Should Satoshi's Coins Be Frozen? The BIP-361 Debate

Roughly 1.1 million BTC are commonly associated with the early-mining pattern known as the Patoshi pattern, which researchers have long linked to Bitcoin's creator, Satoshi Nakamoto. That attribution is influential but not cryptographically proven: it is based on statistical patterns in early blocks rather than a signed statement or demonstrated control of every key.

Many of those early coinbase outputs remain dormant and use Pay-to-Public-Key (P2PK) scripts, meaning their public keys have been visible on-chain since the coins were mined. That makes them especially relevant to Bitcoin's quantum-computing debate.

A draft proposal called BIP-361 would introduce a staged migration away from today's ECDSA and Schnorr signature systems. If activated, it would eventually restrict ordinary spending from quantum-vulnerable outputs that had not migrated in time.

Supporters argue that this is defensive planning: a sufficiently capable quantum computer could derive a private key from an exposed elliptic-curve public key and steal coins before their owners can react. Critics argue that deliberately making currently valid coins harder—or potentially impossible—to spend would violate Bitcoin's long-standing ownership expectations.

Nothing has been activated. BIP-361 remains a draft proposal, and the debate is still about what Bitcoin should do if cryptographically relevant quantum computers become a practical threat.

Key Takeaways

• BIP-361 is a draft proposal that would phase out quantum-vulnerable signatures over about five years after activation.

• Coins not moved to quantum-safe outputs by the deadline would become unspendable through the normal method.

• Roughly 1 million to 1.1 million BTC associated with the Patoshi mining pattern are widely attributed to Satoshi, but the attribution is inferred rather than cryptographically proven. Many of the associated early outputs are P2PK and expose public keys on-chain.

• Jameson Lopp and his co-authors argue a scheduled freeze is safer than a crisis. Adam Back argues for optional upgrades and trusting Bitcoin to respond quickly if needed.

• An experimental recovery prototype may provide a path for some modern BIP-32 wallets, but it is not active on Bitcoin, does not cover every wallet type and cannot currently recover Satoshi-era P2PK outputs.

• Nothing has been decided. BIP-361 is not active.

Where Satoshi's Coins Came From

To understand why these coins matter, it helps to remember how they were created. Satoshi did not buy them. They were mined.

In Bitcoin's first years, each new block paid a reward of 50 BTC. Miners earned that reward through proof of work, the process explained in OneMiners' guide, Proof of Work Explained. Miners compete to find a valid hash, the winner adds the next block, and the network accepts the chain with the most accumulated work. In 2009 and 2010, very few people were mining, so a single early participant could collect a huge number of block rewards.

There is a nice historical twist here. The OneMiners guide traces proof of work back to Adam Back's 1997 invention, Hashcash, which inspired Satoshi's design. Today, Adam Back is one of the loudest voices against freezing those early coins.

Why Quantum Computers Put These Coins in the Spotlight

Bitcoin currently relies on elliptic-curve signatures for ownership authorization. A sufficiently capable quantum computer running Shor's algorithm could, in principle, derive a private key from a known public key.

The amount of exposure depends on the output type and the wallet's history.

Old P2PK outputs, including many coins associated with the Patoshi pattern, expose the public key directly. Reused addresses can also become exposed after a previous spend reveals their key material. Taproot/P2TR outputs are also exposed to long-duration quantum attacks because the output contains an elliptic-curve public key from the beginning.

Other common output types, including unused P2PKH and P2WPKH outputs, normally commit to a hash rather than revealing the public key immediately. They become more exposed when the relevant key is revealed during spending or through address reuse.

The urgency of the discussion increased in 2026 after Google Quantum AI published research showing substantially lower estimated resources for solving the elliptic-curve discrete-logarithm problem than earlier estimates. Google reported roughly a 20-fold reduction in estimated physical-qubit requirements, while emphasizing that the relevant future machines do not yet exist at the required scale.

That does not mean Bitcoin can currently be broken by a quantum computer. It means developers have stronger reasons to design and review migration paths before that capability exists.

What Is BIP-361?

