Quantum Alliance counts 6.04 million bitcoin with exposed public keys

Nine blockchain companies founded the Quantum Alliance on October 15, 2026, an open standards body for post-quantum security. Three things about it are documented so far: the launch itself, the alliance's count of roughly 6.04 million bitcoin, about 30 percent of the circulating supply, held in addresses whose public key is permanently exposed, and a model run by two contributors that names March 2028 as the earliest window for a cryptographically relevant quantum computer. Everything beyond that is assessment, not evidence: when such a machine will actually exist, whether it will be built at all, and whose hands it will be in by then. This piece keeps the two apart and says which address in your own holdings falls into the risk group and which does not.

What the Quantum Alliance is and who founded it on October 15

The Quantum Alliance is a standards body, not a product and not a blockchain. Its purpose is a common definition of what "quantum-ready" actually means for a blockchain, a wallet and a custodian, plus a test procedure that allows such claims to be checked. According to the report by Decrypt, the named contributors include Quantus, Postquant Labs, the Midnight Foundation, Keystone, Abelian and Hacken; the industry outlet TFTC adds American Fortress, Intmax and The Vault. The line-up therefore runs from base protocols through rollups and privacy networks to a hardware wallet maker and an audit firm.

The model is explicitly the Internet Engineering Task Force: proposals win on publicly verifiable evidence and running implementations rather than on company size or token holdings, and all results are published openly. One point matters for expectations. The alliance cannot force anyone to migrate. What it supplies is a yardstick against which providers will have to measure themselves. Sources differ slightly on the founding date, with one aggregator putting the start at October 16; the detailed reports name October 15, a Thursday.

6.04 million bitcoin: where the figure comes from and what it counts

The widely quoted number comes from a count of the blockchain as it stands today and is not a forecast. What it counts are bitcoin sitting in outputs whose public key is already permanently recorded on the blockchain. TFTC traces the figure to Glassnode data and gives 6.04 million BTC, or 30.2 percent of the circulating supply. Decrypt attributes the same order of magnitude to the alliance's own count and speaks of around 30 percent. Both values therefore come from the same measurement; no independent third survey exists so far.

A large share of that stock is old. Early balances from 2009 sit in pay-to-public-key outputs, the first bitcoin output type, in which the public key appears directly in the output. Those coins have not moved for years and some will never move again because the keys are lost. For risk purposes that means the 6.04 million describe an upper bound on the exposed stock. How much of it belongs to active holders who reuse their addresses carelessly today is something the figure does not say.

The public key is the risk, not the bitcoin address

This is the mechanism missing from most of the coverage. A bitcoin address is a hash value, a one-way function over the public key. As long as only the address is known, the public key itself is not on the blockchain, and a quantum computer would have nothing to run Shor's algorithm against. Shor's algorithm is the method by which a sufficiently large quantum computer could derive the private key from a public one.

The public key is exposed the moment funds are first spent from an address, because the signature in the input contains it. From that comes the practical rule that holds regardless of any timetable: an address that has never had anything leave it keeps its public key hidden. An address that is used repeatedly, and that retains a remaining balance after a spend, has published it permanently. Which output types expose their key is something we have broken down in our analysis of the subject.

For self-custody this is the distinction that counts. If you use a modern wallet that generates a fresh receiving address for every incoming payment and sends the change to a new change address, you are already working the way the migration debate demands. Which devices do this reliably is shown in our overview of hardware wallets.

Four alliance working groups, from migration to wallet security

The work starts in four groups. The first deals with migrating existing blockchains, that is, the question of how a live network adopts new signature schemes without devaluing old balances. The second takes on post-quantum zero-knowledge methods; a zero-knowledge proof establishes a statement without revealing the underlying data, and many of these methods today rest on the same mathematics as the vulnerable signatures. The third group works on wallet security, the fourth on cross-blockchain compatibility, so that a migrated network can keep working with one that has not migrated.

That division says more about the time required than any forecast does. Three of the four areas concern software running at third parties: exchanges, custodians, wallet makers and bridge operators. That is precisely why Coinbase has been pressing since mid-October for an early start to the switch and talks about a lead time of years.

Google's March 30, 2026 paper cuts the estimate to under 500,000 qubits

Behind the urgency sits a calculation. No working machine exists to this day. A paper from Google Quantum AI dated March 30, 2026 lowered the estimated number of physical qubits needed to break secp256k1, the curve bitcoin uses, to under 500,000. A physical qubit is a single computing element of the machine; many of them together make up one error-corrected logical qubit, which is what an algorithm actually computes with. Earlier estimates, according to the coverage of the alliance, stood at a multiple of that figure; TFTC puts the improvement at roughly one twentieth of the previous assumption.

That number describes the size of a hypothetical machine, not its delivery date. Nothing in the paper says such a machine exists; both reports examined here state explicitly that it does not. The figure is nonetheless the hardest reference point the debate has, because it replaces a moving estimate with an upper bound that can be checked.

March 2028 in the Quantum Doom Clock is an early-warning window, not a deadline

Two alliance contributors run a model that derives a date from progress in qubit counts, and according to Decrypt that model names March 2028 as the earliest window. It is a model calculation. Anyone working with it reads it as an early warning: before then, no attack is to be expected given the current state of the technology, and after it begins the range in which the model's assumptions are no longer backed by reality.

