From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Sun, 25 May 2025 15:06:42 -0700 Received: from mail-qv1-f60.google.com ([209.85.219.60]) by mail.fairlystable.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94.2) (envelope-from ) id 1uJJUM-00046r-JW for bitcoindev@gnusha.org; Sun, 25 May 2025 15:06:42 -0700 Received: by mail-qv1-f60.google.com with SMTP id 6a1803df08f44-6faa5ecadafsf5824346d6.2 for ; Sun, 25 May 2025 15:06:38 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1748210793; cv=pass; d=google.com; s=arc-20240605; b=dOvonALhzJ/v93CQC4YElEUsoL9Yrfx/Tc1VgyKQwTlMb4aWYBhu7bymZM+p8oRVn0 AcCWJ0ApepWpM+P325X6/JTyfie69r63EW+ePw0u9BlgUuof4Gh6y0PVtLTuJceSfGkf jH2Sp0S7leC7fLI+1BwIzfQfuMf4THGeym5caOAkljYM/qiUkkVNdfeiZsmZSYma6pA2 +4Aa92XtDQUD/St+G8b6wzJKwaRYHsz2SghGvUjRoh+zU24TqwS2bIAbYhOOpx6mJDQB ihn4+QczEzJgghbBABY2MWYcJ8qUP1MkUiOHzKNGVsbrK6Y2T9fIyLiY9qYPXYfKg3uk 4VRw== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:mime-version:feedback-id :references:in-reply-to:message-id:subject:cc:from:to:date :dkim-signature; bh=6M6jDOztllmSyxCpiQKHYlDGuT+m7yzkogZRglrj+7Y=; fh=nYKLjF8l+gkEu4kcCIfzZqWEK81jFaLhrGHDaBcVbKI=; b=RcUbQeRaMV5hn+Ojtkba7J4MFE2OkDrDEsupU4H/Y9XLCG5DTWquXS3I7YRVsjERHt He/bF6+nM1eKWN15eA+nsCS/Vzlph6Ple7hiunzJwvSLf2egb7pLHfEUGXfbHm1jLsKR fWo0irRvRnXD5TFnPOZpddgHaTPjAeaIkjAo6Br70PgmjawOb3UbefazKojr9NbKO/68 4oIbr6xiacr9aHrkdVVT1qaFBOYhY+swcWwfQzW/dWRWL5E9uOmMBXX8B0AkDuwevxqX 9yG2TRkG4/EkZH4vcHVK6qJb59AFj3HVkDZGCKHG0ykl8mKmuQ4WCIaHsS77SWSOjPlz 029A==; darn=gnusha.org ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@proton.me header.s=hpo3656erzdqzewvhaxln4ugty.protonmail header.b=ZKyTbAfp; spf=pass (google.com: domain of conduition@proton.me designates 79.135.106.28 as permitted sender) smtp.mailfrom=conduition@proton.me; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=proton.me DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20230601; t=1748210793; x=1748815593; darn=gnusha.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :feedback-id:references:in-reply-to:message-id:subject:cc:from:to :date:from:to:cc:subject:date:message-id:reply-to; bh=6M6jDOztllmSyxCpiQKHYlDGuT+m7yzkogZRglrj+7Y=; b=U2jy8eWsoAvh9KkJ5dcvGWSdX9zxRuuP893bqb0SnCVsSH2iVPFIQmFduXwcqf3te1 OY+1DRLH8/FpKKHgq0FME3iF56cirOs9lAtmTGiL9kbiWn1InFR5PCJXlRE5mekrPyw/ f8mwFSuLEBYM/vodykL2q4ZNlTf+0L86Lqjf5WIU6/PUGdoGvJj5kSOFlR8s17zWyAHP tpX2smw8EOVxgTesrkZm6gkNT4G/JWvn6zaJmKiycNjd0WWRSjEvAZrID2oxW2aCcpH5 f/SfRCKT6oZZOsQ2iI9FKrQ35FX0kLRGGMVeWUUSZfk9n0kf+vxr4LQQarxf454TSAJX LzEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1748210793; x=1748815593; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :feedback-id:references:in-reply-to:message-id:subject:cc:from:to :date:x-beenthere:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=6M6jDOztllmSyxCpiQKHYlDGuT+m7yzkogZRglrj+7Y=; b=dhGRdNbJdY8s3+kCXCxj2TvQguPKu9U3Slywx5ZLtGYlRUAOzjFrO98jVLOa+MIz6v gjcLP7RGZdBvg65GMDXbSBnNEObdeWCMDKjHk9x+6B97YuAfYgrnRN/7wKN3NtzMCKWW Koj1pnyIZJwcwReQpmgvqPFm13Jzixlt8QI5rjB3bqDsz1+KfBvIvP4RECF5Rvl3vl22 ktv5IjGqEDYwRuXmDzJ62Ur3X67K+o9Dl+uKBT87H8ADNZjGzoXdcHZGNKu/AU+BY3rG /egJAavPDkuq9lx6XPLz/YCt0wm1Y4v659eotm2z+Xd7jOgeCZ5jzmDGp1LlkE310J1d EEsg== X-Forwarded-Encrypted: i=2; AJvYcCWkEMKLUXW7hfwOvCxZ+SBqVuoPgm6TdW6i4LxPEjGv89lfWYRmvUXtk4o0oyjwZc5btfye/F5ZVHuV@gnusha.org X-Gm-Message-State: AOJu0YwtVcD4ErwYgGgSEUH7dWlwcrAdUUySCCppmLkcGld31B5MtwPf tJUF27MKr47EtL2IXlrJiVWvjSTYV/lcju7n5K7zCPs1oNEtio0Fi1UR X-Google-Smtp-Source: AGHT+IHSyZkAydpkImJsfymXaX4jr3IV6MAqTtswjKBIeizEAr1YYJ929SPlOl0qUZhPtQ9oEb+Oxg== X-Received: by 2002:a05:622a:5c18:b0:476:964a:e338 with SMTP id d75a77b69052e-49f46e3dc51mr134738201cf.28.1748210792558; Sun, 25 May 2025 15:06:32 -0700 (PDT) X-BeenThere: bitcoindev@googlegroups.com; h=AVT/gBHl5WuSl0jxqlRPK+nY7Xww+3mBCoEpxxi0ELG/vs4YgA== Received: by 2002:a05:622a:5c8f:b0:47f:81f1:5da0 with SMTP id d75a77b69052e-49f3258cd6els32320521cf.1.-pod-prod-08-us; Sun, 25 May 2025 15:06:29 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXgfRPmRIzOjsBPRQ4Ze1XQFVPRI8jdFlACZczX1lGNptrgzsCYdOIfi6/j1xC08kFNj5rBuf/Zs0vx@googlegroups.com X-Received: by 2002:a05:620a:170a:b0:7c5:3d60:7f88 with SMTP id af79cd13be357-7ceecb7f5fdmr976059185a.16.1748210788848; Sun, 25 May 2025 15:06:28 -0700 (PDT) Received: by 2002:a05:6402:22a2:b0:604:5cbf:497f with SMTP id 4fb4d7f45d1cf-6045cbf508cmsa12; Sun, 25 May 2025 12:03:50 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCX8m88rmMil/UeQqryz2YfMDkaKW5ZLoN8vTlr3tqin25CJsoqQILORHHZWftvsNZlLNJ+Mmno13KjE@googlegroups.com X-Received: by 2002:a05:6402:34cc:b0:5e5:bdfe:6bfb with SMTP id 4fb4d7f45d1cf-602d9bf8dd1mr4830423a12.16.1748199827557; Sun, 25 May 2025 12:03:47 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1748199827; cv=none; d=google.com; s=arc-20240605; b=kAu5xuVXA6X6J/rptbPQnkcOzHj+itROR0DbYfrDRfjYxx9B70tQ5AIs7W8sj+Y+0j AfybgVtM14E1yHNulmMW5GXKmeKybZfThONkfiAxf0wc1rUZoKxVg6aFAtpwxwgbmvXT wqQCtGpenbDrM/wLBoudb4Mf50pwE2uR16Q0ZPIpnGJ+1dwHcnhB8HnPIsLSisPPsH2F ICq/8MxL4owqDUHG1ipH/3deYXzXdCFd64NcJzhxwFZujndLiTuuuHHUh3524lgJifji etaXWYjzTDSkTAqYP60dLYzNghb6n9sspAmfoESWzdHBqhT8xHXqZmFq/elcsxQnHjMp EtoA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=mime-version:feedback-id:references:in-reply-to:message-id:subject :cc:from:to:date:dkim-signature; bh=I+JBIxAIow0is0Z+6gnrspLbjDGxR60PU4FVW+vcGM8=; fh=X0JkQjtGjrIsfkwh4TpsmmFedejki4ehCu+gndiuJFg=; b=bOaxcf5g6KUUMqTnDHXPcETh80KxBidoezBFzbO5Qwjz1KPoajq1jTguNdB3HttmdB uPNT6S+wNRtb/vvvK91MrW/O0II81sRZNCi3VoqG+wmbiymRz8lhTagjrzpLnMlHD5uu jlv50/duVWenMJkGzZoydeLildqEZTUugG2xfsd+2cuXY2XQ7Z0ItS43NIkJsP7zu0C/ 5jRnDaQo983IXcCvWFp47MDZwEHGNpKwQwYZr1g/QkrH2FBFBY+GbXqDiNul+BQ5+DvG srWDf22KpZlTqG9vH20TMqTu6gevaGxhNoYDG7P+A/VeGD6EqeI2eYxdKeVgdClvnL0n QVPQ==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; dkim=pass header.i=@proton.me header.s=hpo3656erzdqzewvhaxln4ugty.protonmail header.b=ZKyTbAfp; spf=pass (google.com: domain of conduition@proton.me designates 79.135.106.28 as permitted sender) smtp.mailfrom=conduition@proton.me; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=proton.me Received: from mail-10628.protonmail.ch (mail-10628.protonmail.ch. [79.135.106.28]) by gmr-mx.google.com with ESMTPS id 4fb4d7f45d1cf-6046367872csi32399a12.0.2025.05.25.12.03.47 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 25 May 2025 12:03:47 -0700 (PDT) Received-SPF: pass (google.com: domain of conduition@proton.me designates 79.135.106.28 as permitted sender) client-ip=79.135.106.28; Date: Sun, 25 May 2025 19:03:40 +0000 To: Agustin Cruz From: "'conduition' via Bitcoin Development Mailing List" Cc: AstroTown , bitcoindev@googlegroups.com Subject: Re: [bitcoindev] Against Allowing Quantum Recovery of Bitcoin Message-ID: In-Reply-To: References: Feedback-ID: 72003692:user:proton X-Pm-Message-ID: 3c3c2eeecc73ec7036888e054cd0b2790de99c58 MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/pgp-signature"; micalg=pgp-sha512; boundary="------1dfcff655c6a50832f43de84ef6e12a6680b2c3e4151d9496e3107b7355b4ddc"; charset=utf-8 X-Original-Sender: conduition@proton.me X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@proton.me header.s=hpo3656erzdqzewvhaxln4ugty.protonmail header.b=ZKyTbAfp; spf=pass (google.com: domain of conduition@proton.me designates 79.135.106.28 as permitted sender) smtp.mailfrom=conduition@proton.me; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=proton.me X-Original-From: conduition Reply-To: conduition Precedence: list Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com List-ID: X-Google-Group-Id: 786775582512 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Score: -0.5 (/) This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --------1dfcff655c6a50832f43de84ef6e12a6680b2c3e4151d9496e3107b7355b4ddc Content-Type: multipart/mixed;boundary=---------------------07e877d605899d35b90ea45642d097f6 -----------------------07e877d605899d35b90ea45642d097f6 Content-Type: multipart/alternative;boundary=---------------------d1a656d57fe171d757e0b8d358350631 -----------------------d1a656d57fe171d757e0b8d358350631 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" Hey Saulo, You're right about the possibility of an ugly split. Laggards who don't mov= e coins to PQ address schemes will be incentivized to follow any chain wher= e they keep their coins. But those who do migrate will be incentivized to f= ollow the chain where unmigrated pre-quantum coins are frozen.=C2=A0 While you're comparing this event to the ETH/ETC split, we should remember = that ETH remained the dominant chain despite their heavy-handed rollback. J= ust goes to show, confusion and face-loss is a lesser evil than allowing an= adversary to pwn the network.=C2=A0 > This is the free-market way to solve problems without imposing rules on e= veryone. It'd still be a free market even if quantum-vulnerable coins are frozen. Th= e only way to test the relative value of quantum-safe vs quantum-vulnerable= coins is to split the chain and see how the market reacts.=C2=A0 IMO, the "free market way" is to give people options and let their money fl= ow to where it works best. That means people should be able to choose wheth= er they want their money to be part of a system that allows quantum attack,= or part of one which does not. I know which I would choose, but neither yo= u nor I can make that choice for everyone. regards, conduition On Monday, March 24th, 2025 at 7:19 AM, Agustin Cruz wrote: > I=E2=80=99m against letting quantum computers scoop up funds from address= es that don=E2=80=99t upgrade to quantum-resistant. > Saulo=E2=80=99s idea of a free-market approach, leaving old coins up for = grabs if people don=E2=80=99t move them, sounds fair at first. Let luck dec= ide, right? But I worry it=E2=80=99d turn into a mess. If quantum machines = start cracking keys and snagging coins, it=E2=80=99s not just lost Satoshi-= era stuff at risk. Plenty of active wallets, like those on the rich list Ja= meson mentioned, could get hit too. Imagine millions of BTC flooding the ma= rket. Prices tank, trust in Bitcoin takes a dive, and we all feel the pain.= Freezing those vulnerable funds keeps that chaos in check. > Plus, =E2=80=9Cyour keys, your coins=E2=80=9D is Bitcoin=E2=80=99s heart.