What happens to Satoshi’s bitcoin when quantum computers arrive?
Under today’s rules, a big enough quantum computer could take Satoshi’s coins, because they sit in old pay-to-public-key outputs that show their public keys on the chain. A draft proposal, BIP-361, would freeze those coins first by phasing out the old signatures, and Bitcoin hasn’t decided whether to do that. So there are two possible endings for roughly 1 million BTC: someone with a quantum computer spends them, or the network locks them for good.
Published: 2026-10-22 · Last Updated: 2026-10-22
This follows our field guide, Should crypto holders worry about quantum computers?, which covers Q-Day and the hardware timeline. This piece zooms in on the single biggest exposed pile of bitcoin.
How many bitcoin does Satoshi own?
Nobody knows exactly. The usual answer is about 1.1 million BTC, and that number is an estimate built from mining fingerprints. No wallet balance backs it up.
In April 2013, researcher Sergio Demian Lerner noticed that one early miner changed a block field called the ExtraNonce in a distinctive way. He called that miner “Patoshi.” His first eyeball estimate was around 1M BTC. He later put it near 1.1M, from about 22,000 blocks, as Decrypt reported.
The range is wider than the headline number. A September 2026 Cointelegraph Magazine review cites Bitquery’s rebuild of the fingerprint: a strict reading gives just under 0.9M BTC, and a loose one about 1.17M. Lerner calls his own evidence circumstantial.
Three claims hide inside “Satoshi owns 1.1 million.” One machine mined these blocks (well supported). That machine was Satoshi’s (likely, unproven). Satoshi still holds the keys (unknowable). I’d use “roughly 0.9M to 1.17M BTC, mined by one early entity” and stop there.
Why are Satoshi’s coins exposed to a quantum computer?
Early block rewards paid out to a format called P2PK, pay-to-public-key. The public key sits right in the output. Modern addresses show only a hash of the key until you spend.
Shor’s algorithm needs that public key to work backward to the private key. P2PK hands it over. CoinShares counts about 1.6M BTC in early P2PK outputs, and Glassnode puts structurally exposed coins at 1.92M BTC as of May 2026. The Patoshi coins are the largest share of the P2PK pile.
They have never moved. So whoever holds the keys has never migrated them, and nobody knows if they ever will.
What is BIP-361?
BIP-361, “Post Quantum Migration and Legacy Signature Sunset,” is a Draft by Jameson Lopp and five co-authors. It assumes Bitcoin first adopts some post-quantum output type, then sets a deadline for leaving the old ones.
As written, it has two phases:
- Phase A, about 3 years after activation (160,000 blocks). Nobody can send coins to quantum-vulnerable address types anymore. You can still move old coins out to a post-quantum address.
- Phase B, 2 years after Phase A. Nodes stop accepting plain ECDSA and Schnorr spends. Old coins can only move through a “rescue protocol” that proves ownership in a way a quantum attacker couldn’t fake.
The rescue protocol carries most of the weight. The BIP suggests a proof based on BIP-32 seed phrases, which most wallets built since 2012 use. It also says plainly that no rescue path is known for P2PK, because the owner has no secret beyond the exposed key. For P2PK, the authors point to a separate idea called Hourglass, and without it those coins stay locked after Phase B.
Read that against Satoshi’s coins and the result is simple. If BIP-361 activated as written with no Hourglass, the Patoshi coins would become unspendable for everyone, Satoshi included. No activation date exists, and the BIP’s header says it still requires a post-quantum signature BIP that hasn’t been written.
What is the difference between BIP-360 and BIP-361?
BIP-360 builds the lifeboat. BIP-361 sets the deadline for getting into it.
BIP-360, Pay-to-Merkle-Root (P2MR), proposes a new output type by soft fork. It works like Taproot with the key-path spend removed, which leaves no public key sitting on the chain while coins wait. Its own abstract says it only defends against long exposure attacks. Protection for a key revealed in the mempool would need real post-quantum signatures, which the authors plan to propose separately.
BIP-361 adds no new output type. It covers what happens to coins that never use one.
Is BIP-360 merged, and what does that mean?
Yes, and it matters less than it sounds. BIP-360’s text sits in the official bitcoin/bips repository with the status Draft, and the repo’s commit history shows it landing in February 2026, with edits as recent as August 2026. BIP-361 joined the repository in April 2026, also as Draft.
“Merged” here means the BIP editors accepted the document into the repository with a number. It doesn’t mean Bitcoin Core implemented it, and it doesn’t mean miners or nodes agreed to activate it. Neither proposal has activation code or a date as of 2026-10-22.
Should Bitcoin freeze Satoshi’s coins?
