Nine institutional holders of Bitcoin — Anchorage Digital, ARK Invest, BlackRock, Block, Blockstream, Coinbase, Fidelity Digital Assets, Galaxy, and Strategy — announced the Bitcoin Security Consortium on July 23, 2026, pledging a combined $15 million over three years for security research. The i...
"Bitcoin's security is a shared responsibility. Today we are launching the Bitcoin Security Consortium, backed by $15 million in commitments to support the developers and researchers strengthening Bitcoin for the decades ahead." — Michael Saylor, Executive Chairman, Strategy
Nine institutional holders of Bitcoin — Anchorage Digital, ARK Invest, BlackRock, Block, Blockstream, Coinbase, Fidelity Digital Assets, Galaxy, and Strategy — announced the Bitcoin Security Consortium on July 23, 2026, pledging a combined $15 million over three years for security research. The immediate focus: post-quantum cryptography. The motivation: a June 2026 Coinbase report estimating that approximately 7 million BTC, worth roughly $460 billion at current prices, sit in addresses where the corresponding public keys are already exposed on-chain — making those coins vulnerable once quantum computers reach sufficient scale.
The consortium arrives at a specific inflection point. BIP-360, Bitcoin's first quantum-resistant address type, was merged into the official repository on February 11, 2026. Google Quantum AI published a March 2026 paper estimating that breaking Bitcoin's secp256k1 ECDSA-256 requires approximately 1,200–1,450 logical qubits — achievable with fewer than 500,000 physical qubits, a 20x reduction from the 20 million projected in 2019. DARPA's managing director stated in March 2026 that a utility-scale quantum computer by 2033 now "seems more likely than not." The timeline has compressed. The money has arrived.
The Bitcoin Security Consortium is deliberately structured as a coordination body, not a fund. Each of the nine members directs its share of the $15 million independently. There is no pooled fund, no centralized allocation committee, and no governance authority over Bitcoin's protocol. Mike Schmidt, Executive Director of the nonprofit Brink, coordinates the group's day-to-day operations in a volunteer capacity, according to Strategy's press release.
The membership spans the institutional Bitcoin stack: asset managers (BlackRock, ARK Invest, Fidelity Digital Assets), corporate holders (Strategy), exchanges (Coinbase), infrastructure providers (Blockstream, Galaxy), custodians (Anchorage Digital), and payments (Block). Collectively, these firms hold, custody, or manage exposure to a significant portion of Bitcoin's circulating supply.
The consortium has committed to publishing periodic reports on the state of Bitcoin security research, aimed at both investors and the public. It explicitly takes no position on specific protocol changes.
At $15 million over three years, the funding amounts to roughly $5 million per year — modest against the $460 billion in exposed BTC, but significant relative to current Bitcoin open-source developer funding. According to Brink's own public reporting, the organization granted approximately $3.5 million to Bitcoin Core developers in 2025. The consortium's pledge effectively doubles the annual funding available for security-specific work.
The June 2026 Coinbase quantum threat report provides the most granular breakdown to date of Bitcoin's quantum attack surface. The 7 million BTC figure breaks down into two categories:
Legacy Pay-to-Public-Key (P2PK) addresses: Approximately 1.7 million BTC across roughly 20,000 addresses. In P2PK outputs, the public key is the address itself — fully visible on-chain from the moment of creation. These include many early-mined coins, some of which may be permanently lost. Satoshi Nakamoto's estimated 1.1 million BTC holdings are predominantly in P2PK format.
Address reuse: Approximately 5 million BTC tied to addresses that have been used for outgoing transactions. When a Bitcoin user spends from an address, the public key is broadcast to the network and permanently recorded on-chain. If additional funds are subsequently received at the same address, those funds sit behind an exposed public key. According to Coinbase, this category includes cold wallets maintained by major exchanges and custodians — entities that have historically reused addresses for operational convenience.
Combined, these 7 million BTC represent approximately 33% of Bitcoin's circulating supply. The dollar exposure fluctuates with price; at Bitcoin's July 2026 price of approximately $65,000, the figure stands near $455–460 billion.
Importantly, modern wallet formats (P2PKH, P2SH, P2WPKH, P2TR) that have never been spent from do not expose public keys. Users holding BTC in these formats without address reuse face no near-term quantum risk.
Bitcoin's transaction authorization relies on the Elliptic Curve Digital Signature Algorithm (ECDSA) over the secp256k1 curve. A sufficiently powerful quantum computer running Shor's algorithm could derive a private key from a public key — an operation that is computationally infeasible for classical computers but polynomial-time for quantum hardware.
The attack scenario is specific: an adversary with quantum capability observes a public key on-chain, computes the corresponding private key, and broadcasts a transaction moving the funds. For unspent P2PK outputs, the public key is permanently visible, providing an indefinite attack window. For reused addresses, the window opens the moment a spending transaction broadcasts the public key.
There is a second, narrower attack vector: an adversary could intercept a transaction in the mempool, extract the public key from the signature, derive the private key, and broadcast a competing transaction before the legitimate one confirms. This "intercept and redirect" attack would require breaking ECDSA within a single block interval (approximately 10 minutes) — a far more demanding computational requirement.
Bitcoin's mining security (SHA-256 proof of work) faces a separate quantum threat via Grover's algorithm, which provides a quadratic speedup for hash preimage search. However, the consensus among researchers is that this threat is less immediate: Grover's speedup can be countered by doubling the hash length, and the practical qubit requirements are substantially higher.