= If quantum tech can steal from you just because you didn=E2=80=99t upgrade= fast enough, that promise feels shaky. Freezing funds after a heads-up per= iod (say, four years) protects that idea better than letting tech giants or= rogue states play vampire with our network. It also nudges people to get t= heir act together and move to safer addresses, which strengthens Bitcoin lo= ng-term. > Saulo=E2=80=99s right that freezing coins could confuse folks or spark a = split like Ethereum Classic. But I=E2=80=99d argue quantum theft would look= worse. Bitcoin would seem broken, not just strict. A clear plan and enough= time to migrate could smooth things over. History=E2=80=99s on our side to= o. Bitcoin=E2=80=99s fixed bugs before, like SegWit. This feels like that, = not a bailout. > So yeah, I=E2=80=99d rather see vulnerable coins locked than handed to wh= oever builds the first quantum rig. It=E2=80=99s less about coddling people= and more about keeping Bitcoin solid for everyone. What do you all think? > Cheers, > Agust=C3=ADn >=20 > On Sun, Mar 23, 2025 at 10:29=E2=80=AFPM AstroTown w= rote: >=20 > > I believe that having some entity announce the decision to freeze old U= TXOs would be more damaging to Bitcoin=E2=80=99s image (and its value) than= having them gathered by QC. This would create another version of Bitcoin, = similar to Ethereum Classic, causing confusion in the market. > > It would be better to simply implement the possibility of moving funds = to a PQC address without a deadline, allowing those who fail to do so to re= ly on luck to avoid having their coins stolen. Most coins would be migrated= to PQC anyway, and in most cases, only the lost ones would remain vulnerab= le. This is the free-market way to solve problems without imposing rules on= everyone. > >=20 > > Saulo Fonseca > >=20 > >=20 > >=20 > > > On 16. Mar 2025, at 15:15, Jameson Lopp wrot= e: > > >=20 > > > The quantum computing debate is heating up. There are many controvers= ial aspects to this debate, including whether or not quantum computers will= ever actually become a practical threat. > > > I won't tread into the unanswerable question of how worried we should= be about quantum computers. I think it's far from a crisis, but given the = difficulty in changing Bitcoin it's worth starting to seriously discuss. To= day I wish to focus on a philosophical quandary related to one of the decis= ions that would need to be made if and when we implement a quantum safe sig= nature scheme. > > >=20 > > > Several Scenarios > > > Because this essay will reference game theory a fair amount, and ther= e are many variables at play that could change the nature of the game, I th= ink it's important to clarify the possible scenarios up front. > > >=20 > > > 1. Quantum computing never materializes, never becomes a threat, and = thus everything discussed in this essay is moot. > > > 2. A quantum computing threat materializes suddenly and Bitcoin does = not have quantum safe signatures as part of the protocol. In this scenario = it would likely make the points below moot because Bitcoin would be fundame= ntally broken and it would take far too long to upgrade the protocol, walle= t software, and migrate user funds in order to restore confidence in the ne= twork. > > > 3. Quantum computing advances slowly enough that we come to consensus= about how to upgrade Bitcoin and post quantum security has been minimally = adopted by the time an attacker appears. > > > 4. Quantum computing advances slowly enough that we come to consensus= about how to upgrade Bitcoin and post quantum security has been highly ado= pted by the time an attacker appears. > > >=20 > > > For the purposes of this post, I'm envisioning being in situation 3 o= r 4. > > >=20 > > > To Freeze or not to Freeze? > > > I've started seeing more people weighing in on what is likely the mos= t contentious aspect of how a quantum resistance upgrade should be handled = in terms of migrating user funds. Should quantum vulnerable funds be left o= pen to be swept by anyone with a sufficiently powerful quantum computer OR = should they be permanently locked? > > >=20 > > >=20 > > > > "I don't see why old coins should be confiscated. The better option= is to let those with quantum computers free up old coins. While this might= have an inflationary impact on bitcoin's price, to use a turn of phrase, t= he inflation is transitory. Those with low time preference should support r= eturning lost coins to circulation." > > >=20 > > > > - Hunter Beast > > >=20 > > >=20 > > > On the other hand: > > >=20 > > >=20 > > > > "Of course they have to be confiscated. If and when (and that's a b= ig if) the existence of a cryptography-breaking QC becomes a credible threa= t, the Bitcoin ecosystem has no other option than softforking out the abili= ty to spend from signature schemes (including ECDSA and BIP340) that are vu= lnerable to QCs. The alternative is that millions of BTC become vulnerable = to theft; I cannot see how the currency can maintain any value at all in su= ch a setting. And this affects everyone; even those which diligently moved = their coins to PQC-protected schemes." > > > > - Pieter Wuille > > >=20 > > >=20 > > > I don't think "confiscation" is the most precise term to use, as the = funds are not being seized and reassigned. Rather, what we're really discus= sing would be better described as "burning" - placing the funds out of reac= h of everyone. > > >=20 > > > Not freezing user funds is one of Bitcoin's inviolable properties. Ho= wever, if quantum computing becomes a threat to Bitcoin's elliptic curve cr= yptography, an inviolable property of Bitcoin will be violated one way or a= nother. > > >=20 > > > Fundamental Properties at Risk > > > 5 years ago I attempted to comprehensively categorize all of Bitcoin'= s fundamental properties that give it value. https://nakamoto.com/what-are-= the-key-properties-of-bitcoin/ > > > The particular properties in play with regard to this issue seem to b= e: > > >=20 > > > Censorship Resistance - No one should have the power to prevent other= s from using their bitcoin or interacting with the network. > > >=20 > > > Forward Compatibility - changing the rules such that certain valid tr= ansactions become invalid could undermine confidence in the protocol. > > >=20 > > > Conservatism - Users should not be expected to be highly responsive t= o system issues. > > >=20 > > > As a result of the above principles, we have developed a strong meme = (kudos to Andreas Antonopoulos) that goes as follows: > > >=20 > > >=20 > > > > Not your keys, not your coins. > > >=20 > > >=20 > > > I posit that the corollary to this principle is: > > >=20 > > >=20 > > > > Your keys, only your coins. > > >=20 > > >=20 > > > A quantum capable entity breaks the corollary of this foundational pr= inciple. We secure our bitcoin with the mathematical probabilities related = to extremely large random numbers. Your funds are only secure because truly= random large numbers should not be guessable or discoverable by anyone els= e in the world. > > >=20 > > > This is the principle behind the motto vires in numeris - strength in= numbers. In a world with quantum enabled adversaries, this principle is nu= ll and void for many types of cryptography, including the elliptic curve di= gital signatures used in Bitcoin. > > >=20 > > > Who is at Risk? > > > There has long been a narrative that Satoshi's coins and others from = the Satoshi era of P2PK locking scripts that exposed the public key directl= y on the blockchain will be those that get scooped up by a quantum "miner."= But unfortunately it's not that simple. If I had a powerful quantum comput= er, which coins would I target? I'd go to the Bitcoin rich list and find th= e wallets that have exposed their public keys due to re-using addresses tha= t have previously been spent from. You can easily find them at https://biti= nfocharts.com/top-100-richest-bitcoin-addresses.html > > >=20 > > > Note that a few of these wallets, like Bitfinex / Kraken / Tether, wo= uld be slightly harder to crack because they are multisig wallets. So a qua= ntum attacker would need to reverse engineer 2 keys for Kraken or 3 for Bit= finex / Tether in order to spend funds. But many are single signature. > > >=20 > > > Point being, it's not only the really old lost BTC that are at risk t= o a quantum enabled adversary, at least at time of writing. If we add a qua= ntum safe signature scheme, we should expect those wallets to be some of th= e first to upgrade given their incentives. > > >=20 > > > The Ethical Dilemma: Quantifying Harm > > > Which decision results in the most harm? > > >=20 > > > By making quantum vulnerable funds unspendable we potentially harm so= me Bitcoin users who were not paying attention and neglected to migrate the= ir funds to a quantum safe locking script. This violates the "conservativis= m" principle stated earlier. On the flip side, we prevent those funds plus = far more lost funds from falling into the hands of the few privileged folks= who gain early access to quantum computers. > > >=20 > > > By leaving quantum vulnerable funds available to spend, the same set = of users who would otherwise have funds frozen are likely to see them stole= n. And many early adopters who lost their keys will eventually see their un= reachable funds scooped up by a quantum enabled adversary. > > >=20 > > > Imagine, for example, being James Howells, who accidentally threw awa= y a hard drive with 8,000 BTC on it, currently worth over $600M USD. He has= spent a decade trying to retrieve it from the landfill where he knows it's= buried, but can't get permission to excavate. I suspect that, given the ch= oice, he'd prefer those funds be permanently frozen rather than fall into s= omeone else's possession - I know I would. > > >=20 > > > Allowing a quantum computer to access lost funds doesn't make those u= sers any worse off than they were before, however it wouldhave a negative i= mpact upon everyone who is currently holding bitcoin. > > >=20 > > > It's prudent to expect significant economic disruption if large amoun= ts of coins fall into new hands. Since a quantum computer is going to have = a massive up front cost, expect those behind it to desire to recoup their i= nvestment. We also know from experience that when someone suddenly finds th= emselves in possession of 9+ figures worth of highly liquid assets, they te= nd to diversify into other things by selling. > > >=20 > > > Allowing quantum recovery of bitcoin is tantamount to wealth redistri= bution. What we'd be allowing is for bitcoin to be redistributed from those= who are ignorant of quantum computers to those who have won the technologi= cal race to acquire quantum computers. It's hard to see a bright side to th= at scenario. > > >=20 > > > Is Quantum Recovery Good for Anyone? > > >=20 > > > Does quantum recovery HELP anyone? I've yet to come across an argumen= t that it's a net positive in any way. It certainly doesn't add any securit= y to the network. If anything, it greatly decreases the security of the net= work by allowing funds to be claimed by those who did not earn them. > > >=20 > > > But wait, you may be thinking, wouldn't quantum "miners" have earned = their coins by all the work and resources invested in building a quantum co= mputer? I suppose, in the same sense that a burglar earns their spoils by t= he resources they invest into surveilling targets and learning the skills n= eeded to break into buildings. What I say "earned" I mean through productiv= e mutual trade. > > >=20 > > > For example: > > >=20 > > > * Investors earn BTC by trading for other currencies. > > > * Merchants earn BTC by trading for goods and services. > > > * Miners earn BTC by trading thermodynamic security. > > > * Quantum miners don't trade anything, they are vampires feeding upon= the system. > > >=20 > > > There's no reason to believe that allowing quantum adversaries to rec= over vulnerable bitcoin will be of benefit to anyone other than the select = few organizations that win the technological arms race to build the first s= uch computers. Probably nation states and/or the top few largest tech compa= nies. > > >=20 > > > One could certainly hope that an organization with quantum supremacy = is benevolent and acts in a "white hat" manner to return lost coins to thei= r owners, but that's incredibly optimistic and foolish to rely upon. Such a= situation creates an insurmountable ethical dilemma of only recovering los= t bitcoin rather than currently owned bitcoin. There's no way to precisely = differentiate between the two; anyone can claim to have lost their bitcoin = but if they have lost their keys then proving they ever had the keys become= s rather difficult. I imagine that any such white hat recovery efforts woul= d have to rely upon attestations from trusted third parties like exchanges. > > >=20 > > > Even if the first actor with quantum supremacy is benevolent, we must= assume the technology could fall into adversarial hands and thus think adv= ersarially about the potential worst case outcomes. Imagine, for example, t= hat North Korea continues scooping up billions of dollars from hacking cryp= to exchanges and decides to invest some of those proceeds