What it is. Bitcoin is the original digital money, and it has written detailed plans for surviving a future code-breaking computer, yet none of them are switched on yet.
What we found. Roughly a million coins that have not moved since Bitcoin's earliest days, including the founder's, sit in a form their owners can no longer protect, and the community has not agreed whether to freeze them, let people slowly rescue them, or leave them exposed.
Why it matters. If a code-breaking computer arrives before that decision is made, those long-dormant coins could be stolen, and big institutions that hold Bitcoin would already be past the deadlines their own rulebooks set for fixing this.
Bitcoin has a deep published specification lineage (BIP-360, BIP-361, Hourglass V2, BTQ testnet, PACT, OP_CHECKSHRINCS) and zero PQ primitives shipped on mainnet. The cold P2PK cohort (~1.7M BTC, ~1M of which is Satoshi-era) cannot be migrated by its owners and is structurally unrescuable absent a Phase-C zk-recovery path; burn-vs-rescue is undeclared.
Summary
Bitcoin scores QRI 33, Band 4 Architected, Migration Stage 2. Mainnet runs ECDSA secp256k1 / Schnorr secp256k1 (BIP-340) with SHA-256d and RIPEMD-160 hashing; BIP-324 transport uses ECDH on secp256k1. Every active asymmetric primitive is Shor-vulnerable. Project Eleven estimates ~6.9M BTC (~33% of supply) at quantum-vulnerable addresses with public keys visible on-chain; ~1.7M BTC sits in P2PK scripts with ~1M attributable to Satoshi-era outputs. BIP-360 is Draft; BIP-361 was merged into bitcoin/bips on 2026-04-14 but remains Draft per BIP-process. Hourglass V2 proposes a rate-limited canary at consensus level (~1 BTC/block from P2PK outputs), still on a personal fork. Trezor Safe 7 ships SLH-DSA-SHA2-128s for firmware signing, a shipped post-quantum firmware-signing path in a hardware wallet. mainnet-traffic cap binds at 5a=0%, the Architecture-Execution Gap is 38, and Migration Stage caps at 2 because milestones lack enforcement-mechanism backing. The headline governance signal is undeclared burn-vs-rescue: the public split between freeze (BIP-361), optional migration, rate-limit canary, and zk-rescue research has no coordinating authority.
Forge. Forge-dominant: this chain secures value and operations with signatures, so the principal quantum risk is forgery of spends/attestations once Shor breaks the curve. There is no harvest-now component for forgery, the public key alone enables it. Decrypt/HNDL applies only to transport/RPC confidentiality.
11 announced → 0 shipped on mainnet under a named primitive. >1.5 deduction.
Vulnerable supply
- Exposed, pubkey visible: ~6.9M BTC (~33% of circulating supply) at quantum-vulnerable addresses with public keys visible on-chain
- Exposed from creation: ~1.7M BTC in P2PK scripts (pubkey never hashed); ~1M attributable to Satoshi-era outputs
- Exposed after spend, still funded: ~5M BTC in hash-pubkey schemes (P2PKH/P2WPKH/P2SH) whose pubkey was revealed in a past spend and still holds UTXOs
- Never revealed, mitigated: majority of supply (~65%) in hash-pubkey addresses never spent; pubkey not yet revealed, mitigated until first spend
- Permanently unmovable / dormant: ~1M Satoshi-era P2PK plus a long tail of lost keys; Chainalysis estimates 2.3-3.7M BTC (11-19%) may be permanently lost (overlaps the exposed cohort)
The ~6.9M figure is EXPOSURE (visible pubkey), not 'cannot be migrated'. Owner-controlled exposed coins can move to a PQ-safe output once one exists; only the dormant/lost cohort (~1M+ Satoshi-era) is structurally unmovable by its owners.
What the gates say
- Gate 1a, Hybrid signature: FAIL , no hybrid signature composition active on mainnet; BIP-360 OR-composition is Draft only) Recorded as FAIL, not N/A: Gate 1a-Sig defines PASS and FAIL only, and a composition that exists solely as a draft does not satisfy it.
