key path support (or BIP360). That's also not a difficult soft fork, but now again you have something that only a small set of users will want to use.

A NUMS point does not suffice unless we explicitly soft-fork out spending from that NUMS point 
(which is, of course, doable).

> This new address type is only suitable for very long term storage since it's more expensive to use in a pre-quantum world (using the a regular Schnorr signature in a script path).
> 
> So now we'd have two soft forks that ~nobody uses, because it's a bunch of extra wallet complexity and you don't know if you should use the tapleaf or the taproot-without-keypath address for your cold storage.
> 
> I doubt that soft forks which nobody intends to use will be activated anytime soon.

There is nontrivial demand (again, for (somewhat) good reason) for PQC on bitcoin today. Suggesting 
that no one intends to use such a thing I find incredibly dubious.

Matt

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups•com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/912fd35e-02f5-49b5-b373-ca02806d952f%40mattcorallo.com.


 permalink raw reply	[|nested]
2025-03-25  1:06     ` Matt Corallo

  2025-03-28 20:00         ` Matt Corallo
  
From: Sjors Provoost @ 2025-03-25  8:16 UTC (permalink / raw)
  To: Bitcoin Development Mailing List;  Matt Corallo, Jameson Lopp

Matt Corallo wrote:

>> In that scenario you'd need to use a NUMS point for the key path. Or maybe that's unsafe, in which case we'd need a new Taproot version without key path support (or BIP360). That's also not a difficult soft fork, but now again you have something that only a small set of users will want to use.
>>> 
>>> 
> A NUMS point does not suffice unless we explicitly soft-fork out spending from that NUMS point (which is, of course, doable).

This could be a solution to the sequencing conundrum that I tried to explain.

Along with the first PCQ scheme for tapscript (script path), we could have a soft that disables one or more NUMS points. The latter has zero effect under the current cryptographic assumptions, so it's not confiscatory.

That way people can start using the scheme without having to worry about whether the community decides to freeze key path spending in time. They'll still worry about the market value of their coins, but not about whether they're going to be the first victim (or the umpteenth victim while everyone is in denial and blames them for poor key management).

- Sjors

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups•com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/27A7048A-88D3-432A-AD7C-07C5EC60942D%40sprovoost.nl.


 permalink raw reply	[|nested]
2025-03-25  8:16       ` Sjors Provoost

  2025-03-30 22:23           ` Javier Mateos
  
From: Matt Corallo @ 2025-03-28 20:00 UTC (permalink / raw)
  To: Sjors Provoost, Bitcoin Development Mailing List;  Jameson Lopp



On 3/25/25 4:16 AM, Sjors Provoost wrote:
> Matt Corallo wrote:
> 
>>> In that scenario you'd need to use a NUMS point for the key path. Or maybe that's unsafe, in which case we'd need a new Taproot version without key path support (or BIP360). That's also not a difficult soft fork, but now again you have something that only a small set of users will want to use.
>>>>
>>>>
>> A NUMS point does not suffice unless we explicitly soft-fork out spending from that NUMS point (which is, of course, doable).
> 
> This could be a solution to the sequencing conundrum that I tried to explain.
> 
> Along with the first PCQ scheme for tapscript (script path), we could have a soft that disables one or more NUMS points. The latter has zero effect under the current cryptographic assumptions, so it's not confiscatory.
> 
> That way people can start using the scheme without having to worry about whether the community decides to freeze key path spending in time. They'll still worry about the market value of their coins, but not about whether they're going to be the first victim (or the umpteenth victim while everyone is in denial and blames them for poor key management).


Mmm, yea, fair enough, that seems perfectly reasonable to include.

Matt

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups•com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/1c7817fa-6451-4256-b8ce-ddca45abbf52%40mattcorallo.com.


 permalink raw reply	[|nested]
2025-03-28 20:00         ` Matt Corallo

  2025-04-04  4:49             ` 'Ben Sigman' via Bitcoin Development Mailing List
  
From: Javier Mateos @ 2025-03-30 22:23 UTC (permalink / raw)
  To: Bitcoin Development Mailing List


[-- Attachment #1.1: Type: text/plain, Size: 3499 bytes --]



Hi everyone!

Seeing the discussions about transitioning to quantum-resistant signatures, 
I notice three main concerns:

   - 
   
   What should be done with vulnerable funds? Freeze them or leave them 
   exposed?
   - 
   
   How can the transition be made without affecting Bitcoin’s stability or 
   dividing the community?
   - 
   
   How can we avoid market chaos if the transition is disorderly?
   
Personally, I believe the key is a gradual, well-planned transition based 
on incentives rather than abrupt changes that create uncertainty.

I can think of a three-phase approach:

🔹 First, allow users to add optional PQC keys to their Taproot addresses 
starting now.
🔹 Then, before the quantum threat becomes real, introduce a soft fork that 
disables vulnerable signatures, but with a long migration period (at least 
four years).
🔹 Finally, when the threat is imminent, gradually phase out old signatures 
instead of forcing a sudden change.

For this to work, adoption should be incentivized—for example, with lower 
fees for secure transactions and wallet tools that facilitate a smooth 
transition. Additionally, real-time monitoring of vulnerable addresses 
would help mitigate risks.

Another key point is to avoid panic. Instead of a sudden "D-Day" where 
everything changes at once, the deactivation of old UTXOs should be 
gradual, with clear communication so no one feels forced or disadvantaged.

In summary, this is not about imposing rules or confiscating anything, but 
about providing options for an orderly transition that doesn’t compromise 
Bitcoin’s philosophy.

-Javier Mateos

El viernes, 28 de marzo de 2025 a las 21:02:43 UTC-3, Matt Corallo escribió:

>
>
> On 3/25/25 4:16 AM, Sjors Provoost wrote:
> > Matt Corallo wrote:
> > 
> >>> In that scenario you'd need to use a NUMS point for the key path. Or 
> maybe that's unsafe, in which case we'd need a new Taproot version without 
> key path support (or BIP360). That's also not a difficult soft fork, but 
> now again you have something that only a small set of users will want to 
> use.
> >>>>
> >>>>
> >> A NUMS point does not suffice unless we explicitly soft-fork out 
> spending from that NUMS point (which is, of course, doable).
> > 
> > This could be a solution to the sequencing conundrum that I tried to 
> explain.
> > 
> > Along with the first PCQ scheme for tapscript (script path), we could 
> have a soft that disables one or more NUMS points. The latter has zero 
> effect under the current cryptographic assumptions, so it's not 
> confiscatory.
> > 
> > That way people can start using the scheme without having to worry about 
> whether the community decides to freeze key path spending in time. They'll 
> still worry about the market value of their coins, but not about whether 
> they're going to be the first victim (or the umpteenth victim while 
> everyone is in denial and blames them for poor key management).
>
>
> Mmm, yea, fair enough, that seems perfectly reasonable to include.
>
> Matt
>

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups•com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/fe4acdff-67ba-4fc6-8844-92d3bd7ca402n%40googlegroups.com.

[-- Attachment #1.2: Type: text/html, Size: 4050 bytes --]

 permalink raw reply	[|nested]
2025-03-30 22:23           ` Javier Mateos

  
From: 'Ben Sigman' via Bitcoin Development Mailing List @ 2025-04-04  4:49 UTC (permalink / raw)
  To: Bitcoin Development Mailing List


[-- Attachment #1.1: Type: text/plain, Size: 4402 bytes --]

Considering the information presented by Jameson, it's difficult to see a 
solution to the quantum attack question other than some form of freeze. 

Murch’s idea of a rolling timeout sounds elegant from one perspective, but 
also more difficult to calculate or understand for an average user. The 
quantum doomsday clock is simpler - albeit, there would be a bidding war…

That being said, the first step seems to be that Bitcoin needs a path to 
having post-quantum signatures / addresses as an option. 

I’d advocate that the developer community focus resources on implementing a 
path forward with at least some version of this - either BIP 360 or some 
form of Taproot PQC.

On Monday, March 31, 2025 at 1:41:20 PM UTC-7 Javier Mateos wrote:

