Nine Firms Launch Quantum Alliance as 6 Million BTC Sit Exposed

Nine blockchain companies have launched the Quantum Alliance, an open standards body meant to define what "quantum-resistant" means for networks, wallets and infrastructure. The launch was announced on Thursday, October 15. By the alliance's count, about 6 million Bitcoin have exposed public keys, and forecasts for a first practical attack point to the late 2020s.

Who built the alliance and on what model

The founders include Quantus, Postquant Labs, Charles Hoskinson's Midnight Foundation, Keystone, Abelian and the security firm Hacken. Base-layer protocols, privacy networks, rollups, hardware wallets and security auditing sit in one group.

As Decrypt reports, the body is modeled on the IETF, the engineering council that writes internet standards. Proposals will advance on public evidence and working implementations, not on company size or token holdings. Everything will be published openly. The standards target Bitcoin, Ethereum and other networks.

The members describe the problem plainly. There is no agreed definition of "quantum-ready," and no standard way to test it. Today a network can call itself quantum-resistant with no evidence at all.

What exactly will be standardized

The work is split into four tracks:

• migration of blockchains to new cryptography
• post-quantum zero-knowledge proof systems
• wallet security
• compatibility between different networks

The alliance also plans to publish shared security tests and guidance for moving existing networks to quantum-resistant signatures. Quantus founder and CEO Christopher Smith said that one day "post-quantum cryptography" will simply be called "cryptography." No finished standards exist yet, and the tests and guidance are still to come.

The risk in numbers and the dispute over timing

Almost every major blockchain secures accounts with elliptic-curve signatures. Once a public key is visible on the ledger, a sufficiently powerful quantum computer running Shor's algorithm could in theory recover the private key and take the funds. The same signatures guard stablecoin minting keys, bridges, oracles and governance contracts, so one cracked privileged key can hit several platforms at once.

Decrypt cites the alliance's estimate of 6.04 million BTC, while CoinDesk reports 6.4 million, or 30.2% of supply. About 1.1 million BTC of that total is attributed to Satoshi Nakamoto.

The members see the timeline differently. Postquant Labs CTO Richard Carback thinks 2028 is a realistic date for a machine that breaks current cryptography. The Vault's chief revenue officer Bryn Bennett answered that nobody knows the date, but the estimates keep falling. For custodians the question is different: can they migrate in time if the moment arrives early.

The alliance points to a model built by two of its contributors that flags March 2028 as an early window, and to a Google Quantum AI study that cut the qubit estimate for breaking Bitcoin's cryptography to under 500,000. Coinbase recently urged Bitcoin developers to start migrating now, and a consortium backed by BlackRock, Strategy and Coinbase has committed $15 million to the problem.

The sharpest argument is over freezing vulnerable coins. Binance founder Changpeng Zhao suggested freezing Satoshi's 1.1 million BTC if they stay untouched. Developer Jameson Lopp has also proposed restrictions on vulnerable coins. Carback prefers moving the coins or placing them in a trust, where owners who can prove ownership recover their funds. Bennett says a freeze is a decision for the Bitcoin network, not the industry, and would set a precedent on property rights. Critics note it breaks the promise that nobody confiscates anyone's coins.

What the switch will cost

Replacing signatures needs agreement among developers, miners, wallet providers, exchanges and users. New signatures take more space on the blockchain, so fees may rise and throughput may drop, though researchers are already working on ways to soften that effect. According to Bennett, nobody has a credible number, because the main cost is coordination, not cryptography.