P2PK: Satoshi's coins and quantum computers

Whenever someone asks which bitcoin a quantum computer would go after first, the answer is the same: the oldest coins on the chain. Not because they are special, but because of how they were locked. In Bitcoin's first years, mining rewards were paid straight to a public key, with no hash in front of it. Those keys have been readable by anyone since the day the blocks were mined. This article explains what that format is, how much is still sitting in it, why a large part of it is attributed to Satoshi, and what the current proposals would do about it.

What a pay-to-public-key output is

Every bitcoin output carries a small script that says what it takes to spend it. In the format almost everyone uses today, that script holds a hash: a short fingerprint of a public key or of a more complex script. To spend the coins you reveal the key or script that matches the hash, then sign. Until that moment, the key itself is not on the chain.

P2PK skips the hash. The locking script is just the public key followed by one instruction, <pubkey> OP_CHECKSIG, which means “a valid signature from this key can spend this”. It is the simplest possible way to lock coins, and it is what the original Bitcoin software used for the reward paid to whoever mined a block. Hashed addresses existed from the beginning too, and over time they became the normal way to pay someone. P2PK stayed mostly as a feature of the earliest blocks.

Two details are worth knowing. First, most of these early keys are written in the long, uncompressed form, 65 bytes instead of the 33 bytes wallets use today. That makes no difference to their security; it is the same key written out in full. Second, P2PK outputs do not have an address of their own. When a block explorer shows you an address starting with 1 for an early mining reward, it is computing the address that the same key would have if it had been hashed. That address is a convenient label, not what is actually written on the chain.

Why P2PK is always exposed

As we explained in our first article, the weakness a large quantum computer would exploit is that Shor's algorithm can derive a private key from its public key. For most coins, the question is when the public key becomes visible. For a hashed address that has never spent, the honest answer is: not yet. That is why we call those outputs protected at rest.

A P2PK output has no “not yet”. The public key is the locking script. Anyone who downloads the chain has a list of every one of those keys, and the exact coins each one controls, and has had it for more than fifteen years. An attacker would not need to watch the mempool and race a transaction, the short-range attack that applies to every coin when it moves. They could pick a key, take as long as their machine needs, and spend the coins whenever they finish.

In our scanner's terms, a P2PK output is in the same group as an address that has spent before and still holds coins: exposed at rest. The difference is that a reused address became exposed because of something its owner did. A P2PK output was exposed by design, before anyone was thinking about quantum computers at all.

How much is in P2PK, and how much is Satoshi's

Two numbers get quoted in this conversation, and they measure different things.

The first is the total in P2PK outputs. Glassnode's chart of supply by output type puts it at roughly 1.7 million BTC in 2026. That figure counts every unspent P2PK output, whoever owns it. In the first years of the network, almost every block reward went to a P2PK output, and a block reward was 50 BTC, so it adds up quickly.

The second is the part attributed to Satoshi. In 2013, Sergio Demian Lerner noticed a pattern in the data miners leave in early blocks, now usually called the “Patoshi pattern”, that suggested a single miner had produced a large share of the blocks in 2009 and 2010. Estimates built on that work are commonly cited at around 1.1 million BTC, almost all of it in P2PK outputs that have never moved. It is worth being precise about what that is. It is a statistical inference about who mined which blocks, not a proof, and nobody outside the miner can confirm it. It is also a subset of the 1.7 million, not a separate pile.

For context, BIP-361 states that as of 1 March 2026, over 34% of all bitcoin had a public key revealed on-chain. That figure includes P2PK, reused addresses and Taproot outputs together. P2PK is a fixed part of it: those coins cannot become less exposed unless someone moves them, and a large share of them probably never will, because the keys are lost or the owner has chosen not to touch them.

Why these coins matter more than their size

At roughly 1.7 million BTC, P2PK is under a tenth of all bitcoin and a minority of the total exposed supply. The reason P2PK dominates the discussion is not only its size. It is three things together.