> Hi everyone!
>
> Seeing the discussions about transitioning to quantum-resistant 
> signatures, I notice three main concerns:
>
>    - 
>    
>    What should be done with vulnerable funds? Freeze them or leave them 
>    exposed?
>    - 
>    
>    How can the transition be made without affecting Bitcoin’s stability 
>    or dividing the community?
>    - 
>    
>    How can we avoid market chaos if the transition is disorderly?
>    
> Personally, I believe the key is a gradual, well-planned transition based 
> on incentives rather than abrupt changes that create uncertainty.
>
> I can think of a three-phase approach:
>
> 🔹 First, allow users to add optional PQC keys to their Taproot addresses 
> starting now.
> 🔹 Then, before the quantum threat becomes real, introduce a soft fork 
> that disables vulnerable signatures, but with a long migration period (at 
> least four years).
> 🔹 Finally, when the threat is imminent, gradually phase out old 
> signatures instead of forcing a sudden change.
>
> For this to work, adoption should be incentivized—for example, with lower 
> fees for secure transactions and wallet tools that facilitate a smooth 
> transition. Additionally, real-time monitoring of vulnerable addresses 
> would help mitigate risks.
>
> Another key point is to avoid panic. Instead of a sudden "D-Day" where 
> everything changes at once, the deactivation of old UTXOs should be 
> gradual, with clear communication so no one feels forced or disadvantaged.
>
> In summary, this is not about imposing rules or confiscating anything, but 
> about providing options for an orderly transition that doesn’t compromise 
> Bitcoin’s philosophy.
>
> -Javier Mateos
>
> El viernes, 28 de marzo de 2025 a las 21:02:43 UTC-3, Matt Corallo 
> escribió:
>
>>
>>
>> On 3/25/25 4:16 AM, Sjors Provoost wrote: 
>> > Matt Corallo wrote: 
>> > 
>> >>> In that scenario you'd need to use a NUMS point for the key path. Or 
>> maybe that's unsafe, in which case we'd need a new Taproot version without 
>> key path support (or BIP360). That's also not a difficult soft fork, but 
>> now again you have something that only a small set of users will want to 
>> use. 
>> >>>> 
>> >>>> 
>> >> A NUMS point does not suffice unless we explicitly soft-fork out 
>> spending from that NUMS point (which is, of course, doable). 
>> > 
>> > This could be a solution to the sequencing conundrum that I tried to 
>> explain. 
>> > 
>> > Along with the first PCQ scheme for tapscript (script path), we could 
>> have a soft that disables one or more NUMS points. The latter has zero 
>> effect under the current cryptographic assumptions, so it's not 
>> confiscatory. 
>> > 
>> > That way people can start using the scheme without having to worry 
>> about whether the community decides to freeze key path spending in time. 
>> They'll still worry about the market value of their coins, but not about 
>> whether they're going to be the first victim (or the umpteenth victim while 
>> everyone is in denial and blames them for poor key management). 
>>
>>
>> Mmm, yea, fair enough, that seems perfectly reasonable to include. 
>>
>> Matt 
>>
>

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups•com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/50193bed-7134-4b4a-9c15-12c5dd559ad7n%40googlegroups.com.

[-- Attachment #1.2: Type: text/html, Size: 5258 bytes --]

 permalink raw reply	[|nested]
2025-03-16 14:15 [bitcoindev] Against Allowing Quantum Recovery of Bitcoin Jameson Lopp
                   ` (3 preceding siblings ...)
  2025-03-17 12:00 ` Matt Corallo

  2025-04-30 15:40   ` Michael Tidwell
  
From: Nadav Ivgi @ 2025-04-06 14:07 UTC (permalink / raw)
  To: Jameson Lopp;  Bitcoin Development Mailing List

[-- Attachment #1: Type: text/plain, Size: 35136 bytes --]

One possible alternative to freezing/burning the coins entirely is letting
quantum attackers keep some small percent as a reward, but force them to
stage the rest to future miners as an additional security budget subsidy.

This can be implemented as a soft fork, by requiring transactions spending
QC-vulnerable coins to allocate some funds to an OP_CLTV[0]-only encumbered
output timelocked far into the future. Miners would then monitor these
outputs and claim them as they become available.

For example, allow a 1% reward to be spent freely to any address but
require 99% to be sent to an OP_CLTV output timelocked to a
deterministically random height between 10-100 years from now.

The 1% reward could also be required to be sent to a script that enforces a
timelock (in addition to other conditions), to avoid flooding the markets
with the rewarded coins all at once. Probably a shorter timelock duration
though, say picked randomly between 10-30 months.

To further smooth out variance in the release schedule, coins could be
split into up-to-N-BTC outputs, each staggered with a different
deterministic timelock. So for example, a single tx spending 10,000 BTC
won't release 9,900 BTC to the miners in a single far-future block (which
may cause chain instability if the miners get into a reorg war over it),
but rather as 9,900 separate outputs of 1 BTC each released gradually
time.[1]

I'm still not sure what I think about this. This is not necessarily an
endorsement, just a thought. :)

- shesek

[0] OP_CSV only supports relative timelocks of up to 65535 blocks (~15
months), which is too short for that purpose. OP_CLTV supports longer
(absolute) timelocks.

[1] This can be made more efficient with CTV, by having a single UTXO
carrying the full amount that slowly unrolls rather than 9,900 separate
UTXO entries.


On Sun, Mar 16, 2025 at 5:22 PM Jameson Lopp <jameson.lopp@gmail•com> wrote:

