How Bitcoin Will Survive Quantum Computing

Bitcoin was designed around a piece of mathematics that a large quantum computer would undo. Its ownership rests on elliptic curve cryptography, where deriving a public key from a private key is trivial but reversing the step is meant to be impossible. Shor’s algorithm removes that guarantee, which is why the phrase quantum resistant bitcoin has moved from a fringe worry to an active engineering programme with real proposals, real deadlines and a genuinely bitter argument about what to do with the coins that cannot be saved.

This guide is about the defence rather than the threat. It sets out exactly which bitcoin is exposed, what breaking a single key would actually require in hardware, and the two competing plans for a quantum resistant bitcoin, post-quantum address types and a legacy signature sunset, that would carry the network across. For the sharper question of whether the attack is even possible, our companion pieces on whether bitcoin survives quantum computing and on Google’s Willow chip cover the risk case in depth.

Why quantum computing puts Bitcoin at risk

Every bitcoin is locked by a key pair on the secp256k1 elliptic curve. Your wallet can produce a public key from your private key in an instant, but working backwards, recovering the private key from the public one, means solving the elliptic curve discrete logarithm problem, which classical computers cannot do in any workable time. That one-way street is the whole basis of Bitcoin ownership, and it is exactly the street that Shor’s algorithm turns into a two-way one.

A sufficiently large quantum computer running Shor’s algorithm can derive a private key from an exposed public key, forging a valid signature and spending coins that were never its own. The industry calls such a machine a cryptographically relevant quantum computer, and its arrival is what the community means by Q-Day. The threat is not that Bitcoin’s blockchain gets rewritten, but that the signatures guarding individual coins stop being unforgeable.

This is the same underlying danger that drives the wider move to post-quantum cryptography across banking and government. Bitcoin simply wears its exposure in public, because so much of its transaction history sits permanently on an open ledger for anyone, including a future attacker, to study at leisure. The work of building a quantum resistant bitcoin is really the work of removing that public exposure and replacing the signature underneath it.

Which bitcoin is actually exposed

Any honest account of a quantum resistant bitcoin has to start with what is and is not at risk. The single most misunderstood point in popular coverage is that quantum computers could drain every wallet. They could not, at least not at rest, because most bitcoin is protected by a hash rather than a bare public key. What matters is whether your public key is visible on the chain, and that depends entirely on the address format and on your own habits.

The address types that leak a key

Pay to public key, the oldest format, writes the raw public key straight into the locking script, where it sits exposed forever. A little over 1.7 million BTC is held this way according to Google’s 2026 analysis, and it includes up to roughly 1.1 million coins that the Patoshi mining pattern attributes to Satoshi Nakamoto, though that attribution is a statistical inference rather than proof. These coins are the most quantum-exposed on the network and, in most cases, the least able to move.

Pay to public key hash, the format most people have used for years, is safer because it publishes only a hash of the public key. The real key stays hidden until the first time the coins are spent, so a never-used address gives an at-rest attacker nothing to work with. The protection ends the instant you spend, and it ends permanently if you reuse the address, because a spent address has already shown its key to the world.

Taproot is the surprising case. It stores the tweaked public key unhashed by design, which the Google authors describe as a security regression back to the exposure level of the oldest addresses. Very little value sits in Taproot outputs today, because most are tiny inscription outputs, so it is a design concern more than a large balance at risk for now.

How much is exposed in total

Four independent measurements from 2025 and 2026 land close together. Glassnode counted 6.04 million BTC with an exposed key in May 2026, Google’s 2026 analysis puts the exposed supply near 6.9 million, Coinbase’s advisory board reached a similar figure, and CoinDesk’s tally came in around 7 million. That is close to 30 percent of all bitcoin, and the number has grown over time because address reuse keeps adding to it.

The figure that should worry holders most is smaller and harder. Of the exposed supply, the arXiv study known as Quantum Horizon estimates that about 2.3 million BTC is irreducibly at risk, meaning it sits in dormant wallets whose owners can never move it, including the Satoshi coins. The rest of the exposed supply sits in live wallets and exchange addresses that could still migrate, if their owners act before a capable machine exists.

What breaking a Bitcoin key really takes

The hardware bar for breaking a single Bitcoin key has fallen sharply, and honest coverage has to report both the fall and the distance still to go. In 2022, Webber and colleagues estimated that cracking Bitcoin’s 256-bit curve within one hour would need around 317 million physical qubits, or about 13 million if you were willing to wait a day. Those numbers made the threat feel comfortably distant.

The picture changed in March 2026, when Google Quantum AI published a resource estimate, validated with a zero-knowledge proof of the circuit, putting the cost of a single key break at roughly 1,200 to 1,450 logical qubits and fewer than half a million physical qubits, resolving in tens of minutes. Measured against Webber’s 2022 estimate that is well over a six-hundredfold improvement in four years, driven by better error correction and better circuits, the same forces that cut the estimated cost of breaking RSA. A separate Caltech and Oratomic paper found that a comparable elliptic curve could fall in days on as few as 10,000 to 26,000 neutral-atom qubits.