- Gate 1a, Hybrid KEM: COND , Bitcoin has no validator-gossip KEM/PK-encryption surface; BIP-324 uses ECDH but is not classified as a TLS/relay KEM in the rubric sense
- Gate 1b, Commit-to-hash: COND , no live OR-composition; BIP-360 spec includes Merkle-root commit-to-hash construction which would satisfy 1b on activation
- Gate 2, Evidence reconstruction: PASS , every sub-score has ≥3 public artifacts; reconstructible in 48h
- Gate 3, Primitive naming: PASS , every sub-score names exact primitives
Burn-vs-rescue policy on file
Declared option f, Undeclared. Bitcoin has no unified policy. Active public split: freeze/burn (BIP-361 three-phase sunset), optional migration (~10-year voluntary window), rate-limit canary (Hourglass V2), and STARK-rescue/zk-recovery (Phase C of BIP-361, research only; PACT is a second, independent zk-rescue branch proposing a private commitment plus future STARK-proof rescue path for dormant coins, itself requiring its own soft fork). The lack of declaration discipline is itself an evaluable signal, governance lacks a coordinating authority.
Seven dimensions
Each dimension scores 0–100 internally; the weighted roll-up produces the QRI.
1 Cryptographic Exposure weight 15% 46 / 100
Bitcoin Core publicly names every cryptographic primitive in active use. Deduction: BIP-360 candidate primitives (ML-DSA / SLH-DSA / FN-DSA) are listed in draft only, not active mainnet primitives.
ECDSA secp256k1 (legacy/SegWit signatures, BIP-66/BIP-141) · Schnorr secp256k1 (Taproot, BIP-340) · SHA-256d (block headers, Merkle root, BIP-9 commitments) · RIPEMD-160 (P2PKH/P2WPKH/P2SH address hash via HASH160) · HMAC-SHA512 (BIP-32 child key derivation) · ChaCha20-Poly1305 (BIP-324 v2 transport AEAD) · X25519/secp256k1-ECDH (BIP-324 handshake) Every active asymmetric primitive is Shor-vulnerable. The encrypted-transport handshake uses ECDH, so even peer-to-peer link confidentiality has HNDL exposure for any future post-quantum adversary.
ECDSA secp256k1→ Shor-break-via-DL-without-pairingsSchnorr secp256k1 (BIP-340)→ Shor-break-via-DL-without-pairingsSHA-256d→ Grover-weaken (256→128-bit)RIPEMD-160→ Grover-weaken (160→80-bit, classically still infeasible)ChaCha20-Poly1305→ PQ-safe symmetric AEADX25519/secp256k1-ECDH (BIP-324 handshake)→ Shor-break-via-DL-without-pairings
Bitcoin currently deploys zero PQ algorithm families on mainnet. BIP-360 proposes lattice (ML-DSA), with FN-DSA and SLH-DSA as secondary candidates, but none are merged into Bitcoin Core. Diversity Cap is not yet triggered because lattice-monoculture has not shipped; if BIP-360 ships ML-DSA without a hash-based fallback, the cap fires.
BIP-360 draft text references ML-DSA (FIPS 204), SLH-DSA (FIPS 205) and FN-DSA candidate parameter sets but does not select a final category for mainnet. No mainnet output uses a NIST PQC parameter set today.
libsecp256k1 has constant-time scalar/point operations, deterministic nonces (RFC 6979), and ongoing fuzzing/Coq-style spec work; one of the most-reviewed ECC libraries in production. Cryptanalytic tier 1 for ECDSA/Schnorr secp256k1 and SHA-256. BIP-324 uses standard ChaCha20-Poly1305 (RFC 8439). No formally-verified PQ implementation has shipped to Bitcoin Core. The BTQ Bitcoin Quantum testnet v0.3.0 ships Dilithium opcodes outside the Core review process, which lowers tier confidence.
2 Quantum Recovery Exposure weight 10% 23 / 100
Bitcoin's UTXO model exposes pubkeys at varying rates by output type. P2TR (Taproot key-path) outputs publish the 32-byte x-only pubkey directly in the scriptPubKey, these are actively exposed. P2PKH/P2WPKH outputs hash the pubkey; pubkey is revealed only when spent. Address reuse, mempool revelation, and P2PK outputs all lift exposure. Project Eleven estimates ~6.9 million BTC at quantum-vulnerable addresses with public keys visible on-chain (~33% of supply). Of that, ~1.7 million BTC sits in P2PK scripts, including roughly 1 million BTC attributable to ~20,000 Satoshi-era P2PK outputs.
