Is Bitcoin Vulnerable to Quantum Computers?

Despite alarming headlines, the quantum computing threat to Bitcoin remains manageable. The notion that a new “super-machine” could single-handedly compromise the entire network is an oversimplification: the necessary technology does not yet exist, but the issue is concrete enough to warrant planning and work toward a post-quantum transition.

Published on March 31, 2026, updated in September 2026.

Two Pillars of Bitcoin’s Security

Quantum computing — a new form of computation that harnesses quantum mechanical phenomena to solve certain classes of mathematical problems far faster than classical computers — is attracting increasing attention. For this reason, quantum computing could undermine important parts of the cryptography used for authentication and for securing digital services (including financial ones) and critical infrastructure.

Bitcoin’s security likewise rests on two cryptographic foundations:

• Digital signatures for transactions (asymmetric cryptography): they prove that whoever spends or transfers bitcoin has the right to do so.
• Mining (hashing and proof-of-work): it makes rewriting the transaction history costly and difficult.

Both could, in theory, be affected by quantum computing — but with very different risks and impacts.

Mining: A Limited Impact

Let us start with the less troublesome of the two. On the mining side, the picture is fairly reassuring. The relevant quantum algorithm is Grover’s, which speeds up hash function searches but only provides a quadratic advantage: it reduces the number of required attempts without turning a hard problem into a trivial one.

Intuitively: even with Grover’s help, mining would remain an activity requiring enormous hardware capacity, energy, and infrastructure. Furthermore, the network can respond by adjusting difficulty, partially offsetting any competitive advantage.

The Most Sensitive Point: Digital Signatures

The central concern involves digital signatures. A sufficiently powerful quantum computer could run Shor’s algorithm, a quantum algorithm that makes tractable certain mathematical problems that are intractable today thereby solving the discrete logarithm problem underlying the elliptic curve cryptography Bitcoin relies on.

In plain terms: if Shor’s algorithm were deployable at scale, it could become possible to derive a private key from its corresponding public key. At that point, bitcoin tied to already-known public keys — for example, funds associated with addresses publicly linked to Satoshi Nakamoto — would be more exposed.

This is why it is recommended to never reuse the same address: when spending, certain technical details are revealed (including, in many cases, the public key), and limiting exposure over time is good practice. That said, two facts remain:

• there are already cases where the public key is known; and
• during transaction propagation, anyone who sees a transaction before confirmation has access to the data needed to validate it. In a mature quantum scenario, an actor with sufficient capability could attempt to derive the private key within the confirmation time window and broadcast a competing transaction (a race attack or on-spend attack). This, however, requires both quantum capability and favorable network conditions.

What Recent Developments Say (Without the Alarmism)

Over the past several months, the technical literature and research community have made one point increasingly clear: resource estimates for a quantum attack on elliptic curve signatures are falling relative to older assessments. The most recent and authoritative example is the whitepaper published on March 31, 2026 by the Google Quantum AI team: researchers estimate that breaking ECDLP-256 — the mathematical problem underlying Bitcoin’s and Ethereum’s cryptography — could require approximately 1,200 logical qubits and fewer than 500,000 physical qubits, a roughly 20-fold reduction from prior estimates. On the same day, a parallel paper from Caltech and startup Oratomic proposed even lower figures, in the range of 10,000 physical qubits — though all of its authors are shareholders of the company, a conflict of interest worth bearing in mind when assessing the results. None of this means an attack is imminent, but it does make it reasonable to accelerate preparations.

To put these numbers in context, a distinction is necessary:

• Logical qubits: idealized, stable qubits, as though error correction were already solved.
• Physical qubits: actual hardware qubits. Obtaining a single logical qubit typically requires many physical qubits, because quantum error correction (fault tolerance) carries significant overhead.

Most of the more “optimistic” analyses — that is, the ones most concerning from a security standpoint — assume substantial progress in error rates, error correction, hardware architectures, and parallelism. It is therefore accurate to speak of a risk that is approaching, but not one that is immediate.

Why This Is Not an Imminent Risk

The critical constraint remains the required technological scale: what would be needed is a fault-tolerant quantum computer capable of sustaining complex computations within timeframes compatible with the attack scenarios described (such as the on-spend attack). Even with reduced estimates, the bar remains well beyond what today’s quantum hardware can reliably achieve.

This places the threat on a medium-to-long-term horizon. The exact timeline is uncertain — it depends on hardware progress — but the direction is clear: preparing now is the rational course.

