Bitcoin quantum threat: Which wallets are at greatest risk?

Fireblocks Research Director: Exposed public keys are the main factor in future quantum risks for Bitcoin

Fireblocks Research Director pointed out that exposed public keys are a key factor in exposing Bitcoin to future quantum computing risks. According to public estimates, approximately 6.7 million to 7 million bitcoins are publicly visible on the chain.

Security risks caused by reuse of older versions of outputs and addresses

Older Bitcoin outputs and reused addresses may cause the corresponding public key behind the funds to be exposed. Fireblocks recommends adopting new deposit and change addresses and continuously monitoring exposed balances. While Bitcoin's BIP 360 proposal helps reduce long-term key exposure, it does not provide complete anti-quantum protection.

Michael Gutkin, vice president of research at Fireblocks, emphasized in an interview with crypto.news that the holder's exposure depends on the type of blockchain, address format, and transaction history, and has nothing to do with whether the holder is an exchange, institution or individual. "Ultimately, exposure depends on whether the public key is already visible on the chain."

Gutkin analysis believes that frequent transactions may cause exposure through address reuse and processing of unspent bitcoins (UTXO). He pointed out that if a vault rarely moves its holdings and the address format and previous activities do not reveal information, its public key may remain hidden for longer. But for the Bitcoin output, known in the early days as "Payment to Public Key"(P2PK), Gutkin explained that the public key was visible from the beginning. Many outputs originating from Satoshi Nakamoto's era use this format, and even if the coins have never been moved, their keys are exposed.

In contrast, Gutkin stated that the "payment-to-public key hash"(P2PKH) and native SegWit addresses (P2WPKH) hide the public key until the first payout is made. However, once the holder makes a payment from the address, according to his explanation, the key will become permanently visible. If the same address subsequently receives more bitcoins, Gutkin pointed out that these new funds will be behind the public key. For holders who check their own exposure, he recommends reviewing whether there has been any expenditure at the address and whether they continue to receive funds.

Taproot and long-term quantum attack risk

Taproot introduces another difference. The authors of BIP360 point out that Taproot output is vulnerable to long-term quantum attacks because its output public key is visible at the time of creation. Under the proposal, a quantum computer with sufficient capabilities can derive private keys from exposed public keys. The proposal authors distinguish between attacks that target long-term visible keys and rapid attacks that are attempted while the transaction reveals the key but has not yet been confirmed.

This concern remains a future threat. In a September 17 report on the Bitcoin migration challenge, Charles Guillemet, Ledger's chief technology officer, said that there is currently no known cryptographically related quantum computer capable of cracking Bitcoin's current signature algorithm. Still, Guillemet warned that research, software changes, hardware wallet upgrades and user adoption can take years, so preparation is an issue that arises independently of actual attackers.

Progressive wallet changes can reduce Bitcoin exposure

In response to calls for "bunker model" preparations, Gutkin believes that institutions should continue to manage public key exposures rather than planning a one-time large-scale transfer. "For organizations, I don't think the goal should be a one-time large-scale migration." he said.

Under his proposed method, new Bitcoin deposits should be transferred to a new address, and change for transactions should be returned to a new address. Gutkin said institutions should track individual unspent transaction outputs (UTXO) to identify which funds are behind exposed keys. With normal spending, Gutkin explained that exposed addresses can be gradually cleared, while new funds reach addresses where their public keys are still hidden. He said a real-time exposure dashboard should show the remaining exposure balance and the transactions that led to additional exposure.

