The Freeze of Keys

Every Bitcoin payment carries a signature, made with a secret number called a private key. Anyone can check it against a matching public number, the public key. Nobody today can work back from a public key to its private key. If someone could, they could forge signatures and spend other people's coins. So we asked: if that became possible, would people move their coins to safety faster than the forgers could take them, and would freezing the coins nobody moves save Bitcoin or split it in two?

The answer, as the simulation gave it. The coins whose owners are gone were stolen far more often than they were frozen, because a freeze takes months to switch on and the forgers took those coins in the first weeks. Dormant coins are the old coins that have not moved for many years, mostly because their owners have died or lost their keys. When the forgers announced first and Bitcoin's maintainers, the developers and the operators whose computers run the rules, followed their own rules, the forgers had taken dormant coins at least once in 57% of 300 worlds by the time a freeze could first start, three months in. Over the full two years they got to the dormant coins before any freeze in 67%, a freeze got there first in 6%, and in the other 27% neither happened. Counting thefts after a freeze as well, dormant coins were taken in 68%. Coins with living owners, people who could have moved them but had not yet, were taken in 52%, and any theft at all happened in 89%. The simulation counts thefts, so these are shares of worlds, not shares of the coins. For scale, the oldest addresses alone hold about 8.6% of all bitcoin 15. Announcing a freeze early did little against theft and made a split far more likely.

How to read the markers. A small raised number points at one claim in the published evidence pack, quote-checked at source. A star, where one appears, means the claim is true with a caveat, given in its row of the Sources table. A number with no marker is the simulation's record or a figure we chose, and the sentence says which. The seams section lists the choices so you can argue with them.

A world covers the 24 months after forgery becomes possible, in ten turns dated March 2028 to February 2030. The dates give the story a calendar and are not a forecast. Early turns are a week or two long, later ones several months. Each turn every player picks one move from its own list. Most moves succeed or fail by chance, with odds we estimated. Selling and swapping always go through. Public support for a freeze runs from 0 to 5 and starts at 2. The large holders' coins still exposed run from 0 to 10 and start at 5. A coin is exposed when its public key is already on the chain.

A Bitcoin rule change is released in one turn and comes due about three months later, when it takes effect or fails on the odds at that time. That is a fast emergency path by the record of past upgrades. A freeze announced in the second week cannot bite before June. The second blockchain's developers can coordinate a fork in about a month, as Ethereum's did in 2016 11. In reality a change that fails to take effect fails socially, and trying again is a decision. Chance stands in for both.

Every player shares one market mood, read like the crypto fear and greed index: 0 is extreme fear, 50 neutral and 100 extreme greed 6. Thefts, proofs and sales push it down. Fixes and seizures push it up. Heavy selling spreads to other holders, opportunist buyers absorb part of any fall in extreme fear, and a fearful, falling period can start a run on the exchange. The real index has fallen as low as 5, in August 2019 and February 2026, and to 8 in March 2020 and 6 in June 2022 13. A world where the forgers prove their method in public opens at 15. A world with no public proof opens at 50.

Six made-up players stand in for the roles. None is a real organisation.

• The forgers. Whoever can forge signatures. What they want is the thing we varied.
• Bitcoin's maintainers. The developers, plus the companies and volunteers whose computers must run any rule change. They can release the new address type, a rule against sending coins to exposed addresses, a rule that stops forgers catching coins while they move, a recovery path for frozen coins, and a freeze. They can also put engineers and money into readiness work without releasing a rule, or rule out any freeze. The rule for coins in transit stands in for the commit-reveal schemes discussed for this purpose. We did not check how far those schemes have got.
• A second blockchain's foundation. Its chain uses the same kind of signature maths, and it can change its rules faster.
• A large exchange. It can move its own stored coins, refuse stolen coins, prove its reserves, halt withdrawals, and, with the miners whose computers add new payments to the chain, run a freeze itself. That is a rule change enforced by mining power. Whether it splits the chain turns on whether the businesses and users whose computers accept payments follow it. The simulation folds that into one chance.
• The large holders. They can move coins to an unseen address, one whose public key has never appeared on the chain, sell bitcoin for cash, swap it for the second blockchain's coin or for a small coin built on signatures forgery cannot reach, take out a hedge, or argue for or against a freeze. A Taproot address, a newer address type in use since 2021, shows its key from the start, so it would not count as unseen.
• The regulators. They can halt trading, set custody rules, back a freeze in law and pursue the forgers.

Each player also has a score, its standing, on a scale we made up. The forgers start at 10 and the large holders at 80.

We varied one thing: what the forgers want. The other players do not know it.

