What happened
Bitcoin developers circulated a draft recovery protocol on Sunday that pairs a commit/reveal scheme with zero-knowledge proofs, according to Crypto Briefing. Users would first publish a hashed commitment tying their existing address to a new, quantum-safe output. After a mandatory waiting period, they would reveal a ZK proof that binds the two without exposing the underlying private key. Coins would then move to the safer script type.
The commit/reveal window is the design's key trick. If an attacker with a working quantum computer tries to race the owner by deriving the private key from a broadcast public key, the honest holder still wins because their commitment landed first. Only holders who can sign a fresh proof qualify. That carves out lost coins, coins in wallets with no active custodian, and, most visibly, the roughly 1.1 million BTC associated with Satoshi Nakamoto.
The proposal is still in draft form and has no consensus support yet. Any deployment would require a soft fork and months of review on the bitcoin-dev list.
Why it matters
Quantum risk has been a slow-burn discussion in Bitcoin for years. The threat model is narrow but well understood. Public-key-exposed addresses, including the P2PK outputs from 2009-2010 where Nakamoto's coins sit, are the most exposed class. Once a public key sits on-chain, a fault-tolerant quantum computer of sufficient scale could in theory derive the private key that controls it.
A commit/reveal migration is not a full defense. It buys time for holders who can sign. It does not solve the problem of coins whose owners are dead, lost, or absent. Under this proposal, that supply becomes a bounty for whichever party first cracks the underlying elliptic curve. The implication cuts both ways. Coins that migrate stay outside the target set. Coins that do not can, in one scenario, be seized by an attacker and dumped into spot markets.