量子问题：是否冻结硬币

Bitcoin’s quantum debate is quite a quagmire. This is not merely a technical debate regarding the trade-offs of different types of cryptography and their strengths against a theoretical quantum computer. It is a debate about which properties of Bitcoin’s ethos are strongest when it is faced with a difficult dilemma: uphold the promise that valid coins remain spendable by their owners, or favor supporting the security of the system by not allowing a significant portion of its monetary supply to be raided via a vulnerability that was well known for many years.

The conundrum at the crux of this controversy is that every serious option violates a principle that Bitcoin users care about. Doing nothing may preserve today’s consensus rules while allowing future quantum-capable actors to take coins whose owners never consented. Freezing vulnerable coins may prevent that theft, but it retroactively invalidates long-standing spending conditions. A forced migration to quantum-resistant signatures may be prudent engineering, but it can also look like a deadline-backed confiscation regime. The debate is ugly because there is no clean path that perfectly preserves property rights, economic predictability, censorship resistance, backward compatibility, and user sovereignty all at once.

This is why I consider the problem to be fascinating. It’s multifaceted: simultaneously technical, sociological, philosophical, and economic in nature. Thus any serious discussion of the problem must consider every angle.

Throughout this essay I’ll be making the case that the quantum migration debate is far more nuanced than just a question between freezing or not freezing vulnerable bitcoin. Rather, it’s a question of how to minimize total property-rights violations once elliptic curve signatures no longer reliably authenticate rightful ownership.

This piece is featured in the latest Print edition of Bitcoin Magazine, The Quantum Issue. We’re sharing it here as an early look at the ideas explored throughout the full issue.

The Quantum Threat

Bitcoin’s current authorization scheme to ensure that funds are only spent by their rightful owners depends on elliptic-curve cryptography. Legacy ECDSA signatures and Schnorr signatures both use the secp256k1 elliptic curve. Under ordinary classical computing assumptions, deriving a private key from a public key is computationally infeasible. A cryptographically relevant quantum computer running Shor’s algorithm changes that assumption: once a public key is available, a sufficiently capable quantum attacker could derive the corresponding private key and sign a transaction to spend the funds that would be accepted as valid by the network. Quantum computers threaten to break the public-key-to-private-key hardness assumption behind ECDSA and Schnorr.

That distinction matters because not all Bitcoin outputs expose the same information at the same time. Some output types reveal a public key immediately and remain vulnerable indefinitely. Others hide the public key behind a hash until the owner spends. This creates two broad attack classes. A long-range attack targets outputs whose public keys are already visible on-chain, such as old pay-to-public-key outputs and Taproot outputs. A short-range attack targets coins at the moment of spending: the owner broadcasts a transaction, the public key becomes visible, and a fast quantum attacker attempts to derive the private key quickly enough to replace or front-run the transaction.

The mining threat is different. Grover’s algorithm can in theory speed up brute-force searching for a valid block hash, but it only provides a quadratic speedup while Shor’s algorithm provides a superpolynomial speedup. Thus the competitive advantage is far less practical to bother using a quantum computer for mining.

The Quantum Quantum Threat

Amusingly, the threat of quantum computers is itself in a quantum state of superposition. A quantum computer worth worrying about may or may not be built and no one can prove or disprove that it will happen. Quantum skeptics don’t dispute that Shor’s algorithm could break ECC. They claim there is no good reason to believe we will ever build the kind of powerful, fault-tolerant quantum computer needed to run Shor’s algorithm at a cryptographically relevant scale.

Everyone agrees that breaking ECC isn’t possible with today’s noisy quantum processors. It requires many reliable logical qubits, extremely low error rates, lengthy computations with high coherence, and quantum error correction running successfully at scale.

A strong skeptical argument is that the quantum fault-tolerance threshold theorem depends on assumptions that may not be physically satisfiable with the required precision. Such assumptions include sufficiently independent noise, sufficiently accurate gates, limited unwanted interactions, and the ability to keep errors below an acceptable threshold across a huge system. Mikhail Dyakonov argues that the theorem assumes idealized conditions and does not tell us the real engineering precision needed to satisfy every assumption in an actual device.

Gil Kalai’s criticism is more structural. His argument is that realistic quantum systems may suffer from correlated noise and noise accumulation that prevent the formation of high-quality quantum error-correcting codes. In his 2011 paper, he proposes that physical realizations of quantum codes, correlations in stochastic systems, and accumulated noise could lead to failure of scalable quantum computers.

This may be the strongest skeptic argument: quantum error correction works only if the noise is tameable. If real high-qubit systems generate adversarially correlated errors, then adding more qubits may very well make the computer more fragile and unreliable.

Quantum scalability is a major unknown. Skeptics argue that progress from 50, 100, or 1,000 physical qubits does not automatically extrapolate to millions of physical qubits or thousands of logical qubits. Quantum systems are analog, delicate, and coupled to their environment. The engineering challenge is not just “make more qubits”; it is “make more qubits while suppressing crosstalk, leakage, correlated errors, calibration drift, thermal effects, measurement errors, fabrication variation, and control noise.” This is why critics reject simple timeline extrapolations. They view “we increased qubit count by X this decade, so we will break ECC by year Y” as weak reasoning.