A consistent signal from the industry: major technology players are planning post-quantum migrations on multi-year roadmaps, not because the risk is “tomorrow,” but because the transition requires years of work and coordination. Google, which commands the world’s most advanced quantum research resources, has set 2029 as its internal deadline to migrate authentication services to post-quantum cryptography — a benchmark that the broader sector, crypto included, would do well to treat as a reference point.

Countermeasures Already Exist (and Are Maturing)

The good news is that research has been active for years. Post-quantum cryptography standards and candidates already exist, including signature schemes and operational guidelines such as the NIST standards ML-DSA/Dilithium and SLH-DSA/SPHINCS+, designed precisely to replace elliptic curve cryptography in high-risk scenarios.

Much as happened with Schnorr/Taproot — the Bitcoin upgrade that introduced more efficient and privacy-friendly signatures and scripts — it is plausible that the Bitcoin community will make significant contributions to the selection, implementation, and standardization of quantum-resistant solutions. The economic incentives are substantial.

What Bitcoin Is Discussing Today

Bitcoin has not yet activated any quantum-resistant changes at the consensus layer, but the most pragmatic direction currently under discussion is a gradual transition:

• reducing key exposure over time (for example, the BIP-360 proposal, which in essence aims to avoid exposing the key-path spend, shifting toward a “script-spend only” approach); BIP-360 already has an experimental testnet running — not a definitive solution, but a concrete signal that the ecosystem is moving in the right direction;
• integrating genuinely post-quantum signatures (e.g. ML-DSA/Dilithium, SLH-DSA/SPHINCS+) through new script rules;
• introducing new output/address types compatible with these signatures (the SegWit v3 area).

Two Different Problems: Securing the Future and Securing the Past

It is worth pausing here, because the label “post-quantum migration” hides two problems that have almost nothing to do with each other.

The first is securing the future: giving Bitcoin addresses and signatures that resist quantum computers, and then moving one’s coins onto them. It is a technical and coordination problem, but a fundamentally solvable one: it takes a standard, a soft fork, updated wallets, and a few years. Anyone who holds their keys and follows the matter will migrate their funds, just as the ecosystem once moved from legacy addresses to SegWit and then to Taproot.

The second is securing the past, and it is a problem of an entirely different nature: the bitcoin whose public key is already written on the blockchain, in plain sight. Nobody can protect those coins on the owner’s behalf; the only way is for whoever holds the keys to move them to a quantum-resistant address. And if that owner is gone, or is not paying attention, or has lost the keys, those bitcoin remain exposed forever.

This is no marginal detail. An estimated 6.5 million bitcoin — nearly a third of all coins in existence — currently sit at addresses whose public key is already visible. Of those, roughly 1.7 million are held in P2PK (pay-to-public-key) outputs, the format used in the earliest days, in 2009-2010, which wrote the public key straight into the transaction without even the intermediate step of a hash. That category includes the million-plus bitcoin attributed to Satoshi Nakamoto, untouched ever since.

An Ethical Problem Before a Technical One

The point is that those bitcoin cannot be secured by anyone, because whoever owns them has been silent for fifteen years. Which leaves the Bitcoin community facing an uncomfortable choice, where both options betray something.

Do nothing. The day a capable quantum computer exists — the so-called Q-day — the first party to get hold of one takes those coins. That would not merely be theft, however enormous: it would be a systemic shock. Millions of bitcoin untouched for fifteen years would hit the market at once, a single entity would end up holding a vast share of the supply, and the credibility of Bitcoin’s scarcity itself would take a bruising.

Freeze or burn them. The network is protected, but something is taken from people who may still hold those keys and have simply not spoken up. More fundamentally, it violates Bitcoin’s founding promise: if you have the key, you spend — nobody can stop you. Critics of these proposals use the word “confiscation” without hesitation. And freezing or burning means 21 million is no longer really 21 million.

Neither path is comfortable, which is why the debate has run for years without resolution. But it is worth saying plainly: not deciding is itself a decision, and it has precise consequences.

The 2026 Development: Attesting Ownership Before Q-Day

Over the course of 2026 an idea has emerged that tries to break the deadlock, and it is as simple as it is elegant: if you cannot move your bitcoin now, at least prove now — while quantum computers do not yet exist — that you hold the keys. Then put a timestamp on that proof.

The whole trick sits there. After Q-day anyone will be able to produce a valid signature for those addresses, so a signature will prove nothing. But a signature dated before Q-day will: no attacker, however powerful, can go back in time to manufacture one. The attestation becomes what separates the rightful owner from whoever merely had the right machine at the right moment.

Two concrete proposals address this, and they are complementary.

