6.04 Million Bitcoin Are Quantum-Exposed — Nine Firms Just Wrote the Test, and March 2028 Is on the Clock

Bitcoin is trading at $81,075, down 0.3% over 24 hours and about 3% below where it sat seven sessions ago, and for once the loudest thing in this market is not the price. On Thursday in Lisbon, executives from nine blockchain organizations launched the Quantum Alliance — an open standards body whose entire job is to answer a question this industry has never settled: what does “quantum-ready” actually mean, and how does anyone test it?

Nine organizations, one yardstick

The founding contributors are Quantus, Postquant Labs, Midnight Foundation, Keystone, American Fortress, Intmax, Abelian, The Vault and security auditor Hacken. Between them they cover base-layer protocols, privacy networks, rollups, hardware signers, addressing schemes and auditing — every layer a migration has to pass through. The alliance is not building a chain and it is not selling a token.

The structure is borrowed from the internet's own standards process. Modeled on the IETF, it is open to individual contributors, and proposals advance on public evidence, rough consensus and working implementations rather than corporate size or token holdings. Work starts in four groups: blockchain migration, post-quantum zero-knowledge systems, wallet security and cross-chain compatibility. Everything published is public, which matters more than it sounds — the point is a yardstick anyone can hold a readiness claim against.

That is the gap being targeted. NIST finalized its first post-quantum cryptography standards in August 2024, but no single party can order a live blockchain to adopt them, and there has never been an agreed definition of what a network's “quantum-ready” claim covers. The existing scoreboards disagree loudly: a May analysis of the qLABS Quantum Vulnerability Index ranked Ethereum second among prepared networks for its roadmap and active research, while migration.fail, a scorecard that counts only cryptography already live, hands Ethereum an F. Both can be defended. Neither gives a custodian, an exchange or a holder a common reference point.

“In the future, ‘post-quantum cryptography’ will just be called ‘cryptography’ and everything else will be in a museum.” — Christopher Smith, founder and CEO of Quantus

What 6.04 million Bitcoin actually means

The number attached to the launch is 6.04 million BTC — 30.2% of supply — counted as quantum-exposed at rest. The mechanism is not exotic. Almost every major chain secures accounts with elliptic-curve signatures, and once an account signs a transaction its public key sits on a public ledger forever; for some address types it is exposed from the moment the output is created. A sufficiently capable quantum computer running Shor's algorithm could work backwards from that key to the private one.

Address type decides how bad it is. The co-authors of BIP-360 — Hunter Beast, Ethan Heilman and Isabel Foxen Duke — describe P2PK and Taproot outputs as the most vulnerable types on the network, and their proposal for a Pay-to-Merkle-Root output exists specifically to remove the quantum-vulnerable keypath spend from Taproot-style addresses. It is a first step, not a fix: post-quantum signature schemes are left to later proposals.

The exposure is also not only coins. The same signatures guard stablecoin minting keys, bridges, oracle feeds and governance contracts, so one compromised privileged key can cascade across platforms. Almost all of a roughly $2.9 trillion market still runs on classical signatures.

The clock says 2028 before it says 2035

Timelines are where this stops being theoretical. The Quantum Doom Clock, a model built by alliance contributors Richard T. Carback III and Colton Dillion, has pointed to March 2028 as an early window for a cryptographically relevant machine since early 2025. In November 2025 Scott Aaronson — a computer scientist known for tempering quantum hype — wrote that a fault-tolerant machine running Shor's algorithm before the next US presidential election had become a live possibility. By April he was relaying hardware experts who put a machine capable of breaking deployed cryptosystems around 2029, with the line: this post is your warning.

The hardware estimates keep shrinking. In March, Google Quantum AI, working with the Ethereum Foundation and Stanford, put the cost of breaking the elliptic-curve cryptography behind Bitcoin and Ether at fewer than 500,000 physical qubits — roughly a twentieth of earlier estimates. In September, IonQ estimated that a fault-tolerant trapped-ion machine with about 20,000 physical qubits could solve Bitcoin's secp256k1 problem in around 26 days per attempt. No existing machine can do any of it.

Google's Science paper on Thursday is the honest version of that progress. Its magic state cultivation technique cut errors about 40-fold on the Willow processor and produced T-states at 99.99% logical fidelity, with only about 8% of attempts passing every check. Cracking a real key needs error rates near one in 10 billion — roughly a million times cleaner than what was just demonstrated. The direction of travel, not this month's number, is what the alliance is pricing in.

What Coinbase wants, and what a standard cannot fix

Coinbase, which says it custodies roughly 5% of all Bitcoin, published its own requirements on Tuesday and the subtext is impatience. Its argument: consensus changes and ecosystem migrations take years, so waiting for a cryptographically relevant machine to be announced leaves no time to respond. It backs a flexible container design along the lines of BIP-360, a staged one-of-two construction that lets the same coins be spent with either a classical or a quantum-safe key during the transition, and compatibility with the multi-party computation that custodians depend on. Dormant, lost and Satoshi-era coins it treats as a separate governance problem.

Money is already moving in that direction. In July, Coinbase joined BlackRock and Strategy in a Bitcoin Security Consortium pledging a combined $15 million toward quantum-proofing the network.

And progress is being oversold, including by people doing real work. StarkWare's quantum-safe Bitcoin transaction, mined on mainnet in August, protects only coins moved into a special output — it cannot help addresses whose public keys are already exposed and, by the company's own account, does not make Bitcoin quantum-safe. Turning one demonstration into network-wide readiness is exactly the gap the new test criteria are meant to expose.

The caveat worth reading twice

Here is the uncomfortable part. None of the nine founding members is publicly identified as a Bitcoin Core contributor. The alliance can define criteria, publish benchmarks and recommend migration paths, but it does not write Bitcoin's code, and a standard nobody implements changes nothing. That is not a reason to dismiss it — it is a reason to read it as infrastructure for buyers, auditors and wallet vendors rather than as a decision by the network.

The counterweight comes from inside Bitcoin. Adam Back has argued the threat is decades away, pointing out that no machine has demonstrated full error correction, and has pushed for a gradual migration once post-quantum schemes are proven. Blockstream has already contributed post-quantum work to Liquid as a testbed, and NIST's 2024 standards give the ecosystem a roadmap that did not exist when this debate started.

What a holder should actually take from this

Three practical things. First, address hygiene beats panic: coins held in addresses that have never signed a transaction keep their public keys hidden behind a hash, while a Taproot output exposes its key at creation — precisely why BIP-360 exists. Second, do not move long-term holdings into any post-quantum scheme that has not been reviewed by people with nothing to sell you; this migration will run for years and the first implementations will not be the last. Third, watch the four working groups' published criteria, and watch whether anyone adjacent to Bitcoin Core engages with them. That engagement, not the press release, is the signal.

Six million coins is the headline. A test that anyone can run against any chain is the deliverable — and it is the difference between a scary number and a migration plan. BTC trades at $81,075 at the time of writing.