> The quantum computing debate is heating up. There are many controversial
> aspects to this debate, including whether or not quantum computers will
> ever actually become a practical threat.
>
> I won't tread into the unanswerable question of how worried we should be
> about quantum computers. I think it's far from a crisis, but given the
> difficulty in changing Bitcoin it's worth starting to seriously discuss.
> Today I wish to focus on a philosophical quandary related to one of the
> decisions that would need to be made if and when we implement a quantum
> safe signature scheme.
>
> Several Scenarios
> Because this essay will reference game theory a fair amount, and there are
> many variables at play that could change the nature of the game, I think
> it's important to clarify the possible scenarios up front.
>
> 1. Quantum computing never materializes, never becomes a threat, and thus
> everything discussed in this essay is moot.
> 2. A quantum computing threat materializes suddenly and Bitcoin does not
> have quantum safe signatures as part of the protocol. In this scenario it
> would likely make the points below moot because Bitcoin would be
> fundamentally broken and it would take far too long to upgrade the
> protocol, wallet software, and migrate user funds in order to restore
> confidence in the network.
> 3. Quantum computing advances slowly enough that we come to consensus
> about how to upgrade Bitcoin and post quantum security has been minimally
> adopted by the time an attacker appears.
> 4. Quantum computing advances slowly enough that we come to consensus
> about how to upgrade Bitcoin and post quantum security has been highly
> adopted by the time an attacker appears.
>
> For the purposes of this post, I'm envisioning being in situation 3 or 4.
>
> To Freeze or not to Freeze?
> I've started seeing more people weighing in on what is likely the most
> contentious aspect of how a quantum resistance upgrade should be handled in
> terms of migrating user funds. Should quantum vulnerable funds be left open
> to be swept by anyone with a sufficiently powerful quantum computer OR
> should they be permanently locked?
>
> "I don't see why old coins should be confiscated. The better option is to
>> let those with quantum computers free up old coins. While this might have
>> an inflationary impact on bitcoin's price, to use a turn of phrase, the
>> inflation is transitory. Those with low time preference should support
>> returning lost coins to circulation."
>
> - Hunter Beast
>
>
> On the other hand:
>
> "Of course they have to be confiscated. If and when (and that's a big if)
>> the existence of a cryptography-breaking QC becomes a credible threat, the
>> Bitcoin ecosystem has no other option than softforking out the ability to
>> spend from signature schemes (including ECDSA and BIP340) that are
>> vulnerable to QCs. The alternative is that millions of BTC become
>> vulnerable to theft; I cannot see how the currency can maintain any value
>> at all in such a setting. And this affects everyone; even those which
>> diligently moved their coins to PQC-protected schemes."
>> - Pieter Wuille
>
>
> I don't think "confiscation" is the most precise term to use, as the funds
> are not being seized and reassigned. Rather, what we're really discussing
> would be better described as "burning" - placing the funds *out of reach
> of everyone*.
>
> Not freezing user funds is one of Bitcoin's inviolable properties.
> However, if quantum computing becomes a threat to Bitcoin's elliptic curve
> cryptography, *an inviolable property of Bitcoin will be violated one way
> or another*.
>
> Fundamental Properties at Risk
> 5 years ago I attempted to comprehensively categorize all of Bitcoin's
> fundamental properties that give it value.
> https://nakamoto.com/what-are-the-key-properties-of-bitcoin/
>
> The particular properties in play with regard to this issue seem to be:
>
> *Censorship Resistance* - No one should have the power to prevent others
> from using their bitcoin or interacting with the network.
>
> *Forward Compatibility* - changing the rules such that certain valid
> transactions become invalid could undermine confidence in the protocol.
>
> *Conservatism* - Users should not be expected to be highly responsive to
> system issues.
>
> As a result of the above principles, we have developed a strong meme
> (kudos to Andreas Antonopoulos) that goes as follows:
>
> Not your keys, not your coins.
>
>
> I posit that the corollary to this principle is:
>
> Your keys, only your coins.
>
>
> A quantum capable entity breaks the corollary of this foundational
> principle. We secure our bitcoin with the mathematical probabilities
> related to extremely large random numbers. Your funds are only secure
> because truly random large numbers should not be guessable or discoverable
> by anyone else in the world.
>
> This is the principle behind the motto *vires in numeris* - strength in
> numbers. In a world with quantum enabled adversaries, this principle is
> null and void for many types of cryptography, including the elliptic curve
> digital signatures used in Bitcoin.
>
> Who is at Risk?
> There has long been a narrative that Satoshi's coins and others from the
> Satoshi era of P2PK locking scripts that exposed the public key directly on
> the blockchain will be those that get scooped up by a quantum "miner." But
> unfortunately it's not that simple. If I had a powerful quantum computer,
> which coins would I target? I'd go to the Bitcoin rich list and find the
> wallets that have exposed their public keys due to re-using addresses that
> have previously been spent from. You can easily find them at
> https://bitinfocharts.com/top-100-richest-bitcoin-addresses.html
>
> Note that a few of these wallets, like Bitfinex / Kraken / Tether, would
> be slightly harder to crack because they are multisig wallets. So a quantum
> attacker would need to reverse engineer 2 keys for Kraken or 3 for Bitfinex
> / Tether in order to spend funds. But many are single signature.
>
> Point being, it's not only the really old lost BTC that are at risk to a
> quantum enabled adversary, at least at time of writing. If we add a quantum
> safe signature scheme, we should expect those wallets to be some of the
> first to upgrade given their incentives.
>
> The Ethical Dilemma: Quantifying Harm
> Which decision results in the most harm?
>
> By making quantum vulnerable funds unspendable we potentially harm some
> Bitcoin users who were not paying attention and neglected to migrate their
> funds to a quantum safe locking script. This violates the "conservativism"
> principle stated earlier. On the flip side, we prevent those funds plus far
> more lost funds from falling into the hands of the few privileged folks who
> gain early access to quantum computers.
>
> By leaving quantum vulnerable funds available to spend, the same set of
> users who would otherwise have funds frozen are likely to see them stolen.
> And many early adopters who lost their keys will eventually see their
> unreachable funds scooped up by a quantum enabled adversary.
>
> Imagine, for example, being James Howells, who accidentally threw away a
> hard drive with 8,000 BTC on it, currently worth over $600M USD. He has
> spent a decade trying to retrieve it from the landfill where he knows it's
> buried, but can't get permission to excavate. I suspect that, given the
> choice, he'd prefer those funds be permanently frozen rather than fall into
> someone else's possession - I know I would.
>
> Allowing a quantum computer to access lost funds doesn't make those users
> any worse off than they were before, however it *would* have a negative
> impact upon everyone who is currently holding bitcoin.
>
> It's prudent to expect significant economic disruption if large amounts of
> coins fall into new hands. Since a quantum computer is going to have a
> massive up front cost, expect those behind it to desire to recoup their
> investment. We also know from experience that when someone suddenly finds
> themselves in possession of 9+ figures worth of highly liquid assets, they
> tend to diversify into other things by selling.
>
> Allowing quantum recovery of bitcoin is *tantamount to wealth
> redistribution*. What we'd be allowing is for bitcoin to be redistributed
> from those who are ignorant of quantum computers to those who have won the
> technological race to acquire quantum computers. It's hard to see a bright
> side to that scenario.
>
> Is Quantum Recovery Good for Anyone?
>
> Does quantum recovery HELP anyone? I've yet to come across an argument
> that it's a net positive in any way. It certainly doesn't add any security
> to the network. If anything, it greatly decreases the security of the
> network by allowing funds to be claimed by those who did not earn them.
>
> But wait, you may be thinking, wouldn't quantum "miners" have earned their
> coins by all the work and resources invested in building a quantum
> computer? I suppose, in the same sense that a burglar earns their spoils by
> the resources they invest into surveilling targets and learning the skills
> needed to break into buildings. What I say "earned" I mean through
> productive mutual trade.
>
> For example:
>
> * Investors earn BTC by trading for other currencies.
> * Merchants earn BTC by trading for goods and services.
> * Miners earn BTC by trading thermodynamic security.
> * Quantum miners don't trade anything, they are vampires feeding upon the
> system.
>
> There's no reason to believe that allowing quantum adversaries to recover
> vulnerable bitcoin will be of benefit to anyone other than the select few
> organizations that win the technological arms race to build the first such
> computers. Probably nation states and/or the top few largest tech companies.
>
> One could certainly hope that an organization with quantum supremacy is
> benevolent and acts in a "white hat" manner to return lost coins to their
> owners, but that's incredibly optimistic and foolish to rely upon. Such a
> situation creates an insurmountable ethical dilemma of only recovering lost
> bitcoin rather than currently owned bitcoin. There's no way to precisely
> differentiate between the two; anyone can claim to have lost their bitcoin
> but if they have lost their keys then proving they ever had the keys
> becomes rather difficult. I imagine that any such white hat recovery
> efforts would have to rely upon attestations from trusted third parties
> like exchanges.
>
> Even if the first actor with quantum supremacy is benevolent, we must
> assume the technology could fall into adversarial hands and thus think
> adversarially about the potential worst case outcomes. Imagine, for
> example, that North Korea continues scooping up billions of dollars from
> hacking crypto exchanges and decides to invest some of those proceeds into
> building a quantum computer for the biggest payday ever...
>
> Downsides to Allowing Quantum Recovery
> Let's think through an exhaustive list of pros and cons for allowing or
> preventing the seizure of funds by a quantum adversary.
>
> Historical Precedent
> Previous protocol vulnerabilities weren’t celebrated as "fair game" but
> rather were treated as failures to be remediated. Treating quantum theft
> differently risks rewriting Bitcoin’s history as a free-for-all rather than
> a system that seeks to protect its users.
>
> Violation of Property Rights
> Allowing a quantum adversary to take control of funds undermines the
> fundamental principle of cryptocurrency - if you keep your keys in your
> possession, only you should be able to access your money. Bitcoin is built
> on the idea that private keys secure an individual’s assets, and
> unauthorized access (even via advanced tech) is theft, not a legitimate
> transfer.
>
> Erosion of Trust in Bitcoin
> If quantum attackers can exploit vulnerable addresses, confidence in
> Bitcoin as a secure store of value would collapse. Users and investors rely
> on cryptographic integrity, and widespread theft could drive adoption away
> from Bitcoin, destabilizing its ecosystem.
>
> This is essentially the counterpoint to claiming the burning of vulnerable
> funds is a violation of property rights. While some will certainly see it
> as such, others will find the apathy toward stopping quantum theft to be
> similarly concerning.
>
> Unfair Advantage
> Quantum attackers, likely equipped with rare and expensive technology,
> would have an unjust edge over regular users who lack access to such tools.
> This creates an inequitable system where only the technologically elite can
> exploit others, contradicting Bitcoin’s ethos of decentralized power.
>
> Bitcoin is designed to create an asymmetric advantage for DEFENDING one's
> wealth. It's supposed to be impractically expensive for attackers to crack
> the entropy and cryptography protecting one's coins. But now we find
> ourselves discussing a situation where this asymmetric advantage is
> compromised in favor of a specific class of attackers.
>
> Economic Disruption
> Large-scale theft from vulnerable addresses could crash Bitcoin’s price as
> quantum recovered funds are dumped on exchanges. This would harm all
> holders, not just those directly targeted, leading to broader financial
> chaos in the markets.
>
> Moral Responsibility
> Permitting theft via quantum computing sets a precedent that technological
> superiority justifies unethical behavior. This is essentially taking a
> "code is law" stance in which we refuse to admit that both code and laws
> can be modified to adapt to previously unforeseen situations.
>
> Burning of coins can certainly be considered a form of theft, thus I think
> it's worth differentiating the two different thefts being discussed:
>
> 1. self-enriching & likely malicious
> 2. harm prevention & not necessarily malicious
>
> Both options lack the consent of the party whose coins are being burnt or
> transferred, thus I think the simple argument that theft is immoral becomes
> a wash and it's important to drill down into the details of each.
>
> Incentives Drive Security
> I can tell you from a decade of working in Bitcoin security - the average
> user is lazy and is a procrastinator. If Bitcoiners are given a "drop dead
> date" after which they know vulnerable funds will be burned, this pressure
> accelerates the adoption of post-quantum cryptography and strengthens
> Bitcoin long-term. Allowing vulnerable users to delay upgrading
> indefinitely will result in more laggards, leaving the network more exposed
> when quantum tech becomes available.
>
> Steel Manning
> Clearly this is a complex and controversial topic, thus it's worth
> thinking through the opposing arguments.
>
> Protecting Property Rights
> Allowing quantum computers to take vulnerable bitcoin could potentially be
> spun as a hard money narrative - we care so greatly about not violating
> someone's access to their coins that we allow them to be stolen!
>
> But I think the flip side to the property rights narrative is that burning
> vulnerable coins prevents said property from falling into undeserving
> hands. If the entire Bitcoin ecosystem just stands around and allows
> quantum adversaries to claim funds that rightfully belong to other users,
> is that really a "win" in the "protecting property rights" category? It
> feels more like apathy to me.
>
> As such, I think the "protecting property rights" argument is a wash.
>
> Quantum Computers Won't Attack Bitcoin
> There is a great deal of skepticism that sufficiently powerful quantum
> computers will ever exist, so we shouldn't bother preparing for a
> non-existent threat. Others have argued that even if such a computer was
> built, a quantum attacker would not go after bitcoin because they wouldn't
> want to reveal their hand by doing so, and would instead attack other
> infrastructure.
>
> It's quite difficult to quantify exactly how valuable attacking other
> infrastructure would be. It also really depends upon when an entity gains