into building a q= uantum computer for the biggest payday ever... > > >=20 > > > Downsides to Allowing Quantum Recovery > > > Let's think through an exhaustive list of pros and cons for allowing = or preventing the seizure of funds by a quantum adversary. > > >=20 > > > Historical Precedent > > > Previous protocol vulnerabilities weren=E2=80=99t celebrated as "fair= game" but rather were treated as failures to be remediated. Treating quant= um theft differently risks rewriting Bitcoin=E2=80=99s history as a free-fo= r-all rather than a system that seeks to protect its users. > > >=20 > > > Violation of Property Rights > > > Allowing a quantum adversary to take control of funds undermines the = fundamental principle of cryptocurrency - if you keep your keys in your pos= session, only you should be able to access your money. Bitcoin is built on = the idea that private keys secure an individual=E2=80=99s assets, and unaut= horized access (even via advanced tech) is theft, not a legitimate transfer= . > > >=20 > > > Erosion of Trust in Bitcoin > > > If quantum attackers can exploit vulnerable addresses, confidence in = Bitcoin as a secure store of value would collapse. Users and investors rely= on cryptographic integrity, and widespread theft could drive adoption away= from Bitcoin, destabilizing its ecosystem. > > >=20 > > > This is essentially the counterpoint to claiming the burning of vulne= rable funds is a violation of property rights. While some will certainly se= e it as such, others will find the apathy toward stopping quantum theft to = be similarly concerning. > > >=20 > > > Unfair Advantage > > > Quantum attackers, likely equipped with rare and expensive technology= , would have an unjust edge over regular users who lack access to such tool= s. This creates an inequitable system where only the technologically elite = can exploit others, contradicting Bitcoin=E2=80=99s ethos of decentralized = power. > > >=20 > > > Bitcoin is designed to create an asymmetric advantage for DEFENDING o= ne's wealth. It's supposed to be impractically expensive for attackers to c= rack the entropy and cryptography protecting one's coins. But now we find o= urselves discussing a situation where this asymmetric advantage is compromi= sed in favor of a specific class of attackers. > > >=20 > > > Economic Disruption > > > Large-scale theft from vulnerable addresses could crash Bitcoin=E2=80= =99s price as quantum recovered funds are dumped on exchanges. This would h= arm all holders, not just those directly targeted, leading to broader finan= cial chaos in the markets. > > >=20 > > > Moral Responsibility > > > Permitting theft via quantum computing sets a precedent that technolo= gical superiority justifies unethical behavior. This is essentially taking = a "code is law" stance in which we refuse to admit that both code and laws = can be modified to adapt to previously unforeseen situations. > > >=20 > > > Burning of coins can certainly be considered a form of theft, thus I = think it's worth differentiating the two different thefts being discussed: > > >=20 > > > 1. self-enriching & likely malicious > > > 2. harm prevention & not necessarily malicious > > >=20 > > > Both options lack the consent of the party whose coins are being burn= t or transferred, thus I think the simple argument that theft is immoral be= comes a wash and it's important to drill down into the details of each. > > >=20 > > > Incentives Drive Security > > > I can tell you from a decade of working in Bitcoin security - the ave= rage user is lazy and is a procrastinator. If Bitcoiners are given a "drop = dead date" after which they know vulnerable funds will be burned, this pres= sure accelerates the adoption of post-quantum cryptography and strengthens = Bitcoin long-term. Allowing vulnerable users to delay upgrading indefinitel= y will result in more laggards, leaving the network more exposed when quant= um tech becomes available. > > >=20 > > > Steel Manning > > > Clearly this is a complex and controversial topic, thus it's worth th= inking through the opposing arguments. > > >=20 > > > Protecting Property Rights > > > Allowing quantum computers to take vulnerable bitcoin could potential= ly be spun as a hard money narrative - we care so greatly about not violati= ng someone's access to their coins that we allow them to be stolen! > > >=20 > > > But I think the flip side to the property rights narrative is that bu= rning vulnerable coins prevents said property from falling into undeserving= hands. If the entire Bitcoin ecosystem just stands around and allows quant= um adversaries to claim funds that rightfully belong to other users, is tha= t really a "win" in the "protecting property rights" category? It feels mor= e like apathy to me. > > >=20 > > > As such, I think the "protecting property rights" argument is a wash. > > >=20 > > > Quantum Computers Won't Attack Bitcoin > > > There is a great deal of skepticism that sufficiently powerful quantu= m computers will ever exist, so we shouldn't bother preparing for a non-exi= stent threat. Others have argued that even if such a computer was built, a = quantum attacker would not go after bitcoin because they wouldn't want to r= eveal their hand by doing so, and would instead attack other infrastructure= . > > >=20 > > > It's quite difficult to quantify exactly how valuable attacking other= infrastructure would be. It also really depends upon when an entity gains = quantum supremacy and thus if by that time most of the world's systems have= already been upgraded. While I think you could argue that certain entities= gaining quantum capability might not attack Bitcoin, it would only delay t= he inevitable - eventually somebody will achieve the capability who decides= to use it for such an attack. > > >=20 > > > Quantum Attackers Would Only Steal Small Amounts > > > Some have argued that even if a quantum attacker targeted bitcoin, th= ey'd only go after old, likely lost P2PK outputs so as to not arouse suspic= ion and cause a market panic. > > >=20 > > > I'm not so sure about that; why go after 50 BTC at a time when you co= uld take 250,000 BTC with the same effort as 50 BTC? This is a classic "zer= o day exploit" game theory in which an attacker knows they have a limited a= mount of time before someone else discovers the exploit and either benefits= from it or patches it. Take, for example, the recent ByBit attack - the hi= ghest value crypto hack of all time. Lazarus Group had compromised the Safe= wallet front end JavaScript app and they could have simply had it reassign= ownership of everyone's Safe wallets as they were interacting with their w= allet. But instead they chose to only specifically target ByBit's wallet wi= th $1.5 billion in it because they wanted to maximize their extractable val= ue. If Lazarus had started stealing from every wallet, they would have been= discovered quickly and the Safe web app would likely have been patched wel= l before any billion dollar wallets executed the malicious code. > > >=20 > > > I think the "only stealing small amounts" argument is strongest for S= ituation #2 described earlier, where a quantum attacker arrives before quan= tum safe cryptography has been deployed across the Bitcoin ecosystem. Becau= se if it became clear that Bitcoin's cryptography was broken AND there was = nowhere safe for vulnerable users to migrate, the only logical option would= be for everyone to liquidate their bitcoin as quickly as possible. As such= , I don't think it applies as strongly for situations in which we have a mi= gration path available. > > >=20 > > > The 21 Million Coin Supply Should be in Circulation > > > Some folks are arguing that it's important for the "circulating / spe= ndable" supply to be as close to 21M as possible and that having a signific= ant portion of the supply out of circulation is somehow undesirable. > > >=20 > > > While the "21M BTC" attribute is a strong memetic narrative, I don't = think anyone has ever expected that it would all be in circulation. It has = always been understood that many coins will be lost, and that's actually pa= rt of the game theory of owning bitcoin! > > >=20 > > > And remember, the 21M number in and of itself is not a particularly i= mportant detail - it's not even mentioned in the whitepaper. What's importa= nt is that the supply is well known and not subject to change. > > >=20 > > > Self-Sovereignty and Personal Responsibility > > > Bitcoin=E2=80=99s design empowers individuals to control their own we= alth, free from centralized intervention. This freedom comes with the burde= n of securing one's private keys. If quantum computing can break obsolete c= ryptography, the fault lies with users who didn't move their funds to quant= um safe locking scripts. Expecting the network to shield users from their o= wn negligence undermines the principle that you, and not a third party, are= accountable for your assets. > > >=20 > > > I think this is generally a fair point that "the community" doesn't o= we you anything in terms of helping you. I think that we do, however, need = to consider the incentives and game theory in play with regard to quantum s= afe Bitcoiners vs quantum vulnerable Bitcoiners. More on that later. > > >=20 > > > Code is Law > > > Bitcoin operates on transparent, immutable rules embedded in its prot= ocol. If a quantum attacker uses superior technology to derive private keys= from public keys, they=E2=80=99re not "hacking" the system - they're simpl= y following what's mathematically permissible within the current code. Alte= ring the protocol to stop this introduces subjective human intervention, wh= ich clashes with the objective, deterministic nature of blockchain. > > >=20 > > > While I tend to agree that code is law, one of the entire points of l= aws is that they can be amended to improve their efficacy in reducing harm.= Leaning on this point seems more like a pro-ossification stance that it's = better to do nothing and allow harm to occur rather than take action to sto= p an attack that was foreseen far in advance. > > >=20 > > > Technological Evolution as a Feature, Not a Bug > > > It's well known that cryptography tends to weaken over time and event= ually break. Quantum computing is just the next step in this progression. U= sers who fail to adapt (e.g., by adopting quantum-resistant wallets when av= ailable) are akin to those who ignored technological advancements like mult= isig or hardware wallets. Allowing quantum theft incentivizes innovation an= d keeps Bitcoin=E2=80=99s ecosystem dynamic, punishing complacency while re= warding vigilance. > > >=20 > > > Market Signals Drive Security > > > If quantum attackers start stealing funds, it sends a clear signal to= the market: upgrade your security or lose everything. This pressure accele= rates the adoption of post-quantum cryptography and strengthens Bitcoin lon= g-term. Coddling vulnerable users delays this necessary evolution, potentia= lly leaving the network more exposed when quantum tech becomes widely acces= sible. Theft is a brutal but effective teacher. > > >=20 > > > Centralized Blacklisting Power > > > Burning vulnerable funds requires centralized decision-making - a sof= t fork to invalidate certain transactions. This sets a dangerous precedent = for future interventions, eroding Bitcoin=E2=80=99s decentralization. If qu= antum theft is blocked, what=E2=80=99s next - reversing exchange hacks? The= system must remain neutral, even if it means some lose out. > > >=20 > > > I think this could be a potential slippery slope if the proposal was = to only burn specific addresses. Rather, I'd expect a neutral proposal to b= urn all funds in locking script types that are known to