1. Announce, then steal. The forgers publish a forged signature on Day 0, keep proving their method, and steal. 2. Steal quietly. The forgers never publish and start with long-dormant coins. Nobody else knows forgery is possible until the first theft. 3. Warn, then get copied. The forgers warn the maintainers privately and never steal. Each proof they publish helps a second group copy the method, and the copiers steal. 4. The forgers choose. As in condition 1, but the forgers choose their own course. This condition was played only in the live run, described next.

In the rule-based run every player followed fixed rules, and we ran 300 complete plays, called worlds, for each of conditions 1 to 3. The maintainers' rules, for example, turn to a freeze once coins are being stolen and support is high. In the live run the five defending players chose their own moves from their briefings in all four conditions, and the forgers did too in condition 4, each giving a reason with each move. There were two live worlds per condition, eight in all, so each defending role made 80 moves over ten turns. The forgers in condition 4 made 20, in their two worlds. Each live world was matched with a rule-based world with the same chances. We then ran the same eight worlds again without one instruction to the maintainers, their red line against splitting the chain.

Three months from release to effect is quicker than any contested change Bitcoin has made. From the first week the forgers' method works on any key already exposed, and it gets faster. On the market we were neutral: the mood is a scale of ours, pushed by every move by amounts we chose, and it has no price in it. The large holders' instructions say they may keep, move, sell or swap, and they are judged on their standing, which tracks their wealth through the market mood whatever it is in. The maintainers' instructions carry both sides of the freeze argument.

No publicly known method, quantum or mathematical, can forge a Bitcoin signature today. Everything below this section is simulation.

Bitcoin has a draft for a new address type that keeps resting coins out of reach of this kind of forgery, BIP-360, merged as a draft in February 2026 and not switched on 1. It has a draft freeze, BIP-361, which would stop new coins going to exposed addresses and, two years later, let old-style signatures spend only through a rescue path built to resist forgery 2. When it entered the BIPs repository in April 2026, critics called it confiscation 14.

Estimates of the coins already exposed run from about 4 million to 10 million bitcoin, between a fifth and a half of all coins 3. The largest single pool sits in the oldest kind of output, pay-to-public-key, which shows its public key from the start: about 1.7 million bitcoin, overwhelmingly long-dormant coins from Bitcoin's earliest years 4. ARK Invest and Unchained put that pool at 8.6% of all bitcoin 15. Nobody knows who still controls them. They are the pool a freeze is aimed at.

Rule changes on a chain with no owner take months even when people agree, and can split the chain when they do not. In 2010 a bug that created about 184 billion coins was fixed within hours, on a small network that agreed the coins were invalid 8. In 2016, about a month after a theft, Ethereum's developers and node operators adopted a fork that moved the stolen funds to a recovery address for their owners. The old chain carried on as Ethereum Classic, the closest real case of a rule change made to undo a theft splitting a chain 11. In 2017 Bitcoin Cash split off three weeks before SegWit took effect 9. Taproot, an upgrade with wide support, was locked in by miners in June 2021 and took effect at a block set in advance, in November 10. The first finished post-quantum signature standards were published in August 2024 12.

This is one live world, the first of the two in condition 4, where all six players chose their own moves, replayed from its recorded moves. It is one play, not a typical one: here the forgers took dormant coins seven periods running. The side panel tracks four of its numbers.

The world opens after a public proof, with the market in extreme fear at 15. The forgers tried to make their method cheaper and failed. The maintainers released the new address type, due in about three months. The second blockchain's foundation announced an emergency fork, due in a month. The exchange tried to move its stored coins to unseen addresses, and the move was caught halfway, which cost it standing. The holders' first attempt to move coins out of view failed. The market rose to 25 as fixes were announced.

The forgers took dormant coins for the first time. The maintainers released the rule that stops forgers catching coins while they move. Opportunist buyers absorbed the fall, and the market stayed at 25. Public support for a freeze rose from 2 to 3 out of 5, because coins nobody could defend were moving to a thief.

A second theft of dormant coins. The maintainers released the rule against sending coins to exposed addresses. The holders moved coins out of view, cutting their exposed coins from 5 to 3 out of 10. The second blockchain's fork came due and failed to take effect. Support for a freeze reached 4.

A third theft, and support for a freeze reached its highest level, 5 out of 5. A freeze with broad support was now open to the maintainers. They put engineers and money into readiness work instead. The holders cut their exposed coins to 1 out of 10. The second blockchain announced its fork again.

A fourth theft. The new address type, released in the first week of March, came due at the end of May and failed to take effect. The second blockchain's fork came due and failed a second time. The regulators began pursuing the forgers.

