Connect with us
DAPA Banner

Crypto World

Dormant Bitcoin Wallets Pose the Biggest Quantum Risk, Explained

Published

on

Crypto Breaking News

As quantum computing edges closer to practical reality, a nuanced risk picture is taking shape for Bitcoin. Rather than a sudden, network-wide catastrophe, researchers and industry observers are highlighting a tiered vulnerability focused on dormant addresses with exposed public keys. Many of these are among the oldest coins from Bitcoin’s early era, and their combination of long-standing exposure, high value, and inertia in defense makes them salient targets for a first generation of quantum-enabled attackers, should such capabilities mature.

Key takeaways

  • Dormant Bitcoin addresses with exposed public keys represent a concentrated risk, especially among early-era holdings that haven’t moved in years.
  • Quantum threats affect public-key cryptography (ECDSA/Schnorr) more directly than hash functions, meaning on-chain exposure of a public key is a critical vulnerability.
  • The risk separates into on-spend attacks (tight time windows tied to block confirmations) and at-rest attacks (longer horizons when keys are exposed but no immediate transaction is triggered).
  • Large, long-dormant holdings — including many 50 BTC block rewards from the early mining era — create a high-value target pool that could attract quantum-driven attacks first.
  • Beyond technology, the dormant-wallet challenge raises governance questions about asset salvage, protection, and how the protocol might accommodate or address historically inaccessible coins.

Where the risk converges on Bitcoin’s cryptography

Bitcoin relies on two cryptographic pillars: the hash function SHA-256 for mining and block security, and public-key cryptography (ECDSA/Schnorr) for transaction signatures. Quantum computers would affect these components in distinct ways. Hash functions are relatively resilient; even with Grover’s algorithm, they would be weakened but not rendered obsolete. Public-key cryptography, however, presents a sharper exposure path. With Shor’s algorithm, a sufficiently powerful quantum computer could derive a private key from a known public key. In practical terms for Bitcoin, that means any coins whose public key has been revealed could theoretically be spent by an attacker if a quantum-capable adversary can perform the computation in time to act on a vulnerability.

The on-spend vs at-rest distinction and why it matters

Understanding the timing of attacks is crucial to assessing risk. There are two broad categories of quantum attacks:

On-spend attacks

  • Trigger a transaction to reveal the user’s public key.
  • Attackers must derive the private key within a short window — roughly the span of a single block, or about 10 minutes — to successfully move funds.

At-rest attacks

  • Target coins whose public keys are already exposed on-chain.
  • Aim for a longer horizon: days, weeks, or longer — with time as the primary constraint, not a rapid transaction window.
  • No immediate transaction trigger is required; attackers can plan and execute when they have sufficient quantum capability.

The contrast is telling. On-spend attacks face a tight clock, while at-rest attacks operate on a long-term timescale, hinging on technical breakthroughs rather than a race against a block window. If a large tranche of the supply has already disclosed its public keys, the window for opportunistic action expands dramatically.

Dormant wallets: three vulnerability factors

Dormant wallets—those that have not actively moved funds or upgraded security—combine three attributes that amplify risk:

  • No defensive action: Active holders can migrate funds, refresh security models, or move assets into newer, quantum-resistant formats. Dormant holders lack such pathways, leaving coins exposed without recourse.
  • Long exposure windows: Since public keys may already be on-chain, attackers can operate offline with less urgency, reducing the urgency imposed by short confirmation times.
  • High-value concentration: Many early Bitcoin holdings have appreciated substantially in value. High-value, dormant coins create a prime target profile for any future quantum-era exploit.

Notes from industry observers emphasize that coins in inactive wallets cannot upgrade their security after the fact. Thus, the burden of adoption and migration would fall to active participants and future protocol changes, not the dormant accounts themselves.

Which wallets are most exposed

The risk is not uniform across the blockchain. Several categories stand out as more exposed than others:

Advertisement

Old P2PK outputs

  • These early formats reveal public keys directly on-chain when spent, offering little additional protection against quantum-enabled adversaries.

Address reuse

  • When an address is spent from and then reused, the public key becomes visible after the first spend. Any remaining funds in that address become more vulnerable as well.

Certain modern script formats, such as those associated with Taproot, also expose public-key material in ways that could fall into an at-rest exposure category under quantum assumptions. While Taproot was designed to improve efficiency and privacy, it does not entirely escape the theoretical risk if keys remain exposed long-term due to address reuse or legacy holdings.