Finally, quantum computer demonstrations have shown that current devices can only outperform classical simulations on carefully selected sampling tasks. Critics have a good point that this says little about executing long, structured algorithms like Shor’s algorithm with enough reliability to recover a 256-bit ECC private key.

Why Post-Quantum Migration Matters

Assuming that a cryptographically relevant quantum computer appears, merely adding the option for Bitcoiners to use post-quantum cryptography won’t be sufficient to stop a quantum attack. The total set of quantum-vulnerable bitcoin includes early pay-to-public-key coins, coins controlled by reused public keys, Taproot outputs, and cases where public keys or extended public keys have been revealed outside the chain. One striking figure is the concentration of BTC in old P2PK outputs, which are a tiny fraction of UTXOs by count but represent a much larger share of value, about 1.7 million BTC. Broader estimates via on-chain analysis of output types, activity patterns, and known ownership lead us to believe that at least 2.6 million BTC would remain vulnerable even if all active Bitcoin users migrated their wallets to post-quantum cryptography.

As such, even with opt-in post-quantum (PQ) cryptography, we should expect there to be a systemic risk sized pool of vulnerable coins lingering indefinitely. These coins could be employed by a quantum attacker to harm the system in a wide variety of ways – not just via selling them and dropping the spot price of BTC. Thus, protecting those vulnerable coins from a quantum threat requires some sort of rule changes that would effectively “lock out” a quantum attacker.

The rhetoric around this issue often uses terms like “confiscation,” “burning,” “freezing,” “stealing,” or “recovery,” but these describe different mechanisms. A freeze would not transfer coins to the state, miners, developers, or some recovery fund. In its most basic form, it would mean changing consensus rules so that certain outputs can no longer be spent using vulnerable ECDSA or Schnorr signatures. That is why advocates sometimes say “burn” rather than “confiscate”: the coins are not reassigned; they become unspendable via their private key. But for a rightful owner who still has the original key, the practical effect can still feel confiscatory: a spend that used to be valid is no longer valid.

BIP-361 divides the migration concept into phases. First, once a quantum-resistant address type exists, the Bitcoin network would stop allowing new coins to be sent to quantum-vulnerable addresses. Later, after a multi-year window, legacy ECDSA and Schnorr spends would become invalid. Finally, there remains the question of recovery options for users who can prove, without solely relying upon broken ECC, that they are the legitimate owner – such as through a zero-knowledge proof derived from a seed phrase or HD wallet structure. The proposal’s primary purpose is not to pick a post-quantum signature algorithm; rather the goal is to create incentives and deadlines so that users, exchanges, custodians, wallets, and institutions actually migrate in a timely fashion and thus allow us to deprecate ECC in order to prevent a quantum attack.

The Case for Freezing

The strongest pro-freeze argument starts from a simple claim: a quantum attacker who derives a private key from a public key is not the legitimate owner in any morally meaningful sense. Under this view, “just let vulnerable coins be taken” is not neutrality; it is allowing a new class of actors to loot old outputs because the protocol failed to strengthen a lock that is known to be weak. Freeze advocates argue that the resulting harm from allowing quantum theft is not just to negligent owners but to all holders, because a successful quantum sweep would redistribute wealth to whoever possesses early quantum capability. This is problematic because that amount of bitcoin in a single actor’s hands who spent relatively little resources to obtain them can be quite dangerous for the ecosystem’s security. Bitcoin’s security model assumes economically rational participants that are incentivized to protect the value of their coins, but a quantum-capable actor has the potential to break that assumption. The pro-freeze position is that Bitcoin should not reward the first entities to break ECC with ammunition that could be leveraged to harm the system.

This argument is especially true for coins believed to be lost. If lost coins are suddenly recoverable by quantum attackers, the circulating supply effectively increases. That does not violate the formal 21 million cap, but it does change the economic landscape: coins that the market may have treated as inert can re-enter circulation, possibly rapidly and in concentrated hands.

The pro-freeze side also argues that the threat is not limited to ordinary profit-seeking. A quantum-capable adversary could attack Bitcoin politically, destabilize markets, undermine public confidence, grief the network for many years, or even acquire enough hashrate to 51% attack the network. Analysis of the game theory in play shows that we can’t simply assume an attacker sweeps vulnerable BTC to sell it and ride off into the sunset; there is a far wider range of strategies and undesirable outcomes.

A related argument is about market panic. Pieter Wuille’s comments in the mailing-list debate sharpen this point: the medium-term danger may be not only an actual cryptographically relevant quantum computer, but the credible belief that one may exist soon. If markets come to believe that a large share of Bitcoin’s supply can be seized at any moment, merely offering voluntary post-quantum outputs may not be enough to restore confidence. A credible plan to disable vulnerable spends could itself be a sufficient reassurance mechanism.