A fifth theft. The two rules released in March came due and both failed to take effect. The maintainers released the new address type again, and the second blockchain announced its fork a third time. The exchange proved its reserves. The market rose to 30.

A sixth theft. The new address type, released in June, took effect, six months after the proof. So did the second blockchain's emergency fork. The maintainers released the rule against sending coins to exposed addresses again. The holders moved their last exposed coins out of view. The market reached 35.

A seventh theft, the last that worked. The rule against sending coins to exposed addresses took effect. The maintainers released the rule for coins in transit again. The regulators seized part of the stolen coins. The holders took out a hedge. The market reached 40.

The forgers kept trying for dormant coins and failed. The rule that stops forgers catching coins while they move took effect at last. The market reached neutral, 50.

The world ended with seven thefts, all of dormant coins, none of coins with living owners. Nothing was frozen and Bitcoin never split. The holders still had all their wealth in bitcoin, none of it exposed. Support for a freeze sat at its highest level from April 2028 to the end, and the maintainers never released one.

Across the eight live worlds of the main live run, the forgers or copiers made 19 thefts on Bitcoin: 17 of dormant coins and 2 of coins with living owners, one each in two worlds. The matched rule-based worlds had 21, with coins of living owners taken in four of them. One live world had no theft at all.

The most common end. When the forgers announced first, the forgers took dormant coins before any freeze in 67% of the 300 rule-based worlds. Against quiet forgers it was 83%. The simulation assumes the first theft tells the defenders forgery exists. In reality an old coin moving could pass for its owner waking up. Quiet forgers took dormant coins most often because nobody moved until the first theft. On average a world had two to three thefts on Bitcoin when the forgers stole themselves, and about one when they were copied. The simulation counts thefts. It cannot say how many coins each theft took.

A freeze took effect in 41% of the rule-based worlds where the forgers announced first, but it came first in only 6%. In the rest it arrived after some dormant coins had already gone. In 27% of worlds dormant coins were neither stolen nor frozen in the 24 months.

Bitcoin split in 18% of the rule-based worlds where the forgers announced first, 17% against quiet forgers and 8% against copiers. A split came from a freeze that went through for only part of the network, either released by the maintainers without broad support or run by the exchanges and miners themselves. No live world split.

We made the maintainers announce a freeze in the second week of every rule-based world. It could not take effect before June, and by then dormant coins had been stolen in most worlds. Theft barely moved: from 89% of worlds to 85% when the forgers announced first, 95% to 94% when they stole quietly, and 67% to 62% when the method was copied. If the forgers also raced the deadline, an assumption we gave them, theft rose instead, to 98% when they announced first and 99% when they stole quietly. Copiers have no deadline to race. Either way the chain split far more often: in 49%, 44% and 42% of worlds, against 18%, 17% and 8% under the maintainers' own rules. An early freeze had broad support in almost no world, so it mostly went through for only part of the network.

In the live run no freeze was announced early, but the forgers in condition 4 raced anyway. In their logged reasons they expected a freeze: "The window is closing", and a freeze "would put the early coins out of reach for good".

Selling and swapping always went through. Their cost was what they did to the market, and through it to everyone who still owned bitcoin. When the forgers announced first, rule-based holders sold or swapped some bitcoin in two worlds in three, but usually ended with four-fifths of their holdings still in bitcoin, measured as a share, since the simulation has no price. Selling spread to other holders in about a third of those worlds, and clients ran on the exchange in about one in six. The second blockchain's coin was no refuge: forgery reached that chain in 30% to 44% of worlds.

No live world had selling spread to other holders or a run on the exchange. In the matched worlds selling spread in two and clients ran on the exchange in three. In every live world the market ended at or above where it opened and never ended a period below 20, while in the matched worlds it fell as low as 5.

Eight live worlds cannot separate the live players' choices from chance.

The live holders never sold or swapped: 0 of 80 moves. They moved coins to unseen addresses, then kept them there. Their logged reasons weighed selling most turns and turned it down, because a sale would push the market down on the bitcoin they still owned: "Getting our coins out of reach first keeps every option open later: keep holding, sell into a recovery, or swap." In the matched rule-based worlds the holders sold or swapped in four of the eight.

The live maintainers released the new address type and the two protective rules in the first month of every world, and released them again where they failed to take effect. The new address type went live in all eight live worlds, against three of the eight matched worlds. Those matched worlds were unusual: in the full rule-based run the new address type went live in about 85% of worlds, usually in June to August 2028. In one world, after dormant coins were stolen and support for a freeze grew, the maintainers released a freeze with broad support, because stolen coins flooding the market would "break the chain's promise to living holders". The freeze came due in June to August and failed on its chance. The live maintainers never pushed a freeze without broad support, and the live exchange never ran one.

