The 35% Prophecy: Quantum, Bitcoin, and the False Certainty of 2028

There is a set of addresses on the Bitcoin blockchain that has not moved in fourteen years. Their public keys hang naked on the ledger, no hashing, no concealment, just raw elliptic-curve arithmetic exposed to anyone who cares to look. Satoshi's earliest coins sit in this configuration. I spent an evening last month mapping the UTXO set for exactly this pattern, and I watched the number climb past four million bitcoins. It is easy to turn that observation into a headline. It is harder to turn it into understanding. Last week, Tom Lee, the Fundstrat co-founder who spent a career in equity markets before discovering that crypto also produces numbers, warned that quantum computers could crack 35 percent of all Bitcoin by 2028. The number went around the internet with the speed that bad math travels. Then Adam Back, the cypherpunk who invented Hashcash and whose name is the only citation in Satoshi's whitepaper, pushed back. The timeline is nonsense, he said, in so many words. The panic, he implied, is the louder message. They are both wrong. And they are both right. The error is not in the direction of their claims. It is in the confidence with which both men speak about a future that neither of them can see. Let me begin with a confession. I am the kind of person who reads blockchain whitepapers for pleasure, which means I have spent more evenings than I care to admit staring at ECDSA parameter sets and trying to feel something. In 2017, while I was still a high school student in Copenhagen, I spent six months auditing the tokenomics of failed ICO startups and wrote a 12,000-word essay called 'Code as Constitution.' I believed then, with the sincerity that only a teenager can summon, that cryptographic consensus was the closest thing humanity had ever built to objective justice. I am older now, and I have watched oracles fail, stablecoins de-peg, and governance tokens enrich the very insiders they were designed to constrain. The one thing I have never stopped believing is that the threat models matter more than the narratives. So when a Wall Street analyst says '35 percent by 2028,' and a cypherpunk says 'relax,' my instinct is to check both against the physics, the history, and the deeply uncomfortable economics of who actually holds the vulnerable keys. The first thing to understand about the quantum panic is that it is not new. It is older than most of the people currently trading Bitcoin. The Bitcoin whitepaper itself, published in 2008, assumed a future in which computational assumptions shift. Satoshi chose ECDSA because it was battle-tested and compact, not because it was immortal. Shor's algorithm, which can in principle factor integers and solve discrete logarithms in polynomial time, was published in 1994. Grover's algorithm, which provides a quadratic speedup for brute-force searches, was published in 1996. The mathematics of the quantum threat is older than Google, and it has been sitting on the shelf, patiently waiting for the hardware to catch up. The second thing to understand is that the numeric claim, 35 percent, has a troubling ambiguity. Does it mean 35 percent of all Bitcoin by supply? Roughly seven million coins, out of the roughly twenty million that will ever exist. Does it mean 35 percent of addresses with a non-zero balance? Or 35 percent of the UTXO set by count? The phrase '35 percent of Bitcoin' sounds precise, but it is a category error dressed as a statistic. I tried to reconstruct what it might mean, and the only interpretation that survives contact with the blockchain is this: 35 percent represents the share of bitcoins that sit in outputs whose public keys are already visible on the ledger. Not 'will be exposed.' Already exposed. P2PK addresses from the early era display their full public key in the script. P2PKH addresses hide it behind SHA-256 and RIPEMD-160 until the first spend, at which point the key is revealed in the input scriptSig and becomes permanently visible. Once a public key is on the chain, the only thing protecting the associated private key is the difficulty of the elliptic curve discrete logarithm problem. And that is precisely the problem that a sufficiently large quantum computer would solve. So the figure, if I am being charitable to Tom Lee, is not entirely fabricated. The industry consensus among analysts who have actually parsed the UTXO set places the share of bitcoins in exposed-key outputs somewhere between a quarter and forty percent, depending on how you count change outputs, lost coins, and the vast, silent hoards that have never moved since 2011. Fourteen years ago, the chain was a public diary. People mined blocks into addresses and left the keys sitting on hard drives that have since been thrown into landfills. The public key was the lock, and the lock was visible to every passerby. We built the temple, but forgot who the god is. The god is not cryptography. The god is time, and time has already leaked. Now the timeline. 