The official BIP-361: Post Quantum Migration and Legacy Signature Sunset was authored by Jameson Lopp, Christian Papathanasiou, Ian Smith, Joe Ross, Steve Vaile and Pierre-Luc Dallaire-Demers. It was assigned BIP number 361 in February 2026 and remains a Draft Bitcoin Improvement Proposal.

Its current schedule has two main stages:

The important point is that Phase B does not guarantee that every old coin will have a usable recovery path.

BIP-361 discusses possible rescue schemes that rely on information a legitimate owner may know but a quantum attacker would not. For example, some BIP-32 deterministic wallets using hardened derivation could potentially prove knowledge of parent private-key material.

For old P2PK coins, however, the BIP says no equivalent knowledge asymmetry is currently known. Its authors therefore discuss compatibility with a separate "Hourglass"-style mechanism if one were designed and activated before Phase B.

BIP-361 is also intended to follow the availability of post-quantum spending technology. BIP-360 proposes Pay-to-Merkle-Root, or P2MR, which can protect against long-exposure attacks by avoiding an exposed elliptic-curve key in the output.

But P2MR is not a complete post-quantum signature system. BIP-360 itself says that protection against faster short-exposure attacks, such as attacks while a transaction waits in the mempool, may require future post-quantum signature schemes.

A Freeze With a Possible Recovery Path

A major criticism of BIP-361 is that legitimate owners who fail to migrate before the sunset could lose the ordinary ability to spend their coins.

In July 2026, CoinDesk reported on a prototype developed by Project Eleven and Jim Posen. The prototype uses a zero-knowledge proof to demonstrate knowledge of hardened BIP-32 parent key material without exposing that material publicly.

The idea is important because a future quantum attacker might recover the private key associated with a visible public key while still lacking the wallet's higher-level deterministic key material. A legitimate wallet owner could potentially use that difference to prove a stronger claim than simply presenting an ECDSA or Schnorr signature.

The reported prototype generated proofs in roughly a quarter of a second on a laptop, but it remains experimental. It is unaudited, incomplete, supports only certain wallet structures and address types, and would require additional consensus rules before it could recover funds on Bitcoin.

It also does not solve the problem for early P2PK coins such as those associated with Satoshi's era. Those coins were created before BIP-32 hierarchical deterministic wallets, so there is no hardened parent-key path for this particular proof system to use.

That does not necessarily mean those coins must be permanently inaccessible under every possible future design. It means this recovery prototype cannot recover them, and BIP-361 would need some other mechanism—such as a separately adopted P2PK rescue design—if the network wanted those coins to remain recoverable after the legacy-signature sunset.

The Case for Freezing

Supporters of BIP-361, led by Jameson Lopp, make several arguments:

• A planned migration beats a panic. Lopp argues that a fixed schedule is the only reliable way to avoid a chaotic, rushed migration if a quantum breakthrough arrives suddenly.

• Frozen is better than stolen. If a quantum attacker could take Satoshi's coins and other exposed coins, they could sell them on the market. Supporters argue it is better to freeze those coins than hand them to thieves.

• It protects confidence. The Bitcoin Quantum Countdown analysis of the freeze debate notes that a cutoff could remove the incentive to attack old coins and help preserve trust in ownership records.

• Owners get plenty of warning. A deadline announced years in advance gives holders time to move to reviewed, quantum-safe outputs.

• Old signatures would no longer prove ownership anyway. Once quantum attacks are practical, a valid old-style signature only proves someone can do the math, not that they are the rightful owner. Supporters see invalidating those signatures as protecting the original owner's claim.

The Case Against Freezing

Critics, including Blockstream CEO Adam Back, push back hard:

• Make upgrades optional, not forced. Back argues developers should build quantum-resistant options now and let users move voluntarily. He says Blockstream is already testing quantum-resistant signatures on its Liquid sidechain, and that Taproot is flexible enough to add new signature methods without disrupting anyone.

• Bitcoin can react quickly when it must. Back points to serious bugs that have been fixed within hours. He argues urgency builds consensus, so Bitcoin does not need to lock in a freeze years ahead. He has suggested users should have roughly a decade to migrate.

