34% of Bitcoin Addresses Are at Risk — The Structural Weakness Quantum Computers Could Break
3-Point Summary
- Bitcoin addresses become quantum‑vulnerable once spent, because their public keys are exposed on‑chain and can be attacked by future quantum computers.
- BIP‑361 is not a PQ address specification but a phased procedure to retire quantum‑vulnerable scripts and prepare the network for a PQ transition.
- ZK‑based authentication could theoretically offer strong quantum resistance, but Bitcoin’s Script limits, block size constraints, and verification costs make it impractical today.
As quantum computing accelerates, Bitcoin’s security model faces its most critical turning point.
Bitcoin’s Quantum Vulnerabilities, BIP‑361, and ZK-Based Alternatives
※ This post is an initial version and will be updated to the final Daily Crypto Times (DCT) format in a day.
As the era of quantum computing approaches faster than many expected, the fundamental security model of Bitcoin is back in the spotlight. BIP‑361, recently proposed by Bitcoin developers, is not a minor technical tweak but the first concrete attempt to address a structural issue: more than 34% of all Bitcoin may be exposed to quantum attacks.
To understand what this proposal really means, we need clear answers to a few key questions:
- Why are all addresses that have been used at least once considered quantum-vulnerable?
- How does Bitcoin’s transaction structure actually expose public keys?
- What exactly does BIP‑361 aim to change?
- Beyond PQ signatures, is a ZK-based alternative realistically possible?
This article tackles precisely those questions. We walk through how Bitcoin’s current security model reveals its limits in a quantum era, what direction BIP‑361 suggests for a quantum-resistant (PQ) transition, and why ZK-based authentication is “theoretically possible but practically difficult” for Bitcoin today. The goal is to connect these pieces into a single coherent narrative.
1. Why Are Bitcoin Addresses Used Even Once Quantum-Vulnerable?
Fundamental Weakness from the UTXO and Script Model
Bitcoin does not use an account-based model. Instead, it relies on the UTXO (Unspent Transaction Output) model. In this structure, the critical question is: what information is written to the blockchain when you receive Bitcoin, and what is revealed when you spend it?
① When Receiving (UTXO Creation) — The Public Key Is Hidden
For a typical P2PKH address (addresses starting with 1), the ScriptPubKey looks like this:
OP_DUP OP_HASH160 <pubkey hash> OP_EQUALVERIFY OP_CHECKSIG
Here, the blockchain stores only the hash of the public key, not the public key itself. At this stage, an attacker cannot see the actual public key, so even with a quantum computer, they cannot directly run a public key → private key inversion attack. In this state, the UTXO is relatively safe.
② When Spending (UTXO Consumption) — The Public Key Is Fully Exposed
To spend this coin, the transaction input’s ScriptSig must include:
<signature> <public key>
In other words, the moment you spend Bitcoin, the public key for that address is written in full to the blockchain. From that point on, the situation changes dramatically.
Bitcoin uses ECDSA (Elliptic Curve Digital Signature Algorithm). On a sufficiently powerful quantum computer, Shor’s Algorithm can efficiently solve the Elliptic Curve Discrete Logarithm Problem (ECDLP), meaning that given a public key, it can recover the corresponding private key in feasible time.
So, in conclusion: any address that has been used at least once to send Bitcoin has its public key exposed and becomes quantum-vulnerable. Early P2PK outputs, old exchange wallets, and addresses used by individuals in the past all fall into this category. Developers are concerned because a significant portion of the current Bitcoin supply is locked in such quantum-vulnerable addresses.
2. What Core Structure Does BIP‑361 Propose for Quantum-Resistant Bitcoin (PQ Bitcoin)?
BIP‑361 Is Not “Defining a PQ Address Format” but a “Procedure to Retire Vulnerable Addresses”
There is a common misunderstanding: BIP‑361 does not define a new PQ address format or a specific cryptographic scheme. Instead, its goals are closer to the following:
- Gradually phase out quantum-vulnerable addresses (P2PK, already-used P2PKH, etc.), and
- Prepare the environment so that, in the future, funds can migrate to quantum-resistant (PQ) addresses.