be quantum vulnerab= le. Thus, we could eliminate any subjectivity from the code. > > >=20 > > > Fairness in Competition > > > Quantum attackers aren't cheating; they're using publicly available p= hysics and math. Anyone with the resources and foresight can build or acces= s quantum tech, just as anyone could mine Bitcoin in 2009 with a CPU. Early= adopters took risks and reaped rewards; quantum innovators are doing the s= ame. Calling it =E2=80=9Cunfair=E2=80=9D ignores that Bitcoin has never pro= mised equality of outcome - only equality of opportunity within its rules. > > >=20 > > > I find this argument to be a mischaracterization because we're not ta= lking about CPUs. This is more akin to talking about ASICs, except each ASI= C costs millions if not billions of dollars. This is out of reach from all = but the wealthiest organizations. > > >=20 > > > Economic Resilience > > > Bitcoin has weathered thefts before (MTGOX, Bitfinex, FTX, etc) and e= merged stronger. The market can absorb quantum losses, with unaffected user= s continuing to hold and new entrants buying in at lower prices. Fear of ec= onomic collapse overestimates the impact - the network=E2=80=99s antifragil= ity thrives on such challenges. > > >=20 > > > This is a big grey area because we don't know when a quantum computer= will come online and we don't know how quickly said computers would be abl= e to steal bitcoin. If, for example, the first generation of sufficiently p= owerful quantum computers were stealing less volume than the current block = reward then of course it will have minimal economic impact. But if they're = taking thousands of BTC per day and bringing them back into circulation, th= ere will likely be a noticeable market impact as it absorbs the new supply. > > >=20 > > > This is where the circumstances will really matter. If a quantum atta= cker appears AFTER the Bitcoin protocol has been upgraded to support quantu= m resistant cryptography then we should expect the most valuable active wal= lets will have upgraded and the juiciest target would be the 31,000 BTC in = the address 12ib7dApVFvg82TXKycWBNpN8kFyiAN1dr which has been dormant since= 2010. In general I'd expect that the amount of BTC re-entering the circula= ting supply would look somewhat similar to the mining emission curve: volum= e would start off very high as the most valuable addresses are drained and = then it would fall off as quantum computers went down the list targeting ad= dresses with less and less BTC. > > >=20 > > > Why is economic impact a factor worth considering? Miners and busines= ses in general. More coins being liquidated will push down the price, which= will negatively impact miner revenue. Similarly, I can attest from working= in the industry for a decade, that lower prices result in less demand from= businesses across the entire industry. As such, burning quantum vulnerable= bitcoin is good for the entire industry. > > >=20 > > > Practicality & Neutrality of Non-Intervention > > > There=E2=80=99s no reliable way to distinguish =E2=80=9Ctheft=E2=80= =9D from legitimate "white hat" key recovery. If someone loses their privat= e key and a quantum computer recovers it, is that stealing or reclaiming? P= olicing quantum actions requires invasive assumptions about intent, which B= itcoin=E2=80=99s trustless design can=E2=80=99t accommodate. Letting the ch= ips fall where they may avoids this mess. > > >=20 > > > Philosophical Purity > > > Bitcoin rejects bailouts. It=E2=80=99s a cold, hard system where outc= omes reflect preparation and skill, not sentimentality. If quantum computin= g upends the game, that=E2=80=99s the point - Bitcoin isn=E2=80=99t meant t= o be safe or fair in a nanny-state sense; it=E2=80=99s meant to be free. Us= ers who lose funds to quantum attacks are casualties of liberty and their o= wn ignorance, not victims of injustice. > > >=20 > > > Bitcoin's DAO Moment > > > This situation has some similarities to The DAO hack of an Ethereum s= mart contract in 2016, which resulted in a fork to stop the attacker and re= turn funds to their original owners. The game theory is similar because it'= s a situation where a threat is known but there's some period of time befor= e the attacker can actually execute the theft. As such, there's time to mit= igate the attack by changing the protocol. > > >=20 > > > It also created a schism in the community around the true meaning of = "code is law," resulting in Ethereum Classic, which decided to allow the at= tacker to retain control of the stolen funds. > > >=20 > > > A soft fork to burn vulnerable bitcoin could certainly result in a ha= rd fork if there are enough miners who reject the soft fork and continue in= cluding transactions. > > >=20 > > > Incentives Matter > > > We can wax philosophical until the cows come home, but what are the a= ctual incentives for existing Bitcoin holders regarding this decision? > > >=20 > > >=20 > > > > "Lost coins only make everyone else's coins worth slightly more. Th= ink of it as a donation to everyone." - Satoshi Nakamoto > > >=20 > > >=20 > > > If true, the corollary is: > > >=20 > > >=20 > > > > "Quantum recovered coins only make everyone else's coins worth less= . Think of it as a theft from everyone." - Jameson Lopp > > >=20 > > >=20 > > > Thus, assuming we get to a point where quantum resistant signatures a= re supported within the Bitcoin protocol, what's the incentive to let vulne= rable coins remain spendable? > > >=20 > > > * It's not good for the actual owners of those coins. It disincentivi= zes owners from upgrading until perhaps it's too late. > > > * It's not good for the more attentive / responsible owners of coins = who have quantum secured their stash. Allowing the circulating supply to ba= lloon will assuredly reduce the purchasing power of all bitcoin holders. > > >=20 > > > Forking Game Theory > > > From a game theory point of view, I see this as incentivizing users t= o upgrade their wallets. If you disagree with the burning of vulnerable coi= ns, all you have to do is move your funds to a quantum safe signature schem= e. Point being, I don't see there being an economic majority (or even more = than a tiny minority) of users who would fight such a soft fork. Why expend= significant resources fighting a fork when you can just move your coins to= a new address? > > >=20 > > > Remember that blocking spending of certain classes of locking scripts= is a tightening of the rules - a soft fork. As such, it can be meaningfull= y enacted and enforced by a mere majority of hashpower. If miners generally= agree that it's in their best interest to burn vulnerable coins, are other= users going to care enough to put in the effort to run new node software t= hat resists the soft fork? Seems unlikely to me. > > >=20 > > > How to Execute Burning > > > In order to be as objective as possible, the goal would be to announc= e to the world that after a specific block height / timestamp, Bitcoin node= s will no longer accept transactions (or blocks containing such transaction= s) that spend funds from any scripts other than the newly instituted quantu= m safe schemes. > > >=20 > > > It could take a staggered approach to first freeze funds that are sus= ceptible to long-range attacks such as those in P2PK scripts or those that = exposed their public keys due to previously re-using addresses, but I expec= t the additional complexity would drive further controversy. > > >=20 > > > How long should the grace period be in order to give the ecosystem ti= me to upgrade? I'd say a minimum of 1 year for software wallets to upgrade.= We can only hope that hardware wallet manufacturers are able to implement = post quantum cryptography on their existing hardware with only a firmware u= pdate. > > >=20 > > > Beyond that, it will take at least 6 months worth of block space for = all users to migrate their funds, even in a best case scenario. Though if y= ou exclude dust UTXOs you could probably get 95% of BTC value migrated in 1= month. Of course this is a highly optimistic situation where everyone is c= ompletely focused on migrations - in reality it will take far longer. > > >=20 > > > Regardless, I'd think that in order to reasonably uphold Bitcoin's co= nservatism it would be preferable to allow a 4 year migration window. In th= e meantime, mining pools could coordinate emergency soft forking logic such= that if quantum attackers materialized, they could accelerate the countdow= n to the quantum vulnerable funds burn. > > >=20 > > > Random Tangential Benefits > > > On the plus side, burning all quantum vulnerable bitcoin would allow = us to prune all of those UTXOs out of the UTXO set, which would also clean = up a lot of dust. Dust UTXOs are a bit of an annoyance and there has even b= een a recent proposal for how to incentivize cleaning them up. > > >=20 > > > We should also expect that incentivizing migration of the entire UTXO= set will create substantial demand for block space that will sustain a fee= market for a fairly lengthy amount of time. > > >=20 > > > In Summary > > > While the moral quandary of violating any of Bitcoin's inviolable pro= perties can make this a very complex issue to discuss, the game theory and = incentives between burning vulnerable coins versus allowing them to be clai= med by entities with quantum supremacy appears to be a much simpler issue. > > >=20 > > > I, for one, am not interested in rewarding quantum capable entities b= y inflating the circulating money supply just because some people lost thei= r keys long ago and some laggards are not upgrading their bitcoin wallet's = security. > > >=20 > > > We can hope that this scenario never comes to pass, but hope is not a= strategy. > > >=20 > > > I welcome your feedback upon any of the above points, and contributio= n of any arguments I failed to consider. > > >=20 > > > -- > > > You received this message because you are subscribed to the Google Gr= oups "Bitcoin Development Mailing List" group. > > > To unsubscribe from this group and stop receiving emails from it, sen= d an email to bitcoindev+unsubscribe@googlegroups.com. > > > To view this discussion visit https://groups.google.com/d/msgid/bitco= indev/CADL_X_cF%3DUKVa7CitXReMq8nA_4RadCF%3D%3DkU4YG%2B0GYN97P6hQ%40mail.gm= ail.com. > >=20 > > -- > > You received this message because you are subscribed to the Google Grou= ps "Bitcoin Development Mailing List" group. > > To unsubscribe from this group and stop receiving emails from it, send = an email to bitcoindev+unsubscribe@googlegroups.com. > > To view this discussion visit https://groups.google.com/d/msgid/bitcoin= dev/E8269A1A-1899-46D2-A7CD-4D9D2B732364%40astrotown.de. >=20 > -- > You received this message because you are subscribed to the Google Groups= "Bitcoin Development Mailing List" group. > To unsubscribe from this group and stop receiving emails from it, send an= email to bitcoindev+unsubscribe@googlegroups.com. > To view this discussion visit https://groups.google.com/d/msgid/bitcoinde= v/CAJDmzYxw%2BmXQKjS%2Bh%2Br6mCoe1rwWUpa_yZDwmwx6U_eO5JhZLg%40mail.gmail.co= m. --=20 You received this message because you are subscribed to the Google Groups "= Bitcoin Development Mailing List" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to bitcoindev+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/= zyx7G6H1TyB2sWVEKAfIYmCCvfXniazvrhGlaZuGLeFtjL3Ky7B-9nBptC0GCxuHMjjw8RasO7c= 3ZX46_6Nerv0SgCP0vOi5_nAXLmiCJOY%3D%40proton.me. -----------------------d1a656d57fe171d757e0b8d358350631 Content-Type: multipart/related;boundary=---------------------cc9cb78b22f294ee74e352bc171ac547 -----------------------cc9cb78b22f294ee74e352bc171ac547 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hey Saulo,<= /div>

