Citi warns BTC faces rising quantum risk

TLDR

Citigroup has warned that Bitcoin (BTC) is relatively exposed to future quantum computing attacks, mainly due to already exposed public keys and slow governance.

1. Citi estimates about 6.5 to 6.9 million BTC with exposed public keys could be vulnerable if quantum computers arrive before Bitcoin upgrades its cryptography.
2. The bank argues Bitcoins conservative governance makes protocol changes slower than on chains like Ethereum, while quantum timelines are being pulled forward to roughly 2030 to 2032.
3. Technically viable post quantum defenses already exist, so the real question is whether Bitcoin coordinates upgrades, with proposals like BIP 360 and related testnets being key signals to watch.

Deep Dive

1. Citis Quantum Risk Warning

In a May 18 research note, Citi analysts said accelerating quantum progress is compressing the timeline for when machines could break Bitcoins elliptic curve signatures, posing a growing threat to its security and to broader financial infrastructure.

They estimate 6.5 to 6.9 million BTC, roughly one third of circulating supply and about 450 billion dollars at current prices, sit in addresses whose public keys are already exposed on chain, making them prime targets for a future quantum attacker collecting data now to decrypt later, the harvest now, decrypt later risk. Citis note is summarized here.

Citis wider work on quantum risk also models trillions of dollars of GDP at stake if major banks or payment systems are compromised, so Bitcoin is framed as part of a much bigger cryptography problem rather than an isolated issue.

2. Why Bitcoin Looks Exposed

Citi and others stress that Bitcoins vulnerability is as much about structure and governance as pure math. Older address formats and early pay to public key outputs permanently reveal public keys, including dormant wallets believed to belong to Satoshi and other long inactive holders worth tens of billions of dollars. One analysis puts 6.7 to 7 million dormant BTC in this bucket.

On a per transaction basis, Bitcoin also reveals the senders public key while a spend is in flight, giving a quantum attacker a brief window to derive the private key if hardware ever gets strong enough. At the same time, Google linked research suggests a 500,000 qubit machine capable of breaking current cryptography in minutes could appear around 2032, with some estimates as early as 2030.

Compared with Ethereum and other proof of stake chains that routinely ship hard forks, Citi argues Bitcoins highly conservative, consensus heavy governance makes rapid migration harder, even though it is central to Bitcoins credibility.

3. What To Watch Next

Security experts note this is not a today problem, but a coordination problem for the next decade. Fireblocks CEO calls it mostly a coordination issue, saying post quantum signature schemes already exist and Bitcoin has changed signature types before, though doing so at full network scale would require years of planning and social consensus. His comments are summarized here.

Developers are already experimenting. Proposals such as BIP 360 and related Bitcoin Quantum testnets trial quantum resistant address formats and key schemes, while other projects and chains explore lattice based signatures and hybrid cryptography that can be swapped in as standards mature. Coverage of Citis note and these proposals highlights adaptability as the key resilience factor.

For crypto users and allocators, the practical monitor set is: progress on Bitcoin post quantum BIPs and testnets, timelines from major quantum labs, and whether large chains begin migrating their address formats and wallets well before any credible Q day.

Conclusion

Citis warning elevates quantum computing from abstract talking point to a concrete long term risk factor for Bitcoin, mainly because so much value already sits behind exposed public keys and governance is slow to change.

At the same time, cryptographic tools to defend against quantum attacks exist today, and industry voices frame the challenge as organizing and executing a migration before powerful quantum machines arrive, not inventing new math from scratch.

For now, the edge lies in tracking how quickly major chains, especially Bitcoin, turn that migration from research into agreed upgrades and live infrastructure, well ahead of any realistic quantum attack window.