Jameson Lopp Says 2.6 Million Bitcoin (BTC) May Never Reach Quantum Safety

2.6 Million BTC Outside Quantum Migration

A quantum computer able to break Bitcoin (BTC) remains thousands of times beyond today's hardware, yet the security chief who says so warns that preparations are already running late. Jameson Lopp, chief security officer at multi-key custodian Casa, argued in a recent interview that closing the gap would take several massive breakthroughs, and the dispute is about cryptography rather than the Bitcoin (BTC) price. At the center of the debate sit about 2.6 million BTC, worth roughly $207 billion, in addresses that may never move to quantum-safe cryptography. Lopp estimates those coins, about 13% of supply, could never migrate. Their private keys are not exposed today, but their public keys already sit on-chain, which would hand an attacker unlimited time once a capable machine exists. The exposed set covers early pay-to-public-key outputs, reused addresses and Taproot outputs, the same script type that carries Bitcoin Ordinals inscriptions. None of those coins can be rescued retroactively once a key falls, which is why the estimate treats them as permanently stranded. Hardware backs Lopp's skepticism: Google's Willow chip runs on 105 qubits, while Google estimated in March that cracking Bitcoin's signatures would need fewer than 500,000, a gap of more than 4,700-fold. The risk targets the elliptic-curve signatures that authorize spending, not the SHA-256 hashing behind mining, where quantum speedups are far weaker. Lopp added one caveat: breakthroughs in artificial intelligence tend to spill into other fields, and quantum research could be next. He set his own benchmark in the interview: "I'm still hopeful that we have at least a decade or more, because if we have less than a decade, we're behind... as we all know, Bitcoin (BTC) is very, very difficult to change." His September essay frames the urgency the same way, writing that decentralized systems must solve hard coordination problems before they become emergencies.

Q-Day Inside a Decade?

Oxford quantum computing lecturer Stefano Gogioso draws the line tighter. He defines Q-Day as the point when Bitcoin's secp256k1 curve can be broken within a single block, roughly 10 minutes, and his forecasting models set it to the early-to-mid 2030s, depending on how conservative the estimate is. He stated both the definition and the range in an October 24 post on X. Gogioso co-founded Spooqy, a startup building quantum money, and argued at a July expert panel that even a small chance of a break justifies preparing now. Lopp's own deadline makes the disagreement concrete. He co-authored BIP-361, a draft proposal to phase out quantum-vulnerable signatures over several years, and does not expect serious calls to activate it unless a capable quantum computer looks less than 10 years away. Gogioso's forecast falls inside that window. Migration itself is slow: Chaincode Labs, a Bitcoin (BTC) research firm, estimates a full upgrade could take five to 15 years, according to Lopp's essay. In July, Gogioso blamed Bitcoin's lack of formal governance for the slow response. Large holders have started moving anyway: Coinbase, which holds about 12% of all BTC, published a post-quantum readiness plan in October. Custodial holdings are the easier case, since an exchange can rotate its custody architecture without touching the base protocol, which is why plans like Coinbase's appear before any consensus change. The protocol, by contrast, still has no agreed deadline, and the wider Bitcoin ecosystem has produced readiness plans from custodians rather than a migration schedule, even with roughly 13% of a supply that is already 95% mined sitting in exposed addresses.

Governance, Not Physics, Sets the Clock

Read together, the two positions agree on more than their headlines suggest. Hardware sits more than 4,700-fold short of what the attack needs, and Bitcoin's change-resistant culture, often read through the lens of Bitcoin maximalism, has no formal mechanism to set a migration deadline, which is why both Lopp and Gogioso treat coordination rather than physics as the binding constraint. What remains unconfirmed is the threat itself: no party in the record claims a quantum computer has broken a Bitcoin signature, or that a Q-Day has drawn near; the early-2030s date is a model projection, not a demonstration. Until a capable machine exists, the 2.6 million coins are a planning problem rather than a loss.