据Gutkin介绍，Fireblocks已经支持该流程的多个组件，并正在开发基于暴露情况选择交易输入以及显示受影响余额的工具。其他托管提供商也推出了相关的控制措施。BitGo在7月22日的公告中详细说明了四项比特币钱包控制措施，涵盖暴露评分、地址修复、交易输入选择和更新的地址默认设置。BitGo表示，其输入选择方法旨在花费与选定地址关联的所有未花费输出，从而降低在交易揭示密钥后留下资金的风险。该公司将这些控制措施描述为操作准备，而非未来比特币升级的替代品。

对于仓促的迁移，Gutkin警告说，大型持有者为争夺有限的比特币交易容量而竞争，可能会导致费用升高并延缓确认速度。在机构内部，他说，额外的交易和审批步骤可能会增加错误，包括将找零发送回暴露的地址。为了限制网络钓鱼和操作错误，Gutkin建议提前建立目标地址、审批政策和可信沟通渠道。他强调，紧急转账不应要求客户或员工遵循不熟悉的操作说明或绕过现有控制措施。

比特币仍需抗量子的交易授权方法

Even with improved address habits, Gutkin said Bitcoin still needs a quantum-resistant method to authorize transactions. In his explanation, BIP 360 solved part of the problem by proposing a "pay-to-Merkle-root" output, which eliminated the key disbursement path exposed in Taproot. Gutkin emphasized that reducing long-term public key exposure does not mean that the proposal constitutes a complete post-quantum solution.

proposal also pointed out that attack protection against short windows before transaction confirmation may require post-quantum signatures. BIP 360 is still listed as a draft. Unlike Ethereum, Gutkin said that Bitcoin cannot simply accept new signature verification contracts through the common application layer. He explained that depending on the design chosen, protocol-level changes may be needed to support the plan and keep transaction fees affordable.

Gutkin还提到了对基于哈希的签名的研究，包括那些通过跟踪签名状态以减少开销的设计。他说，此类方法在签名大小、钱包设计和记录保存方面存在权衡取舍。对于通过基金持有比特币的美国投资者来说，托管安排也是准备工作的一部分。一份关于Coinbase后量子托管计划的9月23日报告指出，现货比特币和以太坊ETF投资者并不控制保障基金持有的私钥；而是由发行商选择的托管方进行管理。在该报告中，Coinbase首席密码学家Yehuda Lindell描述了能够支持不同后量子签名方案的托管基础设施计划。Lindell表示，Coinbase正在探索可编程硬件安全模块作为替代方案，以便在区块链选择的方案无法与其现有的分布式签名系统兼容时使用。

以太坊的低成本验证仍需钱包变更

在以太坊方面，Gutkin指出，标准账户在签署交易后会暴露其公钥，因为可以从签名中恢复出密钥。与比特币的地址轮换不同，他解释说，定期更换以太坊账户不太实用，因为余额、代币批准和应用活动都与该账户绑定。

对于Solana的标准钱包，Gutkin注意到，地址本身就是公钥，因此无需任何初始支出交易，密钥就会暴露。据Gutkin介绍，可编程以太坊账户提供了一种在保留账户的同时更改交易授权的方法。Fireblocks的研究已将ML-DSA-44（一种后量子签名方案）的验证气体消耗从809万降低至123万。

在9月2日发布的一篇研究报告中，Fireblocks表示，该验证器遵循美国国家标准与技术研究院（NIST）发布的数字签名标准FIPS 204。Gutkin表示，团队改进了实现方式，而非改变标准化算法。其中包括更高效的哈希运算、数学运算、签名解码、公钥处理和内存使用。他说，峰值内存消耗从近1兆字节降至约41千字节。

该设计仍带有成本。Gutkin估计，扩展公钥的一次性部署成本约为410万气体，每次验证还需要123万气体。对于进行相对较少交易的 treasury 或冷钱包，Gutkin表示这些成本可能是合理的。他警告说，标准以太坊账户不能简单地切换到ML-DSA，而智能账户集成、托管支持以及与去中心化应用程序的兼容性仍需工程工作。

Gutkin also said that the validator does not enable the entire Ethereum system to achieve anti-quantum security, and its consensus layer and data layer are still under separate research. Despite extensive testing and formal verification, Gutkin said that Fireblocks implementations are still research code and require auditing and hardening before production use. Regarding institutional trusteeship, he added that the company is separately researching production-grade post-quantum signature systems.