2028 is a strange year to choose. It is near enough to create urgency, far enough to be unverifiable, and conveniently aligned with a presidential election cycle in the United States, which means it will be repeated in fund letters, conference panels, and regulatory testimony regardless of its technical merit. Let me state the physics plainly. Breaking ECDSA over the secp256k1 curve, the engine of every Bitcoin private key, requires approximately two thousand three hundred logical qubits. That is the number before error correction. Because physical qubits are noisy, each logical qubit must be encoded in hundreds or thousands of physical qubits, depending on the error rate and the code used. The most credible engineering estimates put the total requirement for a Shor-capable machine at somewhere between eight million and twenty million physical qubits, all working in coherent coordination for hours, not milliseconds. Where are we today? Commercial machines operate with perhaps a few thousand physical qubits. Their error rates are falling, but they are not remotely close to the thresholds required for the surface codes that would sustain a computation of that scale. The community has demonstrated one, two, a handful of logical qubits at a time. The progression is real. I do not dismiss it. But going from a few logical qubits to two thousand three hundred, with the necessary interconnects, cross-talk mitigation, and classical feed-forward, is not a four-year project. It is not even a ten-year project under any published roadmap I have seen. When researchers at NIST, IBM, and the major university groups run the calculations, the dates they publish for cryptanalytic-scale fault-tolerant quantum computing land consistently in the late 2030s or the 2040s. Some say later. Almost none say 2028. The second obvious point is that not all of Bitcoin rests on ECDSA. The SHA-256 hash function that secures the blockchain's proof of work is vulnerable only to Grover's algorithm, which gives a quadratic speedup, reducing the effective security from 256 bits to 128 bits. That is a real degradation, but it is not an existential one. A quantum computer that could brute-force a 128-bit search still faces a workload of 2 to the power 128, a number so large that the difference between classical and quantum attack speeds is irrelevant for practical purposes. The existential threat is limited to the digital signature scheme. And here, crypto does something wonderful and inconvenient at the same time: it admits that many keys have been exposed already, which means the 'harvest now, decrypt later' clock is already ticking for the oldest and most concentrated portions of the supply. Let me sit with that for a moment, because it is the part of the discussion that Tom Lee's headline obscures and Adam Back's dismissal does not address. The standard quantum-hacking scenario, in the classic literature, is that an adversary records encrypted traffic today and stores it until a quantum computer exists. The data is locked in a drawer, waiting for a key that will come. Bitcoin inverts this. The data was never encrypted to begin with. The public keys have been sitting in plain sight since 2009. The adversary already has everything they need. What they lack is the machine. This means that the exposure is not a future event. It is a present condition that becomes dangerous at some unknown future date. In that sense, the 35 percent is not a forecast. It is a storage metric, a measure of how much of the supply will be in the blast radius on day one, whenever day one arrives. Which brings me to Adam Back, and to the cypherpunk gospel that he represents. His rebuttal, when I read it, followed the familiar architecture of the true believer: the timeline is exaggerated, the quantum machines are decades away, the Bitcoin community has the technical means to respond. And on each point, he is not entirely wrong. The timeline is exaggerated. The machines are far away, relative to the average retail investor's holding period. And Bitcoin can, in principle, adopt quantum-resistant signature schemes. There have been design proposals for years. SPHINCS+, a stateless hash-based signature scheme, is a leading candidate, though its signatures are kilobytes rather than the seventy-two bytes of a Schnorr signature, which would cause the blockchain to swell. FROST and other threshold schemes do not solve the problem; they only distribute it. The real engineering solution, if one wants to call it that, would be a soft fork that introduces a new taproot version or a separate address type whose spending condition is quantum-resistant, and then a long, messy migration period during which legacy coins move into the new sanctuary. This is the part where I need to introduce my own experience. In 2020, during what they called DeFi Summer, I interned with a small DAO in Copenhagen that was building a lending protocol. The protocol was elegantly designed. Its smart contracts were audited twice. And in November of that year, an oracle manipulation drained a pool built on the same framework, and I watched twelve ordinary people lose their savings. I interviewed them. I listened to a woman in Odense describe, in a flat voice, how she had put her late husband's insurance payout into a yield farm because a website promised 400 percent APY. The contract performed exactly as written. The mathematics was flawless. And the human system around it collapsed. That experience taught me to stop trusting any theorem that omits the coordination costs of real people. It is why I now read every security discussion with a simple question: even if the solution exists in pure math, does it exist in the messy, political, economically irrational world where human beings actually keep their keys? Apply that question to Bitcoin's quantum migration. Assume the physicists are right that the