Important points
Bitcoin’s quantum risks center around the security of public keys and signatures.
BTQ’s testnet explores post-quantum signatures in a Bitcoin-like environment.
Post-quantum signatures will significantly increase transaction size and block space demands.
“Old BTC risks” center around legacy output types and address reuse patterns.
BTQ Technologies announced the launch of the Bitcoin quantum testnet on January 12, 2026. It is a Bitcoin-like network designed to experiment with post-quantum signatures without touching Bitcoin’s mainnet governance.
The idea is that BTQ will replace Bitcoin’s current signature scheme with ML-DSA, a modular lattice signature standard formalized as Federal Information Processing Standard (FIPS) 204 by the National Institute of Standards and Technology (NIST) as a prerequisite for post-quantum security.
It’s worth remembering that in most Bitcoin quantum threat models, a key assumption is public key exposure. If a public key is already visible on-chain, a fully capable future quantum computer could theoretically attempt to recover the corresponding private key offline.
Did you know? BTQ Technologies is a research-focused company working on post-quantum cryptography and blockchain security. Its Bitcoin Quantum Testnet is designed to study how quantum-resistant signatures work in systems like Bitcoin.
What kind of quantum changes occur?
Most of the discussion about Bitcoin’s quantum risk focuses on digital signatures, rather than Bitcoin’s coin supply or the idea that quantum computers can magically guess random wallets.
A specific concern is that cryptography-related quantum computers (CRQCs) could run Scholl’s algorithm to solve discrete logarithm problems efficiently enough to derive a private key from a known public key, potentially undermining both elliptic curve digital signature algorithms (ECDSA) and Schnorr-based signatures.
Chaincode Labs frames this as the dominant quantum threat model for Bitcoin, as generating valid signatures can enable fraudulent spending.
This risk can be divided into long-range exposure, where the public key is already visible on-chain due to some old script type or reuse, and short-range exposure, where the public key is exposed when the transaction is broadcast and awaiting confirmation, creating a narrow time window.
Of course, there are currently no quantum computers that pose an immediate risk to Bitcoin, and mining-related impacts need to be treated as a separate and more constrained discussion from signature destruction.
Did you know? Scholl’s algorithm already exists as a mathematics, but it requires large-scale, fault-tolerant quantum computers to run. Once such a machine is built, it could be used to derive a private key from a published public key.
What BTQ has built and why it’s interesting
BTQ’s Bitcoin Quantum testnet is essentially a Bitcoin Core-based fork that exchanges signatures, one of Bitcoin’s most important primitives.
BTQ said in its announcement that the testnet will replace ECDSA with ML-DSA. ML-DSA is a modular lattice signature scheme standardized by NIST as FIPS 204 for post-quantum digital signatures.
This change forces a series of engineering trade-offs. Because ML-DSA signatures are approximately 38 to 72 times larger than ECDSA, testnet increases the block size limit to 64 mebibytes (MiB) to make room for additional transaction data.
The company also treats the network as a testing ground for the entire lifecycle, supporting wallet creation, transaction signing and verification, and mining, along with basic infrastructure such as block explorers and mining pools.
In other words, the practical value of testnets is to turn post-quantum Bitcoin into a performance and tuning experiment.
Where Old BTC Risk Concentrates
When analysts talk about “old BTC risks” in a post-quantum context, they are usually referring to public keys that are already published on-chain.
A future CRQC capable of running Scholl’s algorithm could theoretically use these public keys to derive the corresponding private keys and generate useful spending.
In particular, there are three output types that are immediately vulnerable to long-range attacks because they place the elliptic curve public key directly in the locking script (ScriptPubKey). They are Pay-to-Public-Key (P2PK), Pay-to-Multi-Signature (P2MS), and Pay-to-Taproot (P2TR).
The distribution is uneven:
Although P2PK makes up a small percentage of today’s unspent transaction output (UTXO) at about 0.025%, it accounts for a disproportionate share of BTC value, about 8.68% or 1,720,747 Bitcoin (BTC), mostly dormant coins from the Satoshi era.
