One thing usually missed in this debate: most of Satoshi's coins aren't just quantum-vulnerable the way later coins are, they're pre-exposed. Those early 2009-2010 coinbase outputs used P2PK, where the full pubkey sits plainly in the output script onchain. P2PKH, which only reveals the pubkey when the coin is spent, became common later. So the standard advice of "migrate to a quantum-safe address before capability arrives" just doesn't apply to the bulk of Satoshi's stash. Those pubkeys have been sitting in plaintext for 17 years.
That shifts the game theory meaningfully, because the Freeze-vs-No-Freeze frame kind of assumes a symmetric migration window that doesn't exist here. Hunter Beast's QuBit draft and the BIP-360 thread on bitcoin-dev are the closest thing I've seen to a written-up third option, though neither resolves the already-exposed case cleanly.
One thing usually missed in this debate: most of Satoshi's coins aren't just quantum-vulnerable the way later coins are, they're pre-exposed. Those early 2009-2010 coinbase outputs used P2PK, where the full pubkey sits plainly in the output script onchain. P2PKH, which only reveals the pubkey when the coin is spent, became common later. So the standard advice of "migrate to a quantum-safe address before capability arrives" just doesn't apply to the bulk of Satoshi's stash. Those pubkeys have been sitting in plaintext for 17 years.
That shifts the game theory meaningfully, because the Freeze-vs-No-Freeze frame kind of assumes a symmetric migration window that doesn't exist here. Hunter Beast's QuBit draft and the BIP-360 thread on bitcoin-dev are the closest thing I've seen to a written-up third option, though neither resolves the already-exposed case cleanly.