> quantum supremacy and thus if by that time most of the world's systems have
> already been upgraded. While I think you could argue that certain entities
> gaining quantum capability might not attack Bitcoin, it would only delay
> the inevitable - eventually somebody will achieve the capability who
> decides to use it for such an attack.
>
> Quantum Attackers Would Only Steal Small Amounts
> Some have argued that even if a quantum attacker targeted bitcoin, they'd
> only go after old, likely lost P2PK outputs so as to not arouse suspicion
> and cause a market panic.
>
> I'm not so sure about that; why go after 50 BTC at a time when you could
> take 250,000 BTC with the same effort as 50 BTC? This is a classic "zero
> day exploit" game theory in which an attacker knows they have a limited
> amount of time before someone else discovers the exploit and either
> benefits from it or patches it. Take, for example, the recent ByBit attack
> - the highest value crypto hack of all time. Lazarus Group had compromised
> the Safe wallet front end JavaScript app and they could have simply had it
> reassign ownership of everyone's Safe wallets as they were interacting with
> their wallet. But instead they chose to only specifically target ByBit's
> wallet with $1.5 billion in it because they wanted to maximize their
> extractable value. If Lazarus had started stealing from every wallet, they
> would have been discovered quickly and the Safe web app would likely have
> been patched well before any billion dollar wallets executed the malicious
> code.
>
> I think the "only stealing small amounts" argument is strongest for
> Situation #2 described earlier, where a quantum attacker arrives before
> quantum safe cryptography has been deployed across the Bitcoin ecosystem.
> Because if it became clear that Bitcoin's cryptography was broken AND there
> was nowhere safe for vulnerable users to migrate, the only logical option
> would be for everyone to liquidate their bitcoin as quickly as possible. As
> such, I don't think it applies as strongly for situations in which we have
> a migration path available.
>
> The 21 Million Coin Supply Should be in Circulation
> Some folks are arguing that it's important for the "circulating /
> spendable" supply to be as close to 21M as possible and that having a
> significant portion of the supply out of circulation is somehow undesirable.
>
> While the "21M BTC" attribute is a strong memetic narrative, I don't think
> anyone has ever expected that it would all be in circulation. It has always
> been understood that many coins will be lost, and that's actually part of
> the game theory of owning bitcoin!
>
> And remember, the 21M number in and of itself is not a particularly
> important detail - it's not even mentioned in the whitepaper. What's
> important is that the supply is well known and not subject to change.
>
> Self-Sovereignty and Personal Responsibility
> Bitcoin’s design empowers individuals to control their own wealth, free
> from centralized intervention. This freedom comes with the burden of
> securing one's private keys. If quantum computing can break obsolete
> cryptography, the fault lies with users who didn't move their funds to
> quantum safe locking scripts. Expecting the network to shield users from
> their own negligence undermines the principle that you, and not a third
> party, are accountable for your assets.
>
> I think this is generally a fair point that "the community" doesn't owe
> you anything in terms of helping you. I think that we do, however, need to
> consider the incentives and game theory in play with regard to quantum safe
> Bitcoiners vs quantum vulnerable Bitcoiners. More on that later.
>
> Code is Law
> Bitcoin operates on transparent, immutable rules embedded in its protocol.
> If a quantum attacker uses superior technology to derive private keys from
> public keys, they’re not "hacking" the system - they're simply following
> what's mathematically permissible within the current code. Altering the
> protocol to stop this introduces subjective human intervention, which
> clashes with the objective, deterministic nature of blockchain.
>
> While I tend to agree that code is law, one of the entire points of laws
> is that they can be amended to improve their efficacy in reducing harm.
> Leaning on this point seems more like a pro-ossification stance that it's
> better to do nothing and allow harm to occur rather than take action to
> stop an attack that was foreseen far in advance.
>
> Technological Evolution as a Feature, Not a Bug
> It's well known that cryptography tends to weaken over time and eventually
> break. Quantum computing is just the next step in this progression. Users
> who fail to adapt (e.g., by adopting quantum-resistant wallets when
> available) are akin to those who ignored technological advancements like
> multisig or hardware wallets. Allowing quantum theft incentivizes
> innovation and keeps Bitcoin’s ecosystem dynamic, punishing complacency
> while rewarding vigilance.
>
> Market Signals Drive Security
> If quantum attackers start stealing funds, it sends a clear signal to the
> market: upgrade your security or lose everything. This pressure accelerates
> the adoption of post-quantum cryptography and strengthens Bitcoin
> long-term. Coddling vulnerable users delays this necessary evolution,
> potentially leaving the network more exposed when quantum tech becomes
> widely accessible. Theft is a brutal but effective teacher.
>
> Centralized Blacklisting Power
> Burning vulnerable funds requires centralized decision-making - a soft
> fork to invalidate certain transactions. This sets a dangerous precedent
> for future interventions, eroding Bitcoin’s decentralization. If quantum
> theft is blocked, what’s next - reversing exchange hacks? The system must
> remain neutral, even if it means some lose out.
>
> I think this could be a potential slippery slope if the proposal was to
> only burn specific addresses. Rather, I'd expect a neutral proposal to burn
> all funds in locking script types that are known to be quantum vulnerable.
> Thus, we could eliminate any subjectivity from the code.
>
> Fairness in Competition
> Quantum attackers aren't cheating; they're using publicly available
> physics and math. Anyone with the resources and foresight can build or
> access quantum tech, just as anyone could mine Bitcoin in 2009 with a CPU.
> Early adopters took risks and reaped rewards; quantum innovators are doing
> the same. Calling it “unfair” ignores that Bitcoin has never promised
> equality of outcome - only equality of opportunity within its rules.
>
> I find this argument to be a mischaracterization because we're not talking
> about CPUs. This is more akin to talking about ASICs, except each ASIC
> costs millions if not billions of dollars. This is out of reach from all
> but the wealthiest organizations.
>
> Economic Resilience
> Bitcoin has weathered thefts before (MTGOX, Bitfinex, FTX, etc) and
> emerged stronger. The market can absorb quantum losses, with unaffected
> users continuing to hold and new entrants buying in at lower prices. Fear
> of economic collapse overestimates the impact - the network’s antifragility
> thrives on such challenges.
>
> This is a big grey area because we don't know when a quantum computer will
> come online and we don't know how quickly said computers would be able to
> steal bitcoin. If, for example, the first generation of sufficiently
> powerful quantum computers were stealing less volume than the current block
> reward then of course it will have minimal economic impact. But if they're
> taking thousands of BTC per day and bringing them back into circulation,
> there will likely be a noticeable market impact as it absorbs the new
> supply.
>
> This is where the circumstances will really matter. If a quantum attacker
> appears AFTER the Bitcoin protocol has been upgraded to support quantum
> resistant cryptography then we should expect the most valuable active
> wallets will have upgraded and the juiciest target would be the 31,000 BTC
> in the address 12ib7dApVFvg82TXKycWBNpN8kFyiAN1dr which has been dormant
> since 2010. In general I'd expect that the amount of BTC re-entering the
> circulating supply would look somewhat similar to the mining emission
> curve: volume would start off very high as the most valuable addresses are
> drained and then it would fall off as quantum computers went down the list
> targeting addresses with less and less BTC.
>
> Why is economic impact a factor worth considering? Miners and businesses
> in general. More coins being liquidated will push down the price, which
> will negatively impact miner revenue. Similarly, I can attest from working
> in the industry for a decade, that lower prices result in less demand from
> businesses across the entire industry. As such, burning quantum vulnerable
> bitcoin is good for the entire industry.
>
> Practicality & Neutrality of Non-Intervention
> There’s no reliable way to distinguish “theft” from legitimate "white hat"
> key recovery. If someone loses their private key and a quantum computer
> recovers it, is that stealing or reclaiming? Policing quantum actions
> requires invasive assumptions about intent, which Bitcoin’s trustless
> design can’t accommodate. Letting the chips fall where they may avoids this
> mess.
>
> Philosophical Purity
> Bitcoin rejects bailouts. It’s a cold, hard system where outcomes reflect
> preparation and skill, not sentimentality. If quantum computing upends the
> game, that’s the point - Bitcoin isn’t meant to be safe or fair in a
> nanny-state sense; it’s meant to be free. Users who lose funds to quantum
> attacks are casualties of liberty and their own ignorance, not victims of
> injustice.
>
> Bitcoin's DAO Moment
> This situation has some similarities to The DAO hack of an Ethereum smart
> contract in 2016, which resulted in a fork to stop the attacker and return
> funds to their original owners. The game theory is similar because it's a
> situation where a threat is known but there's some period of time before
> the attacker can actually execute the theft. As such, there's time to
> mitigate the attack by changing the protocol.
>
> It also created a schism in the community around the true meaning of "code
> is law," resulting in Ethereum Classic, which decided to allow the attacker
> to retain control of the stolen funds.
>
> A soft fork to burn vulnerable bitcoin could certainly result in a hard
> fork if there are enough miners who reject the soft fork and continue
> including transactions.
>
> Incentives Matter
> We can wax philosophical until the cows come home, but what are the actual
> incentives for existing Bitcoin holders regarding this decision?
>
> "Lost coins only make everyone else's coins worth slightly more. Think of
>> it as a donation to everyone." - Satoshi Nakamoto
>
>
> If true, the corollary is:
>
> "Quantum recovered coins only make everyone else's coins worth less. Think
>> of it as a theft from everyone." - Jameson Lopp
>
>
> Thus, assuming we get to a point where quantum resistant signatures are
> supported within the Bitcoin protocol, what's the incentive to let
> vulnerable coins remain spendable?
>
> * It's not good for the actual owners of those coins. It disincentivizes
> owners from upgrading until perhaps it's too late.
> * It's not good for the more attentive / responsible owners of coins who
> have quantum secured their stash. Allowing the circulating supply to
> balloon will assuredly reduce the purchasing power of all bitcoin holders.
>
> Forking Game Theory
> From a game theory point of view, I see this as incentivizing users to
> upgrade their wallets. If you disagree with the burning of vulnerable
> coins, all you have to do is move your funds to a quantum safe signature
> scheme. Point being, I don't see there being an economic majority (or even
> more than a tiny minority) of users who would fight such a soft fork. Why
> expend significant resources fighting a fork when you can just move your
> coins to a new address?
>
> Remember that blocking spending of certain classes of locking scripts is a
> tightening of the rules - a soft fork. As such, it can be meaningfully
> enacted and enforced by a mere majority of hashpower. If miners generally
> agree that it's in their best interest to burn vulnerable coins, are other
> users going to care enough to put in the effort to run new node software
> that resists the soft fork? Seems unlikely to me.
>
> How to Execute Burning
> In order to be as objective as possible, the goal would be to announce to
> the world that after a specific block height / timestamp, Bitcoin nodes
> will no longer accept transactions (or blocks containing such transactions)
> that spend funds from any scripts other than the newly instituted quantum
> safe schemes.
>
> It could take a staggered approach to first freeze funds that are
> susceptible to long-range attacks such as those in P2PK scripts or those
> that exposed their public keys due to previously re-using addresses, but I
> expect the additional complexity would drive further controversy.
>
> How long should the grace period be in order to give the ecosystem time to
> upgrade? I'd say a minimum of 1 year for software wallets to upgrade. We
> can only hope that hardware wallet manufacturers are able to implement post
> quantum cryptography on their existing hardware with only a firmware update.
>
> Beyond that, it will take at least 6 months worth of block space for all
> users to migrate their funds, even in a best case scenario. Though if you
> exclude dust UTXOs you could probably get 95% of BTC value migrated in 1
> month. Of course this is a highly optimistic situation where everyone is
> completely focused on migrations - in reality it will take far longer.
>
> Regardless, I'd think that in order to reasonably uphold Bitcoin's
> conservatism it would be preferable to allow a 4 year migration window. In
> the meantime, mining pools could coordinate emergency soft forking logic
> such that if quantum attackers materialized, they could accelerate the
> countdown to the quantum vulnerable funds burn.
>
> Random Tangential Benefits
> On the plus side, burning all quantum vulnerable bitcoin would allow us to
> prune all of those UTXOs out of the UTXO set, which would also clean up a
> lot of dust. Dust UTXOs are a bit of an annoyance and there has even been a
> recent proposal for how to incentivize cleaning them up.
>
> We should also expect that incentivizing migration of the entire UTXO set
> will create substantial demand for block space that will sustain a fee
> market for a fairly lengthy amount of time.
>
> In Summary
> While the moral quandary of violating any of Bitcoin's inviolable
> properties can make this a very complex issue to discuss, the game theory
> and incentives between burning vulnerable coins versus allowing them to be
> claimed by entities with quantum supremacy appears to be a much simpler
> issue.
>
> I, for one, am not interested in rewarding quantum capable entities by
> inflating the circulating money supply just because some people lost their
> keys long ago and some laggards are not upgrading their bitcoin wallet's
> security.
>
> We can hope that this scenario never comes to pass, but hope is not a
> strategy.
>
> I welcome your feedback upon any of the above points, and contribution of
> any arguments I failed to consider.
>
> --
> You received this message because you are subscribed to the Google Groups
> "Bitcoin Development Mailing List" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to bitcoindev+unsubscribe@googlegroups•com.
> To view this discussion visit
> https://groups.google.com/d/msgid/bitcoindev/CADL_X_cF%3DUKVa7CitXReMq8nA_4RadCF%3D%3DkU4YG%2B0GYN97P6hQ%40mail.gmail.com
> <https://groups.google.com/d/msgid/bitcoindev/CADL_X_cF%3DUKVa7CitXReMq8nA_4RadCF%3D%3DkU4YG%2B0GYN97P6hQ%40mail.gmail.com?utm_medium=email&utm_source=footer>
> .
>