You're = right about the possibility of an ugly split. Laggards who don't move coins= to PQ address schemes will be incentivized to follow any chain where they = keep their coins. But those who do migrate will be incentivized to follow t= he chain where unmigrated pre-quantum coins are frozen. 

While you're compari= ng this event to the ETH/ETC split, we should remember that ETH remained th= e dominant chain despite their heavy-handed rollback. Just goes to show, co= nfusion and face-loss is a lesser evil than allowing an adversary to pwn th= e network. 

This is the free-market way to solve problems without impos= ing rules on everyone.

It'd still be a free market even if quantu= m-vulnerable coins are frozen. The only way to test the relative value of q= uantum-safe vs quantum-vulnerable coins is to split the chain and see how t= he market reacts. 

IMO, the "free market way" is to give people options and l= et their money flow to where it works best. That means people should be abl= e to choose whether they want their money to be part of a system that allow= s quantum attack, or part of one which does not. I know which I would choos= e, but neither you nor I can make that choice for everyone.

regards,
conduition
On Monday, March 24th, 2025 at 7:19 AM, Agustin Cruz <agustin.cr= uz@gmail.com> wrote:
I=E2=80=99m against letting q= uantum computers scoop up funds from addresses that don=E2=80=99t upgrade t= o quantum-resistant.
Saulo=E2=80=99s idea of a free-market approach, le= aving old coins up for grabs if people don=E2=80=99t move them, sounds fair= at first. Let luck decide, right? But I worry it=E2=80=99d turn into a mes= s. If quantum machines start cracking keys and snagging coins, it=E2=80=99s= not just lost Satoshi-era stuff at risk. Plenty of active wallets, like th= ose on the rich list Jameson mentioned, could get hit too. Imagine millions= of BTC flooding the market. Prices tank, trust in Bitcoin takes a dive, an= d we all feel the pain. Freezing those vulnerable funds keeps that chaos in= check.
Plus, =E2=80=9Cyour keys, your coins=E2=80=9D is Bitcoin=E2=80= =99s heart. If quantum tech can steal from you just because you didn=E2=80= =99t upgrade fast enough, that promise feels shaky. Freezing funds after a = heads-up period (say, four years) protects that idea better than letting te= ch giants or rogue states play vampire with our network. It also nudges peo= ple to get their act together and move to safer addresses, which strengthen= s Bitcoin long-term.
Saulo=E2=80=99s right that freezing coins could con= fuse folks or spark a split like Ethereum Classic. But I=E2=80=99d argue qu= antum theft would look worse. Bitcoin would seem broken, not just strict. A= clear plan and enough time to migrate could smooth things over. History=E2= =80=99s on our side too. Bitcoin=E2=80=99s fixed bugs before, like SegWit. = This feels like that, not a bailout.
So yeah, I=E2=80=99d rather see vul= nerable coins locked than handed to whoever builds the first quantum rig. I= t=E2=80=99s less about coddling people and more about keeping Bitcoin solid= for everyone. What do you all think?
Cheers,
Agust=C3=ADn


On Sun, Mar 23, 2025 at 10:29=E2=80=AFPM AstroTown <<= a href=3D"mailto:saulo@astrotown.de" rel=3D"noreferrer nofollow noopener">s= aulo@astrotown.de> wrote:
I believe that having some entity announce the decision to freeze= old UTXOs would be more damaging to Bitcoin=E2=80=99s image (and its value= ) than having them gathered by QC. This would create another version of Bit= coin, similar to Ethereum Classic, causing confusion in the market.<= div dir=3D"ltr">

It would be better to simply implement the possibility of mo= ving funds to a PQC address without a deadline, allowing those who fail to = do so to rely on luck to avoid having their coins stolen. Most coins would = be migrated to PQC anyway, and in most cases, only the lost ones would rema= in vulnerable. This is the free-market way to solve problems without imposi= ng rules on everyone.

Saulo Fonseca


<= div>On 16. Mar 2025, at 15:15, Jameson Lopp <jameson.lopp@gmail.com> wrote:

The quantum computing debate is heating up. There are many co= ntroversial aspects to this debate, including whether or not quantum comput= ers will ever actually become a practical threat.

I won't tread int= o the unanswerable question of how worried we should be about quantum compu= ters. I think it's far from a crisis, but given the difficulty in changing = Bitcoin it's worth starting to seriously discuss. Today I wish to focus on = a philosophical quandary related to one of the decisions that would need to= be made if and when we implement a quantum safe signature scheme.

<= font size=3D"6">Several Scenarios
Because this essay will referen= ce game theory a fair amount, and there are many variables at play that cou= ld change the nature of the game, I think it's important to clarify the pos= sible scenarios up front.