first cryptanalytic-scale machine arrives in 2040, not 2028. That gives the ecosystem roughly fifteen years to agree on a new signature scheme, hard fork the protocol, and persuade every exchange, custodian, hardware wallet manufacturer, and forgotten-hard-drive owner in the world to move their coins. Is that plausible? Look at the history of Bitcoin upgrades that were far simpler. SegWit, a backward-compatible soft fork that changed how signature data is committed, took more than two years of bitter civil war, user-activated soft forks, and near-conflict from 2015 to 2017. Taproot, which activated in 2021, took years of BIP discussions, review cycles, and lindy-culture suspicion. And those were uncontroversial improvements with no existential urgency. A quantum-resistant migration would be the largest change to Bitcoin's security model in its history. It would require invalidating, or at least shaming, the oldest and most mythologized corner of the supply. It would force the community to decide what happens to coins whose owners are dead, whose keys are lost, or whose addresses have been dormant for a decade. You cannot ask a person who lost their backup in a boat accident in 2013 to participate in an orderly migration. Those coins will sit forever in exposed-key outputs, and on the day a quantum machine switches on, they will belong to whoever races to compute the private keys first. And here is the part that neither Lee nor Back wants to say out loud: those unclaimed, exposed coins are a financial incentive hidden inside a catastrophe. If a quantum computer ever becomes available to an adversary, the first target on the Bitcoin network will not be the coinbase transaction of a whale who is still actively trading. It will be the oldest, frozen, high-value outputs, the ones that everyone has already written off as lost. Satoshi's own mined coins, a million bitcoin that have never moved, sit in P2PK addresses with their public keys exposed. The moment a Shor-capable machine exists, that treasure becomes a race. The winner is not the rightful owner, because the rightful owner is absent, dead, or unreachable. The winner is whoever gets there first. We talk about the quantum threat as a matter of cryptography, but it is equally a matter of archaeology. The ledger remembers every unspent promise, but the heart forgets that immutability cuts both ways. It protects the dead from theft. It also protects the dead from their own redemption. This is the heart of my discomfort with both men. Tom Lee's 2028 prophecy is a marketing artifact, a number chosen for its emotional resonance rather than its physical basis. It tells investors that there is a deadline, which means there is a reason to act, which means there is a reason to click, to watch, to trade. The figure of 35 percent is not a cryptographic audit. It is a plot point in a story about fear. Adam Back's rebuttal, for all its technical authority, performs the opposite service. It tells investors that everything is fine, that Bitcoin's cypherpunk foundation has anticipated this, that the protocols will adapt as they always have. And that is true, in the same sense that a building with fire escapes is safe from fire. The building is not safe. The fire escapes are simply the difference between survival and tragedy. The confidence itself is the vulnerability, because confidence erodes the urgency of migration. Let me be more precise about the technical state of affairs, because precision is the only antidote to this kind of fog. In 2021, a team led by Craig Gidney and Martin Ekerå published the most detailed cost analysis to date for breaking RSA-2048, estimating that twenty million noisy physical qubits could factor a 2048-bit modulus in about eight hours. The same framework has been applied to elliptic-curve cryptography by multiple research groups. Breaking secp256k1 is not cheaper than breaking RSA-2048. It may be somewhat more expensive in terms of logical qubit overhead, because the group operations require more carefully arranged arithmetic circuits. The consensus of the cryptanalytic literature is that a practical attack on Bitcoin's signature scheme is not a single-machine problem. It is an industrial-scale problem, requiring either one enormous facility running for hours, or a network of smaller facilities coordinating in parallel. That is a resource commitment comparable to building a particle accelerator. It is not something that appears in a university lab as a weekend hack. The discovery of a fundamentally faster algorithm would change this, but that is unquantifiable, and any discussion that pretends to quantify it is dishonest. There is also a question of coordination and incentives. A quantum attacker does not need to crack every key. They need to crack one key that is large enough to move the market, and they need to do it before anyone knows what is happening. Imagine the sequence. A sophisticated actor, or a state, has quietly built a Shor-capable machine. They do not announce it. They spend months identifying the most exposed, most concentrated, most liquid outputs. They crack those private keys, transfer the coins to obfuscated addresses, and then, in a single coordinated action, they dump the supply accumulated over years, shorting the market in advance. The price collapses. The panic begins. The narrative 'Bitcoin is broken' spreads, and the attacker, having profited from both the theft and the short