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups•com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/CAGXD5f1eTwqMAkxzdJOup3syR%2B5UjrkAaHroBJT0HQw5FA2_YQ%40mail.gmail.com.

[-- Attachment #2: Type: text/html, Size: 37637 bytes --]

 permalink raw reply	[|nested]
2025-04-06 14:07 ` Nadav Ivgi

  
From: Michael Tidwell @ 2025-04-30 15:40 UTC (permalink / raw)
  To: Bitcoin Development Mailing List


[-- Attachment #1.1: Type: text/plain, Size: 37995 bytes --]

I'm late, but want to share thoughts. I gathered from this thread the way 
more pertinent and prerequisite idea is to formulate some idea for pqc safe 
schemes, before the idea of burning/freezing/other becomes actionable.
Originally I thought Matt's idea of a secure leaf that could be enabled to 
be the only spend path seemed clever, but after thinking about it more, I 
think it would be better to cleanly have a new address/ taproot version. 

1. We get public data to know how many coins are using the post-quantum 
secured scheme. Allow better informed decisions on adoptions, planning, and 
understanding sentiment on the perceived threat.
2. would have clean separation for users to know whether or not their 
address is PQC secured.
3. for people not worried about it, they wouldn't feel arm-bar'd into 
having longer descriptors and an unnecessary leaf.
4. *unsure here*, but possible that library and wallet developers could 
treat this with cleaner separation uX, UI and not worry about (legacy-tr) 
vs (pqc-tr) descriptions and script code. (To help users differentiate)
5. We wouldn't need to worry about some roll out period or flag day where 
the leafs become necessary or an enabled spend path.

Given that pqc transactions will likely require additional space and 
computational resources, we should be cautious about heavily incentivizing 
uncertain approaches (i.e. it may be advantageous to decide on something 
before having certainty about the optimal approach). Significant fee 
discounts may be needed once there's high confidence on the 
approach/method. However, enhanced security itself inherently serves as 
part of the explicit incentive, and maybe should be part of the incentive 
calculation.

On Monday, April 7, 2025 at 6:34:54 AM UTC-4 Nadav Ivgi wrote:

> One possible alternative to freezing/burning the coins entirely is letting 
> quantum attackers keep some small percent as a reward, but force them to 
> stage the rest to future miners as an additional security budget subsidy.
>
> This can be implemented as a soft fork, by requiring transactions spending 
> QC-vulnerable coins to allocate some funds to an OP_CLTV[0]-only encumbered 
> output timelocked far into the future. Miners would then monitor these 
> outputs and claim them as they become available.
>
> For example, allow a 1% reward to be spent freely to any address but 
> require 99% to be sent to an OP_CLTV output timelocked to a 
> deterministically random height between 10-100 years from now.
>
> The 1% reward could also be required to be sent to a script that enforces 
> a timelock (in addition to other conditions), to avoid flooding the markets 
> with the rewarded coins all at once. Probably a shorter timelock duration 
> though, say picked randomly between 10-30 months.
>
> To further smooth out variance in the release schedule, coins could be 
> split into up-to-N-BTC outputs, each staggered with a different 
> deterministic timelock. So for example, a single tx spending 10,000 BTC 
> won't release 9,900 BTC to the miners in a single far-future block (which 
> may cause chain instability if the miners get into a reorg war over it), 
> but rather as 9,900 separate outputs of 1 BTC each released gradually 
> time.[1]
>
> I'm still not sure what I think about this. This is not necessarily an 
> endorsement, just a thought. :)
>
> - shesek
>
> [0] OP_CSV only supports relative timelocks of up to 65535 blocks (~15 
> months), which is too short for that purpose. OP_CLTV supports longer 
> (absolute) timelocks.
>
> [1] This can be made more efficient with CTV, by having a single UTXO 
> carrying the full amount that slowly unrolls rather than 9,900 separate 
> UTXO entries.
>
>
> On Sun, Mar 16, 2025 at 5:22 PM Jameson Lopp <jameso...@gmail•com> wrote:
>
>> The quantum computing debate is heating up. There are many controversial 
>> aspects to this debate, including whether or not quantum computers will 
>> ever actually become a practical threat.
>>
>> I won't tread into the unanswerable question of how worried we should be 
>> about quantum computers. I think it's far from a crisis, but given the 
>> difficulty in changing Bitcoin it's worth starting to seriously discuss. 
>> Today I wish to focus on a philosophical quandary related to one of the 
>> decisions that would need to be made if and when we implement a quantum 
>> safe signature scheme.
>>
>> Several Scenarios
>> Because this essay will reference game theory a fair amount, and there 
>> are many variables at play that could change the nature of the game, I 
>> think it's important to clarify the possible scenarios up front.
>>
>> 1. Quantum computing never materializes, never becomes a threat, and thus 
>> everything discussed in this essay is moot.
>> 2. A quantum computing threat materializes suddenly and Bitcoin does not 
>> have quantum safe signatures as part of the protocol. In this scenario it 
>> would likely make the points below moot because Bitcoin would be 
>> fundamentally broken and it would take far too long to upgrade the 
>> protocol, wallet software, and migrate user funds in order to restore 
>> confidence in the network.
>> 3. Quantum computing advances slowly enough that we come to consensus 
>> about how to upgrade Bitcoin and post quantum security has been minimally 
>> adopted by the time an attacker appears.
>> 4. Quantum computing advances slowly enough that we come to consensus 
>> about how to upgrade Bitcoin and post quantum security has been highly 
>> adopted by the time an attacker appears.
>>
>> For the purposes of this post, I'm envisioning being in situation 3 or 4.
>>
>> To Freeze or not to Freeze?
>> I've started seeing more people weighing in on what is likely the most 
>> contentious aspect of how a quantum resistance upgrade should be handled in 
>> terms of migrating user funds. Should quantum vulnerable funds be left open 
>> to be swept by anyone with a sufficiently powerful quantum computer OR 
>> should they be permanently locked?
>>
>> "I don't see why old coins should be confiscated. The better option is to 
>>> let those with quantum computers free up old coins. While this might have 
>>> an inflationary impact on bitcoin's price, to use a turn of phrase, the 
>>> inflation is transitory. Those with low time preference should support 
>>> returning lost coins to circulation." 
>>
>> - Hunter Beast
>>
>>
>> On the other hand:
>>
>> "Of course they have to be confiscated. If and when (and that's a big if) 
>>> the existence of a cryptography-breaking QC becomes a credible threat, the 
>>> Bitcoin ecosystem has no other option than softforking out the ability to 
>>> spend from signature schemes (including ECDSA and BIP340) that are 
>>> vulnerable to QCs. The alternative is that millions of BTC become 
>>> vulnerable to theft; I cannot see how the currency can maintain any value 
>>> at all in such a setting. And this affects everyone; even those which 
>>> diligently moved their coins to PQC-protected schemes."
>>> - Pieter Wuille
>>
>>
>> I don't think "confiscation" is the most precise term to use, as the 
>> funds are not being seized and reassigned. Rather, what we're really 
>> discussing would be better described as "burning" - placing the funds *out 
>> of reach of everyone*.
>>
>> Not freezing user funds is one of Bitcoin's inviolable properties. 
>> However, if quantum computing becomes a threat to Bitcoin's elliptic curve 
>> cryptography, *an inviolable property of Bitcoin will be violated one 
>> way or another*.
>>
>> Fundamental Properties at Risk
>> 5 years ago I attempted to comprehensively categorize all of Bitcoin's 
>> fundamental properties that give it value. 
>> https://nakamoto.com/what-are-the-key-properties-of-bitcoin/
>>
>> The particular properties in play with regard to this issue seem to be:
>>
>> *Censorship Resistance* - No one should have the power to prevent others 
>> from using their bitcoin or interacting with the network.
>>
>> *Forward Compatibility* - changing the rules such that certain valid 
>> transactions become invalid could undermine confidence in the protocol.
>>
>> *Conservatism* - Users should not be expected to be highly responsive to 
>> system issues.
>>
>> As a result of the above principles, we have developed a strong meme 
>> (kudos to Andreas Antonopoulos) that goes as follows:
>>
>> Not your keys, not your coins.
>>
>>
>> I posit that the corollary to this principle is:
>>
>> Your keys, only your coins.
>>
>>
>> A quantum capable entity breaks the corollary of this foundational 
>> principle. We secure our bitcoin with the mathematical probabilities 
>> related to extremely large random numbers. Your funds are only secure 
>> because truly random large numbers should not be guessable or discoverable 
>> by anyone else in the world.
>>
>> This is the principle behind the motto *vires in numeris* - strength in 
>> numbers. In a world with quantum enabled adversaries, this principle is 
>> null and void for many types of cryptography, including the elliptic curve 
>> digital signatures used in Bitcoin.
>>
>> Who is at Risk?
>> There has long been a narrative that Satoshi's coins and others from the 
>> Satoshi era of P2PK locking scripts that exposed the public key directly on 
>> the blockchain will be those that get scooped up by a quantum "miner." But 
>> unfortunately it's not that simple. If I had a powerful quantum computer, 
>> which coins would I target? I'd go to the Bitcoin rich list and find the 
>> wallets that have exposed their public keys due to re-using addresses that 
>> have previously been spent from. You can easily find them at 
>> https://bitinfocharts.com/top-100-richest-bitcoin-addresses.html
>>
>> Note that a few of these wallets, like Bitfinex / Kraken / Tether, would 
>> be slightly harder to crack because they are multisig wallets. So a quantum 
>> attacker would need to reverse engineer 2 keys for Kraken or 3 for Bitfinex 
>> / Tether in order to spend funds. But many are single signature.
>>
>> Point being, it's not only the really old lost BTC that are at risk to a 
>> quantum enabled adversary, at least at time of writing. If we add a quantum 
>> safe signature scheme, we should expect those wallets to be some of the 
>> first to upgrade given their incentives.
>>
>> The Ethical Dilemma: Quantifying Harm
>> Which decision results in the most harm?
>>
>> By making quantum vulnerable funds unspendable we potentially harm some 
>> Bitcoin users who were not paying attention and neglected to migrate their 
>> funds to a quantum safe locking script. This violates the "conservativism" 
>> principle stated earlier. On the flip side, we prevent those funds plus far 
>> more lost funds from falling into the hands of the few privileged folks who 
>> gain early access to quantum computers.
>>
>> By leaving quantum vulnerable funds available to spend, the same set of 
>> users who would otherwise have funds frozen are likely to see them stolen. 
>> And many early adopters who lost their keys will eventually see their 
>> unreachable funds scooped up by a quantum enabled adversary.
>>
>> Imagine, for example, being James Howells, who accidentally threw away a 
>> hard drive with 8,000 BTC on it, currently worth over $600M USD. He has 
>> spent a decade trying to retrieve it from the landfill where he knows it's 
>> buried, but can't get permission to excavate. I suspect that, given the 
>> choice, he'd prefer those funds be permanently frozen rather than fall into 
>> someone else's possession - I know I would.
>>
>> Allowing a quantum computer to access lost funds doesn't make those users 
>> any worse off than they were before, however it *would* have a negative 
>> impact upon everyone who is currently holding bitcoin.
>>
>> It's prudent to expect significant economic disruption if large amounts 
>> of coins fall into new hands. Since a quantum computer is going to have a 
>> massive up front cost, expect those behind it to desire to recoup their 
>> investment. We also know from experience that when someone suddenly finds 
>> themselves in possession of 9+ figures worth of highly liquid assets, they 
>> tend to diversify into other things by selling.
>>
>> Allowing quantum recovery of bitcoin is *tantamount to wealth 
>> redistribution*. What we'd be allowing is for bitcoin to be 
>> redistributed from those who are ignorant of quantum computers to those who 
>> have won the technological race to acquire quantum computers. It's hard to 
>> see a bright side to that scenario.
>>
>> Is Quantum Recovery Good for Anyone?
>>
>> Does quantum recovery HELP anyone? I've yet to come across an argument 
>> that it's a net positive in any way. It certainly doesn't add any security 
>> to the network. If anything, it greatly decreases the security of the 
>> network by allowing funds to be claimed by those who did not earn them.
>>
>> But wait, you may be thinking, wouldn't quantum "miners" have earned 
>> their coins by all the work and resources invested in building a quantum 
>> computer? I suppose, in the same sense that a burglar earns their spoils by 
>> the resources they invest into surveilling targets and learning the skills 
>> needed to break into buildings. What I say "earned" I mean through 
>> productive mutual trade.
>>
>> For example:
>>
>> * Investors earn BTC by trading for other currencies.
>> * Merchants earn BTC by trading for goods and services.
>> * Miners earn BTC by trading thermodynamic security.
>> * Quantum miners don't trade anything, they are vampires feeding upon the 