Three positions dominate, and each one is coherent.
Freeze them (Lopp and co-authors). Lopp’s March 2025 essay argues that letting a quantum attacker take dormant coins hands wealth from careless or dead holders to whoever builds the machine first. His line: “Quantum recovered coins only make everyone else’s coins worth less.” BIP-361 calls itself defensive and argues that a fixed deadline gives everyone a private reason to upgrade. Lopp has also described the plan as a rough contingency, not a finished spec.
Offer upgrades, freeze nothing (Adam Back). At Paris Blockchain Week in April 2026, the Blockstream CEO argued for adding quantum-resistant options now and letting holders opt in. He called current quantum machines “essentially lab experiments” and pointed to Bitcoin’s record of fixing urgent bugs fast as proof it can coordinate in a crisis, as Decrypt also reported.
The plan can’t save them anyway (Charles Hoskinson). The Cardano founder said BIP-361 works in practice like a hard fork, and that its recovery path can’t cover about 1.7M pre-2013 coins that predate seed phrases, Satoshi’s among them. He still called it “not a bad proposal.”
My read: the freeze camp has the better argument on incentives, and the opt-in camp has the better argument on property rights. Hoskinson’s point is the one I’d watch, because it shows that a rescue protocol can’t help Satoshi’s coins in the first place. For P2PK, the real choice is freeze, throttle (Hourglass) or let them go.
What would “steal vs freeze” mean for bitcoin’s supply?
Bitcoin’s cap stays at 21 million either way. What changes is how many coins can actually move.
- Steal. Roughly 1M Patoshi coins, and up to about 1.6M P2PK coins in total, could come back into circulation through whoever cracks them first. BIP-361 warns this might happen covertly, spread over weeks or months.
- Freeze. The same coins would stay where they are, permanently unspendable. The BIP leans on Satoshi’s 2010 forum post that lost coins work like “a donation to everyone.”
- Throttle. Hourglass, posted by Hunter Beast in April 2025, would allow only one P2PK input per block, which stretches any sell-off over months.
The coins are dormant today, so a freeze mostly formalizes what the market already assumes. Theft would put back into play coins most people treat as gone.
What can a holder of old coins actually do?
If you control keys to early coins, you have more options than Satoshi does, because you can still move them.
- Check the address type. P2PK and any address you’ve spent from before show their public key. A never-spent standard address shows only a hash.
- Move exposed coins to a fresh address you’ve never spent from. Today that buys you hash protection against long exposure attacks.
- Keep your seed phrase. BIP-361’s proposed rescue path relies on BIP-32 seed derivation. If you only have a raw private key from 2010, you are in the P2PK problem group.
- Watch for a post-quantum output type to activate. When wallets support one, migrate. Under BIP-361 as drafted, you’d have about five years from activation.
Nothing here is investment advice.
Frequently asked questions
What happens to Satoshi’s coins at Q-Day?
Under current rules, anyone with a capable quantum computer could derive the private keys and spend them, because they sit in P2PK outputs with visible public keys. If BIP-361 activates first, they would be frozen instead. Neither outcome is decided.
How many bitcoin does Satoshi own?
Estimates run from just under 0.9M to about 1.17M BTC, based on Sergio Lerner’s Patoshi mining pattern. The common figure is about 1.1M. It rests on circumstantial evidence, and nobody can prove who holds the keys today.
Will Bitcoin freeze lost or quantum-vulnerable coins?
Not yet. BIP-361 proposes it and remains a Draft with no activation date as of 2026-10-22. Adam Back and others oppose a forced freeze.
What is BIP-361?
It’s a draft by Jameson Lopp and five co-authors. About three years after activation it would block sends to quantum-vulnerable addresses, and two years later it would restrict old ECDSA and Schnorr spends to a quantum-safe rescue protocol. It has no known rescue path for P2PK coins.
What is the difference between BIP-360 and BIP-361?
BIP-360 creates a new output type, Pay-to-Merkle-Root, that hides public keys from long exposure attacks. BIP-361 is a migration deadline for coins that don’t move to a post-quantum type. Both are Drafts.
Should Bitcoin freeze Satoshi’s coins?
Bitcoin hasn’t settled it. Freezing removes a huge prize for an attacker but overrides an owner’s control of their coins. Leaving them open respects property rights but could put about 1M BTC in an attacker’s hands. Hourglass offers a middle path that slows the release.
About the Author
Rick Bakas is an AI operator and the publisher of Bakas Media, covering AI, quantum computing and crypto. He built the ABBI conversational AI in 2017 and has worked in tokenized assets since 2021. Sources are linked inline next to each number.