Having seen the proposals floating around to mitigate the danger of quantum thefts, I have come to the conclusion that, in late 2026, almost every problem has been solved already.
Here's a little overview:
Until a quantum hack takes 10 minutes or less, the standard practice of
not-reusing addresses is enough to protect your funds.
If the quantum attack takes 10 minutes or less (which is very far away probably, I think 2030 is far too "optimistic" from QC-developer's view), then a
commit-reveal scheme like proposed by Tadge Dryja and others can simply be required to move funds from ECDSA keys safely. There is no urgent need to migrate to post-quantum addresses prematurely.
Quantum-resistant addresses / keys: Proposals like SHRINCS and SHRIMPS provide relatively small signature sizes, so while there will be less capacity than now, the sizes would be manageable, perhaps with a moderate block size increase. Taking into account that half of the blocks are currently occupied by Runes and similar stuff, the SHRINCS signature size (~5 times the ECDSA signature) looks much less scary.
Taproot vulnerability: BIP-360 solves the problem of the vulnerable key-spend path in P2TR transactions.
P2PK / P2MS / P2TR with published public keys: This is the hardest problem to solve if you don't want to confiscate coins (which should stay taboo). But there are three basic ideas which combined, would make attacks on coins very costly:
-
Hourglass: Only allowing a limited number of vulnerable coins per block to be transferred.
-
Landmines: Require a timelock and additionally a collateral. If an ownership proof from before Q-day is provided during the timelock, the collateral can also be collected by the rightful owner. (
Thread)
-
Long timelock: Require a long timelock to transfer the vulnerable coins, e.g. 1 year, or even
as long as the coins have not been moved (this would specially protect Satoshi's coins and other old coins, it would be de facto unfeasible to steal them if you have to freeze them for 10+ years). An exception should be made for coins where an ownership proof is provided.
These proposals can be combined and would attach a risk to an attack on P2PK and similar vulnerable coins.
So: why is there still FUD about quantum computers? I think we can now think about implementation - and then relax, we'll be better prepared than most banks
The proposal would also cover the case that an AI discovers some hidden method to compute the private key from the public key.
Or am I missing something?