position, disappears. The network is not destroyed. The protocol still runs. But the social contract is broken. A security system that a participant can no longer trust is worthless, regardless of whether it continues to produce blocks. This is where I think Tom Lee's number, for all its sloppiness, points to a genuine, quantifiable vulnerability that Adam Back's dismissal can't wish away. The 35 percent, or twenty-five, or forty percent of bitcoin in exposed-key outputs, represents a pool of potential one-way transactions that cannot be reversed once the physics arrives. There is no consensus fork that can un-expose a public key. There is no software upgrade that can protect a coin whose private key has been computed by an adversary. Once the machine exists, those specific coins are gone, not from the ledger, but from their rightful owners. The only possible protection is to move every exposed coin to a quantum-resistant address before the attack window opens. And moving, for the human beings involved, requires three things: awareness, access to their keys, and access to the internet. Awareness can be raised. Access to keys cannot be restored if lost. Access to the internet cannot be guaranteed for a generation of elderly holders in jurisdictions that may have restricted, censored, or simply failed. Let me return to the question of governance, because I believe it is the largest unanswered question in this entire debate, and it is the one that neither a Wall Street analyst nor a cypherpunk founder is equipped to answer. Bitcoin's security has always rested on a two-layer model. The first layer is mathematics, the hard problem of the elliptic-curve discrete logarithm, the preimage resistance of hash functions. The second layer is human coordination, the consensus rules that determine what counts as a valid transaction and what counts as a chain. For fourteen years, the mathematics has been the strong layer and the coordination has been the weak one. SegWit activation required a coordinated economic boycott. The block-size war nearly split the network in two. The community has repeatedly chosen immutability of the ledger over adaptability of the code, and it has done so for good reasons: trustless consensus depends on predictable rules. But the arrival of a quantum threat fundamentally changes the calculus. The rules themselves are the problem. The rules allowed public keys to remain exposed for years. The rules reward miners for processing signatures that may one day be forged. The rules make no distinction between a coin that belongs to a living, reachable owner and a coin that belongs to no one. Code is law, until the law breaks the code. I think about this whenever I read about the latest legal assault on open-source developers. In August 2022, the U.S. Treasury sanctioned the Tornado Cash smart contract, and the implication was that the developers of code, neutral infrastructure, could be held criminally liable for how that code was used. My jaw does not drop anymore. I have processed it. But it feeds a specific anxiety: the same open-source maintainers that would be responsible for designing and deploying a quantum-resistant migration are the ones being told, by regulators, that their code can make them targets. The burden of saving Bitcoin falls on a handful of volunteer, underfunded, overstretched engineers who already face legal risk for doing their jobs. Faith in the protocol is not faith in the people. It is the opposite. It is faith that the people can be spared from having to make decisions, because the protocol has encoded them in advance. But a quantum migration cannot be encoded in advance. It requires a decision, rendered by humans, with all of the political and economic distortion that entails. And the people who must make that decision are the same people who have been taught, by their own culture, to distrust change. Let me bring the conversation back to the market, because that is where the 35 percent prophecy does its real work. The interesting thing, to me, is how little the market has responded. If institutional investors genuinely believed that one-third of the Bitcoin supply could be cracked in four years, the price would trade at a discount. The futures curve would show deep contango. Options markets would be pricing in systemic risk. Instead, we have observed, in the years following the ETF approval, the exact opposite. Bitcoin has been absorbed into the mainstream financial plumbing. Wall Street has bought the token, packaged it, and called it a store of value. The same institutional machine that demanded custody, audit trails, and securities compliance has casually absorbed the existence of a cryptography threat that could, in the worst case, invalidate its holdings. Either the market is behaving rationally, because it has correctly assessed that the 2028 timeline is nonsense, or the market is behaving in its usual fashion, which is to ignore tail risks until they become headwinds. I have spent enough time around institutional capital to suspect it is the latter. The quote from John Maynard Keynes, that markets can remain irrational longer than you can remain solvent, has a quantum cousin: they can also remain careless longer than you can remain safe. This is where my contrarian position forms. I am not arguing that the quantum threat is imminent. I do not believe that a quantum computer will crack 35 percent of Bitcoin in 2028. I believe the probability