For your own planning the interval matters more than the date. Roughly 17 months lie between today and March 2028. A soft fork in bitcoin has historically taken longer than that from a mature specification to activation, and the switch at custodians and exchanges comes after. That calculation is exactly the alliance's argument for an early start, and it stands whether or not you believe the date.

BIP-360 and pay-to-merkle-root: bitcoin needs a soft fork to make the switch

Inside bitcoin the work runs separately from the alliance. The concrete proposal is called BIP-360; a BIP is a Bitcoin Improvement Proposal, the public drafting route for protocol changes. According to TFTC, BIP-360 describes an output type called pay-to-merkle-root that keeps the public key out of the blockchain for longer by having the output contain only a commitment to a quantum-resistant key hash. A revision dated July 24, 2026 added Python examples and test vectors, which makes the draft testable.

Implementation would come as a soft fork, a backward-compatible rule change under which old nodes continue to accept the new transactions. A soft fork is easier to push through than a hard split, but it needs agreement among miners, node operators and wallet makers. That the majority of the alliance's founding members do not come from bitcoin core development is the central criticism of it, and TFTC frames that as an opinion piece. For context, that means the alliance sets standards for the whole field; it does not decide bitcoin's path.

Christopher Smith, founder and chief executive of member firm Quantus, sums up the expectation: "In the future, post-quantum cryptography will simply be called cryptography, and everything else will be in a museum." The quote appears in that form in both reports examined here.

Address reuse is the point holders in Germany control themselves

Of all the areas named, exactly one is reachable without a protocol change: address reuse. Address reuse means using the same receiving address more than once, for instance as a fixed withdrawal address at an exchange or as a donation address. After the first spend from that address its public key is exposed, and every further incoming payment lands on a key that is already public.

The wallet setting comes first: does the wallet generate a new address for every incoming payment, or has it been showing the same one for months? Then there are the withdrawal addresses stored at exchanges and payment services, which often sit unchanged for years and hit the same exposed key with every deposit. And then there is the output type of old holdings: balances in very early output types belong to the group the alliance is talking about.

A word on the caution this debate requires: a demand to move funds to a supposedly "quantum-safe" address is not a step in the migration. Changes of that kind run through software updates and through your own wallet, never through an address that arrives in a message.

$15 million from BlackRock, Strategy and Coinbase for the quantum problem

The alliance is not the only answer to Google's calculation. According to Decrypt, a consortium backed by BlackRock, Strategy and Coinbase has committed $15 million to work on quantum risk. Measured against the holdings of those three houses it is a small sum, and it says nothing about success. It does say something about direction: the large custodians now treat the subject as an operational risk with a budget rather than a debate about the future.

For investors in Germany that is the more important observation. If you hold bitcoin through a security or leave it with a custodian, your exposure to the switch depends on their schedule. If you hold it yourself, you decide yourself, but you also pay for the switch yourself.

Custody at a regulated exchange shifts the switch onto the provider

If the coins sit at an exchange or a custodian, migration belongs on their list of duties. The addresses holding the balances belong to the provider, and the decision on output types and signature schemes is theirs. The useful question to put to a provider is therefore not whether it is "quantum-safe" but whether it has a published roadmap for the switch and who audits it. That is exactly what the alliance's yardstick is being built for. Which providers operate with authorisation in the EU and how their custody is structured is set out in our overview of regulated crypto exchanges.

If you hold your coins yourself, you carry the migration yourself, but you can also start immediately. The order is always the same: first secure and verify the recovery phrase, then update the software, and move balances after that. Reverse the order and start by moving, and you risk losing the funds at a point where no quantum computer is needed at all.

Holding period and records: why the wallet counts for FIFO allocation

Moving to fresh addresses creates transactions, and those have to remain traceable. The German finance ministry's letter of March 6, 2025 on individual questions of the income tax treatment of crypto assets takes individual identification as the basis for the sequence of disposals of privately held assets and, where that is not possible, permits the FIFO method as a simplification, applied per wallet. Which holdings sit in which wallet therefore forms part of the calculation.

In practice that means: if you move holdings to new addresses, record the times, addresses, amounts and prices so that acquisition and allocation can be evidenced later. A transfer between two of your own addresses is not a sale on the market, because there is no consideration and no buyer; how the transaction is to be treated in your own return is something to settle against the letter, and with a tax adviser for larger holdings. The usual tools collect the records as you go.

Our assessment: the timetable is contested, address hygiene is not

From this desk, what carries this story is the mechanics, not the date. Three documented points argue for that: the 6.04 million exposed bitcoin come from a single measurement, the qubit estimate of under 500,000 describes a machine that does not exist, and March 2028 comes out of a model run by two parties who make their living from the subject. Nothing argues against the practical consequence: a fresh receiving address per incoming payment costs nothing, requires no protocol change, and works whether or not the model is right. Selling in panic today, or moving holdings in haste, means taking on a real risk to avoid a hypothetical one. Crypto assets can swing sharply and can lead to a total loss.

Quantum Alliance: before March 2028 your choice of address decides alone

Three steps, in this order:

1. Check the wallet. Open your wallet and see whether it offers a new address when you receive. If it does not, a change is due; which programs get it right is shown in our comparison of software wallets.
2. Renew withdrawal addresses. Review the addresses stored permanently at exchanges and services and replace reused ones with fresh addresses. If you use a custodian, ask there about the published roadmap; the market overview is provided by the major crypto exchanges compared.
3. Secure the records. Before every move, note the time, address, amount and price so the allocation holds up later; tax software and portfolio trackers help with this.

(As of October 21, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)