Nine Firms Form a Quantum Alliance and Put Exposed Bitcoin at 30.2%

Nine blockchain organizations formed a standards body in Lisbon on Thursday and put a number on what they want the industry to fix. The Quantum Alliance says 6.04 million bitcoin, or 30.2% of supply, sit behind public keys that are already visible on chain, where a future quantum computer could work backwards to the private key. It promises readiness criteria, open test benchmarks and migration designs across four working groups. No machine capable of that attack exists. The accounts of the launch do not agree on the count.

6.04 million, or 6.4 million

The alliance's own release gives 6.04 million bitcoin at 30.2% of supply. CoinDesk's headline, and ChainCatcher relaying it, put the same 30.2% against 6.4 million. Bitcoin.com carries both as a range and rounds the share to about 30%. TFTC cites Glassnode for 6.04 million and says plainly that it does not use the higher figure. One percentage cannot describe both counts, and we could not establish where 6.4 million entered the coverage.

A third band sits above both. TFTC's separate piece on Google's quantum result puts the coins behind exposed keys at 6.7 million to 6.9 million across Europol, Fireblocks and Google documents. That range overlaps neither of the others. The one component every account shares is roughly 1.1 million bitcoin in Satoshi-era pay-to-public-key outputs, an early output type that publishes the key itself.

Four groups, no dates

The release names the work and not the calendar. The four groups cover:

moving existing funds and keys to new signature schemes
post-quantum zero-knowledge proof systems
wallet security
compatibility between chains during a migration

Governance follows the model of the Internet Engineering Task Force: individual contributors can join, proposals advance on public evidence and working implementations, and company size and token holdings carry no voting weight. The promised readiness definition, test criteria and reference designs come with no publication dates, and the wire copy's own link to join a working group is an unfilled placeholder.

Three qubit counts, four dates

The hardware estimates in the release do not line up, because they answer different questions. Google's March paper, written with Ethereum Foundation and Stanford researchers, said fewer than 500,000 physical qubits could break the curve both bitcoin and Ethereum use, in a modelled attack lasting about nine minutes after a key is exposed. IonQ's September figure is about 20,000 physical qubits taking roughly 26 days an attempt, a claim this desk found in TFTC's relay alone. The Quantum Doom Clock, built by two Postquant Labs founders, models about 856,000. Give the attacker more time and the qubit count falls, which is the whole distance between those numbers.

The dates spread as widely. The Doom Clock points to March 2028 as an early window. The release itself passes on an expert view of around 2029, and TFTC puts independent estimates in the early-to-mid 2030s. Shor published the algorithm in 1994 and nobody has run it against these curves.

"In the future, 'post-quantum cryptography' will just be called 'cryptography' and everything else will be in a museum," said Christopher Smith, founder and chief executive of Quantus.

The question a standard cannot answer

Google's Willow processor cut errors in preparing magic states by about 40-fold, in a paper published in Science on 15 October, with fidelity near 99.99% for the roughly 8% of attempts that passed every check. CoinDesk's piece says the result does not make a bitcoin attack 40 times cheaper. TFTC's arithmetic puts the achieved error rate near one in 10,000 against the one in 10 billion such an attack would need. Google's own post says larger demonstrations are still needed.

What no standard settles is what happens to coins whose owners never migrate. CoinDesk reports that members disagree on timing and on whether quantum-vulnerable bitcoin should be frozen. The release and Crypto Briefing's account do not raise freezing at all. TFTC argues for voluntary migration through BIP-360, a draft that is not active on mainnet. StarkWare's quantum-safe transaction mined on mainnet in August is in the alliance's own timeline, and it is still the furthest the migration work has gone.