Elliptic curve cryptography is meaningfully easier to break than the RSA that protects most of the web, because the numbers involved are smaller. Craig Gidney’s 2025 work put RSA-2048 at under a million noisy qubits and roughly a week of running time, and the Caltech group noted that the same machine would crack a 256-bit curve one to two orders of magnitude faster. The reassurance in all this is scale. Today’s best quantum processors have on the order of a thousand physical qubits and at most around a hundred logical ones, so the gap is still two to three orders of magnitude wide.

When the machine might arrive

Estimates cluster in the early 2030s, with wide error bars and interested parties on both sides. Project Eleven’s 2026 report gives a baseline Q-Day of 2033, with an optimistic 2030 and a pessimistic 2042, though the firm sells the fix and its timeline should be read as such, a point we make in our coverage of the 2033 baseline scenario. The more neutral Global Risk Institute survey of 26 experts, run by Michele Mosca, put the chance of breaking RSA-2048 within ten years at 28 to 49 percent and within fifteen years at 51 to 70 percent, its highest reading yet.

Regulators have picked a side by setting hard dates. The United States standards body NIST plans to deprecate today’s signature schemes after 2030 and disallow them after 2035, which is the calendar most migration plans are pinned to. Whether the machine is a decade away or two, the migration itself is slow, and that is the part Bitcoin controls.

The mempool problem that touches every address

Even a freshly generated address that has never been reused has one moment of exposure, and that moment is when it spends. To move coins, a wallet has to publish a signature, which reveals the public key, and the transaction then sits in the public mempool for several minutes until a miner confirms it. During that window the key is visible to everyone, including a quantum attacker.

An attacker with a fast enough machine could read the key from the mempool, derive the private key, and broadcast a competing transaction with a higher fee to steal the coins before the original confirms. Google’s analysis puts the best-case success rate of such a short-window attack at just under 41 percent against Bitcoin’s ten-minute block time, under assumptions that favour the attacker, and realistic conditions would lower it. Either way it is far harder than attacking coins at rest, and it needs fast-clock hardware that slow neutral-atom machines cannot yet provide.

The defence, usefully, is partly built in. Shorter block times make the attack collapse, with the same model giving under 3 percent against Litecoin and a fraction of a percent against faster chains, and no amount of address hygiene removes the spend-time window entirely. This is why the long-term answer cannot be careful habits alone. It has to be a signature scheme that a quantum computer cannot break even when the key is visible.

Why quantum computers cannot break mining

A common fear is that quantum computers will seize control of mining and rewrite the ledger. They will not, and the reason is precise. Mining relies on the SHA-256 hash function, and the only relevant quantum tool against it is Grover’s algorithm, which offers a mere square-root speed-up rather than the exponential one that Shor brings to elliptic curves.

That quadratic gain is almost entirely consumed by the overhead of running SHA-256 inside a fault-tolerant quantum circuit, and Grover’s algorithm parallelises poorly, so many machines buy far less than many classical chips would. Google’s analysis found that even under fantastical assumptions a quantum miner would reach a fraction of the hash rate of a single modern mining chip, and Chaincode Labs reached the same order of magnitude, more than a thousand times slower than one ASIC against a network running at hundreds of exahashes. The vulnerability that does exist is in the signatures, not the mining, a distinction our explainer on SHA-256 and quantum attacks draws out in more detail.

The first fix, better addresses

The cleaner half of the road to a quantum resistant bitcoin is to stop exposing keys in the first place. The proposal known as BIP-360 introduces a new output type, Pay to Merkle Root, that behaves almost exactly like Taproot but removes the quantum-vulnerable key-path spend, so the chain stores only a hash and never a bare key. It was assigned in December 2024 by Hunter Beast, Ethan Heilman and Isabel Foxen Duke, and merged into the Bitcoin proposals repository, though merging is an editorial step and not activation. You can read the quantum resistant bitcoin proposal BIP-360 in full on the project’s own repository.

On its own it does not make the network fully quantum resistant. Bitcoin still needs a post-quantum signature scheme to sit inside these new outputs, and BIP-360 is a first step rather than a complete answer, and its authors are candid about that. It defends only against attacks on coins at rest, and it deliberately does not yet specify a post-quantum signature scheme, leaving the choice among lattice schemes such as ML-DSA, hash-based schemes such as SLH-DSA and the more compact FALCON to a later proposal. Separate ideas are already circulating, including Blockstream researchers’ case for hash-based signatures that rest only on the SHA-256 that Bitcoin already trusts, and a throttling scheme called Hourglass that would slow any drain of the old exposed coins.

