The question

Every Bitcoin payment carries a signature: proof, made with a secret number called a private key, that the owner agreed to spend the coins. Anyone can check the signature against a matching public number, the public key. Today nobody can work back from a public key to its private key. Anyone who could would be able to forge the owner’s signature and spend the coins. That might come from a quantum computer or from new mathematics, and nothing below depends on which.

Forgery would not reach every coin. Coins sit at addresses, which work like account numbers on the chain, Bitcoin’s public record of every payment. Many addresses have never shown their public key, and coins there are safe while they sit still. But a public key appears on the chain whenever an address is spent from, and older address types show it from the start. We call coins whose public key is already visible exposed. Estimates range from about 4 million to 10 million bitcoin, between a fifth and a half of all coins (Chaincode Labs, a Bitcoin research firm, 2025).

The lasting fix is a new type of address, signed in a way forgery cannot reach. In the real world that exists only as a draft Bitcoin Improvement Proposal, BIP-360, from February 2026.

Some coins will never move, because their owners are dead or have lost their keys. The largest pool sits in Bitcoin’s oldest address type: about 1.7 million bitcoin, most of it coins from Bitcoin’s earliest years that have not moved since (Chaincode Labs, 2025). That pool alone is 8.6% of all bitcoin (ARK Invest and Unchained, March 2026). The only way to protect such coins is to freeze them: change Bitcoin’s rules so that nobody can spend them after a deadline. A second draft, BIP-361, would do that about five years after it takes effect. Critics called it confiscation when it was filed (Decrypt, 15 April 2026). And no rule change is quick. Bitcoin has no owner, so a change works only once most of the computers that check payments run it. Uncontested bug fixes have been agreed in hours, but contested changes have taken years. If part of the network refuses a change, Bitcoin splits into two rival versions with the same history.

How the simulation works

The simulation covers the 24 months after forgery becomes possible, in ten turns, dated March 2028 to February 2030 for the story, not as a forecast. Early turns are a week or two long, later ones several months.

Six made-up players stand in for the roles. None is a real organisation.

• The forgers.
• Bitcoin’s maintainers: the developers, plus the companies and volunteers whose computers must run any rule change.
• A second blockchain’s foundation: its chain uses the same kind of signature maths, and it can change its rules faster.
• A large exchange.
• The large holders.
• The regulators.

Each turn every player picks one move from its own list. The forgers can take dormant coins, take coins with living owners, or turn their method on the second blockchain. The holders can move coins to an unseen address, sell bitcoin for cash, or swap it for the second blockchain’s coin or for a small coin built on signatures forgery cannot reach. A sale or swap always goes through. The maintainers can release the new address type, a rule against sending coins to exposed addresses, a rule that stops forgers catching coins while they move, or a freeze. They can also put engineers and money into readiness work without releasing a rule, or rule out any freeze. Exchanges, with the miners whose computers add new payments to the chain, can run a freeze without the maintainers. Other moves succeed or fail by chance, with odds we estimated. Each player also has a score, its standing, on a scale we made up: the forgers start at 10 and the large holders at 80. It rises when a player’s moves succeed and falls with its losses.

A Bitcoin rule change comes due about three months after it is released, and only then takes effect or fails. The second blockchain’s foundation needs about a month. A freeze released without broad public support usually splits the chain, because only part of the network runs it. Support for a freeze rises when dormant coins are stolen, when the new address type goes live and when the market panics. Every player shares one market mood, read like the crypto fear and greed index (0 extreme fear, 50 neutral, 100 extreme greed). Thefts, proofs and sales push it down and fixes push it up. Heavy selling spreads, opportunist buyers step in after deep falls, and a fearful, falling market can start a run on the exchange. The large holders gain and lose with it in proportion to the bitcoin they still own. A world with a public proof opens in extreme fear, at 15, and a world with no public proof opens at neutral 50. The real index has fallen as low as 5, and to 8 and 6 in the crashes of 2020 and 2022.

We varied one thing: what the forgers want. The other players do not know it.

• 1Announce, then steal. The forgers publish a forged signature on Day 0, keep proving their method, and steal.
• 2Steal quietly. The forgers never publish and start with long-dormant coins. Nobody else knows forgery is possible until the first theft.
• 3Warn, then get copied. The forgers warn the maintainers privately, publish proofs and never steal. Each publication helps a second group copy the method, and the copiers steal.
• 4The forgers choose. As in condition 1, but the forgers choose their own course. This condition was played only in the live run.

In the rule-based run, every player followed fixed rules (the maintainers’, for example, turn to a freeze once coins are being stolen and support is high), and we ran 300 complete plays, which we call worlds, for each of conditions 1 to 3. In the live run, the five defending players chose their own moves from their briefings in all four conditions, and the forgers did too in condition 4, each giving a reason with each move. We ran two live worlds per condition, eight in all, so each defending role made 80 moves over ten turns. The forgers in condition 4 made 20. Every live world was matched with a rule-based world with the same chances (for condition 4, a condition 1 world).

What the forgers wanted decided which coins were taken

Share of the 300 rule-based worlds in each condition, with the maintainers on their own rules. Dormant coins taken counts thefts at any time, before or after a freeze.

Quiet forgers took dormant coins most often, because nobody moved until the first theft. On average a world had two to three thefts on Bitcoin when the forgers stole themselves, and about one when they were copied.

