Blog

Bitcoin investors are suddenly confronting an uncomfortable math problem inside the $91.7 billion U.S. spot bitcoin ETF market.

“Coinbase Custody holds 84% of all US spot Bitcoin ETF assets,” Marc Baumann, founder of research firm fiftyonexyz, posted on X on April 14. “That’s $77 billion with a single custodian. For an industry built on decentralization, the most important product category has a single point of failure. Regulators will notice.”

The warning is landing as bitcoin trades near $77,000, having clawed back from a 40% drawdown since its late-2025 peak around $126,000. It also lands three weeks after the April 2 conditional approval of a national trust charter for Coinbase by the Office of the Comptroller of the Currency. “OCC grants Coinbase conditional approval for a National Trust Bank Charter,” Swiss law firm Goldblum & Partners posted on X on April 13, noting that “11 crypto firms now in the federal banking pipeline” and that a new rule, 12 CFR 5.20, “explicitly permits non-fiduciary crypto custody for national trust banks.” That regulatory blessing, in a twist, deepens the concentration analysts are now calling out.

The figure itself has become the new rallying cry of bitcoin’s structural skeptics. CryptoSlate first framed the dollar number on April 12 as “over 80% of Bitcoin ETF assets hit Coinbase custody choke point with $74B at risk.” Within 48 hours, the phrasing was circulating through crypto-media accounts and analyst threads.

“Over 80% of Bitcoin ETF assets now sit inside Coinbase custody. That’s roughly $74B concentrated in one infrastructure layer,” wrote crypto-media account W3BCMedia on April 13. Institutional adoption was growing, the account added, “but so is systemic custody risk.”

What the data shows

The $91.7 billion pile of U.S. spot bitcoin exchange-traded fund assets, a figure Baumann compiled from issuer prospectus filings, spans BlackRock’s IBIT, ARK 21Shares’ ARKB and Morgan Stanley’s newly launched MSBT, among others. A common thread runs through the bulk of them: Coinbase Prime is the custodian. Fidelity’s FBTC is the notable exception, self-custodying through in-house Fidelity Digital Assets.

New inflows are not diversifying that base. Blockchain intelligence firm Arkham confirmed on X on April 15 that “Morgan Stanley is buying bitcoin” via MSBT, noting the fund “has bought $83.6M of BTC” and “currently holds $64.4M in its on-chain addresses.” Those coins, too, route through Coinbase Prime.

For retail investors holding ETF shares, the arrangement has been a non-issue since spot approval in January 2024. For the handful of X accounts now amplifying the warning, it reads differently.

“Not Your Keys Not Your Coins,” wrote a pseudonymous account on April 14, citing the list of exchanges that have failed since 2014. “Makes you question Saylor or IBIT risk. Really Coinbase custody is a major key man risk.”

Why Wall Street is pushing in anyway

The paradox is that institutional appetite is accelerating, not slowing, as the concentration grows.

Fordefi, a crypto wallet infrastructure firm, tallied the last 90 days on X: Mastercard acquiring stablecoin rails provider BVNK for $1.8 billion; Citi rolling out institutional bitcoin custody; Morgan Stanley saying it will “operate as a crypto bank”; Crypto.com joining BitGo, Circle, Ripple and Paxos with OCC approval. “FDIC opened a formal crypto custody study,” the post added.

The bitcoin ETF market has “officially entered Phase Two,” Joe Consorti, a macro and bitcoin analyst, said in an April 15 video that has drawn more than 14,000 views. Phase One, Consorti argued, was basic spot access. Phase Two, he said, is about packaging bitcoin into volatility-dampened, yield-generating products for conservative investors, pointing to Goldman Sachs’s premium-income ETF filing, Morgan Stanley’s MSBT and Schwab’s advisor-channel products.

Consorti’s math: a 3% allocation from U.S. wealth advisors alone could push bitcoin to $210,000. The $144 trillion wealth-advisory market is the pool the ETF wrapper now unlocks.

The bull case leans on the same custody data that worries the skeptics. On Simply Bitcoin’s April 15 video,, the host called MicroStrategy and its ETF-wrapped peers “a synthetic miner,” buying more bitcoin in one session than the network mints in a week.

Bitwise chief investment officer Matt Hougan goes even bigger. His long-term $1 million target rests on a “sustained steady boom” of institutional flows, not the violent boom-bust cycles of earlier bitcoin eras. Every dollar landing in Coinbase Prime, on that read, is bullish collateral.