of that specific event is low enough that I would not mention it in a risk section of a portfolio report without a long footnote. But I also believe that Adam Back's rebuttal, and the general mood of Bitcoin maximalism, is exhibiting a version of the same failure that precedes every systemic collapse: the failure to distinguish between 'the catastrophic event is unlikely this year' and 'the catastrophic event is impossible.' The first is a risk assessment. The second is a delusion. And the gap between the two is filled with genuine vulnerabilities, not least of which is the complacency of the community. When I hear a cypherpunk say that Bitcoin can adapt, I hear a true statement. When I hear the same cypherpunk imply that adaptation is easy, I hear the voice of someone who has never held a focus group with the non-technical majority, who has never tried to explain a soft fork to a retiree in Florida, who has never watched a decentralized governance process collapse because nobody could agree on the color of the logo. The historical record supports this pessimism. Bitcoin's first eight years saw a chain split over block size, a crisis that was resolved only by economic weight, not by technical elegance. Ethereum's migration from proof of work to proof of stake required years of coordinated effort, and even then it left behind a shadow chain. Zcash, which pioneered zero-knowledge proofs, has been through multiple protocol upgrades that were far less contentious than what a quantum migration would require. The point is not that upgrades fail. The point is that they are slow, and the quantum clock, if it matters at all, is running faster than the governance clock. Suppose we decide in 2027 to begin a ten-year migration to a quantum-resistant address type. The technical design takes two years. The consensus activation takes two years. The actual migration, the moving of hundreds of millions of coins, takes another five at optimistic speed. That brings us to 2036, which is precisely the point at which many physicists believe the first serious cryptanalytic machines could exist. There is no slack. There is no margin for error. And the margin is the thing that collapses in every real crisis. I should not let myself become entirely grim. There is a version of this story that ends well, and I think it is worth tracing, because the Bitcoin community has displayed, in crisis after crisis, an almost pathological ability to survive its own mistakes. When the price crashed in 2022, when the fraud was exposed, when the industry was reduced to its true believers, the network kept running. Blocks were produced. Settlements occurred. The protocol did its job. This is not trivial. Bitcoin is the longest-running, most secure, most economically valuable distributed database in history, and it has survived hostile governments, exchange collapses, and the eternal human capacity for greed. The quantum threat is not fundamentally different from those threats. It is a test of whether the community can respond to an external, existential challenge without tearing itself apart. I believe it can. But I do not believe it can do so while its most prominent voices are busy telling it that there is nothing to worry about, or, conversely, that the world ends in 2028. Both narratives rob the ecosystem of the one resource it needs the most: the capacity for sustained, boring, coordinated attention. What would sustained attention look like? It would look like funding for post-quantum signature research, not as a moonshot but as a core protocol initiative. It would look like public education campaigns that explain the difference between P2PK and P2PKH, between a key that is exposed and a key that is hidden, in terms that an average user can understand. It would look like a cultural shift away from the fetishization of lost coins, toward an honest acknowledgment that 'lost' is not 'sacred,' and that the first quantum-cracked wallet will open a philosophical door that cannot be closed. Most of all, it would look like a design process that begins before the crisis, that builds the migration rails while block production is still cheap, that asks the hard governance questions while there is still time to answer them calmly. We built the temple, but forgot who the god is. The god is not the architecture. The god is the people who use it, in all their chaotic, fragile, mortal imperfection. And the temple they built was never meant to last forever. It was meant to outlast its builders, yes. But it was also meant to be repaired, adapted, and, when necessary, upgraded. Let me offer a different frame for the 35 percent. Do not read it as a deadline. Read it as a measurement of how much of Bitcoin's value is already exposed to a future cryptographic breakthrough. It is not a warning about 2028. It is a description of the situation that exists today, right now, in this sideways market that we are all pretending to navigate. The public keys are on the chain. The clock on their security began ticking the moment they were revealed. The only unknown is when the machine arrives, not whether the keys are at risk. This is the new insight that gets lost in the Tom Lee headline and the Adam Back rebuttal: there is no moment of quantum attack. There is only a continuous, decades-long exposure, punctuated at the end by a sudden, catastrophic loss. The attack window is not a point in time. It is a period that began in 2009 and extends into