Cold-key exposure is the dominant Bitcoin Forge surface. Project Eleven counts ~1 million BTC concentrated in 11 addresses (Satoshi-era P2PK), plus a long tail of ~20,000 individual P2PK keys totaling ~1.7M BTC. These outputs have had public keys visible on-chain since 2009-2010 and many have not moved for 15+ years, making Y for these holders effectively infinite, they cannot be migrated by their owners. The headline driver of BIP-361 and Hourglass V2 (rate-limit) proposals.
Bitcoin signatures retain validity indefinitely in the UTXO model, there is no expiry. Any output script with an exposed pubkey is forgeable forever post-Shor unless the UTXO is moved to a PQ-safe output type. X = effectively infinite for the cold cohort. Structurally worse than account-based chains where rotated keys can invalidate prior signatures.
BIP-324 uses ECDH-secp256k1 handshake and ChaCha20-Poly1305 AEAD. The handshake is Shor-vulnerable; harvested handshakes and link traffic could be retroactively decrypted. RPC over TLS uses standard classical KEMs unless operators deploy hybrid KEM at the load-balancer layer. No protocol-level PQ KEM is documented for Bitcoin's transport. Mitigating factor: Bitcoin link traffic is largely block/tx propagation already mirrored on-chain in plaintext, so the privacy delta from HNDL is small relative to validator gossip on PoS chains.
3 Metadata, Anonymity & Confidentiality weight 13% 36 / 100
Bitcoin is pseudonymous UTXO. Public chain analytics (Chainalysis, Arkham, mempool.space) cluster addresses with high recall. Off-chain mixers (CoinJoin, Wasabi 2.x, JoinMarket) provide partial unlinkability for users who opt in. No protocol-level shielded set.
Bitcoin nodes are widely self-hosted (~20K reachable nodes). Top-3 RPC providers (mempool.space, blockstream.info, self-hosted Electrum servers) less concentrated than EVM RPC. Mempool gossip is observable via any full node. Validator metadata retention does not apply (PoW). Mining pool concentration is high: Foundry USA ~25.6%, AntPool ~19.8%, ViaBTC ~10-11%; combined top-3 ~55%, with a March 2026 reorg event illustrating concentration risk.
WBTC (BitGo custody, Ethereum), tBTC (decentralized, threshold ECDSA), and Lightning Network are the dominant Bitcoin bridges/L2s. WBTC mints/burns are fully traceable through the BitGo merchant flow. tBTC uses a t-ECDSA signing group and is publicly auditable. Lightning provides off-chain unlinkability for routed payments but channel open/close are on-chain.
Shor on secp256k1 exposes pubkeys behind every previously-spent P2PKH/P2WPKH output, plus all P2TR outputs by construction. Address-clustering heuristics already perform near-complete de-anonymization for non-CoinJoin users; PQ does not add catastrophic anonymity loss but removes the small remaining privacy buffer for cold P2PKH addresses.
No protocol-level mixnet. Off-chain CoinJoin coordinators (Wasabi 2.x, JoinMarket) provide opt-in shuffling, wallet-layer only. Samourai Whirlpool was shut down in 2024.
4 Migration Architecture weight 10% 56 / 100
Bitcoin requires a soft fork to introduce new output types or signature schemes. Historical cadence: SegWit (2017, ~2 years to activation), Taproot (2021, ~3 years from BIP-340 to activation). BIP-360 P2MR is structured as a soft fork adding a new SegWit version 2 output type, the canonical agility path. There is no algorithm-switch primitive comparable to EIP-7702.
No account abstraction. UTXO model has no native key rotation, users must spend from old outputs to new addresses, which itself reveals the pubkey at spend time. Client-layer PQ wrappers (e.g., commitment-to-PQ-pubkey schemes proposed in BIP-360 discussions) are spec-only. Migration burden falls entirely on individual UTXO holders.