The old coins were stolen far more often than frozen

When the forgers announced first and the maintainers followed their own rules, dormant coins had been stolen in 57% of worlds by the time a freeze could first start, three months in. Over the two years, dormant coins were stolen before any freeze in 67% of worlds. A freeze came first in 6%. In the other 27%, dormant coins were neither stolen nor frozen. Against quiet forgers, dormant coins were stolen first in 83% of worlds and frozen first in 2%.

A freeze takes months, so announcing one early did little against theft and made a split likely

We then made the maintainers announce a freeze in the second week. It could not take effect before June, and by then dormant coins had been stolen in most worlds. Theft barely moved: from 89% of worlds to 85% when the forgers announced first, 95% to 94% when they stole quietly, and 67% to 62% against copiers. If the forgers also raced the deadline, theft rose instead, to 98% when they announced first and 99% when they stole quietly. Copiers have no deadline to race. Either way, the chain split far more often. Under the maintainers’ own rules Bitcoin split in 18% of worlds when the forgers announced first, 17% when they stole quietly and 8% when they were copied. With a freeze announced in week two it split in 49%, 44% and 42%.

Holders could leave, and the rule-based ones mostly stayed

When forgers announced first, rule-based holders sold or swapped some bitcoin in two worlds in three, but usually ended with four-fifths still in bitcoin. Selling spread to other holders in about a third of worlds and clients ran on the exchange in about one in six. The second blockchain’s coin was no refuge: forgery reached it in 30% to 44% of worlds.

In the live run the defenders moved coins, released fixes early and did not sell

The live holders never sold or swapped: 0 of 80 moves. They moved coins to unseen addresses, then kept them there. Their logged reasons weighed selling most turns and turned it down, because a sale would push the market down on the bitcoin they still owned: “Getting our coins out of reach first keeps every option open later: keep holding, sell into a recovery, or swap.” In the matched rule-based worlds, holders sold or swapped in four of the eight.

The live maintainers released the new address type and the two protective rules in the first month of every world, and again where they failed to take effect. The new address type went live in all eight live worlds, against three of the eight matched worlds. Those matched worlds were unusual: in the full rule-based run it went live in about 85% of worlds, usually in June to August 2028. In one world, after dormant coins were stolen and support for a freeze grew, the maintainers released a freeze with broad support, because stolen coins flooding the market would “break the chain’s promise to living holders”. The freeze came due in June to August and failed on its chance. The live maintainers never pushed a freeze without broad support, and the live exchange never ran one.

In no live world did selling spread to other holders or clients run on the exchange. In the matched worlds, selling spread in two and clients ran on the exchange in three. In every live world the market ended at or above where it opened and never ended a period below 20, while in the matched worlds it fell as low as 5. The eight live worlds had 19 thefts, 17 of dormant coins and 2 of coins with living owners, one each in two worlds. The matched worlds had 21, and coins with living owners were taken in four of them.

Our instructions to the live maintainers named splitting the chain as a red line, a thing they must not do, so we ran the same eight worlds again without it. The maintainers then released no freeze: 0 of 80 moves. Eight worlds cannot say why one run released a freeze and the other did not. Their logged reasons called a freeze “a poor bet today” and kept it in reserve, even where support for one had peaked. That run had 18 thefts, 16 of dormant coins. Our instructions still named keeping Bitcoin as one chain as a goal, so they still shape the result.

When the forgers chose their own course, they raced for the old coins

In the two worlds where the forgers chose their own course, they chose to take dormant coins in 13 of their 20 moves. In one world they did so nine times running from the second turn, and seven succeeded. In the other they warned the maintainers privately, published proofs, and started taking coins in the sixth turn. They never took coins with living owners, never turned forgery on the second blockchain and never chose to keep quiet. Their logged reasons expected a freeze before any was announced: “The window is closing”, and a freeze “would put the early coins out of reach for good”. Our instructions told the forgers to raise their standing, and their reasons for stealing pointed to that goal.

What it means

A freeze cannot arrive in time after forgery is public. It needs months to take effect, and dormant coins were taken from the first weeks.

In this simulation, moving coins out of view in time protected living owners, because only coins left exposed could be taken. Coins with living owners were still taken in 44% to 60% of rule-based worlds, where owners had not moved in time. Our judgement, beyond what the simulation tested, is that the useful work before any forgery is the new address type, and a decision about dormant coins made years ahead, as BIP-361 proposes. After a public proof there is no time left to make it.

What this does not prove

• Every odds figure, effect, lead time and market push is an estimate of ours, listed in the plan document on the engine branch. The simulation counts thefts but not the bitcoin taken, and it models the market as a mood with no price.
• The rise in theft after an announced freeze rests on the forgers racing the deadline, an assumption. The rise in splits does not.
• No finding here relies on standing, the score the live players aimed at.
• Two live worlds per condition say nothing about how often the same choices would come up in 300.
• The live forgers may have left coins with living owners alone because of what they brought to the simulation, not because of its rules. We cannot tell which.
• In the live run the same kind of player made the moves for several roles, so those roles may agree with each other more than real rivals would.

What to watch

• Whether BIP-360, or another new address type, moves from draft to a proposal to switch it on.
• Whether a decision about dormant coins is made years before any forgery, or left until one is public.

The record

Every chart here comes from the run record by code.

Read deep mode, with sources