1. It is the easiest target. The keys are on-chain, the amounts are large and round, and many of the outputs have not moved in over a decade. An attacker with a working machine would not have to guess which coins are vulnerable.
2. Nobody can fix it from the outside. A user with a reused address can move their coins to a fresh one. Coins whose keys are lost cannot be moved by anyone except whoever eventually breaks the key. No upgrade, soft fork or new address type changes that on its own.
3. The coins are symbolic. If coins widely attributed to Satoshi started moving, the market and the press would react to that fact alone, whether the mover was the original owner, a quantum attacker or something else. That is why the debate is as much about supply and trust as about cryptography.

None of this tells you when such a machine might exist. We do not make that kind of prediction, and nobody can do it reliably. What it tells you is why the proposals spend so much effort on a part of the supply most people will never own.

What the current proposals would do

BIP-360, in its current form, adds a new output type called Pay-to-Merkle-Root that removes the exposed key Taproot has at rest. It does nothing for coins that do not move. A P2PK output stays a P2PK output until someone with the key spends it, so BIP-360 only helps owners who are able and willing to migrate.

BIP-361 is the proposal that deals with coins that do not move. It is still a draft, and it depends on a post-quantum signature BIP that does not exist yet. In its final phase, nodes would stop accepting the old signature types, which would freeze any coins that had not migrated. For most of those coins, the draft describes a rescue protocol based on proving knowledge of the wallet's seed. For P2PK there is no rescue: the authors write that they support Hourglass for P2PK because it is not currently believed possible to build such a proof for those outputs. The early keys were not derived from a seed in the way modern wallets are, so there is nothing extra the real owner knows that an attacker with the private key would not.

Hourglass itself is a separate draft by Hunter Beast and Michael Casey, first posted to the Bitcoin development list in April 2025 and revised as Hourglass V2 in February 2026. It does not freeze P2PK coins and does not let them be spent freely either. It would allow one P2PK spend per block, and in the second version cap the net amount of that spend at one bitcoin per block. The idea is to turn a possible flood of old coins into a slow, predictable trickle. It has no BIP number. In the discussion thread, one participant estimated that draining all 1.7 million BTC at that rate would take about 32 years; others objected that the limit would turn into a fee contest between real owners and miners. BIP-361 describes itself as compatible with an Hourglass-style rule, provided it activates before the final phase; without one, P2PK coins would simply become unspendable.

So the options on the table are, roughly: freeze the coins, slow them down, or leave them alone and accept that whoever breaks the keys first can spend them. Each has serious objections, and none has consensus. That is the honest state of the debate at the time of writing.

If you hold early coins yourself

Most people reading this do not own P2PK outputs. You would only have them if you mined or received coins in Bitcoin's first years with the original software and have not moved them since. If that is you, the situation is simple to describe, even if acting on it is not.

1. Moving the coins ends the at-rest exposure. Sending them to a fresh hashed address, one that has never been used, puts them behind a hash like any modern coins. The key appears briefly in the spending transaction, which is the short-range window every transaction has.
2. Be careful with old wallet files. A wallet from 2009 or 2010 is old software and old file formats. Work on a copy, offline, and do not load it into tools you do not fully trust. The risk from a careless recovery today is real and immediate; the quantum risk is not.
3. Moving is a decision with its own effects. Early coins moving is visible on-chain and can attract attention. Weigh that, and get advice suited to your situation. This article is not financial or security advice.

What our scanner can and cannot see here

This is a case where our scanner says nothing, and it is better to say so plainly.

ShorWatch works from per-address statistics in public chain data. A P2PK output has no address, so it is not part of what the scanner reads. If you paste the 1 address an explorer shows for an early mining reward, the scanner looks at the hashed form of that key, not at the P2PK output, and its result will not reflect the coins you are thinking of. Treat it as no answer, not as a protected one.

The scanner does cover the hashed addresses that most wallets have used since then, including legacy addresses starting with 1 that hold coins in the normal hashed form. Within those limits, it is an informed first pass, not an audit.