Fireblocks wants custodians to shrink Bitcoin's quantum exposure one spend at a time

If exposure "ultimately comes down to whether the public key is already visible onchain," as Gutkin told crypto.news ^[2], then the type of holder drops out of the model. He said the chain, the address type and the transaction history decide it, whether the owner is an exchange, an institution or an individual ^[3]. A custodian controls the third of those, and only going forward.

Gutkin's plan is a policy for flows. Address reuse is the part a custodian can stop at once. A spent address keeps its key visible, and every later deposit to it lands behind that key ^[5]. Fresh deposit and change addresses end the reuse, and tracking each UTXO finds the coins already behind visible keys ^[7]. "For an institution, I don't think the goal should be a one-time mass migration," he said, answering calls for "bunker mode" preparation ^[8]. That rules out a single sweep of the whole book. The move happens through payments the institution would make anyway ^[7].

Address format is the first limit. A fresh address hides its key only if its format does. P2PK outputs, many from the Satoshi era, expose the key from creation even if the coins never move ^[4]. The BIP 360 authors say Taproot output keys are visible at creation too ^[6]. BitGo's July 22 controls include updated address defaults ^[10], so at least one custodian treats the default format as part of the job.

Speed is the second. Exposed addresses empty only as fast as the holder spends from them ^[7]. Gutkin said a treasury that rarely moves its holdings may keep its keys hidden longer, provided format and past activity have not already revealed them ^[17]. That same low activity means coins already behind an exposed key leave slowly. BitGo's input selection tries to spend every unspent output tied to a selected address ^[18], so one payment can clear an address outright.

The third limit is the window between broadcast and confirmation. The BIP 360 authors separate attacks on keys visible for long periods from faster attacks launched after a transaction reveals a key and before it confirms ^[11]. BIP 360 itself reduces long-term key exposure but does not offer complete protection, according to crypto.news ^[12].

Ledger CTO Charles Guillemet said in a Sep. 17 report that no cryptographically relevant quantum computer capable of breaking Bitcoin's current signatures is known to exist ^[13]. He also warned that research, software changes, hardware-wallet upgrades and user adoption could take years ^[14].

I think the case holds for coins a custodian holds and moves. Fresh addresses and a UTXO ledger cut exposure now, with no protocol change. Fireblocks says it already supports parts of the process and is building exposure-based input selection and displays of affected balances ^[15]. None of that touches coins behind visible keys whose owners never spend, within an estimated 6.7 million to 7 million exposed BTC ^[1]. On Ethereum, Fireblocks is working on the signature side instead, and has cut post-quantum signature verification from 8.09 million to 1.23 million gas ^[16], about 85% less ^[19].

Gutkin's own dashboard is the test. He said it should show the remaining exposed balance next to the transactions adding to it ^[9]. Suppose a custodian runs fresh addresses for a year and the first figure stays flat. Then the gradual approach has failed for that book.