A proposal published by Paradigm on May 1, 2026, at 22:54 UTC+8 describes how Bitcoin holders could privately record evidence of address control before quantum computers threaten their keys—without moving their coins. That evidence could support a future recovery route if Bitcoin ever disables ordinary spending from quantum-vulnerable outputs.
Called Provable Address-Control Timestamps, or PACTs, the mechanism is an illustrative design, not a formal protocol proposal or an adopted Bitcoin feature. Creating a timestamp would not require a fork, but using it to recover coins would require substantial protocol changes later. There is no guarantee Bitcoin would adopt that recovery route.
The dilemma: freeze vulnerable coins or leave them exposed?
A sufficiently powerful cryptographically relevant quantum computer, or CRQC, could derive private keys from exposed public keys. According to the article, this could put hundreds of billions of dollars in bitcoin at risk. Whether—and when—such computers will arrive remains uncertain; the threat might never materialize.
One possible response, discussed in the draft of BIP-361, is a soft fork that eventually ends spending from addresses with exposed public keys. This proposed “sunset” could prevent quantum attackers from taking those coins, but it would also freeze funds belonging to holders who had not moved them in time.
Moving coins is not a privacy-neutral alternative. It incurs fees, reveals that a holder is active and can expose information such as wallet relationships or timing patterns. The article highlights wallets believed to belong to Satoshi Nakamoto: approximately 1.1 million BTC, valued at over $75 billion at the time of publication. A move from those wallets would be a significant public signal.
The source also notes a possible timing problem: Bitcoin did not yet support post-quantum addresses when the article was published. If quantum capabilities advanced quickly, holders might face only a short interval between support for new addresses and a requirement to use them.
What PACTs would record
The proposal separates two actions: recording evidence of control before a quantum threat, and proving that evidence later if a rescue mechanism becomes necessary.
In the illustrative design, a holder would:
- Generate a 256-bit secret salt.
- Create a BIP-322 full message proof of control over the vulnerable output’s
scriptPubKey, the script defining its spending conditions. The message would identify the PACT purpose, Bitcoin network, relevant script and salt. - Hash the proof and salt into a commitment, then timestamp that commitment through OpenTimestamps.
- Securely retain the salt, control proof and OpenTimestamps proof file as recovery material.
OpenTimestamps aggregates hashes into a Merkle tree and anchors them in Bitcoin through an OP_RETURN output. The holder would not need to make a Bitcoin transaction themselves, and the service is free to use.
Only the opaque commitment would be shared—not the salt, control proof, public key, address or identity of the coins. The source nevertheless cautions that privacy-conscious users would still need to protect network metadata when contacting timestamping services. Producing a proof with a private key also carries some risk, even though that proof would remain private.
How a future rescue could work
If Bitcoin later adopted a quantum sunset and a PACT rescue mechanism, a claimant could submit a post-quantum-secure zero-knowledge proof, such as a STARK, establishing that:
- They know the secret salt and a valid BIP-322 control proof for the frozen output.
- Those materials match a commitment timestamped before an agreed cutoff, set before quantum computers were believed capable of deriving private keys from exposed public keys.
- The proof authorizes the specific rescue transaction, preventing someone from copying it to redirect the coins.
The salt and original control proof would remain hidden. The rescue rules could also require proof only that the timestamp was early enough, rather than disclosure of its exact date.
Verification would need to establish the full connection from the commitment through the OpenTimestamps attestation, its Bitcoin transaction and block inclusion, to a block recognized as part of the active chain before the cutoff. How to anchor that evidence to chain history remains a practical design question.
This is the central before-and-after distinction: a PACT would preserve evidence now; it would not create a currently available right to spend after a sunset. Bitcoin would still have to adopt rules accepting that evidence.
Why existing rescue ideas may not cover early holders
The article describes another possible recovery approach for keys derived from a parent key under BIP-32. A holder might prove knowledge of the parent key—information a quantum attacker deriving an exposed child private key would not obtain. This approach is discussed in BIP-361, and a prototype prover has been implemented.
But millions of bitcoins with exposed public keys predate BIP-32. PACTs are intended to offer a possible route for those older holdings by preserving evidence before attackers could derive the same private keys.
What remains unresolved
The commitment process uses established components, but eventual consensus verification would require substantial new Bitcoin infrastructure. A standardized PACT format would also need expert and community input.
Coverage is not universal. Multisignature arrangements, complex scripts, custodial wallets and hardware-wallet support would require careful standardization. The source also flags a BIP-322 caveat: the ability to sign a message from an address is not necessarily identical to the ability to authorize a transaction from it.
Most importantly, holders should not rely solely on PACTs for protection before a rescue protocol is adopted. Bitcoin might never sunset vulnerable keys, or it might choose a different recovery mechanism. The proposal’s narrower aim is to preserve a private option without forcing a decision now about whether a quantum sunset is necessary.
The article credits Jeremy Rubin with proposing a similar design on the Delving Bitcoin forum.
Original source: Paradigm — “PACTs: Protecting Your Bitcoin From a Quantum Sunset”, published May 1, 2026, at 22:54 UTC+8.