>> system.
>>
>> There's no reason to believe that allowing quantum adversaries to recover 
>> vulnerable bitcoin will be of benefit to anyone other than the select few 
>> organizations that win the technological arms race to build the first such 
>> computers. Probably nation states and/or the top few largest tech companies.
>>
>> One could certainly hope that an organization with quantum supremacy is 
>> benevolent and acts in a "white hat" manner to return lost coins to their 
>> owners, but that's incredibly optimistic and foolish to rely upon. Such a 
>> situation creates an insurmountable ethical dilemma of only recovering lost 
>> bitcoin rather than currently owned bitcoin. There's no way to precisely 
>> differentiate between the two; anyone can claim to have lost their bitcoin 
>> but if they have lost their keys then proving they ever had the keys 
>> becomes rather difficult. I imagine that any such white hat recovery 
>> efforts would have to rely upon attestations from trusted third parties 
>> like exchanges.
>>
>> Even if the first actor with quantum supremacy is benevolent, we must 
>> assume the technology could fall into adversarial hands and thus think 
>> adversarially about the potential worst case outcomes. Imagine, for 
>> example, that North Korea continues scooping up billions of dollars from 
>> hacking crypto exchanges and decides to invest some of those proceeds into 
>> building a quantum computer for the biggest payday ever...
>>
>> Downsides to Allowing Quantum Recovery
>> Let's think through an exhaustive list of pros and cons for allowing or 
>> preventing the seizure of funds by a quantum adversary.
>>
>> Historical Precedent
>> Previous protocol vulnerabilities weren’t celebrated as "fair game" but 
>> rather were treated as failures to be remediated. Treating quantum theft 
>> differently risks rewriting Bitcoin’s history as a free-for-all rather than 
>> a system that seeks to protect its users.
>>
>> Violation of Property Rights
>> Allowing a quantum adversary to take control of funds undermines the 
>> fundamental principle of cryptocurrency - if you keep your keys in your 
>> possession, only you should be able to access your money. Bitcoin is built 
>> on the idea that private keys secure an individual’s assets, and 
>> unauthorized access (even via advanced tech) is theft, not a legitimate 
>> transfer.
>>
>> Erosion of Trust in Bitcoin
>> If quantum attackers can exploit vulnerable addresses, confidence in 
>> Bitcoin as a secure store of value would collapse. Users and investors rely 
>> on cryptographic integrity, and widespread theft could drive adoption away 
>> from Bitcoin, destabilizing its ecosystem.
>>
>> This is essentially the counterpoint to claiming the burning of 
>> vulnerable funds is a violation of property rights. While some will 
>> certainly see it as such, others will find the apathy toward stopping 
>> quantum theft to be similarly concerning.
>>
>> Unfair Advantage
>> Quantum attackers, likely equipped with rare and expensive technology, 
>> would have an unjust edge over regular users who lack access to such tools. 
>> This creates an inequitable system where only the technologically elite can 
>> exploit others, contradicting Bitcoin’s ethos of decentralized power.
>>
>> Bitcoin is designed to create an asymmetric advantage for DEFENDING one's 
>> wealth. It's supposed to be impractically expensive for attackers to crack 
>> the entropy and cryptography protecting one's coins. But now we find 
>> ourselves discussing a situation where this asymmetric advantage is 
>> compromised in favor of a specific class of attackers.
>>
>> Economic Disruption
>> Large-scale theft from vulnerable addresses could crash Bitcoin’s price 
>> as quantum recovered funds are dumped on exchanges. This would harm all 
>> holders, not just those directly targeted, leading to broader financial 
>> chaos in the markets.
>>
>> Moral Responsibility
>> Permitting theft via quantum computing sets a precedent that 
>> technological superiority justifies unethical behavior. This is essentially 
>> taking a "code is law" stance in which we refuse to admit that both code 
>> and laws can be modified to adapt to previously unforeseen situations.
>>
>> Burning of coins can certainly be considered a form of theft, thus I 
>> think it's worth differentiating the two different thefts being discussed:
>>
>> 1. self-enriching & likely malicious
>> 2. harm prevention & not necessarily malicious
>>
>> Both options lack the consent of the party whose coins are being burnt or 
>> transferred, thus I think the simple argument that theft is immoral becomes 
>> a wash and it's important to drill down into the details of each.
>>
>> Incentives Drive Security
>> I can tell you from a decade of working in Bitcoin security - the average 
>> user is lazy and is a procrastinator. If Bitcoiners are given a "drop dead 
>> date" after which they know vulnerable funds will be burned, this pressure 
>> accelerates the adoption of post-quantum cryptography and strengthens 
>> Bitcoin long-term. Allowing vulnerable users to delay upgrading 
>> indefinitely will result in more laggards, leaving the network more exposed 
>> when quantum tech becomes available.
>>
>> Steel Manning
>> Clearly this is a complex and controversial topic, thus it's worth 
>> thinking through the opposing arguments.
>>
>> Protecting Property Rights
>> Allowing quantum computers to take vulnerable bitcoin could potentially 
>> be spun as a hard money narrative - we care so greatly about not violating 
>> someone's access to their coins that we allow them to be stolen!
>>
>> But I think the flip side to the property rights narrative is that 
>> burning vulnerable coins prevents said property from falling into 
>> undeserving hands. If the entire Bitcoin ecosystem just stands around and 
>> allows quantum adversaries to claim funds that rightfully belong to other 
>> users, is that really a "win" in the "protecting property rights" category? 
>> It feels more like apathy to me.
>>
>> As such, I think the "protecting property rights" argument is a wash.
>>
>> Quantum Computers Won't Attack Bitcoin
>> There is a great deal of skepticism that sufficiently powerful quantum 
>> computers will ever exist, so we shouldn't bother preparing for a 
>> non-existent threat. Others have argued that even if such a computer was 
>> built, a quantum attacker would not go after bitcoin because they wouldn't 
>> want to reveal their hand by doing so, and would instead attack other 
>> infrastructure.
>>
>> It's quite difficult to quantify exactly how valuable attacking other 
>> infrastructure would be. It also really depends upon when an entity gains 
>> quantum supremacy and thus if by that time most of the world's systems have 
>> already been upgraded. While I think you could argue that certain entities 
>> gaining quantum capability might not attack Bitcoin, it would only delay 
>> the inevitable - eventually somebody will achieve the capability who 
>> decides to use it for such an attack.
>>
>> Quantum Attackers Would Only Steal Small Amounts
>> Some have argued that even if a quantum attacker targeted bitcoin, they'd 
>> only go after old, likely lost P2PK outputs so as to not arouse suspicion 
>> and cause a market panic.
>>
>> I'm not so sure about that; why go after 50 BTC at a time when you could 
>> take 250,000 BTC with the same effort as 50 BTC? This is a classic "zero 
>> day exploit" game theory in which an attacker knows they have a limited 
>> amount of time before someone else discovers the exploit and either 
>> benefits from it or patches it. Take, for example, the recent ByBit attack 
>> - the highest value crypto hack of all time. Lazarus Group had compromised 
>> the Safe wallet front end JavaScript app and they could have simply had it 
>> reassign ownership of everyone's Safe wallets as they were interacting with 
>> their wallet. But instead they chose to only specifically target ByBit's 
>> wallet with $1.5 billion in it because they wanted to maximize their 
>> extractable value. If Lazarus had started stealing from every wallet, they 
>> would have been discovered quickly and the Safe web app would likely have 
>> been patched well before any billion dollar wallets executed the malicious 
>> code.
>>
>> I think the "only stealing small amounts" argument is strongest for 
>> Situation #2 described earlier, where a quantum attacker arrives before 
>> quantum safe cryptography has been deployed across the Bitcoin ecosystem. 
>> Because if it became clear that Bitcoin's cryptography was broken AND there 
>> was nowhere safe for vulnerable users to migrate, the only logical option 
>> would be for everyone to liquidate their bitcoin as quickly as possible. As 
>> such, I don't think it applies as strongly for situations in which we have 
>> a migration path available.
>>
>> The 21 Million Coin Supply Should be in Circulation
>> Some folks are arguing that it's important for the "circulating / 
>> spendable" supply to be as close to 21M as possible and that having a 
>> significant portion of the supply out of circulation is somehow undesirable.
>>
>> While the "21M BTC" attribute is a strong memetic narrative, I don't 
>> think anyone has ever expected that it would all be in circulation. It has 
>> always been understood that many coins will be lost, and that's actually 
>> part of the game theory of owning bitcoin!
>>
>> And remember, the 21M number in and of itself is not a particularly 
>> important detail - it's not even mentioned in the whitepaper. What's 
>> important is that the supply is well known and not subject to change.
>>
>> Self-Sovereignty and Personal Responsibility
>> Bitcoin’s design empowers individuals to control their own wealth, free 
>> from centralized intervention. This freedom comes with the burden of 
>> securing one's private keys. If quantum computing can break obsolete 
>> cryptography, the fault lies with users who didn't move their funds to 
>> quantum safe locking scripts. Expecting the network to shield users from 
>> their own negligence undermines the principle that you, and not a third 
>> party, are accountable for your assets.
>>
>> I think this is generally a fair point that "the community" doesn't owe 
>> you anything in terms of helping you. I think that we do, however, need to 
>> consider the incentives and game theory in play with regard to quantum safe 
>> Bitcoiners vs quantum vulnerable Bitcoiners. More on that later.
>>
>> Code is Law
>> Bitcoin operates on transparent, immutable rules embedded in its 
>> protocol. If a quantum attacker uses superior technology to derive private 
>> keys from public keys, they’re not "hacking" the system - they're simply 
>> following what's mathematically permissible within the current code. 
>> Altering the protocol to stop this introduces subjective human 
>> intervention, which clashes with the objective, deterministic nature of 
>> blockchain.
>>
>> While I tend to agree that code is law, one of the entire points of laws 
>> is that they can be amended to improve their efficacy in reducing harm. 
>> Leaning on this point seems more like a pro-ossification stance that it's 
>> better to do nothing and allow harm to occur rather than take action to 
>> stop an attack that was foreseen far in advance.
>>
>> Technological Evolution as a Feature, Not a Bug
>> It's well known that cryptography tends to weaken over time and 
>> eventually break. Quantum computing is just the next step in this 
>> progression. Users who fail to adapt (e.g., by adopting quantum-resistant 
>> wallets when available) are akin to those who ignored technological 
