Satoshi Nakamoto's Bitcoin: Why 1.1 million coins may have been frozen

中本聪的比特币与量子计算威胁：BIP-361提案解析

据估计，比特币创始人中本聪（Satoshi Nakamoto）拥有约110万枚比特币。以周日早晨83,045美元的价格计算，这笔资产价值约为910亿美元（约合815亿欧元），分散在网络第一年的早期地址中。这些硬币被视为从未被触碰过，但它们却处于比特币开发者之间最激烈辩论的中心：一份编号为BIP-361的草案提议，在量子计算机未来可能窃取这些资产之前将其冻结。

“如果中本聪回归会发生什么”这个问题与比特币本身一样古老。而新的问题在于，一旦网络强化自身以抵御量子攻击，他的硬币是否还能被移动。这对您自己的地址也是一个实用的教训。

中本聪究竟拥有多少比特币？

没有人确切知道答案，因为中本聪从未公开他的地址。通常引用的数字源自计算机科学家塞尔吉奥·德米安·勒纳（Sergio Demian Lerner）。2013年，他在比特币区块链的早期区块中发现了一种模式，指向一个非常早期的矿工。后来对这种所谓“帕托希（Patoshi）”模式的分析得出的结论是，中本聪拥有约110万枚比特币。这约占目前流通总量2,010万枚比特币的5.5%。

Satoshi Nakamoto released a white paper on October 31, 2008, and launched the network on January 3, 2009. He quit in spring 2011. The coins attributed to him were in an early address format called Pay-to-Public-Key (P2PK), which makes them a special case today.

Why would quantum computers endanger Satoshi Nakamoto's Bitcoin?

Bitcoin uses digital signatures to protect balances. Only people who know the private key can spend these funds, and today's computers cannot deduce the private key from the public key. However, a sufficiently powerful quantum computer can do this. It is uncertain when this moment will come. The authors of BIP-361 cite some roadmap and believe that such machines could become possible as early as 2027 and 2030, while other experts believe it will take longer.

Only coins whose public keys are already visible are at risk. In the P2PK address of Satoshi Nakamoto's era, the public key was displayed on the blockchain from the beginning. In more modern formats, the public key only appears after the address is spent once. The draft clearly states on this point: If quantum computers continue to develop, all keys output by P2PK will be found almost surely and the balance will be stolen.

Recommendation for BIP-361: Freeze rather than steal

BIP-361题为“后量子迁移与传统签名日落”，自2026年2月起作为比特币改进提案正式注册中的草案存在。其主要作者是开发者詹姆斯·洛普（Jameson Lopp）。该计划的前提是比特币首先获得一种抗量子的地址类型，例如同样处于草案阶段的BIP-360。此后，它将分两个阶段进行：

• 阶段A：激活后约三年，精确来说是160,000个区块之后，网络将停止接受向脆弱地址付款。新资金只能流入抗量子安全的格式。
• 阶段B：激活后五年，在一个提前很久宣布的日期，使用旧签名进行花费只能通过抗量子救援程序进行。

这种救援程序依赖于真正所有者拥有一种攻击者所不知道的信息。任何使用带有助记词的现代钱包的人都可以证明其对原始密钥的了解，而攻击者并不持有该密钥。对于P2PK地址来说，这种优势并不存在，正如作者们自己所承认的那样。按照目前的解读，中本聪的硬币因此将永久锁定，除非进一步的提案为这类遗留持仓创建单独的、缓慢的花费路径。

支持者的论点

The authors quoted Satoshi Nakamoto himself. He wrote at the Bitcoin Forum in 2010 that lost coins only add slightly to other people's coins, and people can view them as donations to everyone. Frozen coins tighten the supply; stolen coins instantly expand the supply.

Reasons for Opposing a Freeze

This resistance is fundamental. Bitcoin promises that no one can lock in other people's coins, and that's exactly what BIP-361 will do, albeit after years of notice. Critics see it as a breach of property promises, no matter who the coins belong to. Even Lop didn't like his own proposal. In April, he called it a crude contingency plan and said: "I wrote it because I prefer alternatives that are less likely."

This is not decided by any committee. Soft forks require broad agreement from miners, node operators, wallets and exchanges. Both drafts are far from meeting this standard;BIP-360 and BIP-361 still have "draft" status.

If Satoshi Nakamoto returns, what will it mean for the price of Bitcoin?

If Satoshi Nakamoto's coins were moved before the deadline, the market initially didn't know who was behind it: Satoshi Nakamoto himself, his successor, or an attacker with a quantum computer. The mere assumption that a position worth about $91 billion could enter the market is enough to cause tremendous pressure, even if not a coin is sold. An explicit freeze would exclude this risk from the calculation. Backers of a U.S. bill that would lock in government-held bitcoin for 20 years have made a similar argument: What cannot be sold does not burden the price.

Which of your Bitcoin addresses will be affected?

For most investors in Germany, this is not an imminent danger today. However, this is a good opportunity to review your address:

• Coins on the exchange: The provider decides which address format to store them in. Moving to a quantum-resistant address in the future will be up to them.
• Own wallet with mnemonic words: Modern wallet generates a new address for each payment. For addresses that start with "1","3", or "bc1q", the public key is exposed only after you spend it. Therefore, not reusing addresses is a simple protection rule.
• Taproot address (starting with "bc1p"): Keys are visible here from the beginning, and BIP-361 explicitly lists them as fragile formats. But this is not a reason for rushing today, but a key point for subsequent transfers.
• Very old wallet: Anyone who holds coins from the earliest years should check the format they are in. Moving to your own new address is not a sale and will not trigger taxes in Germany.

If you hold your own coins, the Hardware Wallet Comparison List lists devices that can cleanly manage mnemonics and new devices. If you are new to this, the comparison list for purchasing Bitcoin lists verified providers.