The bear case: regulators haven’t blinked yet

The bull narrative has only been tested in two calm years. One custody incident, one freeze order or one operational failure at a venue holding $77 billion would test it all at once.

Baumann’s phrase, “regulators will notice,” is the line critics keep returning to. The OCC’s April 2 trust-charter pulls Coinbase inside the federal banking perimeter. That cuts two ways: more oversight, and more exposure to the kind of supervisory actions banks periodically face. So far, neither Coinbase nor the OCC has publicly flagged any worry about the ETF concentration.

An April 13 post from fiduciary-focused account prudentmachines pushed a different fault line. “Coinbase got conditional OCC approval for a national trust bank charter, enabling them to custody federally regulated digital assets. Coinbase custodies most U.S. Bitcoin ETF assets,” the account wrote. “The question is whether that custodial function triggers fiduciary status under ERISA.”

If it does, retirement-plan sponsors eyeing spot bitcoin exposure through 401(k) menus inherit a set of duties they have not yet been asked to perform. The Department of Labor’s March 30 proposed “safe harbor” rule for alternative assets in 401(k) plans is already sharpening the question.

Nic Carter, co-founder of Castle Island Ventures, has gone further. On an April 3 Bankless interview, Carter argued the near-term quantum-computing risk to bitcoin sits inside “institutional custody and wallet infrastructure,” naming Coinbase Custody and Fidelity. He calls what is piling up on those platforms “cryptographic migration debt.”

Michael Saylor has pushed a different worry. His “paper bitcoin” warnings, broken down on Germany’s Blocktrainer channel on April 13, argue that institutional claims on coins at centralized custodians inflate what looks like real circulating supply. Host Roman Reher summarized the point bluntly: holding coins at a major custodian “doesn’t guarantee they aren’t being used as collateral.”

Coinbase’s own ETF prospectus filings say the opposite. Spot ETF assets, per the documents, are held in segregated cold storage, not lent out or rehypothecated. The SEC approved the spot bitcoin ETFs on that premise. The open question is whether it holds under stress.

What to watch

The cleanest exit is diversification. A second custodian named in any issuer’s next filing would break the math instantly. So would OCC or Securities and Exchange Commission guidance on custody concentration, or Coinbase laying out contingency arrangements for its biggest clients.

None of it has happened yet.

Bitcoin trades near $77,000. Roughly $77 billion of its U.S. institutional footprint sits in one place. “Regulators will notice,” Baumann wrote on April 14. For now, nobody at the OCC or the SEC has said otherwise.

Part 1 of this series explained what quantum computers actually are. Not just faster versions of regular computers, but a fundamentally different kind of machine that exploits the weird rules of physics that only apply at the scale of atoms and particles.

But knowing how a quantum computer works does not tell you how it can be used to steal bitcoin by a bad actor. That requires understanding what it is actually attacking, how bitcoin’s security is built, and exactly where the weakness sits.

This piece starts with bitcoin’s encryption and works through to the nine-minute window it takes to break it, as identified by Google’s recent quantum computing paper.

The one-way map

Bitcoin uses a system called elliptic curve cryptography to prove who owns what. Every wallet has two keys. A private key, which is a secret number, 256 digits long in binary, roughly as long as this sentence. A public key is derived from the private key by performing a mathematical operation on the specific curve called “secp256k1.”

Think of it as a one-way map. Start at a known location on the curve that everyone agrees on, called the generator point G (as shown in the chart below). Take a private number of steps in a pattern defined by the curve’s math. The number of steps is your private key. Where you end up on the curve is your public key (point K in the chart). Anyone can verify that you ended up at that specific location. Nobody can figure out how many steps you took to get there.

Technically, this is written as K = k × G, where k is your private key and K is your public key. The “multiplication” is not regular multiplication but a geometric operation where you repeatedly add a point to itself along the curve. The result lands on a seemingly random spot that only your specific number k would produce.

The crucial property is that going forward is easy and going backward is, for classical computers, effectively impossible. If you know k and G, calculating K takes milliseconds. If you know K and G and want to figure out k, you are solving what mathematicians call the elliptic curve discrete logarithm problem.

It is estimated that the best-known classical algorithms for a 256-bit curve would take longer than the age of the universe.

This one-way trapdoor is the entire security model. Your private key proves you own your coins. Your public key is safe to share because no classical computer can reverse the math. When you send bitcoin, your wallet uses the private key to create a digital signature, a mathematical proof that you know the secret number without revealing it.

Shor’s algorithm opens the door both ways

In 1994, a mathematician named Peter Shor discovered a quantum algorithm that breaks the trapdoor.