the indeterminate future, growing more dangerous with each passing year as the hardware improves and the coins remain frozen. The implications are uncomfortable. For one, they suggest that the market should be discounting not just the year 2028, but every year that has already passed since the first public key was exposed. For another, they suggest that the most valuable activity in crypto today is not trading, not yield farming, not NFT minting, but the unglamorous work of key hygiene and protocol governance. The same way we eventually taught people to back up their seed phrases, we must now teach them to consolidate their funds into addresses that have never revealed a public key, and eventually into addresses that no quantum computer will ever break. This is not an exciting message. It does not produce a chart that goes up. It produces the opposite: a long, careful, deliberate process of hardening that will be invisible if it succeeds and catastrophic if it fails. There is one more angle that I feel compelled to address, because it is the one that haunts me most. The race-to-crack dynamic I described earlier, where an adversary targets lost and frozen coins, has a strange ethical asymmetry. The coins are, by conventional definition, owned by no one, because no one can produce the private key. Yet they are not abandoned in the sense that a house is abandoned when its owner dies. They are protected, for now, by mathematics. When the mathematics fails, they will become available to whoever has the computational power. This will not be the anonymous cypherpunk teenager in a basement. It will be a state, or a well-capitalized corporation, or a black-market operation with state-level resources. Whoever wins that race will control a historically significant fraction of fixed supply, and they will do so without any legal process, because there is no legal framework for 'the original key holder is unreachable, and the mathematics has been superseded.' The question of who legitimately owns a coin in a post-quantum world is not a cryptographic question. It is a legal question, a philosophical question, and a moral question. And nobody in the Bitcoin community wants to answer it. In my work as an open-source evangelist in Copenhagen, I have had the privilege of organizing workshops that bring blockchain developers and AI researchers into the same room, usually around topics like zero-knowledge proofs for private model training. The best of those sessions have a particular quality: they begin with everyone assuming the other side is naïve, and they end with everyone realizing that the naive assumptions are shared. I see the same dynamic in the quantum debate. Tom Lee assumes that Bitcoin is a security that can be stress-tested with backtests. Adam Back assumes that Bitcoin is an autonomous protocol that can evolve without social engineering. Both assumptions are wrong. Bitcoin is a social system expressed in mathematics, and its survival depends as much on its ability to convince millions of strangers to coordinate as on its ability to resist a hypothetical machine that does not yet exist. The hardest key to crack is not the ECDSA private key. It is the consensus key, the fragile agreement among a scattered, defiant, often irrational community that their shared ledger is worth preserving. So here is my measured conclusion, in place of a verdict. The prediction of 35 percent by 2028 is not a technical forecast. It is a rhetorical event, designed to provoke a reaction, and it has succeeded. Adam Back's rebuttal is also a rhetorical event, designed to calm the herd, and it has also succeeded. The truth is less useful to either camp. It is that Bitcoin's security model has an expiration date, though the date is written in physics, not calendars. It is that a significant fraction of the supply is already in the blast radius. It is that the migration conversation must begin before the crisis, not after, because governance is slower than mathematics. And it is that neither panic nor dismissal can save us from the one thing that has always determined the fate of open systems: the willingness of the people inside them to do boring, difficult, unglamorous work before it becomes urgent. The ledger remembers every transaction, every key, every public byte that was ever broadcast. But the heart forgets. The heart forgets that security is a practice, not a property. The heart forgets that every fortress decays, and that the only defense is continuous repair. I do not know whether the first Shor-capable machine arrives in 2040 or 2050 or 2070. I do know that when it arrives, it will not ask whether the Bitcoin community was ready. It will simply execute the mathematics. The question is whether we will have spent the years before that moment as a community that planned, or as a community that hoped. Tom Lee gave us a number. Adam Back gave us reassurance. Neither one has given us the only thing that matters: a migration path that a seventy-year-old hardware wallet user, a dead man's widow, and a teenager in a country with rolling blackouts can all actually follow. That path will not be built in 2028. It is being built now, or it is not being built at all. And we will know, not because of a headline, but because of the quiet choices of a million ordinary people moving their coins, one transaction at a time, toward an address that the future cannot break. That is the only prophecy worth believing in.