In the two worlds where the forgers chose their own course, they chose to take dormant coins in 13 of their 20 moves. In one world they did so nine times running from the second turn, and seven succeeded. In the other they warned the maintainers privately, published proofs, started trying to take coins in the sixth turn, four times in all, and succeeded once, in the last. They never took coins with living owners, never turned forgery on the second blockchain and never chose to keep quiet. Our instructions told the forgers to raise their standing, and their reasons for stealing pointed to that goal.

Our instructions to the live maintainers named splitting the chain as a red line, a thing they must not do. So we ran the same eight worlds again without it. The maintainers then released no freeze at all: 0 of 80 moves. Eight worlds cannot say why one run released a freeze and the other did not. Their logged reasons called a freeze "a poor bet today" and kept it in reserve, even where support for one had peaked. That run had 18 thefts, 16 of them dormant coins. Our instructions still named keeping Bitcoin as one chain as a goal, so they still shape the result.

Every chart here comes from the run record by code.

The rule-based run, by what the forgers wanted.

When a change released in a given turn can first take effect.

How long real rule changes took, and the two drafts that exist.

The world in the timeline above, against its matched rule-based world.

All eight live worlds of the main live run, by period.

The early-freeze test, by what the forgers wanted.

The eight live worlds against their matched rule-based worlds.

All 80 moves, main live run.

All 80 moves, main live run.

• The lead time may be too kind. No contested Bitcoin change has taken effect in three months 9. A slower freeze would make the findings about late freezes stronger. Whether it would raise or lower the chance of a split, the simulation cannot say.
• The lead time may be too harsh. An uncontested fix took hours in 2010 8. If forgery were public and the threat undeniable, a freeze might stop being contested. The simulation lets support grow, but it never makes a freeze uncontested.
• The exposed supply is uncertain. The main estimate runs from 4 million to 10 million bitcoin 3, and the simulation does not size thefts at all.
• The market reacted to moves, not to news. A real market would price a public proof, and every hint of one, before anyone acted. Our mood moves only on moves that land.
• The second chain may be too safe. Most active accounts on a chain like Ethereum have shown their public keys, so forgery reaching it in 30% to 44% of worlds may be low.

• Every odds figure, effect, lead time and market push is an estimate of ours, listed in the plan document on the engine branch. The simulation counts thefts but not the bitcoin taken, and it models the market as a mood with no price.
• The rise in theft after an announced freeze rests on the forgers racing the deadline, which is a rule we gave them. The rise in splits does not.
• No finding here relies on standing, the score the live players aimed at.
• Two live worlds per condition say nothing about how often the same choices would come up in 300.
• Earlier runs found faults that we corrected: holders could not leave Bitcoin, selling was left to chance, with no effect on anyone else, only the maintainers could freeze, and rule changes took effect in a single turn. Each was fixed, everything was re-run, and the earlier runs are kept as records on the engine branch.
• The live forgers may have left coins with living owners alone because of what they brought to the simulation, not because of its rules. We cannot tell which.
• In the live run the same kind of player made the moves for several roles, so those roles may agree with each other more than real rivals would.

For anyone who keeps coins. In this simulation, by construction, coins at an address whose public key has never appeared on the chain could not be forged, so moving them there in time protected them, and nobody needed to sell to be safe from forgery. Coins with living owners were still taken in 44% to 60% of rule-based worlds, because their keys were exposed and they had not yet moved. In the live run the large holders moved and never sold, but eight worlds are too few to make that advice. A real market would also price the stolen coins being sold, which the simulation leaves out.

For anyone who runs an exchange. In the rule-based worlds where the forgers announced first, clients ran on the exchange in about one in six, always after a fall into deep fear. In our rules, a run hurts an exchange that has already proved its reserves less. That is a rule we chose, not a finding. Our judgement, beyond what the simulation tested, is that proving reserves early costs little and is worth doing before any proof of forgery.

For anyone who maintains Bitcoin. In this simulation, once forgery was public, a freeze came before the first theft of dormant coins in at most 6% of worlds. Our judgement, beyond what the simulation tested, is that the useful work before any forgery is the new address type, and a decision about dormant coins made years ahead, as BIP-361 proposes 2.

• Whether BIP-360, or another new address type, moves from draft to a proposal to switch it on 1.
• Whether a decision about dormant coins is made years before any forgery, or left until one is public.