The pro-freeze camp also sees deadlines as necessary because voluntary migration is likely to be slow. People procrastinate; institutions move slowly; hardware wallets, exchanges, custodians, estate plans, multisig coordinators, and cold-storage procedures all need time to implement changes and plan for migrations. Matt Corallo has argued that Bitcoin should add a simple post-quantum capability well in advance of it being necessary, because wallets need to start embedding or committing to quantum-resistant public keys long before any later emergency decision about freezing vulnerable UTXOs becomes credible.

There is also a fiduciary responsibility argument. Public companies, ETFs, custodians, and exchanges will be unable to ignore a known migration deadline. A locked-in consensus change gives compliance departments and risk committees something concrete to act on. It also turns an abstract future threat into a project plan: upgrade software, generate new addresses, move funds, verify backups, communicate with customers, and complete migrations before a known date. BIP-361 explicitly argues that exchanges and custodians would face fiduciary and legal pressure to act once a deadline exists.

It’s also worth noting that all of this migration planning is applicable to more situations than just the emergence of a cryptographically relevant quantum computer. Most of the arguments in this debate apply to ANY situation where ECC is known to have been weakened. Generally speaking, cryptography tends not to withstand the test of time and any given cryptographic algorithm tends to be weakened over long time frames (decades) as researchers find flaws and develop new techniques that break prior assumptions.

Finally, freezing advocates argue that Bitcoin has always depended on users enforcing rules that protect the system as a whole. A soft fork that objectively disables a known-insecure spend path is not the same as arbitrary political confiscation, in their view. The proposed line is not “these people are disfavored” but “these script types require cryptography that no longer meets the bar for Bitcoin’s security assumptions.” If the rule is mechanical, objective, announced years in advance, and paired with a viable migration path, proponents argue that it is more akin to replacing a broken lock than blacklisting an owner.

This piece is featured in the latest Print edition of Bitcoin Magazine, The Quantum Issue. We’re sharing it here as an early look at the ideas explored throughout the full issue.

Anti-freeze Arguments

The strongest anti-freeze argument starts with the opposite premise: Bitcoin’s social contract is that a valid coin remains spendable by the holder of the corresponding key under the consensus rules accepted when the coin was received. Retroactively invalidating that spend path crosses an inviolable line. It turns “not your keys, not your coins” into “not your upgraded-by-deadline, not your coins.” Even if no one else receives the frozen coins, the original owner loses practical control. That is why critics describe forced freezing as confiscatory, not merely protective.

This objection is not just sentimental. Bitcoin’s credibility depends heavily on the expectation that developers and node operators will not pick winners and losers among UTXO owners. A freeze aimed at “vulnerable coins” may be technically objective, but it still targets a subset of owners based on past address choices, wallet design, dormancy, or inability to act. Critics worry that once the network accepts retroactive invalidation for one reason, future coalitions may find other reasons: sanctions, theft recovery, inheritance disputes, state pressure, “obviously” lost coins, or other emergencies.

A second objection is that freezing cannot distinguish between lost coins, careless owners, dormant owners, imprisoned owners, dead owners with heirs, users in hostile jurisdictions, timelocked arrangements, forgotten cold storage, and deliberately long-term savers. Bitcoin has many users whose goal is to avoid being forced to stay online and responsive to policy changes. A person who stored coins safely for decades should not necessarily lose them because the rest of the network later declared their storage method obsolete. It’s worth noting that there is an incentive conflict between active current holders who benefit from reducing the effective supply and inactive rightful owners who may be unable to take action to defend themselves.

A third objection is uncertainty. A cryptographically relevant quantum computer may arrive later than expected, may not arrive in the form feared, may remain secret for some time, or may be countered by less drastic tools. If Bitcoin permanently burns millions of coins and the threat does not materialize on the assumed timeline, the network will have committed an irreversible self-inflicted property-rights violation. Critics therefore argue that premature freezing is worse than measured preparation.

A fourth objection is governance and legitimacy. Freezing vulnerable coins would be one of the most controversial consensus changes in Bitcoin’s history. Some have warned that announcing a freeze of old UTXOs could damage Bitcoin’s image more than a quantum attack itself and could produce a major fork in which one side accepts the freeze and another preserves old spendability. In that scenario, the “solution” creates a new political attack surface: exchanges, custodians, miners, and users must choose which chain’s property-rights model they prefer.

A fifth objection is legal risk. Some participants in the mailing-list debate warned that developers, companies, or miners involved in consciously changing code to freeze funds could face liability claims from owners whose coins become unspendable. Even if those claims ultimately fail, the legal process itself could chill development, divide institutions, and make consensus coordination harder.

A sixth objection is technical humility. Post-quantum cryptography is real, but not free. NIST has standardized ML-DSA, SLH-DSA, and ML-KEM, with more work continuing, yet Bitcoin has unusual constraints: every byte matters, verification cost matters, wallet compatibility matters, and consensus failures are catastrophic. Chaincode’s comparison of candidate schemes in their quantum deep dive report shows why the choice is not trivial: post-quantum signatures and keys can be much larger than Schnorr or ECDSA, and schemes differ sharply in maturity, signature size, public-key size, signing cost, verification cost, and assumptions.