Somewhere between one million and six point nine million sits the most consequential accounting dispute in Bitcoin's history, and almost nobody is pricing it. In a September interview, Ethereum Foundation researcher Justin Drake โ introduced to readers as a "Bitcoin security researcher" โ put the exposed supply at roughly one million coins spread across twenty thousand addresses. On-chain analyst James Check countered with a tighter, more defensible figure: 1.716 million coins that are credibly vulnerable. Broaden the criteria to every stale, reused, or pre-hash address and the number swells past 6.9 million. That is not a rounding error. That is a spread wide enough to swallow the market capitalization of most of the rest of this industry. And it deserves your attention now, in the middle of a sideways tape, precisely because nothing about it is urgent โ which is how structural risks always get ignored until they are not.
Why the Address Format Is the Whole Story
To understand why this matters, you have to go back to the mechanics rather than the narrative. Bitcoin's earliest outputs used P2PK โ Pay-to-Public-Key. The public key was written directly into the script, in full, permanently. There was no hashing step. Anyone reading the chain today can see the raw key material of every coin mined before the address format changed. Shor's algorithm, run on a sufficiently capable quantum machine, works backward from a public key to a private key. That is not speculation; it is a mathematical property of elliptic curve cryptography. Modern P2PKH addresses expose the public key only at the moment of spending, which is why Drake's core advice โ move to fresh addresses, do not reuse them, never broadcast a key you still depend on โ is technically sound.
Against that backdrop, two defenses have surfaced. BIP-361, proposed in April, would phase out vulnerable addresses in two stages: first block outgoing transfers from them, then, after a two-year window, hard-freeze them at consensus level. Separately, a system called Quantum Safe Bitcoin executed a quantum-resistant transaction in August, but only through a private mempool operated by MARA's SlipStream โ meaning it never touched the public broadcast layer or the full consensus of the network. Both efforts are real. Both are early. And both sit inside a community that has historically taken years to agree that anything at all should change.
The Number Nobody Can Agree On
In 2017, I spent eleven months as lead community liaison for a decentralized lending project in Cape Town, manually vetting more than two hundred community submissions. What I learned then still governs how I read claims like these: the headline figure is almost always the marketing figure, the defensible figure is usually somewhere in the middle, and the gap between them is where ordinary people get hurt. Drake's one million coins across twenty thousand addresses is seductive because it is clean โ roughly fifty coins per address, matching early block rewards. Check's 1.716 million is less tidy but more honest, because it restricts itself to addresses where the exposure is structural rather than theoretical. The 6.9 million figure, which circulates freely in mainstream coverage, includes coins that may never be vulnerable at all. The spread between these three numbers is not a data problem. It is a pricing problem, and markets cannot price what they cannot define.
Here is the structural fact that keeps me up. The exposure is permanent and irreversible. You cannot retroactively hash a public key that was broadcast in 2009. There is no patch, no soft fork, no upgrade that erases the chain's own history. Every unspent P2PK output is, and will remain, an open ciphertext waiting for a faster machine. This is what I mean when I write that code is law, but ethics is conscience โ the code here is fixed, indifferent, and entirely indifferent to who it was meant to protect. The ethics have to come from us.
That leads directly to the advice gap nobody is addressing. Drake's recommendation โ route change to a new address on every spend โ is correct. It is also not default behavior in a meaningful slice of widely used wallets. Address reuse remains common, and most holders have never checked. So we have a situation where the technical guidance is sound, the tooling silently contradicts it, and the audience most likely to be affected is the least equipped to notice. I have watched this pattern before: a correct warning, issued to people who lack the means to act on it, followed by a scam wave targeting exactly those people. In the same interview, Drake warned that fraudsters would promote fake post-quantum secure wallets. He is right, and that warning deserves more space than the headline received.