The scale of the problem: dormant coins dominate the risk

Quantifying quantum risk goes beyond theoretical math; it hinges on measurable exposure. Reports indicate that billions of dollars’ worth of Bitcoin remains in addresses whose public keys are exposed, with a significant portion tracing back to early-era mining rewards. A notable share of these coins has not moved for more than a decade, creating a silent pool of assets that could become vulnerable as quantum capabilities advance. Among the most cited examples are the large blocks rewarded to miners in Bitcoin’s infancy — many of these blocks yielded 50 BTC rewards that subsequently remained idle for years. This concentration implies that the largest quantum-targets are often the largest Bitcoin holdings.

A deeper challenge: Dormant wallets and network governance

The emergence of a quantum threat for dormant wallets also raises governance and policy questions that extend beyond pure cryptography. If a future quantum attack were to surface, the Bitcoin community might face difficult choices about asset salvage, fund protection, or even temporary protocol adjustments to address long-dormant coins. Questions include whether such coins should remain spendable, whether there should be mechanisms to protect or freeze longitudinal holdings, and how public policy interacts with the immutable nature of the protocol when a subset of assets appears irrecoverable by design.

Why this doesn’t mean Bitcoin is broken

Crucially, observers stress that there is no current, widely accepted evidence that quantum computers capable of breaking Bitcoin’s cryptography exist today. The development path toward practical, scalable quantum systems is expected to span years, if not decades, of sustained engineering progress. The risk is not imminent, but incremental and evolving. In the near term, the impact is likely to be selective rather than universal as early-stage quantum capabilities emerge and defenses are refined. Active users can adapt more quickly than dormant wallets, which means mitigation may initially favor those who actively manage their keys and upgrade security models.

What can be done in the meantime

Holders and the broader ecosystem can take concrete steps to reduce exposure and accelerate readiness:

Advertisement
  • Minimize public-key exposure: Avoid address reuse and curb unnecessary early revelation of public keys, maintaining better separation between on-chain activity and key exposure.
  • Migration pathways: Develop and promote clear routes for moving funds into quantum-resistant formats as these technologies mature, ensuring a smooth transition for users who want to upgrade their security posture.
  • Continued protocol research: Ongoing work explores integrating quantum-resistant cryptography with Bitcoin’s core properties, aiming to preserve security and decentralization without introducing new central points of failure.

Practically, these measures primarily benefit active participants today, highlighting the gap between movable funds and long-dormant assets. The broader lesson is that a staged approach to upgrading cryptography may be essential to maintain resilience as technology evolves.

In summary, the dormant-wallet vulnerability reframes the quantum risk narrative for Bitcoin. It underscores a layered challenge: the network isn’t threatened as a monolith, but certain pockets of the supply could be more fragile than others if and when quantum capabilities advance. The future resilience of Bitcoin will depend not only on breakthroughs in quantum hardware but on decisive action by the ecosystem to strengthen, migrate, and adapt the way keys are managed across the lifecycle of the blockchain.

Readers should watch for ongoing research into quantum-resistant cryptography, milestones in post-quantum upgrades, and policy discussions about how to handle historical holdings that may be irretrievably exposed to future computational breakthroughs. The next phase will likely hinge on practical migration pathways and protocol-level safeguards that can extend protection to both active and dormant users without compromising Bitcoin’s core principles.

Risk & affiliate notice: Crypto assets are volatile and capital is at risk. This article may contain affiliate links. Read full disclosure

Advertisement

Source link

Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

Texas man behind $20M Meta-1 Coin fraud gets 23-year sentence

Published

on

Crypto Breaking News

A Texas man who helped orchestrate a cryptocurrency scam that defrauded roughly $20 million from about 1,000 investors was sentenced to 23 years in federal prison on Tuesday. U.S. District Judge LaShonda Hunt handed down the sentence to Robert Dunlap, who served as a trustee for the Meta-1 Coin project and helped market the fictitious token.

According to the U.S. Attorney’s Office for the Northern District of Illinois, Dunlap and his co-conspirators used a self-created Meta Exchange to inflate the token’s market price and trading volume with automated trading bots, while presenting investors with misleading assurances about asset backing and potential returns. Prosecutors said the scheme relied on false statements and concealed expenses, with funds ultimately used for personal purchases, including luxury vehicles such as a Ferrari.

The defendant was convicted in November on two counts of mail fraud, each carrying a potential sentence of up to 20 years in federal prison. Prosecutors noted in the sentencing memorandum that Dunlap was “unrepentant” and that his misrepresentations escalated over time, underscoring the seriousness of the case as a warning to would-be crypto scammers.

The SEC has been active in pursuing similar schemes. In March 2020, the agency ordered an asset freeze and other emergency relief against Dunlap, an alleged accomplice, Nicole Bowdler, and former Washington state Senator David Schmidt to stop marketing and selling Meta-1 Coin. The SEC alleged that investors were told Meta-1 Coin was risk-free and could deliver enormous returns—claims that investors later learned were false. The agency noted that the coins were never distributed and that funds were diverted to personal use.