P2MS accounts for about 1.037% of UTXO, but the report estimates that only about 57 BTC has been secured.
P2TR is common in count at around 32.5% of UTXO, but smaller for the same snapshot, around 0.74% or 146,715 BTC. The exposure is related to Taproot’s keypath design, where the reconciled public keys are visible on-chain.
Address reuse also allows public keys to remain visible once they appear on the chain, potentially turning what would normally be a “time-spent” exposure into a long-range risk.
BTQ’s own messaging uses this public key framework to assert a large pool of potential influences. The company says 6.26 million BTC were exposed, which is part of why the company says testing post-quantum signatures in a Bitcoin-like environment is worth doing now.
What’s next for Bitcoin?
The most concrete approach in the short term is observation and preparation.
As discussed, the signature threat model is driven by public key disclosure. This is why Bitcoin’s existing wallet and scripting practices often focus on how to reduce public keys, either by exposing them early, as in some traditional script types, or by default, as in common wallet behavior that avoids reuse.
“Old BTC risk” is therefore primarily a property of past production types and reuse patterns, and does not suddenly apply equally to all coins.
The second, more practical constraint is capacity. Even if a post-quantum transition were socially agreed upon, block space and coordination issues would still remain.
River’s explainer summarizes academic estimates that show how sensitive timelines are to assumptions. In a theoretical scenario where every transaction is a migration, the timeline could be significantly compressed, but with more realistic block space allocations, migrations would take years, even before considering governance and deployment.
BTQ’s testnet fits into that bucket. This allows engineers to observe the operational costs of post-quantum signatures, including larger data sizes and various limitations, in a Bitcoin-like setting without claiming that Bitcoin can be broken quickly.
Did you know? The biggest obstacle to quantum computers is noise, or error. Current qubits make frequent errors, requiring fault-tolerant error correction. This means using many physical qubits to generate a small number of trusted “logical” qubits before performing the long calculations needed to crack real-world codes.
What kind of mitigation measures will be taken at the Bitcoin level?
At the protocol level, quantum preparation is often discussed as an ordered path.
Post-quantum signature schemes tend to be much larger than elliptic curve signatures, with knock-on effects on transaction size, bandwidth, and verification costs. BTQ’s experiments with ML-DSA revealed the same kind of trade-offs.
That’s why some Bitcoin proposals are first focused on reducing the most structural exposures within existing script designs without immediately adapting the network to specific post-quantum signature algorithms.
A recent example is Bitcoin Improvement Proposal (BIP) 360, which proposes a new output type called Pay-to-Tapscript-Hash (P2TSH). P2TSH is similar to Taproot, but removes key path consumption, i.e. paths that rely on elliptic curve signatures, leaving a tap script native root that can be used to avoid key path dependencies.
A related idea has been circulating on Bitcoin developer mailing lists under the broader “hash-only” or “script-based” Taproot family, often discussed as Pay-to-Quantum-Resistant-Hash (P2QRH) style structures. These proposals also aim to reuse Taproot’s structure while skipping the expenditure of quantum-vulnerable keys.
Importantly, none of these issues are resolved. Importantly, the possible response to a Bitcoin move is being discussed as a matter of gradual adjustments that balance conservatism, compatibility, and the cost of changing transaction formats.
BTQ testnet is very clear
BTQ’s Bitcoin quantum testnet won’t settle the quantum debate, but it will make it harder to ignore two points.
First, most reliable threat models focus on locations where the public key is already publicly available, which is why “old coin” patterns keep popping up in our analyses.
Second, post-quantum Bitcoin is a matter of engineering and coordination. BTQ Technologies’ own design choices, such as moving to ML-DSA and lifting blocking restrictions to accommodate much larger signatures, illustrate these tradeoffs.
After all, the testnet is a sandbox to measure costs and constraints and should not be taken as evidence that Bitcoin is likely to break any time soon.
Cointelegraph maintains complete editorial independence. The selection, commissioning and publication of features and magazine content is not influenced by advertisers, partners or commercial relationships.