Strong record of soft-fork upgrades under contested conditions. SegWit 2017 (UASF activation under block-size-war pressure) and Taproot 2021 (Speedy Trial signaling) both shipped without chain split. Block-size war (2015-2017) demonstrated coordination capability under adversarial pressure. Cadence is conservative, typically 2-4 years from BIP draft to activation.
BIP-360 P2MR is hybrid by construction, a new output type alongside existing P2PKH/P2WPKH/P2TR. Old UTXOs remain spendable under classical ECDSA/Schnorr; new UTXOs commit to a Merkle root over PQ pubkeys. The canonical Gate 1a-Sig OR-composition pattern. Gate 1b (commit-to-hash) is satisfied by the Merkle-root commitment. Status: Draft, not active.
BIP-360 candidate primitives are stateless (ML-DSA, SLH-DSA, FN-DSA). No stateful hash scheme (XMSS, LMS) is in scope. Default 15/15 per v3.1 rule.
N/A, Nakamoto PoW, no BLS aggregation in consensus. Not scored, so it is left out of the dimension total rather than counted as a zero.
5 Deployment Execution weight 22% 18 / 100
Zero PQC primitives on Bitcoin mainnet as of 2026-05-01. BIP-360 is Draft; BIP-361 is Draft (merged into bitcoin/bips 2026-04-15). No mainnet PQ output type. BTQ Bitcoin Quantum testnet v0.3.0 ships Dilithium opcodes but is testnet-only and outside Bitcoin Core.
Zero PQ code merged in Bitcoin Core. External BTQ Bitcoin Quantum client (forked from Core) ships Dilithium opcodes on testnet v0.3.0. Not in mainline.
PoW network, no validator set. Miners run SHA-256d unchanged; their per-block signature is over block-reward transactions using ECDSA secp256k1, not PQ. Not scored: there is no key-holding block producer here, so there is no validator key to adopt. Left out of the dimension total rather than counted as a zero. Post-quantum user-transaction signing is measured in 5a.
VOIDED to 0 per v3.1 (5a=0 forces Milestone-Discipline cap). Bitcoin does have multiple dated artifacts, BIP-360 entered the BIPs repository on 2026-02-11 (Draft); BIP-361 was merged 2026-04-15 with three-phase sunset; BTQ Bitcoin Quantum testnet v0.3.0 March 2026; Hourglass V2 spec on personal GitHub. None are enforcement-mechanism-backed.
Announced PQC artifacts in trailing 12 months: BIP-360, BIP-361, Hourglass V2, BTQ testnet v0.3.0, Project Eleven Q-Day Prize publicity, Project Eleven's 2026 quantum-threat report, industry-press Bitcoin PQ commentary, Trezor Safe 7 firmware-signing, PACT, OP_CHECKSHRINCS, an unreviewed third-party ZK-freeze claim. Shipped on mainnet: zero. Bitcoin's published artifacts are technically grounded BIPs and explicitly labelled Draft or research-only; estimated ratio ~10-11 announced-to-shipped, qualifying for the >1.5 deduction band but below the >5.0 narrative-only tag.
BIP-360 references ML-DSA-44 (~2,420-byte signature, ~1,312-byte pubkey), SLH-DSA-128s (~7,856 bytes), FN-DSA-512 (~666 bytes). Versus current Bitcoin Schnorr 64-byte signature, multipliers fall in the 10-125× range raw bytes. Adjusted to vbytes via SegWit witness discount, BIP-360 estimates ~5-7× block-cost increase per spend for ML-DSA.
6 Supply Chain Vendor Readiness weight 22% 23 / 100
Top-3 Bitcoin custody wallets by user volume include Ledger, Trezor, a major-exchange wallet (custodial-adjacent); active hardware-wallet leaders are Trezor, Ledger, Coldcard. Trezor Safe 7 ships SLH-DSA-SHA2-128s in hybrid with Ed25519 for firmware-signing and boot verification, a shipped post-quantum firmware signing path (firmware, not user transactions). Ledger Donjon published 2026 PQC research analysis but has not announced a product PQC roadmap.