Advertisement

Token claims, market manipulation, and the broader crackdown

The case centers on Meta-1 Coin, a token that prosecutors said was touted as backed by a $1 billion art collection—including works by Picasso and van Gogh—and $44 billion in gold. Those asset-backed claims were part of the fraud profile presented by the government, which also described how Dunlap and associates marketed the token through a trust structure from 2018 to 2023. The government alleged investors were promised returns that would dwarf typical crypto gains, with figures that were manipulated to create an illusion of robust trading activity.

Beyond the Meta-1 case, regulators and authorities have signaled a broader push to curb crypto fraud and manipulation. In parallel reporting, authorities have pursued other crypto-related prosecutions, including charges related to hacking and DeFi-related exploits, underscoring a tightening stance as enforcement agencies increasingly scrutinize market misconduct in digital assets.

What this means for investors and the market

The Dunlap sentence highlights the risk profile of investment projects that promise outsized, rapid returns and rely on opaque asset claims. For investors, the case emphasizes the importance of due diligence, independent verification of asset backing, and a healthy skepticism toward platforms that blend trading activity with promises of instant wealth. For the crypto industry, the outcome signals regulators’ willingness to pursue not only misrepresentation but also the operational mechanics that enable such fraud, including automated market manipulation tied to self-hosted exchanges.

Looking ahead, readers should watch how the regulatory pendulum continues to swing on disclosure standards, enforcement actions, and the treatment of asset-backed crypto products. While the Meta-1 saga has reached a definitive sentencing point, the broader crackdown on crypto scams is far from over, with ongoing investigations and charges shaping market expectations for investor protection and compliance in the sector.

Advertisement

According to the U.S. Attorney’s Office in Illinois, the case serves as a stark reminder that alleged crypto fraud carries serious, long-lasting consequences. For further context, the original SEC filing and press release detailing the 2020 asset freeze are available through the agency’s public records.

Risk & affiliate notice: Crypto assets are volatile and capital is at risk. This article may contain affiliate links. Read full disclosure

Source link

Advertisement
Continue Reading

Crypto World

Circle Internet Group faces class action over failure to stop Drift Protocol exploit funds

Published

on

Circle Internet Group faces class action over Drift Protocol exploit
Circle Internet Group faces class action over Drift Protocol exploit
  • Circle is accused of failing to freeze exploit-linked transfers.
  • Approximately $230 million in stolen funds was routed through Circle’s USDC.
  • Drift plans $147.5 million recovery backed by future revenue.

Circle Internet Group, the issuer of the USDC stablecoin, is facing a class action lawsuit over its alleged failure to stop the movement of stolen funds linked to the Drift Protocol exploit.

The lawsuit, filed by Drift investor Joshua McCollum at the US district court in Massachusetts on behalf of over 100 impacted users, centres on whether the company had both the ability and the obligation to intervene as the exploit unfolded.

Lawsuit targets Circle’s role in fund transfers

The legal action stems from the April 2026 breach of Drift Protocol, a Solana-based decentralised exchange, where attackers drained roughly $285 million.

A significant portion of those funds, estimated at around $230 million, was quickly converted into USDC.

From there, the funds were moved across chains, primarily from Solana to Ethereum, using cross-chain infrastructure.

Advertisement

The transfers were not instantaneous. They occurred over several hours and were split into more than 100 transactions.

This detail sits at the centre of the lawsuit.

Plaintiffs argue that Circle had a window of opportunity to act.

According to the claim, the company could have frozen the affected wallets or halted the transfers, limiting the damage. Instead, the funds continued moving until they were fully out of reach.

Advertisement

The case accuses Circle of negligence and of indirectly facilitating the loss by failing to act despite having the technical capability to do so.

This argument is reinforced by previous instances where the company has frozen wallets tied to illicit activity, showing that such intervention is not only possible but already part of its operational toolkit.

At its core, the lawsuit raises a difficult question: when a centralised entity operates within a decentralised system, where does its responsibility begin and end?

Drift’s recovery plan

In response to the exploit, Drift Protocol has outlined a structured recovery plan aimed at addressing user losses while rebuilding the platform’s liquidity and operations.

Advertisement

The protocol is seeking to mobilise up to $147.5 million, with a significant portion backed by Tether and other ecosystem partners.

This figure, however, should not be viewed as immediate compensation.

A large share of the funding comes in the form of a revenue-linked credit facility estimated at around $100 million.

This means the protocol will draw funds over time and repay them using future trading fees and platform revenue rather than distributing the full amount upfront.