The second fix, and the freeze versus steal fight

The harder half of the problem is what to do about coins that never migrate. Once a capable machine exists, every exposed key is a standing invitation, and the network faces a genuinely ugly choice. It can let attackers steal those coins, or it can make them permanently unspendable, and there is no neutral third option that saves them.

Jameson Lopp made the case for freezing in a March 2025 essay, arguing that theft would redistribute enormous wealth to whoever builds the first machine. He put it bluntly, writing that “quantum miners don’t trade anything, they are vampires feeding upon the system,” and that “allowing quantum recovery of bitcoin is tantamount to wealth redistribution.” That view became BIP-361, co-authored by Lopp and others and assigned in February 2026, which would sunset the old signature types in phases. Sending to vulnerable addresses would stop after roughly three years, and spending from them would become impossible after about five, at which point unmigrated coins, including Satoshi’s, would freeze.

The objection is a matter of principle, not physics. Freezing coins means the network reaching in and invalidating funds their owners never agreed to give up, which breaks a promise many hold sacred. Bitcoin developer Antoine Riard warned that the plan risks “opening a Pandora box, where we would introduce a precedent that it is legitimate as a community to technicaly confiscate some coins of users, without their consents.” Binance founder Changpeng Zhao took the other side, arguing that “if we don’t do anything with it, then we’re basically giving it to somebody who’s going to hack it,” while investor Michael Terpin countered that a freeze “begins a slippery slope of creating permission in a permissionless system relative to personal property.”

Not everyone accepts the urgency at all. Adam Back, a veteran cryptographer, has described today’s quantum machines as essentially lab experiments and argued for optional upgrades and a decade of voluntary migration rather than a forced sunset. Between those poles sit softer ideas, such as a BitMEX proposal for a quantum tripwire that would freeze legacy coins only after an on-chain spend proves a working attacker exists. The debate is real, unsettled, and the reason a technical fix could still stall.

The block space cost of quantum-safe signatures

Post-quantum signatures work, but they are big, and Bitcoin’s block space is scarce. A Schnorr signature is 64 bytes today. The smallest of NIST’s standardised lattice signatures, ML-DSA-44, is 2,420 bytes, roughly 38 times larger, and the hash-based SLH-DSA schemes run from about 7,856 bytes upward, well over a hundred times larger. The more compact FALCON, at around 666 bytes, is the least painful option but is not yet in the finalised standard set.

Those sizes matter because every migrating coin has to be moved in a transaction that carries one of these signatures. Shifting the whole vulnerable supply would consume months of scarce block space and would be far harder than the Taproot rollout, with fees spiking throughout. The scaling cost is one more reason the migration has to begin long before any machine is close, rather than in a panic after one appears.

How long a Bitcoin upgrade really takes

Shipping a quantum resistant bitcoin is not only a cryptography problem, it is a governance one. Bitcoin changes its rules slowly and by consent, which is a strength in normal times and a liability against a deadline. A quantum migration would be a soft fork, moving through the proposal process and then activated by miner signalling, and history sets a sobering base rate. SegWit was conceived years before it activated in 2017 and took roughly six more years to reach broad adoption. Taproot, from first ideas to activation in 2021, took around seven and a half years, and a majority of transactions still do not use it.

Neither of those upgrades had anything forcing the pace, whereas a credible quantum threat would. Chaincode Labs argues that an emergency contingency option could in principle be built in as little as one to two years, pointing to how quickly the network patched a serious inflation bug in 2018, while conceding there is little historical precedent for moving that fast on a consensus change. The honest reading is that routine upgrades have taken seven or eight years, that an emergency could compress that, and that the freeze argument alone could add years of delay before anything ships.

What holders can do today

The practical advice is real, limited, and worth following now. The most important step is to stop reusing addresses, because reuse is what has turned a structural problem affecting a couple of million coins into one affecting six. Every time you receive to a fresh address and spend the whole balance, you keep your key hidden until the moment of spending and no longer.

If your coins sit in an address whose key is already exposed, meaning any pay to public key output, any Taproot output, or any address you have spent from before, moving them to a fresh, never-used address of a hashed type reduces your at-rest exposure. It is worth being honest about the limits. These hashed address types are only somewhat quantum resistant, they still reveal a key at spend time, and moving to Taproot for safety would be counterproductive because Taproot exposes the key by design. None of this helps coins you cannot move, which are precisely the coins the freeze debate is about.

The larger point is that no individual habit solves the problem, only a network-wide migration to genuine post-quantum signatures does, and that migration has not started. A truly quantum resistant bitcoin depends on a consensus change, not on wallet hygiene. Following the engineering, and keeping funds in wallets whose developers are tracking BIP-360 and its successors, is the most a holder can reasonably do while the community argues out the rest.

Frequently asked questions