On Tuesday, Bitcoin nudged lower around the $81k line, the tape as grindy as ever. Away from the price action, the quantum-computing front saw fresh movement — the latest turn in a story we have followed about the quantum threat to Bitcoin’s signatures. On October 16, nine blockchain companies announced the formation of the Quantum Alliance, a body meant to set a set of quantum-safety testing standards for blockchains, wallets, and infrastructure.

The alliance’s positioning is clear: unable to change Bitcoin’s code, it will instead build a yardstick outside Bitcoin itself, to assess how quantum-ready each part of the ecosystem is. The member roster — Quantus, American Fortress, Intmax, Keystone, Midnight Foundation, Postquant Labs, Abelian, The Vault, and Hacken — is a clean slate of public chains, wallets, and security vendors; no Bitcoin Core developer appears on the list [1]. Modeled on the IETF, the alliance splits into four working groups: blockchain migration, post-quantum zero-knowledge systems, wallet security, and cross-chain compatibility.

By their estimate, some 6.04 million BTC — about 30% of total supply — already have their public keys exposed on-chain and could, in theory, have their private keys reverse-engineered by a sufficiently powerful quantum computer. But an exposed public key is not the same as a bare-public-key address. Part comes from early pay-to-public-key (P2PK) outputs, where the public key is written straight into the locking script; the rest comes from addresses like P2PKH that, once they have been spent, leave the public key on-chain alongside the signature. Of that total, roughly 1.0–1.1 million BTC are attributed to Satoshi, by the Patoshi-pattern accounting [2].

How should these troublesome coins be handled? In particular, if they have fallen silent — the owner gone or the private key lost, unable to move the coins to a safe address — then what?

The alliance is not of one mind on the answer. One camp wants to move the coins out and re-house them in a quantum-resistant way; the other worries that, the moment the protocol gains the ability to dispose of any dormant coin, it opens a precedent that breaks property rights and neutrality alike. Move or freeze — a question argued in academia for over a year — has now been placed on the industry’s table, unchanged.

The proposals on the table are, counted up, still the same unsettled ideas. BIP-361 has sat in the official repository for more than half a year: status Draft, type Informational, filed February 11, 2026 [3]. Its design runs in two steps — first, forbid further transfers to old, exposed-public-key addresses, herding new funds behind the quantum-resistant door; then, five years on, by a widely publicized flag day, bring the old signatures under a so-called quantum-safe rescue protocol. The word “freeze” never appears on the page, but the effect is not far from it.

Hourglass V2 takes another path — rate-limiting. At most one P2PK spend per block, with net outflow no greater than one bitcoin, which works out to about 144 BTC a day. The proposal still has no formal BIP number; it circulates only on the Delving Bitcoin forum and the bitcoindev mailing list [4]. Its aim is simply to slow things down — imperfect, and with little consensus behind it.

The third road comes from Paradigm’s Dan Robinson, who published PACT on May 1, 2026 [5]. A holder can, today, quietly create a timestamp that proves they knew the private key before any quantum computer existed; tomorrow the protocol could accept that zero-knowledge proof as an alternative spending path for the old address. The single most important move in the whole design is that it devotes a section of its own, titled precisely “The Satoshi Problem.”

The coins suspected of belonging to Satoshi are exactly the most special class within this exposed-public-key group. P2PK writes the public key straight into the locking script, public from the day it went on-chain; that era had no BIP-32 parent-key derivation, no BIP-39 mnemonic, not even the P2PKH hash-protected public-key address. The premise of zero-knowledge rescue is that you can prove you know something others do not — which requires the address to have been derived from a mnemonic. P2PK has no such thing. The authors of BIP-361 concede in the document itself that they do not currently believe a rescue protocol can be constructed for P2PK UTXOs, because no known asymmetry of knowledge exists [3].

PACT shifts the asymmetry from the seed to time. A quantum attacker can compute the private key but cannot forge a timestamp anchored to the chain long before. It also gives silence its first cost-based solution: no need to move publicly, no need to reveal identity — simply leave proof behind, in advance, while no one is watching. This is the most likely path that could still work for Satoshi, but it also depends on Satoshi still being alive and able to sign a proof ahead of time.

This is not a simple problem. The whole industry is still thinking, still debating fiercely. We must not open the door to confiscatory freezing — that trades Bitcoin’s neutrality for a sense of security that will not last, a trade we have argued elsewhere is exactly what makes a decentralized blockchain the more valuable as centralized power grows. But lying flat may be no answer either: the 6.04 million exposed-public-key coins sit there, and the quantum-computing schedule tightens year by year. Even if some of it is FUD, even if quantum computing never manages to break Bitcoin, the awareness to prepare ahead of time is always indispensable.

Nine companies forming an alliance will not change or forge consensus overnight. But at least, from now on, an organization is focused on the subject. The quantum computer is not built yet, but the table where someone speaks for Satoshi is already set. One even wonders: if several institutions of some credibility joined to create a multisig address, and on the eve of a quantum breakthrough moved the coins from early P2PK addresses — Satoshi’s included — under the guise of protective transfer, later letting owners reclaim them with some proof, might that be the sort of solution this alliance produces?

If Satoshi is dead, or unwilling to expose their identity, for whatever reason unwilling to reclaim, then those coins would remain in the alliance’s custody forever. (Of course, this is purely speculation.)

References