• Dormant does not mean abandoned. The Quantum Countdown analysis notes that some owners hold on purpose, rely on inheritance plans, lack technical skills, or simply never hear about a deadline. A freeze would catch them too.

• It breaks a core promise. In Bitcoin, controlling the key has always meant you can spend the coins. Freezing coins that meet the original spending rules is, to critics, a property-rights violation.

• It sets a precedent. If the network can freeze one group of coins today, critics worry a future majority could use the same power for other reasons, weakening Bitcoin's neutrality.

• There is no court on the blockchain. Bitcoin has no way to settle disputes over inheritance, stolen keys or competing claims to frozen coins.

The Middle-Ground Options

The debate is not just "freeze" or "don't freeze." The Quantum Countdown analysis outlines a range of choices:

So, Should Satoshi's Coins Be Frozen?

There is no consensus, and reasonable people disagree. The core disagreement is simple to state: Lopp bets that Bitcoin cannot coordinate fast enough in a crisis, so it should plan now. Back bets that it can, so it should avoid a forced freeze.

As the Quantum Countdown analysis puts it, this is ultimately a question about rules and legitimacy, not just cryptography. Math can verify a signature, but it cannot decide who rightfully owns a coin. Whatever happens will depend on how real the quantum threat becomes, how quickly safe alternatives are ready, and whether the Bitcoin community can agree.

What This Means for Everyday Holders

BIP-361 is not active, and no Bitcoin is about to be frozen under it. The practical lesson today is preparation rather than panic.

• Avoid address reuse. Reusing an address can leave public-key information exposed for long periods after a previous spend.

• Do not judge quantum exposure only from an address prefix. Unspent P2PKH and P2WPKH outputs generally hide the public key behind a hash until spending, while P2PK and Taproot/P2TR outputs expose elliptic-curve public-key information differently and may face long-exposure risk.

• Keep complete wallet backups. A seed phrase is important for many wallets, but future recovery mechanisms may also depend on derivation paths, wallet descriptors or hardened BIP-32 parent-key information.

• Follow wallet and Bitcoin-development updates rather than moving funds because of social-media warnings. No post-quantum migration deadline is currently active.

• Never give anyone your seed phrase or private keys to "protect" your Bitcoin from quantum computers. Any real protocol migration would be implemented through publicly reviewed wallet and network software, not through a support agent asking for your recovery secret.

Frequently Asked Questions

What is BIP-361? BIP-361 is a draft proposal titled Post Quantum Migration and Legacy Signature Sunset. If activated, its current design would begin restricting legacy-to-vulnerable payments after roughly 160,000 blocks, or about three years, and would tighten ECDSA/Schnorr spending rules roughly two years later.

How many bitcoin does Satoshi own? There is no cryptographically proven figure. Roughly 1 million to 1.1 million BTC are commonly associated with the Patoshi early-mining pattern and are widely attributed to Satoshi Nakamoto, but that attribution is based on blockchain analysis rather than definitive proof that Satoshi controlled every key in the set.

Would BIP-361 affect Satoshi-associated coins? Yes, if the proposal were eventually activated in a compatible form and those exposed P2PK outputs had not migrated or qualified for another rescue mechanism by the relevant sunset date.

Can frozen coins be recovered? Potentially, but not universally. Project Eleven has demonstrated an experimental zero-knowledge proof for certain modern BIP-32 wallet structures. It is not active on Bitcoin and does not currently recover old P2PK coins such as the Satoshi-era outputs.

Is BIP-361 going to be activated? Nobody knows. It remains a draft, no activation is scheduled, and substantial technical and governance questions remain unresolved.

Final Thoughts

The question of freezing Satoshi's coins goes to the heart of what Bitcoin is. Supporters see BIP-361 as responsible planning that keeps a future quantum thief from walking away with millions of coins. Critics see it as a dangerous precedent that overrides the simple rule that whoever holds the key controls the coins. Both sides want to protect Bitcoin. They disagree about which risk is worse. For now, the best thing any holder can do is stay informed, keep good wallet habits, and follow the debate as it unfolds.

This article is for educational purposes only and is not financial, legal or security advice. Bitcoin proposals may change or never be adopted. Always verify the latest information before acting.