A new Bitcoin proposal is trying to solve one of the sharpest problems in the network’s quantum-computing debate: how to protect old exposed addresses without forcing their owners to move coins first. Dan Robinson, a general partner at Paradigm, outlined PACTs, short for Provable Address-Control Timestamps, as a way for holders to privately prove they controlled an address at an earlier date and keep that proof hidden until they actually need to spend.
The issue matters because many older Bitcoin wallets have exposed public keys. If sufficiently powerful quantum computers arrive, those addresses could become vulnerable to theft. The group includes wallets linked to Satoshi Nakamoto, with roughly 1.1 million BTC attributed to the pseudonymous creator and valued in the article at about $84 billion.
BIP-361 would phase out vulnerable addresses over five years
In mid-April, Jameson Lopp and five other developers proposed BIP-361, a plan that would gradually stop allowing spends from quantum-vulnerable address types. The proposal uses a five-year transition window and would freeze coins that are not moved into quantum-safe formats in time. That protects the network from a future theft scenario, but it creates a second problem: dormant holders would need to reveal themselves or lose access.
PACTs aim at that trade-off. Instead of requiring a transaction from the old address, the holder would create proof of ownership and attach a timestamp to it, while keeping the underlying materials private. No coins move at this stage. Public observers would only see a commitment, not the wallet details behind it.
How the commitment works on Bitcoin
Under Robinson’s design, a holder generates a random salt, which makes the cryptographic commitment unique and hard to guess. The holder then uses BIP-322, the standard for signing a message from a Bitcoin address without spending from it, to produce an ownership proof. The salt and the proof are bundled into an onchain commitment and timestamped through OpenTimestamps.
OpenTimestamps anchors data to the Bitcoin blockchain through a single batched transaction. The salt, proof, and timestamp files remain private. That keeps the process from exposing which address is involved, how much BTC is tied to it, or any other identifying detail while still creating evidence that can be used later.
STARK proof would be the rescue path after a future soft fork
If Bitcoin eventually adopts a soft fork that freezes quantum-vulnerable coins, PACTs envision a rescue path based on a STARK proof. Robinson said that proof could show the holder created the commitment before quantum hardware existed. When the owner later wants to spend, the network could accept that proof and release the coins.
The redemption path is designed to reveal very little. According to the proposal, it would not disclose the address, the amount, or even the time when the original timestamp was made. That privacy angle is central for long-dormant wallets whose controllers may not want to surface publicly just to preserve access.
The idea still depends on major new Bitcoin infrastructure
Robinson also argued that PACTs address a gap in BIP-361 around wallets derived from BIP-32, the deterministic key-generation standard introduced in 2012. Wallets created before 2012, including most known Satoshi addresses, do not use BIP-32 and cannot be rescued through that route. PACTs open a different path, but only if Bitcoin gains capabilities it does not have today.
That is the hard limit. Bitcoin currently lacks a STARK verification protocol, and Robinson said adopting one would require a separate soft fork backed by broad community consensus. He also noted that the verification stack would need substantial new plumbing, including support across multisig wallets, complex scripts, and hardware wallets, all of which would need careful standardization.
PACTs cannot solve the final constraint. They only work if Satoshi, or whoever controls those keys now, actually creates the commitment in advance. If no controller does that, nothing can be built retroactively. In that case, the coins remain exposed to whichever happens first: quantum theft or a community-enforced freeze.