Advertisement

To manage user claims, Drift plans to issue a new recovery token, though its official name and final structure are yet to be confirmed.

This token will be distributed to affected users and will represent their share of the recovery pool.

It is expected to be transferable, allowing users to either hold it and wait for gradual repayments or sell it on secondary markets for immediate liquidity, likely at a discount.

The recovery pool itself will not rely solely on external funding.

Advertisement

It is designed to be continuously replenished through multiple sources, including protocol revenue, partner contributions, and any funds that may be recovered from the attackers.

This creates a system where repayments are tied directly to the platform’s ability to restart operations and generate consistent trading activity.

Despite these measures, there remains a clear shortfall.

With total losses estimated at approximately $285 million and recovery efforts targeting up to $150 million, a large portion of user funds is not immediately covered.

Advertisement

This gap highlights that users are unlikely to be fully reimbursed in the near term, and recovery will depend heavily on Drift’s long-term performance.

To support a relaunch, part of the recovery framework is also focused on restoring liquidity.

Incentives and financial support are being directed toward market makers to rebuild order books and improve trading conditions once the platform resumes full operations.

Without sufficient liquidity, even a technically sound relaunch would struggle to attract users back.

Advertisement

Another major shift is the protocol’s decision to move away from USDC as its primary settlement asset and instead adopt USDT.

This change comes after roughly $230 million of the stolen funds were converted into USDC and moved across chains during the exploit.

The switch signals a reassessment of risk and reflects a broader effort to restructure the platform’s core infrastructure following the incident.

Overall, Drift’s recovery plan is built around gradual restitution rather than immediate payouts.

Advertisement

Its success will depend on how quickly the platform can regain user trust, restore liquidity, and generate enough revenue to sustain long-term repayments.

Source link

Advertisement
Continue Reading

Crypto World

Fake Ledger Device Sold Chinese Marketplace: Research

Published

on

China, Ledger, Hardware Wallet, Cybersecurity, Hacks

A Brazilian security researcher has warned others of the latest counterfeit Ledger device scam aimed at stealing users’ crypto.

Posting as “Past_Computer2901” on the “ledgerwallet” Reddit channel on Thursday, the security researcher said they purchased what they thought was a legitimate Ledger device for personal use, but soon realized after it arrived that it was a sophisticated counterfeit aimed at stealing user funds. 

“This isn’t meant to cause panic, but rather to serve as a serious warning — I’m honestly still a bit shaken by the sheer scale of this operation,” they said. 

Scammers are adopting increasingly sophisticated strategies to target users opting for self-custody, from supply chain attacks to social engineering and approval scams.

Advertisement

Earlier this month, more than 50 victims were tricked into revealing their seed phrases on a fake Ledger Live app that made its way to the Apple App Store via a bait-and-switch strategy. The victims lost a combined $9.5 million before Apple took down the malicious app.

How the counterfeit Ledger device scam works

The researcher said he bought the Ledger Nano S Plus from a Chinese marketplace, which was priced the same as the official Ledger store. The packaging and the listing also appeared legitimate at first.

However, when they connected the device to the genuine Ledger Live app — which was luckily already installed on their computer — it failed Ledger’s built-in “Genuine Check.” 

This prompted them to pull apart the device, discovering modified hardware and firmware designed to capture and expose sensitive wallet data.

Advertisement

The security researcher said the scammers target first-time Ledger users, as the QR code that comes in the box would normally direct users to download a malicious version of the Ledger Live app that would show a fake “Genuine Check.”

Users continuing to follow the prompts will eventually allow scammers to obtain a user’s seed phrases and drain funds at any time.

China, Ledger, Hardware Wallet, Cybersecurity, Hacks
Picture of the counterfeit Ledger device being taken apart. Source: Reddit

“Stay safe out there. Only download Ledger Live from ledger.com. Only buy hardware from ledger.com,” the security researcher said. 

“If your device fails the Genuine Check — stop using it immediately.”

After pulling apart the device, they discovered clear signs of tampering, including scraped chip markings and a WiFi and Bluetooth antenna embedded inside the unit. 

Legitimate Ledger hardware products are designed to keep private keys fully offline.

Advertisement

Related: Musician loses $420K Bitcoin ‘retirement fund’ via fake Ledger app

The security researcher then looked into the firmware, putting the “chip into boot mode,” which initially identified the device as a Nano S Plus 7704 with an attached serial number.

However, once the boot sequence completed, another manufacturer’s name showed up: Espressif Systems, a publicly listed Chinese semiconductor company based in Shanghai.

Cointelegraph reached out to Espressif for comment but didn’t receive an immediate response.

Advertisement

Magazine:  What’s a ‘Network State’ and are there real-life examples? Big Questions