Top-3 Bitcoin bridges: WBTC (BitGo-custodied), tBTC (threshold-ECDSA, Threshold Network), Lightning Network. Zero have published PQC roadmaps. WBTC depends on BitGo. tBTC uses threshold ECDSA, same secp256k1 vulnerability. Lightning channels use ECDSA-secp256k1 commitment transactions and ECDH for onion routing (Sphinx).
Top-3 institutional Bitcoin custodians: a tier-1 US custodian, BitGo, Fidelity Digital Assets. Fireblocks has publicly committed to publishing a full PQC strategy document later in 2026 covering certificate, TLS, and MPC migration. a tier-1 US custodian committed in April 2026 to launching quantum-proof institutional custody by late 2026 (not dated more precisely). BitGo and Fidelity have no public PQC migration timetable.
Bitcoin RPC concentration is low (self-hosted majority, mempool.space, Blockstream Esplora). Of HSM vendors holding institutional Bitcoin keys (Thales Luna, AWS CloudHSM, YubiHSM, Ledger Vault), AWS KMS published a PQC hybrid TLS pilot for KMS endpoints in 2024-2025; broader signing-path PQC is research only. TEE attestation (Intel SGX/TDX, AMD SEV-SNP, AWS Nitro) remains classical for attestation-key signing.
7 Governance & Coordination weight 8% 54 / 100
Mining pool concentration is real: Foundry USA ~25.6% + AntPool ~19.8% combined ~45%, top-3 with ViaBTC ~55-56%. Nakamoto coefficient for mining ≈ 3. Reachable node count ~20K; node software diversity is dominated by Bitcoin Core with minor Bitcoin Knots and btcd presence. March 2026 saw a 2-block reorg from Foundry, concentration is no longer hypothetical.
SegWit 2017 (UASF), Taproot 2021 (Speedy Trial). Both successful. Cadence is slow but the network has shipped consensus-level upgrades under contested conditions. BIP-360 / BIP-361 are early. BIP-360 co-author estimate: 7-year migration window from spec to activation.
No formal foundation. Bitcoin Core maintainers operate under rough-consensus model. BIP authorship is distributed: BIP-360, BIP-361. No named coordination lead with mandate to ship PQ across the ecosystem. the parent company's CEO announced in April 2026 a coalition to coordinate Bitcoin PQ migration, early stage.
Block size wars 2015-2017, UASF, SegWit activation under fork-threat conditions. Strong precedent for rough-consensus coordination under economic and political pressure.
Hourglass V2 (Hunter Beast / cryptoquick) is a rate-limited spending rule canary, proposed at consensus level, ≤1 BTC/block from P2PK outputs (~144 BTC/day, vs unconstrained ~6,000+ P2PK transactions per block). Status: spec only on personal BIPs branch, not in bitcoin/bips. Project Eleven Q-Day Prize functions as a community honeypot signal, awarding 1 BTC for documented quantum attacks on ECC of progressively larger key sizes (15-bit broken April 2026, since disputed).
Source-disagreement disclosure
v3.1 requires every chain card to publish material divergences among authoritative sources, plus the delta-QRI under alternative weighting.
The BIP file was merged into the bitcoin/bips repository on 2026-04-15; the document itself remains labeled Status: Draft per BIP-process header. Both states are simultaneously true.
ML-DSA prioritized in current draft; FN-DSA preferred for aggregation; SLH-DSA candidate for stateless conservatism. Shortlist not finalized.
April 2026 1-BTC prize award contested, independent reviewers reproduced the 15-bit ECC break on classical hardware using random-number-generator approaches, raising questions about whether the demonstration is genuinely quantum.
Delta-QRI under alternative weighting
Under a stricter exposure-weighted model that weights Dim 2 cold-key exposure higher and Dim 6 vendor lower, QRI falls to ~25. Under a milestone-credit model that does not void 5d when 5a=0, QRI rises to ~32-33. Range: 25-33.
Announcement-to-shipped ratio
Announced: 11. Shipped: 0. Ratio: 11.
Tag: >1.5 deduction
Peers in the L1 profile
9 chains closest to Bitcoin by Stage then QRI.