The Two-Year Deadline Is a Political Instrument
Which brings me to BIP-361's most revealing detail: the two-year cutoff. Nothing in the proposal's text justifies that specific number from first principles. A freeze window is a political instrument dressed as a technical parameter. Read carefully, the deadline is an implicit admission that its authors believe a credible quantum threat exists within a foreseeable window โ even though no one, Drake included, will commit to a timeline. That ambiguity is not an oversight. It is the only way to move a proposal through a community that would reject it outright if it arrived with a date attached.
Then there is Quantum Safe Bitcoin, and here I want to be precise rather than dismissive. Running quantum-resistant signatures through a private mempool operated by a single mining pool is not a network upgrade. It is a demonstration. It has not been validated by full-node consensus, it has not been stress-tested against adversarial conditions, and it depends on a central channel that the project's own philosophy would reject. I have spent years writing about Layer 2 sequencers that bill themselves as decentralized while running on one machine in a data center. This is the same shape of claim, one layer deeper. Decentralization deferred is decentralization denied.
The supply math deserves its own paragraph. Roughly 8.6 percent of circulating supply sits in the credibly exposed band. Extend the criteria and you reach a third of all coins in existence. Those coins were mined at a cost basis near zero โ electricity, not dollars. If even a fraction of them ever become movable, the marginal seller arrives with no anchor and no mercy. Check's judgment that this would be painful but not catastrophic is reasonable, precisely because these coins have not moved in fifteen years and their holders move slowly when they move at all. But there is a scenario almost nobody models: an actor who unlocks exposed keys and liquidates quietly, over months, through over-the-counter channels, never touching the addresses the entire world is watching. That outcome is worse than a visible dump, because it never triggers the alarms we have built.
And governance is the amplifier nobody mentions. Bitcoin's greatest strength โ no leader, no foundation, no one to subpoena โ is also its slowest feature. BIP-361 needs rough consensus across miners, node operators, and users. Historically, consensus-level changes to Bitcoin have been rare and bruising. If the proposal stalls, the network does not inherit a weaker defense; it inherits no defense, and the gray zone persists indefinitely.
Meanwhile the counterparty disclosure problem is arriving faster than any quantum timeline. Exchange-traded funds and institutional custodians now hold a material share of supply. When the next round of filings lands, quantum exposure becomes a risk factor that compliance teams must either name or explain away. That is a slower, duller, and far more probable vector for repricing than any laboratory breakthrough.
The Threat Worth Fearing Is the Freeze, Not the Machine
Now let me argue against my own alarm, because the contrarian reading matters as much as the warning. The threat that deserves the most attention is not quantum computing. It is the freeze. The moment BIP-361 โ or anything like it โ succeeds at consensus level, Bitcoin has demonstrated, publicly and permanently, that supply is not immutable. Twenty-one million is not a physical law. It is a social contract, and contracts get amended. Once that precedent exists, every future exceptional circumstance has a template. I have watched DAOs write governance charters that claimed immutability in the first paragraph and reserved emergency powers in the last. The pattern is old, and it never ends where it starts.
I would also flag the source. The framing of Drake as a Bitcoin security researcher is a gentle edit that matters. He is an Ethereum Foundation researcher, and Ethereum publishes a post-quantum roadmap. That does not make his technical points wrong โ they are largely correct โ but it does mean the loudest voice urging Bitcoin toward a difficult migration has a counterparty whose narrative benefits from the comparison. Readers deserve to know who is speaking. Solidarity over speculation means naming the interest, not ignoring it.
And the panic economy is already forming. Every quantum headline is a hook for a wallet that claims to be quantum-safe and is not. The people most likely to click are the same people least able to absorb the loss. That, not Shor's algorithm, is what will hurt this community in the next twelve months.
What to Watch
If you want one signal to track through this chop, it is not price. It is those twenty thousand addresses. Any movement โ one transaction, one signature, one coin โ is the loudest thing this market could hear. Until then, treat every urgent migration link as hostile, keep your keys on hardware you control, and remember that the honest answer to when is still that we do not know. Culture on-chain, heart on-screen. The chain will keep its secrets. We have to keep ours.