Original publication: May 1, 2026, at 22:54 UTC+08:00. This article explains a proposal, not an available Bitcoin recovery feature.
Could Bitcoin holders prepare for a future quantum threat without publicly moving their coins? A Paradigm article proposes Provable Address-Control Timestamps, or PACTs: private, timestamped commitments that could establish control of an address before quantum computers became capable of deriving its private key.
The important limitation is that creating this evidence would not guarantee a future right to spend. Bitcoin would need to adopt rescue rules that recognize it. The article’s construction is illustrative rather than a formal specification, and it calls for expert review and community standardization.
The problem PACTs aim to address
A sufficiently powerful cryptographically relevant quantum computer, or CRQC, could derive private keys from exposed public keys. According to the source, that could put hundreds of billions of dollars of Bitcoin at risk.
One possible response, discussed in the draft of BIP-361, is a soft fork that eventually disables spending from addresses with exposed public keys—a “quantum sunset.” That would also affect legitimate holders who had not moved their coins before the deadline.
Moving funds is public and costs transaction fees. It can reveal that a dormant holder is still active, along with possible timing patterns, wallet relationships or network information. The source highlights wallets believed to belong to Satoshi Nakamoto, estimated to contain around 1.1 million BTC, worth over $75 billion at the article’s publication.
Some proposed rescue mechanisms could help holders whose keys were derived from a parent key, as under BIP-32. A holder might prove knowledge of that parent key, information a quantum attacker deriving only the exposed address’s private key would not possess. But this would not cover the earliest addresses that predate BIP-32 and lack such a derivation path.
PACTs target that gap: preserve evidence of earlier control without moving the coins.
How the proposed workflow works
The following describes the source’s conceptual design. It is not a tested wallet procedure or a finalized standard.
1. Create a private proof of control
The holder generates a 256-bit secret salt and uses BIP-322 full message signing to prove control of the vulnerable output’s scriptPubKey—the script that defines its spending conditions.
The signed message would commit to:
- The PACT purpose and version.
- The Bitcoin network.
- The vulnerable output’s
scriptPubKey. - The secret salt.
The illustrative commitment is:
SHA256("PACT/v1 commitment" || salt || SHA256(control_proof))
Here, control_proof is the BIP-322 full message proof. Neither it nor the salt would be sent to the timestamping service.
2. Timestamp the commitment
The holder submits the commitment to OpenTimestamps, an open-source protocol that anchors hashes to Bitcoin through aggregation into a Merkle tree and inclusion in an OP_RETURN output.
OpenTimestamps is free to use and can batch many commitments into one Bitcoin transaction. The holder would not need to make a Bitcoin transaction or move the vulnerable coins.
The commitment itself reveals no address, public key, salt, proof or coin ownership. However, the source cautions that privacy-conscious users would still need to protect network metadata when contacting timestamping services.
3. Keep the recovery artifacts
The holder must securely retain:
- The secret salt.
- The BIP-322 control proof.
- The OpenTimestamps proof file.
The intended result is private, timestamped evidence of control, not a change to the coins’ spending conditions or protection already enforced by Bitcoin.
What a future rescue would need to prove
If Bitcoin later adopted both a quantum sunset and compatible PACT rescue rules, a claimant could provide a post-quantum-secure zero-knowledge proof, such as a STARK, establishing that:
- They know the secret salt and a valid BIP-322 control proof for the frozen output.
- Those values produce a commitment timestamped before an agreed cutoff, set before quantum computers were believed capable of deriving the relevant private keys.
- The timestamp is anchored in Bitcoin’s recognized chain history before that cutoff.
- The rescue proof authorizes the specific rescue transaction, preventing someone from copying it to redirect the funds.
The salt and original control proof would remain hidden. Depending on the eventual rules, the holder might only need to prove that the timestamp was early enough, rather than disclose its exact date.
This is not a small implementation detail. The source says verifying such proofs would require substantial new Bitcoin protocol infrastructure. A practical design would also need to specify how transaction-level verification connects to historical chain data, likely through a recent block hash.
What PACTs would—and would not—offer
No fork would be required to create commitments. Once a format was standardized, holders could begin timestamping evidence without waiting for post-quantum addresses or a decision on whether to sunset vulnerable outputs.
Future acceptance would remain uncertain. Bitcoin might never adopt a quantum sunset, and even if it did, it might choose a different rescue mechanism. The source explicitly warns holders not to rely solely on PACTs before a rescue protocol is adopted.
Wallet coverage would need work. The proposal is expected to suit many single-key wallets, but multisig, complex scripts, custodial arrangements and hardware-wallet support would require careful standardization. BIP-322 also notes that the ability to sign a message is not necessarily identical to the ability to sign a transaction from the same address.
Key handling still introduces risk. Producing the control proof requires using the private key. Although only an opaque commitment is shared with OpenTimestamps, the signing process is not risk-free, and the resulting artifacts need protection.
Bottom line for builders and holders
PACTs separate two decisions: preserving evidence of key control and deciding whether Bitcoin should ever restrict quantum-vulnerable spending. The former could be prepared without moving coins; the latter would remain a future protocol decision.
For now, the useful takeaway is the design—not a claim that a recovery tool has shipped. The article identifies standardization, wallet compatibility and consensus verification as unresolved work. It also acknowledges similar prior work proposed by Jeremy Rubin on the Delving Bitcoin forum.
The quantum threat itself remains uncertain: CRQCs may not threaten Bitcoin for a long time, or may never do so.
Read the original Paradigm article: “PACTs: Protecting Your Bitcoin From a Quantum Sunset”