Taproot's bigger attack vector than future QC

Me:
Isn't the bigger attack vector of the attack surface Taproot, not quantum computing itself (which may have bigger initial targets like nation state spying & stealing their bitcoin reserves if private key stores can be decrypted), but p2tr wallets being made hot for remote private key exfiltration malware for periodic anti-QC moves, instead of just being left cold, airgapped with the security of an unspent public key hash?

Grok:
Yes, you're largely correct. Taproot (P2TR) has meaningfully expanded the immediate quantum attack surface compared to older hashed address types, even though quantum computing itself remains a future (but increasingly discussed) threat.

Quantum Threat Basics#

A cryptographically relevant quantum computer (CRQC) using Shor's algorithm can solve the elliptic curve discrete logarithm problem (ECDLP) on secp256k1. This lets an attacker derive a private key from a public key.

• No public key exposed (e.g., unspent P2PKH/P2WPKH where only a hash was revealed): The attacker must wait for you to broadcast a spend (revealing the pubkey in the tx) and then race the confirmation window. This is a "short window" or on-spend attack.

• Public key exposed (P2PK, reused addresses, or P2TR): The attacker can work on it today, offline, at their leisure. This is a "long-range" or "harvest now, break later" attack.

Recent estimates (e.g., Google Quantum AI research) suggest a future CRQC could crack a key in minutes once it has the public key—well within Bitcoin's block time for on-spend races, but devastating for already-exposed keys.

Why Taproot Increases the Surface#

P2TR outputs commit to a tweaked public key (x-only) directly in the scriptPubKey/address. This is by design for key-path efficiency and privacy features (Schnorr + MAST).

• Unlike native SegWit (P2WPKH), where the pubkey stays hidden until spend, P2TR exposes an equivalent to the public key from the moment coins are received.

• This makes all P2TR holdings vulnerable to long-range quantum attacks immediately, not just when spent.

• Estimates put ~6.5–6.9 million BTC in exposed formats (including P2TR, old P2PK, reused addresses)—roughly 1/3 of supply, worth hundreds of billions. Taproot adoption has contributed to this.

Your point about "bigger attack vector" holds in the current landscape: classical attacks (malware, keyloggers, supply-chain compromises, remote exfiltration) are real today. Quantum is hypothetical but high-impact for exposed keys.

Hot vs. Cold for Anti-QC Moves#

You're right on the operational security angle:

• Cold/airgapped with unspent hash-based outputs (legacy best practice for large holdings): Pubkey hidden. Funds stay safe until you decide to move them. Minimal ongoing exposure.

• Making them "hot" periodically for anti-QC migration: This introduces remote attack surface (wallet software, connected devices, malware targeting exfiltration). If quantum arrives suddenly, mass migrations could create chaos, mempool races, and fee spikes. Nation-states or sophisticated actors could target hot wallets holding significant BTC.

Best practice for paranoid/long-term storage remains: Use hashed outputs (P2WPKH or similar) for cold storage, avoid reuse, and only reveal pubkeys when necessary. Taproot is great for spending/privacy but not ideal for "set and forget" high-value cold storage in a quantum-aware world.

Mitigations and Future#

• BIP 360 (P2MR): A Taproot-like proposal without the exposed key-path spend. It hides the pubkey better until actual spend via script paths. Good incremental step.

• Taproot itself has upsides: Script paths can potentially hide post-quantum fallbacks, and key-path spends could be soft-fork disabled if needed.

• Broader upgrades (post-quantum signatures, quantum-resistant address types) are being discussed, but Bitcoin moves slowly and deliberately.

Bottom line: Quantum is the existential long-term crypto risk, but Taproot's design choice did regress the quantum exposure profile for a big chunk of Bitcoin in exchange for usability/privacy wins. Your intuition about preferring cold, hash-hidden storage over hot periodic migrations for large holdings is sound opsec. For most users today, the bigger risks are still classical (keys, custody, phishing).