1. Quantum computing never materializes, n= ever becomes a threat, and thus everything discussed in this essay is moot.=
2. A quantum computing threat materializes suddenly and Bitcoin does no= t have quantum safe signatures as part of the protocol. In this scenario it= would likely make the points below moot because Bitcoin would be fundament= ally broken and it would take far too long to upgrade the protocol, wallet = software, and migrate user funds in order to restore confidence in the netw= ork.
3. Quantum computing advances slowly enough that we come to consens= us about how to upgrade Bitcoin and post quantum security has been minimall= y adopted by the time an attacker appears.
4. Quantum computing advances= slowly enough that we come to consensus about how to upgrade Bitcoin and p= ost quantum security has been highly adopted by the time an attacker appear= s.

For the purposes of this post, I'm envisioning being in situation= 3 or 4.

To Freeze or not to Freeze?
I've= started seeing more people weighing in on what is likely the most contenti= ous aspect of how a quantum resistance upgrade should be handled in terms o= f migrating user funds. Should quantum vulnerable funds be left open to be = swept by anyone with a sufficiently powerful quantum computer OR should the= y be permanently locked?

"I don't see why old coins should be confiscated. The better option is t= o let those with quantum computers free up old coins. While this might have= an inflationary impact on bitcoin's price, to use a turn of phrase, the in= flation is transitory. Those with low time preference should support return= ing lost coins to circulation."
- Hunter Beast

On the other han= d:

"Of course t= hey have to be confiscated. If and when (and that's a big if) the existence= of a cryptography-breaking QC becomes a credible threat, the Bitcoin ecosy= stem has no other option than softforking out the ability to spend from sig= nature schemes (including ECDSA and BIP340) that are vulnerable to QCs. The= alternative is that millions of BTC become vulnerable to theft; I cannot s= ee how the currency can maintain any value at all in such a setting. And th= is affects everyone; even those which diligently moved their coins to PQC-p= rotected schemes."
- Pieter Wuille

I don't think "confis= cation" is the most precise term to use, as the funds are not being seized = and reassigned. Rather, what we're really discussing would be better descri= bed as "burning" - placing the funds out of reach of everyone.
Not freezing user funds is one of Bitcoin's inviolable properties. Howeve= r, if quantum computing becomes a threat to Bitcoin's elliptic curve crypto= graphy, an inviolable property of Bitcoin will be violated one way or an= other.

Fundamental Properties at Risk
5 years ago I attempted to comprehensively categorize all of Bitcoin's fun= damental properties that give it value. https://nakamoto.com/what-are-the-key-properties-of-bitco= in/

The particular properties in play with regard to this issue = seem to be:

Censorship Resistance - No one should have the po= wer to prevent others from using their bitcoin or interacting with the netw= ork.

Forward Compatibility - changing the rules such that cer= tain valid transactions become invalid could undermine confidence in the pr= otocol.

Conservatism - Users should not be expected to be hig= hly responsive to system issues.

As a result of the above principles= , we have developed a strong meme (kudos to Andreas Antonopoulos) that goes= as follows:

Not your = keys, not your coins.

I posit that the corollary to this pr= inciple is:

Your keys,= only your coins.

A quantum capable entity breaks the corol= lary of this foundational principle. We secure our bitcoin with the mathema= tical probabilities related to extremely large random numbers. Your funds a= re only secure because truly random large numbers should not be guessable o= r discoverable by anyone else in the world.

This is the principle be= hind the motto vires in numeris - strength in numbers. In a world wi= th quantum enabled adversaries, this principle is null and void for many ty= pes of cryptography, including the elliptic curve digital signatures used i= n Bitcoin.

Who is at Risk?
There has long= been a narrative that Satoshi's coins and others from the Satoshi era of P= 2PK locking scripts that exposed the public key directly on the blockchain = will be those that get scooped up by a quantum "miner." But unfortunately i= t's not that simple. If I had a powerful quantum computer, which coins woul= d I target? I'd go to the Bitcoin rich list and find the wallets that have = exposed their public keys due to re-using addresses that have previously be= en spent from. You can easily find them at https://bitinfocharts.com/top-100-richest-bitcoin-= addresses.html

Note that a few of these wallets, like Bitfinex /= Kraken / Tether, would be slightly harder to crack because they are multis= ig wallets. So a quantum attacker would need to reverse engineer 2 keys for= Kraken or 3 for Bitfinex / Tether in order to spend funds. But many are si= ngle signature.

Point being, it's not only the really old lost BTC t= hat are at risk to a quantum enabled adversary, at least at time of writing= . If we add a quantum safe signature scheme, we should expect those wallets= to be some of the first to upgrade given their incentives.

The Ethical Dilemma: Quantifying Harm
Which decision res= ults in the most harm?

By making quantum vulnerable funds unspendabl= e we potentially harm some Bitcoin users who were not paying attention and = neglected to migrate their funds to a quantum safe locking script. This vio= lates the "conservativism" principle stated earlier. On the flip side, we p= revent those funds plus far more lost funds from falling into the hands of = the few privileged folks who gain early access to quantum computers.
By leaving quantum vulnerable funds available to spend, the same set of us= ers who would otherwise have funds frozen are likely to see them stolen. An= d many early adopters who lost their keys will eventually see their unreach= able funds scooped up by a quantum enabled adversary.

Imagine, for e= xample, being James Howells, who accidentally threw away a hard drive with = 8,000 BTC on it, currently worth over $600M USD. He has spent a decade tryi= ng to retrieve it from the landfill where he knows it's buried, but can't g= et permission to excavate. I suspect that, given the choice, he'd prefer th= ose funds be permanently frozen rather than fall into someone else's posses= sion - I know I would.

Allowing a quantum computer to access lost fu= nds doesn't make those users any worse off than they were before, however i= t wouldhave a negative impact upon everyone who is currently holding= bitcoin.

It's prudent to expect significant economic disruption if = large amounts of coins fall into new hands. Since a quantum computer is goi= ng to have a massive up front cost, expect those behind it to desire to rec= oup their investment. We also know from experience that when someone sudden= ly finds themselves in possession of 9+ figures worth of highly liquid asse= ts, they tend to diversify into other things by selling.

Allowing qu= antum recovery of bitcoin is tantamount to wealth redistribution. Wh= at we'd be allowing is for bitcoin to be redistributed from those who are i= gnorant of quantum computers to those who have won the technological race t= o acquire quantum computers. It's hard to see a bright side to that scenari= o.

Is Quantum Recovery Good for Anyone?
<= br>Does quantum recovery HELP anyone? I've yet to come across an argument t= hat it's a net positive in any way. It certainly doesn't add any security t= o the network. If anything, it greatly decreases the security of the networ= k by allowing funds to be claimed by those who did not earn them.

Bu= t wait, you may be thinking, wouldn't quantum "miners" have earned their co= ins by all the work and resources invested in building a quantum computer? = I suppose, in the same sense that a burglar earns their spoils by the resou= rces they invest into surveilling targets and learning the skills needed to= break into buildings. What I say "earned" I mean through productive mutual= trade.

For example:

* Investors earn BTC by trading for othe= r currencies.
* Merchants earn BTC by trading for goods and services.* Miners earn BTC by trading thermodynamic security.
* Quantum miners d= on't trade anything, they are vampires feeding upon the system.

Ther= e's no reason to believe that allowing quantum adversaries to recover vulne= rable bitcoin will be of benefit to anyone other than the select few organi= zations that win the technological arms race to build the first such comput= ers. Probably nation states and/or the top few largest tech companies.
<= br>One could certainly hope that an organization with quantum supremacy is = benevolent and acts in a "white hat" manner to return lost coins to their o= wners, but that's incredibly optimistic and foolish to rely upon. Such a si= tuation creates an insurmountable ethical dilemma of only recovering lost b= itcoin rather than currently owned bitcoin. There's no way to precisely dif= ferentiate between the two; anyone can claim to have lost their bitcoin but= if they have lost their keys then proving they ever had the keys becomes r= ather difficult. I imagine that any such white hat recovery efforts would h= ave to rely upon attestations from trusted third parties like exchanges.
Even if the first actor with quantum supremacy is benevolent, we must = assume the technology could fall into adversarial hands and thus think adve= rsarially about the potential worst case outcomes. Imagine, for example, th= at North Korea continues scooping up billions of dollars from hacking crypt= o exchanges and decides to invest some of those proceeds into building a qu= antum computer for the biggest payday ever...

Downs= ides to Allowing Quantum Recovery
Let's think through an exhausti= ve list of pros and cons for allowing or preventing the seizure of funds by= a quantum adversary.

Historical PrecedentPrevious protocol vulnerabilities weren=E2=80=99t celebrated as "fair gam= e" but rather were treated as failures to be remediated. Treating quantum t= heft differently risks rewriting Bitcoin=E2=80=99s history as a free-for-al= l rather than a system that seeks to protect its users.

Violation of Property Rights
Allowing a quantum adversary = to take control of funds undermines the fundamental principle of cryptocurr= ency - if you keep your keys in your possession, only you should be able to= access your money. Bitcoin is built on the idea that private keys secure a= n individual=E2=80=99s assets, and unauthorized access (even via advanced t= ech) is theft, not a legitimate transfer.

Erosion o= f Trust in Bitcoin
If quantum attackers can exploit vulnerable ad= dresses, confidence in Bitcoin as a secure store of value would collapse. U= sers and investors rely on cryptographic integrity, and widespread theft co= uld drive adoption away from Bitcoin, destabilizing its ecosystem.

T= his is essentially the counterpoint to claiming the burning of vulnerable f= unds is a violation of property rights. While some will certainly see it as= such, others will find the apathy toward stopping quantum theft to be simi= larly concerning.

Unfair Advantage
Quantu= m attackers, likely equipped with rare and expensive technology, would have= an unjust edge over regular users who lack access to such tools. This crea= tes an inequitable system where only the technologically elite can exploit = others, contradicting Bitcoin=E2=80=99s ethos of decentralized power.
Bitcoin is designed to create an asymmetric advantage for DEFENDING one's= wealth. It's supposed to be impractically expensive for attackers to crack= the entropy and cryptography protecting one's coins. But now we find ourse= lves discussing a situation where this asymmetric advantage is compromised = in favor of a specific class of attackers.

Economic= Disruption
Large-scale theft from vulnerable addresses could cra= sh Bitcoin=E2=80=99s price as quantum recovered funds are dumped on exchang= es. This would harm all holders, not just those directly targeted, leading = to broader financial chaos in the markets.