The gap between current quantum hardware and the capability needed to break Bitcoin's cryptography remains significant — but it is closing faster than most projections anticipated.
Current state (mid-2026): The best publicly known quantum hardware operates at approximately 2,500 physical qubits. Google's Willow chip carries 105 superconducting qubits. IBM's Condor processor reached 1,121 qubits. Atom Computing's neutral-atom machine holds the current commercial record at 1,225 qubits. None can run Shor's algorithm at cryptographically relevant scale.
Revised estimates: Google Quantum AI's March 2026 whitepaper estimated that breaking secp256k1 ECDSA-256 requires approximately 1,200–1,450 logical qubits and fewer than 500,000 physical qubits under their superconducting architecture. A simultaneous analysis from Caltech and Oratomic estimated approximately 26,000 physical qubits on a neutral-atom machine could accomplish the same attack over a 10-day window. Both estimates represent a substantial reduction from the 20 million physical qubit projection that prevailed as recently as 2019.
Timeline estimates: DARPA's March 2026 assessment put the baseline for a cryptographically relevant quantum computer at 2033. An arXiv paper published in June 2026 (2606.14484) analyzed quantum computing as a threat to both Bitcoin and Ethereum, concluding the threat window sits at 5–10 years. IBM's quantum roadmap targets full-scale fault-tolerant quantum computing by 2029, with quantum advantage demonstrations in 2026.
The relevant metric is not qubit count alone but logical qubits — error-corrected qubits capable of sustained coherent computation. Current error rates require hundreds to thousands of physical qubits per logical qubit. Google's Willow demonstrated reduced error rates as qubit count scales, a necessary milestone. But the jump from 105 qubits to 500,000 remains a roughly 4,760x scaling challenge.
BIP-360, merged into Bitcoin's official repository on February 11, 2026, introduces Pay-to-Merkle-Root (P2MR) — Bitcoin's first quantum-resistant address type. The proposal removes the most quantum-vulnerable key path from Taproot outputs and creates a framework for integrating post-quantum signature schemes.
The companion BIP for post-quantum signatures points to two NIST-standardized algorithms:
ML-DSA (Module-Lattice-Based Digital Signature Algorithm, formerly CRYSTALS-Dilithium): The pragmatic near-term choice. ML-DSA-44 produces signatures of approximately 2,420 bytes — a 37x increase over Bitcoin's current 65-byte Schnorr signatures. Verification is fast. NIST finalized the standard as FIPS 204 in August 2024.
SLH-DSA (Stateless Hash-Based Digital Signature Algorithm, formerly SPHINCS+): A conservative fallback relying solely on hash functions with no lattice assumptions. Signatures run approximately 7,800 bytes, making on-chain use prohibitively expensive for most transactions. NIST standardized it as FIPS 205.
The size differential is the central engineering challenge. A standard Bitcoin block is 4 MB. At 2,420 bytes per ML-DSA signature versus 65 bytes for Schnorr, a block that currently fits approximately 2,500 transactions would accommodate roughly 1,600 — a 36% capacity reduction. With SLH-DSA, the reduction exceeds 80%.
The migration path requires a soft fork. No activation timeline has been set. The Bitcoin Core development process requires extensive peer review, testing, and community consensus — historically measured in years. The Taproot soft fork, by comparison, took approximately four years from initial proposal (January 2018) to activation (November 2021).
BTQ Technologies demonstrated a proof-of-concept quantum-safe Bitcoin implementation using NIST-standardized post-quantum cryptography in October 2025, though the work has not been integrated into the mainline Bitcoin codebase.
The consortium surfaces a structural tension in Bitcoin's security model. On one hand, the quantum threat demands proactive protocol changes — new address types, new signature schemes, potentially a mandatory migration away from vulnerable address formats. On the other hand, Bitcoin's value proposition rests partly on protocol stability and resistance to change.
Michael Saylor has argued publicly that Bitcoin's core protocol should remain stable, with innovation occurring on Layer-2 systems and applications rather than through base-layer consensus changes. Yet the consortium he co-launched exists specifically to fund research into changes that would require a consensus-level soft fork.
The consortium addresses this tension through its governance structure: it funds researchers but does not direct protocol development. It takes no position on specific BIPs. Whether this arm's-length approach survives contact with a concrete upgrade proposal — particularly one that might deprecate legacy address formats — remains to be tested.
There is also the question of the approximately 1.1 million BTC in presumed Satoshi addresses. These are P2PK outputs with fully exposed public keys. A quantum-capable adversary could potentially move these coins. Any migration scheme that time-locks or burns unmigrated coins would effectively destroy Bitcoin's earliest holdings — a politically charged decision regardless of its technical merits.
The Bitcoin Security Consortium represents the first coordinated institutional response to a threat that has migrated from theoretical to probable within a compressed timeline. The $15 million commitment is modest relative to the $460 billion exposure but material relative to existing Bitcoin open-source funding levels. The technical groundwork — BIP-360, NIST-standardized algorithms, revised qubit estimates — exists. The missing pieces are activation consensus, a migration strategy for legacy addresses, and a resolution to the block-space cost of larger signatures. The consortium's deliberately passive governance model funds the research but leaves these decisions to Bitcoin's existing consensus process. Whether a 5–10 year threat window provides sufficient runway for a protocol that historically takes 3–4 years to activate soft forks is the open question the $15 million is implicitly designed to accelerate.