6.4 Million Bitcoin in the Quantum Crosshairs. What Self-Custody Actually Fixes

The number traveled fast. On October 16, 2026, CoinDesk reported that a newly formed Quantum Alliance had counted 6.4 million bitcoin as vulnerable to a future quantum computer. The Alliance's own count, as picked up by Decrypt and others, is more precisely 6.04 million bitcoin, about 30.2 percent of the supply, sitting in addresses whose public keys are permanently exposed on-chain. Either way, the shape of the problem is the same. Nearly a third of all bitcoin is in outputs where a sufficiently powerful quantum computer running Shor's algorithm could, in principle, walk from the public key back to the private key.

Two clarifications before anything else. First, no existing machine can do this. The Alliance itself is explicit that these coins cannot be stolen today. Second, the 6.04 million includes the roughly 1.1 million bitcoin attributed to Satoshi Nakamoto, in the oldest pay-to-public-key outputs, where the public key was committed directly in the output from day one.

What the Quantum Alliance is

The Quantum Alliance launched on October 15, 2026, put together by nine crypto companies: Quantus, Postquant Labs, Charles Hoskinson's Midnight Foundation, Keystone, Abelian, the security firm Hacken, and, per TFTC's reporting, American Fortress, Intmax and The Vault. Its stated job is to define and verify what "post-quantum ready" actually means for blockchain systems, and to publish common security tests plus guidance for migrating existing networks to quantum-resistant cryptography.

Two things are worth noticing. It is not a Bitcoin governance body. Nothing it publishes changes Bitcoin's consensus rules, and the fights over what to do with exposed coins, freeze them, move them, put them in a trust, are still running through the BIP process I covered in the post-quantum upgrade race piece. And its own contributors cannot agree on the timeline. A model run by two of them names March 2028 as the earliest plausible window for a cryptographically relevant quantum computer. Other credible estimates run a decade later. The Alliance exists precisely because nobody knows the date and waiting for one is not a plan.

What Google Willow actually changed

Every time a quantum headline lands, someone asks whether Google's Willow chip broke Bitcoin. It did not, and it was never close. Willow, announced in December 2024, is a 105-qubit processor. Breaking Bitcoin's elliptic curve signatures requires on the order of millions of noisy physical qubits. Willow is three orders of magnitude short, and its benchmark results have nothing to do with factoring or discrete logarithms.

What Willow actually changed is quieter and more important. Its real milestone was error correction: for the first time, a chip demonstrated that adding more qubits made the logical error rate go down, not up. That below-threshold result is the load-bearing assumption behind every roadmap to a fault-tolerant machine. Since then, the trend has been one-directional. Google Quantum AI's May 2025 analysis cut the estimated resources to break RSA-2048 from roughly 20 million qubits to under a million, and reporting around the Alliance launch cites work putting the bitcoin-scale requirement under 500,000. None of that came from better hardware. It came from better algorithms and better error correction, the two things Willow accelerated.

So the honest read is this. Willow did not move the threat closer in calendar time, but it removed one of the reasons to doubt the threat exists. Every successive improvement shrinks the machine required. The target got cheaper to hit even though the arrow has not been fired.

What self-custody fixes, and what it does not

Here is the part that matters to anyone holding their own keys, and where a dangerous half-truth circulates. Self-custody does not make your bitcoin quantum-safe. It never claimed to.

The quantum threat is a property of the cryptography and the ledger, not of the custody model. If your coins sit in a pay-to-public-key output, in a reused address whose public key went on-chain the first time you spent from it, or in a Taproot output, which exposes its public key on receive, then it does not matter whether the keys live in your fireproof safe, on a Ledger, or in Coinbase's cold storage. The public key is on the public ledger, and exposure is exposure. A quantum attacker does not care whose hardware stores the private key; Shor's algorithm needs only the public one. Self-custody solves the counterparty problem, the seizure problem, the rehypothecation problem. It does nothing about key exposure.

What self-custody does fix, and this is not nothing, is agency. The holder of their own keys can restructure their holdings the day better tooling arrives. An exchange customer can only wait for the custodian to migrate, and the 6.04 million figure does not break down by who is waiting on whom. When a quantum-safe output type ships, BIP-360's P2MR addresses, for instance, self-custody is the difference between moving in an afternoon and filing a support ticket.

The actual lever is address hygiene, and it works because of one asymmetry: a quantum computer can invert elliptic curve signatures, but it cannot efficiently invert hash functions. Coins in addresses that have never spent keep their public keys hidden behind a hash, so a quantum attacker has no target to grind on. Every spend from an address burns that protection permanently.

Which translates into three concrete habits. Never reuse an address; a modern wallet generating a fresh address per receipt already does this, so the failure is user behavior, not software. Keep long-hold cold storage in plain SegWit, the bc1q addresses, which hide the public key until spend, rather than Taproot's bc1p, which exposes it on receive; for a coin you will not touch for a decade, that difference is your entire at-rest exposure. And treat any coins already sitting in legacy P2PK outputs or heavily reused addresses as your migration shortlist, because those are the stationary targets the first wave of any quantum attacker would go after. I walked through the derivation-tree logic behind all of this, including why your seed phrase survives Q-Day, in the quantum recovery tool piece.

The unglamorous conclusion

The Quantum Alliance is industry coordination arriving before consensus coordination, which is the normal order of things. Willow did not break anything but did make the roadmap harder to dismiss. And the 6.04 million, or 6.4 million, depending on which headline you read, is not a number you are helpless in front of. For most self-custody holders, the quantum exposure of their own stack is close to zero already, provided the addresses are fresh and the long-hold coins are not sitting in exposed output types.

Nobody can give you a Q-Day date. But you can check, today, whether your coins are in the third of the supply an attacker would be able to see. That check costs nothing and it is the whole ballgame.

Sources: CoinDesk: Quantum Alliance forms amid warnings of vulnerable bitcoin · Decrypt: Crypto Firms Launch Quantum Alliance · Google: Willow quantum chip · Related: The Post-Quantum Upgrade Race Is Real · Why Your Seed Phrase Survives Q-Day