Moral Re= sponsibility
Permitting theft via quantum computing sets a preced= ent that technological superiority justifies unethical behavior. This is es= sentially taking a "code is law" stance in which we refuse to admit that bo= th code and laws can be modified to adapt to previously unforeseen situatio= ns.

Burning of coins can certainly be considered a form of theft, th= us I think it's worth differentiating the two different thefts being discus= sed:

1. self-enriching & likely malicious
2. harm prevention = & not necessarily malicious

Both options lack the consent of the= party whose coins are being burnt or transferred, thus I think the simple = argument that theft is immoral becomes a wash and it's important to drill d= own into the details of each.

Incentives Drive Secu= rity
I can tell you from a decade of working in Bitcoin security = - the average user is lazy and is a procrastinator. If Bitcoiners are given= a "drop dead date" after which they know vulnerable funds will be burned, = this pressure accelerates the adoption of post-quantum cryptography and str= engthens Bitcoin long-term. Allowing vulnerable users to delay upgrading in= definitely will result in more laggards, leaving the network more exposed w= hen quantum tech becomes available.

Steel ManningClearly this is a complex and controversial topic, thus it's worth= thinking through the opposing arguments.

Protectin= g Property Rights
Allowing quantum computers to take vulnerable b= itcoin could potentially be spun as a hard money narrative - we care so gre= atly about not violating someone's access to their coins that we allow them= to be stolen!

But I think the flip side to the property rights narr= ative is that burning vulnerable coins prevents said property from falling = into undeserving hands. If the entire Bitcoin ecosystem just stands around = and allows quantum adversaries to claim funds that rightfully belong to oth= er users, is that really a "win" in the "protecting property rights" catego= ry? It feels more like apathy to me.

As such, I think the "protectin= g property rights" argument is a wash.

Quantum Comp= uters Won't Attack Bitcoin
There is a great deal of skepticism th= at sufficiently powerful quantum computers will ever exist, so we shouldn't= bother preparing for a non-existent threat. Others have argued that even i= f such a computer was built, a quantum attacker would not go after bitcoin = because they wouldn't want to reveal their hand by doing so, and would inst= ead attack other infrastructure.

It's quite difficult to quantify ex= actly how valuable attacking other infrastructure would be. It also really = depends upon when an entity gains quantum supremacy and thus if by that tim= e most of the world's systems have already been upgraded. While I think you= could argue that certain entities gaining quantum capability might not att= ack Bitcoin, it would only delay the inevitable - eventually somebody will = achieve the capability who decides to use it for such an attack.

Quantum Attackers Would Only Steal Small Amounts
So= me have argued that even if a quantum attacker targeted bitcoin, they'd onl= y go after old, likely lost P2PK outputs so as to not arouse suspicion and = cause a market panic.

I'm not so sure about that; why go after 50 BT= C at a time when you could take 250,000 BTC with the same effort as 50 BTC?= This is a classic "zero day exploit" game theory in which an attacker know= s they have a limited amount of time before someone else discovers the expl= oit and either benefits from it or patches it. Take, for example, the recen= t ByBit attack - the highest value crypto hack of all time. Lazarus Group h= ad compromised the Safe wallet front end JavaScript app and they could have= simply had it reassign ownership of everyone's Safe wallets as they were i= nteracting with their wallet. But instead they chose to only specifically t= arget ByBit's wallet with $1.5 billion in it because they wanted to maximiz= e their extractable value. If Lazarus had started stealing from every walle= t, they would have been discovered quickly and the Safe web app would likel= y have been patched well before any billion dollar wallets executed the mal= icious code.

I think the "only stealing small amounts" argument is s= trongest for Situation #2 described earlier, where a quantum attacker arriv= es before quantum safe cryptography has been deployed across the Bitcoin ec= osystem. Because if it became clear that Bitcoin's cryptography was broken = AND there was nowhere safe for vulnerable users to migrate, the only logica= l option would be for everyone to liquidate their bitcoin as quickly as pos= sible. As such, I don't think it applies as strongly for situations in whic= h we have a migration path available.

The 21 Millio= n Coin Supply Should be in Circulation
Some folks are arguing tha= t it's important for the "circulating / spendable" supply to be as close to= 21M as possible and that having a significant portion of the supply out of= circulation is somehow undesirable.

While the "21M BTC" attribute i= s a strong memetic narrative, I don't think anyone has ever expected that i= t would all be in circulation. It has always been understood that many coin= s will be lost, and that's actually part of the game theory of owning bitco= in!

And remember, the 21M number in and of itself is not a particula= rly important detail - it's not even mentioned in the whitepaper. What's im= portant is that the supply is well known and not subject to change.

= Self-Sovereignty and Personal Responsibility
Bit= coin=E2=80=99s design empowers individuals to control their own wealth, fre= e from centralized intervention. This freedom comes with the burden of secu= ring one's private keys. If quantum computing can break obsolete cryptograp= hy, the fault lies with users who didn't move their funds to quantum safe l= ocking scripts. Expecting the network to shield users from their own neglig= ence undermines the principle that you, and not a third party, are accounta= ble for your assets.

I think this is generally a fair point that "th= e community" doesn't owe you anything in terms of helping you. I think that= we do, however, need to consider the incentives and game theory in play wi= th regard to quantum safe Bitcoiners vs quantum vulnerable Bitcoiners. More= on that later.

Code is Law
Bitcoin opera= tes on transparent, immutable rules embedded in its protocol. If a quantum = attacker uses superior technology to derive private keys from public keys, = they=E2=80=99re not "hacking" the system - they're simply following what's = mathematically permissible within the current code. Altering the protocol t= o stop this introduces subjective human intervention, which clashes with th= e objective, deterministic nature of blockchain.

While I tend to agr= ee that code is law, one of the entire points of laws is that they can be a= mended to improve their efficacy in reducing harm. Leaning on this point se= ems more like a pro-ossification stance that it's better to do nothing and = allow harm to occur rather than take action to stop an attack that was fore= seen far in advance.

Technological Evolution as a F= eature, Not a Bug
It's well known that cryptography tends to weak= en over time and eventually break. Quantum computing is just the next step = in this progression. Users who fail to adapt (e.g., by adopting quantum-res= istant wallets when available) are akin to those who ignored technological = advancements like multisig or hardware wallets. Allowing quantum theft ince= ntivizes innovation and keeps Bitcoin=E2=80=99s ecosystem dynamic, punishin= g complacency while rewarding vigilance.

Market Sig= nals Drive Security
If quantum attackers start stealing funds, it= sends a clear signal to the market: upgrade your security or lose everythi= ng. This pressure accelerates the adoption of post-quantum cryptography and= strengthens Bitcoin long-term. Coddling vulnerable users delays this neces= sary evolution, potentially leaving the network more exposed when quantum t= ech becomes widely accessible. Theft is a brutal but effective teacher.
=
Centralized Blacklisting Power
Burning vulne= rable funds requires centralized decision-making - a soft fork to invalidat= e certain transactions. This sets a dangerous precedent for future interven= tions, eroding Bitcoin=E2=80=99s decentralization. If quantum theft is bloc= ked, what=E2=80=99s next - reversing exchange hacks? The system must remain= neutral, even if it means some lose out.

I think this could be a po= tential slippery slope if the proposal was to only burn specific addresses.= Rather, I'd expect a neutral proposal to burn all funds in locking script = types that are known to be quantum vulnerable. Thus, we could eliminate any= subjectivity from the code.

Fairness in Competitio= n
Quantum attackers aren't cheating; they're using publicly avail= able physics and math. Anyone with the resources and foresight can build or= access quantum tech, just as anyone could mine Bitcoin in 2009 with a CPU.= Early adopters took risks and reaped rewards; quantum innovators are doing= the same. Calling it =E2=80=9Cunfair=E2=80=9D ignores that Bitcoin has nev= er promised equality of outcome - only equality of opportunity within its r= ules.

I find this argument to be a mischaracterization because we're= not talking about CPUs. This is more akin to talking about ASICs, except e= ach ASIC costs millions if not billions of dollars. This is out of reach fr= om all but the wealthiest organizations.

Economic R= esilience
Bitcoin has weathered thefts before (MTGOX, Bitfinex, F= TX, etc) and emerged stronger. The market can absorb quantum losses, with u= naffected users continuing to hold and new entrants buying in at lower pric= es. Fear of economic collapse overestimates the impact - the network=E2=80= =99s antifragility thrives on such challenges.

This is a big grey ar= ea because we don't know when a quantum computer will come online and we do= n't know how quickly said computers would be able to steal bitcoin. If, for= example, the first generation of sufficiently powerful quantum computers w= ere stealing less volume than the current block reward then of course it wi= ll have minimal economic impact. But if they're taking thousands of BTC per= day and bringing them back into circulation, there will likely be a notice= able market impact as it absorbs the new supply.

This is where the c= ircumstances will really matter. If a quantum attacker appears AFTER the Bi= tcoin protocol has been upgraded to support quantum resistant cryptography = then we should expect the most valuable active wallets will have upgraded a= nd the juiciest target would be the 31,000 BTC in the address 12ib7dApVFvg8= 2TXKycWBNpN8kFyiAN1dr which has been dormant since 2010. In general I'd exp= ect that the amount of BTC re-entering the circulating supply would look so= mewhat similar to the mining emission curve: volume would start off very hi= gh as the most valuable addresses are drained and then it would fall off as= quantum computers went down the list targeting addresses with less and les= s BTC.

Why is economic impact a factor worth considering? Miners and= businesses in general. More coins being liquidated will push down the pric= e, which will negatively impact miner revenue. Similarly, I can attest from= working in the industry for a decade, that lower prices result in less dem= and from businesses across the entire industry. As such, burning quantum vu= lnerable bitcoin is good for the entire industry.

P= racticality & Neutrality of Non-Intervention
There=E2=80=99s = no reliable way to distinguish =E2=80=9Ctheft=E2=80=9D from legitimate "whi= te hat" key recovery. If someone loses their private key and a quantum comp= uter recovers it, is that stealing or reclaiming? Policing quantum actions = requires invasive assumptions about intent, which Bitcoin=E2=80=99s trustle= ss design can=E2=80=99t accommodate. Letting the chips fall where they may = avoids this mess.

