围绕比特币是否具备抗量子能力的讨论，往往集中在“量子计算机是否会在不久的将来出现”这一问题上。事实上，没有人真正知道，在未来几年甚至几十年内，出现一台在密码学层面具有实际威胁性的量子计算机的概率究竟有多大。然而，比特币的价值从根本上依赖于人们对其安全性和可靠性的信任。 对比特币而言，最大的威胁并不是量子计算本身，而是人们对量子计算可能到来的恐惧。这种威胁已经存在，而且无法仅靠纯粹理性的论证来消除。我个人相信，在我的有生之年，可能都看不到一台能够破解现代密码学的量子计算机，但事实是，我并不真正确定。 在这样的背景下，最审慎的做法，是主动将比特币协议升级为具备抗量子能力，并明确一条清晰的迁移路径，其中还应包括如何处理“丢失的比特币”（例如中本聪的比特币）这一策略。 但这并非一件轻而易举的事情。任何此类迁移都伴随着真实而艰难的权衡：基于格的后量子密码学尚未经受时间的充分考验；基于哈希的方案则显得相当“古老”；BIP32 需要被重新设计；而且我们还将失去 Schnorr 签名在多重签名场景下所具备的可加性优势。最后，在如何处理丢失比特币的问题上，也不存在一个干净利落的解决方案——冻结这些币会为比特币中的“没收行为”树立一个危险的先例，而如果继续让它们暴露在潜在风险之下，又可能对整个网络的系统性稳定构成威胁。 The debate around Bitcoin’s quantum resistance largely focuses on the likelihood of a quantum computer emerging in the near future. In reality, no one knows the true probability of a cryptographically relevant quantum computer appearing in the coming years or even decades. Yet Bitcoin’s value fundamentally depends on trust in its security and reliability. The greatest threat to Bitcoin is not quantum computing itself, but the fear that it might arrive. That threat is already present, and it cannot be dispelled by purely rational arguments. I personally believe I might not see a quantum computer capable of breaking modern cryptography in my lifetime, but the truth is, I don’t actually know. In this context, the prudent course of action is to proactively upgrade the Bitcoin protocol to be quantum-resistant and to define a clear migration path, including a strategy for handling “lost” coins (such as Satoshi’s). This would not be trivial. Any such migration involves real trade-offs: lattice-based post-quantum cryptography has not yet stood the test of time; hash-based schemes feel archaic, BIP32 would need to be rethought, and we would lose Schnorr’s additive signature advantages for multisignature setups. Finally, with respect to lost coins, there is no clean solution. Freezing them would set a dangerous precedent for confiscation in Bitcoin, while leaving them vulnerable could pose a systemic risk to the network’s overall stability.