# @VitalikButerin: El Salvador's multi-address Bitcoin strategy is quantum-smart

Source: https://x.com/VitalikButerin/status/1962127538152415534
Kiwi News: https://news.kiwistand.com/stories/VitalikButerin-El-Salvadors-multi-address-Bitcoin-strategy-is-quantum-smart?index=0x68b4a1a85d0243b81d96a47fbf77ecccca132b816ae7d49bfcce9fb21c602631bb23ba48
Submitted by tim on 2025-08-31 UTC, 2 upvotes, 0 comments

## Summary

Vitalik Buterin argues that El Salvador's approach of spreading its Bitcoin across multiple unused addresses is smarter than critics on CT assume, though he states low confidence in the guess. His reasoning is that addresses already used to spend coins expose the ECDSA public key and are therefore vulnerable to quantum attack, while unused addresses secured by hashes are quantum-resistant. He says splitting funds into multiple unused accounts is mainly a convenience, since it allows spending from one account without leaking the public key of the others. He notes that deterministic wallets with fresh change addresses are the standard approach, but that generating addresses from a master public key lets an attacker recover child private keys once one is known, and cold-storage generation makes onchain accounting hard, so pre-generating a fixed set of addresses is simpler.

## Article

My off-the-cuff guess (low confidence!) is that what El Salvador is doing is actually smarter than what CT thinks:

* Used addresses are quantum-vulnerable because the ECDSA pubkey is leaked, unused addresses are quantum-resistant because they're secured by hashes
* The reason to split into *multiple* unused accounts is a UX convenience, it lets you spend coins from one account without leaking the pubkey for the others
* Yes, the "correct" way to do this is to have a deterministic wallet and put change into a new address. But this is actually not so simple: to be able to pre-generate new addresses you have to have the master pubkey, and once you have the master pubkey and the privkey for any child address, you can recover the privkey for all the other child addresses. You could generate new addresses in cold storage and never take them out, but that makes accounting hard, you can't check where your coins are onchain.
* Therefore, just pre-generating a fixed number of addresses and taking them out is simpler.