Philosophical Purity
Bi= tcoin rejects bailouts. It=E2=80=99s a cold, hard system where outcomes ref= lect preparation and skill, not sentimentality. If quantum computing upends= the game, that=E2=80=99s the point - Bitcoin isn=E2=80=99t meant to be saf= e or fair in a nanny-state sense; it=E2=80=99s meant to be free. Users who = lose funds to quantum attacks are casualties of liberty and their own ignor= ance, not victims of injustice.

Bitcoin's DAO Momen= t
This situation has some similarities to The DAO hack of an Ethe= reum smart contract in 2016, which resulted in a fork to stop the attacker = and return funds to their original owners. The game theory is similar becau= se it's a situation where a threat is known but there's some period of time= before the attacker can actually execute the theft. As such, there's time = to mitigate the attack by changing the protocol.

It also created a s= chism in the community around the true meaning of "code is law," resulting = in Ethereum Classic, which decided to allow the attacker to retain control = of the stolen funds.

A soft fork to burn vulnerable bitcoin could ce= rtainly result in a hard fork if there are enough miners who reject the sof= t fork and continue including transactions.

Incenti= ves Matter
We can wax philosophical until the cows come home, but= what are the actual incentives for existing Bitcoin holders regarding this= decision?

"Lost coins= only make everyone else's coins worth slightly more. Think of it as a dona= tion to everyone." - Satoshi Nakamoto

If true, the corollar= y is:

"Quantum recover= ed coins only make everyone else's coins worth less. Think of it as a theft= from everyone." - Jameson Lopp

Thus, assuming we get to a = point where quantum resistant signatures are supported within the Bitcoin p= rotocol, what's the incentive to let vulnerable coins remain spendable?
=
* It's not good for the actual owners of those coins. It disincentivize= s owners from upgrading until perhaps it's too late.
* It's not good for= the more attentive / responsible owners of coins who have quantum secured = their stash. Allowing the circulating supply to balloon will assuredly redu= ce the purchasing power of all bitcoin holders.

For= king Game Theory
From a game theory point of view, I see this as = incentivizing users to upgrade their wallets. If you disagree with the burn= ing of vulnerable coins, all you have to do is move your funds to a quantum= safe signature scheme. Point being, I don't see there being an economic ma= jority (or even more than a tiny minority) of users who would fight such a = soft fork. Why expend significant resources fighting a fork when you can ju= st move your coins to a new address?

Remember that blocking spending= of certain classes of locking scripts is a tightening of the rules - a sof= t fork. As such, it can be meaningfully enacted and enforced by a mere majo= rity of hashpower. If miners generally agree that it's in their best intere= st to burn vulnerable coins, are other users going to care enough to put in= the effort to run new node software that resists the soft fork? Seems unli= kely to me.

How to Execute Burning
In ord= er to be as objective as possible, the goal would be to announce to the wor= ld that after a specific block height / timestamp, Bitcoin nodes will no lo= nger accept transactions (or blocks containing such transactions) that spen= d funds from any scripts other than the newly instituted quantum safe schem= es.

It could take a staggered approach to first freeze funds that ar= e susceptible to long-range attacks such as those in P2PK scripts or those = that exposed their public keys due to previously re-using addresses, but I = expect the additional complexity would drive further controversy.

Ho= w long should the grace period be in order to give the ecosystem time to up= grade? I'd say a minimum of 1 year for software wallets to upgrade. We can = only hope that hardware wallet manufacturers are able to implement post qua= ntum cryptography on their existing hardware with only a firmware update.
Beyond that, it will take at least 6 months worth of block space for = all users to migrate their funds, even in a best case scenario. Though if y= ou exclude dust UTXOs you could probably get 95% of BTC value migrated in 1= month. Of course this is a highly optimistic situation where everyone is c= ompletely focused on migrations - in reality it will take far longer.
Regardless, I'd think that in order to reasonably uphold Bitcoin's conser= vatism it would be preferable to allow a 4 year migration window. In the me= antime, mining pools could coordinate emergency soft forking logic such tha= t if quantum attackers materialized, they could accelerate the countdown to= the quantum vulnerable funds burn.

Random Tangenti= al Benefits
On the plus side, burning all quantum vulnerable bitc= oin would allow us to prune all of those UTXOs out of the UTXO set, which w= ould also clean up a lot of dust. Dust UTXOs are a bit of an annoyance and = there has even been a recent proposal for how to incentivize cleaning them = up.

We should also expect that incentivizing migration of the entire= UTXO set will create substantial demand for block space that will sustain = a fee market for a fairly lengthy amount of time.

I= n Summary
While the moral quandary of violating any of Bitcoin's = inviolable properties can make this a very complex issue to discuss, the ga= me theory and incentives between burning vulnerable coins versus allowing t= hem to be claimed by entities with quantum supremacy appears to be a much s= impler issue.

I, for one, am not interested in rewarding quantum cap= able entities by inflating the circulating money supply just because some p= eople lost their keys long ago and some laggards are not upgrading their bi= tcoin wallet's security.

We can hope that this scenario never comes = to pass, but hope is not a strategy.

I welcome your feedback upon an= y of the above points, and contribution of any arguments I failed to consid= er.

--
You received this message because you = are subscribed to the Google Groups "Bitcoin Development Mailing List" grou= p.
To unsubscribe from this group and stop receiving emails from it, sen= d an email to bitcoindev+unsubscribe= @googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/CADL_X_cF%= 3DUKVa7CitXReMq8nA_4RadCF%3D%3DkU4YG%2B0GYN97P6hQ%40mail.gmail.com.

--
You received this message because you are subscribed to the Google Groups "= Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an e= mail to bitcoindev+unsubscribe@googl= egroups.com.
To view this discussion visit https://groups.google.com/d/msg= id/bitcoindev/E8269A1A-1899-46D2-A7CD-4D9D2B732364%40astrotown.de.

--
You received this message because you are subscribed to the Google Groups "= Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an e= mail to bitcoindev+unsubscribe@googlegroups.com. To view this discussion visit https://= groups.google.com/d/msgid/bitcoindev/CAJDmzYxw%2BmXQKjS%2Bh%2Br6mCoe1rwWUpa= _yZDwmwx6U_eO5JhZLg%40mail.gmail.com.

--
You received this message because you are subscribed to the Google Groups &= quot;Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an e= mail to bitcoind= ev+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/zyx7G6= H1TyB2sWVEKAfIYmCCvfXniazvrhGlaZuGLeFtjL3Ky7B-9nBptC0GCxuHMjjw8RasO7c3ZX46_= 6Nerv0SgCP0vOi5_nAXLmiCJOY%3D%40proton.me.
-----------------------cc9cb78b22f294ee74e352bc171ac547-- -----------------------d1a656d57fe171d757e0b8d358350631-- -----------------------07e877d605899d35b90ea45642d097f6 Content-Type: application/pgp-keys; filename="publickey - conduition@proton.me - 0x474891AD.asc"; name="publickey - conduition@proton.me - 0x474891AD.asc" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="publickey - conduition@proton.me - 0x474891AD.asc"; name="publickey - conduition@proton.me - 0x474891AD.asc" LS0tLS1CRUdJTiBQR1AgUFVCTElDIEtFWSBCTE9DSy0tLS0tCgp4ak1FWkRub0tSWUpLd1lCQkFI YVJ3OEJBUWRBcnBZYWFjZDgwcXdocmNaQW9VbW9NSHNWS21iZWlPZUEKcFhXbk1ybFdPZkxOSzJO dmJtUjFhWFJwYjI1QWNISnZkRzl1TG0xbElEeGpiMjVrZFdsMGFXOXVRSEJ5CmIzUnZiaTV0WlQ3 Q2pBUVFGZ29BUGdXQ1pEbm9LUVFMQ1FjSUNaQjRLV3p0aFBhenhRTVZDQW9FRmdBQwpBUUlaQVFL YkF3SWVBUlloQkVkSWthMENNdHJMZGcxM2EzZ3BiTzJFOXJQRkFBQTZhQUVBM1RmNHdqSVoKYnox K0diS0h4K09WQytNUXlVdi84RStoWUpjTE5QZnA0NEFBLzNiak5OTXN4WHdJTGZEM0xManNVVWFo CitBV2JyblVjVUFqQ2R1d3hUT01LempnRVpEbm9LUklLS3dZQkJBR1hWUUVGQVFFSFFDSXYxZW5J MU5MbAo3Zm55RzlVWk1wQ3ZsdG5vc0JrTmhQUVZxT3BXL3RKSkF3RUlCOEo0QkJnV0NBQXFCWUpr T2VncENaQjQKS1d6dGhQYXp4UUtiREJZaEJFZElrYTBDTXRyTGRnMTNhM2dwYk8yRTlyUEZBQUFR TFFEL2NCR2kwUDdwCkZTTkl2N1B6OVpkeUNVQjhzTy90dWZkV3NjQkNZK2ZMYTV3QkFNK0hTL3Jp S014RGt0TkhLakRGc2EvUgpEVDFxUGNBYXZCaXc2dDZ4Ti9jRgo9Y3d5eAotLS0tLUVORCBQR1Ag UFVCTElDIEtFWSBCTE9DSy0tLS0tCg== -----------------------07e877d605899d35b90ea45642d097f6-- --------1dfcff655c6a50832f43de84ef6e12a6680b2c3e4151d9496e3107b7355b4ddc Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: ProtonMail wrsEARYKAG0FgmgzaXsJkHgpbO2E9rPFRRQAAAAAABwAIHNhbHRAbm90YXRp b25zLm9wZW5wZ3Bqcy5vcmeEUm/qt1JOXNWbBkbn0BjGoPd9mmzqtKPpEKSt O9/06xYhBEdIka0CMtrLdg13a3gpbO2E9rPFAABfWQD/TXtVI7dtgUXu+BMQ KKMfx1cQ7NyCWWDhndCTz6fW64YBAOcvlQhGR+q76tCkQYthyuI8ADTlQQCh bMbe1sor/VYJ =7Fla -----END PGP SIGNATURE----- --------1dfcff655c6a50832f43de84ef6e12a6680b2c3e4151d9496e3107b7355b4ddc--