Shor’s algorithm solves the discrete logarithm problem efficiently. The same math that would take a classical computer longer than the universe has existed, Shor’s algorithm handles in what mathematicians call polynomial time, meaning the difficulty grows slowly as numbers get bigger rather than explosively.

The intuition for how it works comes back to the three quantum properties from Part 1 of this series.

The algorithm needs to find your private key k, given your public key K and the generator point G. It converts this into a problem of finding the period of a function. Think of a function that takes a number as input and returns a point on the elliptic curve.

As you feed it sequential numbers, 1, 2, 3, 4, the outputs eventually repeat in a cycle. The length of that cycle is called the period, and once you know how often the function repeats, the math of the discrete logarithm problem unravels in a single step. The private key falls out almost immediately.

Finding this period of a function is exactly what quantum computers are built for. The algorithm puts its input register into a superposition (or, in quantum mechanics, a particle exists in multiple locations simultaneously), representing all possible values simultaneously. It applies the function to all of them at once.

Then it applies a quantum operation called the Fourier transform, which causes the number of wrong answers to cancel out while the correct answers are reinforced.

When you measure the result, the period appears. From this period, ordinary math recovers k. That is your private key, and therefore your coins.

The attack uses all three quantum tricks from the first piece. Superposition evaluates the function on every possible input at once. Entanglement links the input and output so the results stay correlated. ‘Interference’ filters the noise until only the answer remains.

Why bitcoin still works today

Shor’s algorithm has been known for more than 30 years. The reason bitcoin still exists is that running it requires a quantum computer with a large enough number of stable qubits to maintain coherence through the entire calculation.

Building that machine has been beyond reach, but the question has always been how large is “large enough.”

Previous estimates said millions of physical qubits. Google’s paper, in early April by its Quantum AI division with contributions from Ethereum Foundation researcher Justin Drake and Stanford cryptographer Dan Boneh, reduced that to fewer than 500,000.

Or a roughly 20-fold reduction from prior estimates.

The team designed two quantum circuits that implement Shor’s algorithm against bitcoin’s specific elliptic curve. One uses approximately 1,200 logical qubits and 90 million Toffoli gates. The other uses approximately 1,450 logical qubits and 70 million Toffoli gates.

A Toffoli gate is a type of gate that acts on three qubits: two control qubits, which affect the state of a third, target qubit. Imagine this as three light switches (qubits) and a special lightbulb (the target) that only turns on if two specific switches are flipped on at the same time.

Because qubits lose their quantum state constantly, as Part 1 explained, you need hundreds of redundant qubits checking each other’s work to maintain a single reliable logical qubit. Most of a quantum computer exists just to catch the machine’s own mistakes before they ruin the calculation. The roughly 400-to-1 ratio between physical and logical qubits reflects how much of the machine exists as self-babysitting infrastructure.

The nine-minute window

Google’s paper did not just reduce qubit counts. It introduced a practical attack scenario that changes how to think about the threat.

The parts of Shor’s algorithm that depend only on the elliptic curve’s fixed parameters, which are publicly known and identical for every bitcoin wallet, can be precomputed. The quantum computer sits in a primed state, already halfway through the calculation, waiting.

The moment a target public key appears, whether broadcast in a transaction to the network’s mempool or already exposed on the blockchain from a previous transaction, the machine only needs to finish the second half.

Google estimates that the second half takes about nine minutes.

Bitcoin’s average block confirmation time is 10 minutes. That means if a user broadcasts a transaction and their public key is visible in the mempool, a quantum attacker has roughly nine minutes to derive a private key and submit a competing transaction that redirects funds.

The math gives the attacker a roughly 41% chance of finishing before your original transaction confirms.

That is the mempool attack. It is alarming but it requires a quantum computer that does not exist yet.

The bigger concern, however, is the 6.9 million bitcoin (roughly one-third of total supply) sitting in wallets where the public key has already been permanently exposed on the blockchain. Those coins are vulnerable to an “at-rest” attack that requires no race against the clock. The attacker can take as long as needed.

A quantum computer running Shor’s algorithm can turn a bitcoin public key into the private key that controls the coins. For coins transacted since Taproot (a privacy upgrade on Bitcoin that went live in November 2021), the public key is already visible. For coins in older addresses, the public key is hidden until you spend, at which point you have roughly nine minutes before the attacker catches up.

What this means in practice, which 6.9 million bitcoin are already exposed, what Taproot changed, and how fast the hardware is closing the gap, is the subject of the next and final piece in this series.