Key Takeaways
- • Galaxy Digital analysis indicates the Bitcoin community is reaching consensus that quantum computing poses a real but manageable threat, with vulnerability limited to specific wallet categories rather than representing network-wide existential risk.
- • Approximately 7 million BTC (~$470 billion at recent valuations) may be vulnerable under "long exposure" definitions, primarily comprising early-era coins with reused public addresses, exchange deposit addresses, and legacy formats including coins attributed to Satoshi Nakamoto.
- • Vulnerability is concentrated in two primary exposure categories: wallets whose public keys are already visible onchain (early Bitcoin era) and wallets whose public keys are revealed during transaction execution—with most modern wallets creating new addresses for each transaction, limiting current risk.
- • The threat threshold is a cryptographically relevant quantum computer (CRQC), not all quantum computers; Galaxy's assessment suggests the quantum threat is real but far from an existential crisis to Bitcoin's current network security.
- • Galaxy Digital frames governance risk as a more immediate concern to Bitcoin than quantum computing threats, positioning the quantum issue as a manageable long-term adaptation challenge rather than an urgent existential crisis.
Summary
A substantive debate has emerged within the Bitcoin community regarding the timeline and severity of quantum computing threats to network security, with Galaxy Digital's recent analysis attempting to establish common ground on both the reality and scope of the risk. The core vulnerability is well-established: a sufficiently capable quantum computer could theoretically derive private keys from exposed public keys, enabling attackers to forge signatures and steal coins. However, Galaxy's research indicates that vulnerability is far more circumscribed than broader market concerns suggest.
The critical distinction lies in which Bitcoin wallets face actual risk. Not all wallets are equally vulnerable; in fact, most modern wallets remain secure because funds are exposed to quantum attack only when public keys are revealed onchain. Project Eleven, a security organization focused on quantum risks to digital assets, estimates that approximately 7 million BTC worth roughly $470 billion may be vulnerable under a "long exposure" classification. This figure encompasses three primary categories: coins held in addresses that have been reused for multiple transactions (contrary to recommended security practices), coins held by exchanges or custodians that reuse deposit addresses for operational simplicity, and coins in legacy address formats—notably including coins believed to be held by Bitcoin's pseudonymous creator Satoshi Nakamoto.
The vulnerability window is further narrowed by the technical threshold required to pose actual risk. The relevant benchmark is a cryptographically relevant quantum computer (CRQC), not quantum computers generally. This distinction is material: current quantum computing developments, while advancing, remain distant from CRQC capabilities. Galaxy's Alex Thorn characterized the quantum threat as "real but limited today," affecting only certain exposed wallets rather than threatening the network's foundational security architecture or current operational viability.
Galaxy Digital's analysis suggests Bitcoin is already adapting proactively to quantum threats through community-driven evolution, with developers and network participants incorporating quantum-resistant considerations into ongoing protocol development. This incremental adaptation reflects the extended timeline before CRQC emergence, providing ample opportunity for systematic network hardening. The framing positions quantum risk as a manageable long-term engineering challenge requiring sustained attention rather than an immediate crisis demanding emergency intervention. Notably, Galaxy's leadership indicated that governance risk presents a more pressing concern to Bitcoin's resilience than quantum computing threats, suggesting the market's focus should remain calibrated toward near-term institutional and regulatory dynamics rather than distant cryptographic vulnerabilities.
The critical distinction lies in which Bitcoin wallets face actual risk. Not all wallets are equally vulnerable; in fact, most modern wallets remain secure because funds are exposed to quantum attack only when public keys are revealed onchain. Project Eleven, a security organization focused on quantum risks to digital assets, estimates that approximately 7 million BTC worth roughly $470 billion may be vulnerable under a "long exposure" classification. This figure encompasses three primary categories: coins held in addresses that have been reused for multiple transactions (contrary to recommended security practices), coins held by exchanges or custodians that reuse deposit addresses for operational simplicity, and coins in legacy address formats—notably including coins believed to be held by Bitcoin's pseudonymous creator Satoshi Nakamoto.
The vulnerability window is further narrowed by the technical threshold required to pose actual risk. The relevant benchmark is a cryptographically relevant quantum computer (CRQC), not quantum computers generally. This distinction is material: current quantum computing developments, while advancing, remain distant from CRQC capabilities. Galaxy's Alex Thorn characterized the quantum threat as "real but limited today," affecting only certain exposed wallets rather than threatening the network's foundational security architecture or current operational viability.
Galaxy Digital's analysis suggests Bitcoin is already adapting proactively to quantum threats through community-driven evolution, with developers and network participants incorporating quantum-resistant considerations into ongoing protocol development. This incremental adaptation reflects the extended timeline before CRQC emergence, providing ample opportunity for systematic network hardening. The framing positions quantum risk as a manageable long-term engineering challenge requiring sustained attention rather than an immediate crisis demanding emergency intervention. Notably, Galaxy's leadership indicated that governance risk presents a more pressing concern to Bitcoin's resilience than quantum computing threats, suggesting the market's focus should remain calibrated toward near-term institutional and regulatory dynamics rather than distant cryptographic vulnerabilities.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.