>> advancements like multisig or hardware wallets. Allowing quantum theft 
>> incentivizes innovation and keeps Bitcoin’s ecosystem dynamic, punishing 
>> complacency while rewarding vigilance.
>>
>> Market Signals Drive Security
>> If quantum attackers start stealing funds, it sends a clear signal to the 
>> market: upgrade your security or lose everything. This pressure accelerates 
>> the adoption of post-quantum cryptography and strengthens Bitcoin 
>> long-term. Coddling vulnerable users delays this necessary evolution, 
>> potentially leaving the network more exposed when quantum tech becomes 
>> widely accessible. Theft is a brutal but effective teacher.
>>
>> Centralized Blacklisting Power
>> Burning vulnerable funds requires centralized decision-making - a soft 
>> fork to invalidate certain transactions. This sets a dangerous precedent 
>> for future interventions, eroding Bitcoin’s decentralization. If quantum 
>> theft is blocked, what’s next - reversing exchange hacks? The system must 
>> remain neutral, even if it means some lose out.
>>
>> I think this could be a potential slippery slope if the proposal was to 
>> only burn specific addresses. Rather, I'd expect a neutral proposal to burn 
>> all funds in locking script types that are known to be quantum vulnerable. 
>> Thus, we could eliminate any subjectivity from the code.
>>
>> Fairness in Competition
>> Quantum attackers aren't cheating; they're using publicly available 
>> physics and math. Anyone with the resources and foresight can build or 
>> access quantum tech, just as anyone could mine Bitcoin in 2009 with a CPU. 
>> Early adopters took risks and reaped rewards; quantum innovators are doing 
>> the same. Calling it “unfair” ignores that Bitcoin has never promised 
>> equality of outcome - only equality of opportunity within its rules.
>>
>> I find this argument to be a mischaracterization because we're not 
>> talking about CPUs. This is more akin to talking about ASICs, except each 
>> ASIC costs millions if not billions of dollars. This is out of reach from 
>> all but the wealthiest organizations.
>>
>> Economic Resilience
>> Bitcoin has weathered thefts before (MTGOX, Bitfinex, FTX, etc) and 
>> emerged stronger. The market can absorb quantum losses, with unaffected 
>> users continuing to hold and new entrants buying in at lower prices. Fear 
>> of economic collapse overestimates the impact - the network’s antifragility 
>> thrives on such challenges.
>>
>> This is a big grey area because we don't know when a quantum computer 
>> will come online and we don't know how quickly said computers would be able 
>> to steal bitcoin. If, for example, the first generation of sufficiently 
>> powerful quantum computers were stealing less volume than the current block 
>> reward then of course it will have minimal economic impact. But if they're 
>> taking thousands of BTC per day and bringing them back into circulation, 
>> there will likely be a noticeable market impact as it absorbs the new 
>> supply.
>>
>> This is where the circumstances will really matter. If a quantum attacker 
>> appears AFTER the Bitcoin protocol has been upgraded to support quantum 
>> resistant cryptography then we should expect the most valuable active 
>> wallets will have upgraded and the juiciest target would be the 31,000 BTC 
>> in the address 12ib7dApVFvg82TXKycWBNpN8kFyiAN1dr which has been dormant 
>> since 2010. In general I'd expect that the amount of BTC re-entering the 
>> circulating supply would look somewhat similar to the mining emission 
>> curve: volume would start off very high as the most valuable addresses are 
>> drained and then it would fall off as quantum computers went down the list 
>> targeting addresses with less and less BTC.
>>
>> Why is economic impact a factor worth considering? Miners and businesses 
>> in general. More coins being liquidated will push down the price, which 
>> will negatively impact miner revenue. Similarly, I can attest from working 
>> in the industry for a decade, that lower prices result in less demand from 
>> businesses across the entire industry. As such, burning quantum vulnerable 
>> bitcoin is good for the entire industry.
>>
>> Practicality & Neutrality of Non-Intervention
>> There’s no reliable way to distinguish “theft” from legitimate "white 
>> hat" key recovery. If someone loses their private key and a quantum 
>> computer recovers it, is that stealing or reclaiming? Policing quantum 
>> actions requires invasive assumptions about intent, which Bitcoin’s 
>> trustless design can’t accommodate. Letting the chips fall where they may 
>> avoids this mess.
>>
>> Philosophical Purity
>> Bitcoin rejects bailouts. It’s a cold, hard system where outcomes reflect 
>> preparation and skill, not sentimentality. If quantum computing upends the 
>> game, that’s the point - Bitcoin isn’t meant to be safe or fair in a 
>> nanny-state sense; it’s meant to be free. Users who lose funds to quantum 
>> attacks are casualties of liberty and their own ignorance, not victims of 
>> injustice.
>>
>> Bitcoin's DAO Moment
>> This situation has some similarities to The DAO hack of an Ethereum smart 
>> contract in 2016, which resulted in a fork to stop the attacker and return 
>> funds to their original owners. The game theory is similar because it's a 
>> situation where a threat is known but there's some period of time before 
>> the attacker can actually execute the theft. As such, there's time to 
>> mitigate the attack by changing the protocol.
>>
>> It also created a schism in the community around the true meaning of 
>> "code is law," resulting in Ethereum Classic, which decided to allow the 
>> attacker to retain control of the stolen funds.
>>
>> A soft fork to burn vulnerable bitcoin could certainly result in a hard 
>> fork if there are enough miners who reject the soft fork and continue 
>> including transactions.
>>
>> Incentives Matter
>> We can wax philosophical until the cows come home, but what are the 
>> actual incentives for existing Bitcoin holders regarding this decision?
>>
>> "Lost coins only make everyone else's coins worth slightly more. Think of 
>>> it as a donation to everyone." - Satoshi Nakamoto
>>
>>
>> If true, the corollary is:
>>
>> "Quantum recovered coins only make everyone else's coins worth less. 
>>> Think of it as a theft from everyone." - Jameson Lopp
>>
>>
>> Thus, assuming we get to a point where quantum resistant signatures are 
>> supported within the Bitcoin protocol, what's the incentive to let 
>> vulnerable coins remain spendable?
>>
>> * It's not good for the actual owners of those coins. It disincentivizes 
>> owners from upgrading until perhaps it's too late.
>> * It's not good for the more attentive / responsible owners of coins who 
>> have quantum secured their stash. Allowing the circulating supply to 
>> balloon will assuredly reduce the purchasing power of all bitcoin holders.
>>
>> Forking Game Theory
>> From a game theory point of view, I see this as incentivizing users to 
>> upgrade their wallets. If you disagree with the burning of vulnerable 
>> coins, all you have to do is move your funds to a quantum safe signature 
>> scheme. Point being, I don't see there being an economic majority (or even 
>> more than a tiny minority) of users who would fight such a soft fork. Why 
>> expend significant resources fighting a fork when you can just move your 
>> coins to a new address?
>>
>> Remember that blocking spending of certain classes of locking scripts is 
>> a tightening of the rules - a soft fork. As such, it can be meaningfully 
>> enacted and enforced by a mere majority of hashpower. If miners generally 
>> agree that it's in their best interest to burn vulnerable coins, are other 
>> users going to care enough to put in the effort to run new node software 
>> that resists the soft fork? Seems unlikely to me.
>>
>> How to Execute Burning
>> In order to be as objective as possible, the goal would be to announce to 
>> the world that after a specific block height / timestamp, Bitcoin nodes 
>> will no longer accept transactions (or blocks containing such transactions) 
>> that spend funds from any scripts other than the newly instituted quantum 
>> safe schemes.
>>
>> It could take a staggered approach to first freeze funds that are 
>> susceptible to long-range attacks such as those in P2PK scripts or those 
>> that exposed their public keys due to previously re-using addresses, but I 
>> expect the additional complexity would drive further controversy.
>>
>> How long should the grace period be in order to give the ecosystem time 
>> to upgrade? I'd say a minimum of 1 year for software wallets to upgrade. We 
>> can only hope that hardware wallet manufacturers are able to implement post 
>> quantum cryptography on their existing hardware with only a firmware update.
>>
>> Beyond that, it will take at least 6 months worth of block space for all 
>> users to migrate their funds, even in a best case scenario. Though if you 
>> exclude dust UTXOs you could probably get 95% of BTC value migrated in 1 
>> month. Of course this is a highly optimistic situation where everyone is 
>> completely focused on migrations - in reality it will take far longer.
>>
>> Regardless, I'd think that in order to reasonably uphold Bitcoin's 
>> conservatism it would be preferable to allow a 4 year migration window. In 
>> the meantime, mining pools could coordinate emergency soft forking logic 
>> such that if quantum attackers materialized, they could accelerate the 
>> countdown to the quantum vulnerable funds burn.
>>
>> Random Tangential Benefits
>> On the plus side, burning all quantum vulnerable bitcoin would allow us 
>> to prune all of those UTXOs out of the UTXO set, which would also clean up 
>> a lot of dust. Dust UTXOs are a bit of an annoyance and there has even been 
>> a recent proposal for how to incentivize cleaning them up.
>>
>> We should also expect that incentivizing migration of the entire UTXO set 
>> will create substantial demand for block space that will sustain a fee 
>> market for a fairly lengthy amount of time.
>>
>> In Summary
>> While the moral quandary of violating any of Bitcoin's inviolable 
>> properties can make this a very complex issue to discuss, the game theory 
>> and incentives between burning vulnerable coins versus allowing them to be 
>> claimed by entities with quantum supremacy appears to be a much simpler 
>> issue.
>>
>> I, for one, am not interested in rewarding quantum capable entities by 
>> inflating the circulating money supply just because some people lost their 
>> keys long ago and some laggards are not upgrading their bitcoin wallet's 
>> security.
>>
>> We can hope that this scenario never comes to pass, but hope is not a 
>> strategy.
>>
>> I welcome your feedback upon any of the above points, and contribution of 
>> any arguments I failed to consider.
>>
>> -- 
>>
> You received this message because you are subscribed to the Google Groups 
>> "Bitcoin Development Mailing List" group.
>>
> To unsubscribe from this group and stop receiving emails from it, send an 
>> email to bitcoindev+...@googlegroups•com.
>> To view this discussion visit 
>> https://groups.google.com/d/msgid/bitcoindev/CADL_X_cF%3DUKVa7CitXReMq8nA_4RadCF%3D%3DkU4YG%2B0GYN97P6hQ%40mail.gmail.com 
>> <https://groups.google.com/d/msgid/bitcoindev/CADL_X_cF%3DUKVa7CitXReMq8nA_4RadCF%3D%3DkU4YG%2B0GYN97P6hQ%40mail.gmail.com?utm_medium=email&utm_source=footer>
>> .
>>
>

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups•com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/dbe7018c-149f-4ead-be39-fa368eca06f0n%40googlegroups.com.

[-- Attachment #1.2: Type: text/html, Size: 40912 bytes --]

 permalink raw reply	[|nested]