PACTs (Provable Address-Control Timestamps), put forward by Dan Robinson of Paradigm on May 1, 2026. The owner signs a message with the key of their address (using BIP-322, the standard for signing without spending), adds a random secret, and anchors the whole thing to the blockchain with OpenTimestamps. No transaction is needed, no fee is paid, neither the address nor the amount is revealed, and nobody even knows the attestation exists. Should Bitcoin later freeze vulnerable funds, the owner would present a zero-knowledge proof (a STARK proof) saying, in essence: “I held a valid attestation before date X” — and would recover their bitcoin without disclosing which ones. This is the only route that also works for P2PK outputs: it requires nothing beyond a signature made in time. In principle Satoshi — or anyone still holding those keys — could use it today, without moving a single satoshi and without saying a word.

Signature lifting, carried from research by Alon Sattath and Robert Wyborski to a working prototype by Project Eleven together with Jim Posen (the maintainer of Binius) in July 2026. Here one proves, again in zero knowledge, knowledge of the parent key from which the address was derived in the BIP-32 tree used by modern wallets. A quantum computer can work back from a public key to its private key, but it cannot climb the derivation tree: the parent key stays out of reach. Its merit is that it asks nothing of the user in advance. Its limitation is the mirror image: it only works for keys generated by a hierarchical wallet. And the old P2PK coins from 2009, generated one at a time with no common seed, have no parent — precisely the most exposed funds are left out.

The Proposals on the Table, and What They Mean for Bitcoin Holders

Around these building blocks, the debate over deadlines is taking shape. BIP-361 (Post Quantum Migration and Legacy Signature Sunset), presented by Jameson Lopp and others in April 2026, proposes a two-phase schedule: roughly three years after activation it would no longer be possible to send bitcoin to vulnerable addresses; two years later, legacy ECDSA/Schnorr signatures would face constraints that prevent theft, while leaving open the recovery route through the cryptographic proofs described above.

For P2PK outputs, where recovery proofs do not work, the reference proposal is different and lighter: Hourglass freezes nothing, but limits spending to one P2PK transaction per block. Were Q-day to arrive, those coins could not flood the market within hours — at most roughly 7,200 a day — giving the market and the network time to react. It does not solve the ethical problem: it makes it manageable.

None of this is settled, and the community is divided on every single proposal. But two things changed in 2026. The first is that the discussion has moved from “whether” to “how.” The second, more concrete, concerns anyone holding bitcoin: if the attestation route takes hold, there is something that can only be done before Q-day, because afterwards it would be worth nothing. It is the rare case where the correct action is free, private, and commits you to nothing — and only makes sense if taken early.

A Manageable Transition: Two Useful Analogies (Y2K + China’s Mining Ban)

The situation is more reminiscent of the Y2K bug than of a sudden collapse: a potentially serious risk, but one with a time horizon long enough to allow for audits, standards, upgrades, and migration — provided the work starts in time. Recent developments do not change the substance of this assessment: they bring the horizon closer, but they do not make it immediate.

At the same time, Bitcoin has already demonstrated remarkable resilience in the face of concrete shocks. One example is the 2021 China mining ban: within weeks, an enormous share of global hashrate went dark, and countless headlines declared the end of Bitcoin. In reality, the network adapted automatically — mining difficulty dropped, miners relocated to other countries, and within months the hashrate returned to high levels. What appeared to be a fatal blow turned out to be a demonstration of the system’s robustness.

The point is that quantum computing, however deeper a challenge on the cryptographic plane, is a slower and more predictable threat than a sudden government ban: it does not arrive overnight and leaves time to plan a post-quantum transition. If Bitcoin absorbed a fast and brutal exogenous shock to its mining infrastructure, it also has the time and the tools to navigate a cryptographic migration announced years in advance — as long as the work begins in earnest, and with method.

Conclusion

Concerns about quantum computing as an “immediate” threat to Bitcoin remain overblown relative to the actual state of the technology. The latest technical work — including Google’s March 31, 2026 whitepaper — represents a meaningful update to resource estimates and a legitimate call to accelerate preparations, but not an announcement of imminent danger.

The necessary hardware does not yet exist. The vulnerability, though closer than before, remains theoretical. Post-quantum solutions are already standardized and deployable. The real sticking point is not the mathematics but what to do about the bitcoin nobody can secure any longer: that is where the hardest part of this transition is decided, because it touches the ethics of the system before its engineering. Quantum computing is the next great test for modern cryptography: not a cause for panic, but an invitation to prepare early and prepare methodically.