The 3-Phase Roadmap Proposed by BIP‑361
- After 3 years: Block new transactions that send coins to quantum-vulnerable addresses.
- After 5 years: Reject legacy ECDSA signatures coming from those vulnerable scripts.
- In the future: Discuss a “recovery option” for coins that have not migrated to PQ addresses.
In short, BIP‑361 is a procedural proposal to clean up quantum-vulnerable addresses, and on top of that cleanup, it creates room for PQ addresses to be introduced. So what structural direction should PQ addresses take?
Structural Principles PQ Addresses Need to Follow
Although BIP‑361 does not name specific algorithms, it implicitly assumes several structural requirements:
- Public keys must never be exposed directly on-chain.
- Use a quantum-resistant signature scheme that can be verified without revealing the public key in the traditional sense.
- Maintain a public-key-hash-based address model, but allow migration to stronger hash functions if needed.
- Adjust Script and size limits to accommodate NIST PQC candidates such as Dilithium, Falcon, or SPHINCS+.
Summarized in one line: PQ Bitcoin addresses should “keep the public key hidden at all times, while allowing verification using only quantum-resistant signatures.” The core goal is to break the current pattern of “address → public key revealed upon spending.”
3. Can Bitcoin Achieve Quantum Resistance Using ZK Instead?
Theoretically Yes — But It Would Require Massive Changes to Bitcoin
A natural question arises here: “Instead of PQ signatures, could we use ZK (zero-knowledge) proofs to achieve quantum resistance?”
In theory, yes. With a ZK proof, a user can prove:
“I know the private key for this address” without revealing the private key or the public key.
In such a design, the blockchain never stores the public key, so there is no “public key target” for a quantum computer to attack. From a purely cryptographic perspective, a ZK-based model can be extremely strong against quantum attacks.
Why ZK Is Still Unrealistic for Bitcoin Today
① Script Language Limitations
Bitcoin’s Script language is intentionally minimal. It has no loops, no complex arithmetic, and no built-in support for verifying SNARKs or STARKs. To support ZK verification, Bitcoin would need new opcodes and a hard-fork-level protocol upgrade, which goes against its conservative design philosophy.
② Proof Size and Block Size
ZK‑SNARK proofs are typically a few hundred bytes, while ZK‑STARK proofs can be several kilobytes to tens of kilobytes. Given Bitcoin’s 1MB block size limit, storing large numbers of ZK proofs would be highly inefficient and would significantly increase on-chain data.
③ Verification Cost
ZK proof verification is computationally expensive in terms of CPU and memory. Since every full node must verify every transaction, dramatically increasing verification cost would harm decentralization and verifiability, two core pillars of Bitcoin’s design.
For these reasons, while ZK-based quantum resistance is cryptographically attractive, it is widely seen as impractical for Bitcoin’s current architecture and governance model.
Summary
- Bitcoin addresses become quantum-vulnerable the moment they are spent, because their public keys are exposed on-chain, enabling quantum attacks on the private keys.
- BIP‑361 does not define a PQ address format; it proposes a phased retirement of quantum-vulnerable addresses and prepares the ground for a PQ transition.
- ZK-based designs could, in theory, provide strong quantum resistance, but Bitcoin’s Script model, block size, and verification costs make such an approach unrealistic today.
In the end, Bitcoin’s strategy for the quantum era is converging toward one direction: minimize public key exposure and transition to quantum-resistant signature schemes (PQ signatures). The fact that quantum computers are not yet a mainstream threat does not mean this discussion can be postponed indefinitely. The structural choices made now are likely to shape Bitcoin’s next decade.
Younchan Jung
Researcher exploring structural shifts in AI, blockchain, and the on‑chain economy.
If you would like to read this article in Korean, please click the button below.
댓글
댓글 쓰기