Quantum computing and Bitcoin's integrity: what is actually at risk

Direct answer

As of September 2026, no existing quantum computer can break the cryptography that protects Bitcoin. The real threat has a technical name — a "cryptographically relevant quantum computer" (CRQC) — meaning a machine with enough stable qubits to run Shor's algorithm against an elliptic curve in useful time. That machine does not exist yet, but the estimated resources it would require dropped sharply in 2026, reviving the debate about when — not if — the network needs to migrate to quantum-resistant signatures. This article explains what is actually exposed, what is not, the numbers behind the recent headlines, and the mitigation path the Bitcoin community has already started building.

The two algorithms that matter: Shor and Grover

The quantum threat to Bitcoin is not one thing — it is two algorithms with very different effects on different parts of the protocol.

• Shor's algorithm: solves the elliptic-curve discrete logarithm problem in polynomial time — the mathematical basis of the ECDSA signature Bitcoin uses, on curve secp256k1. Anyone who holds an address's public key and a large enough quantum computer can compute the matching private key. That breaks the signature, not "the money" itself: the concrete risk is someone forging a signature to spend coins that are not theirs.
• Grover's algorithm: only speeds up brute-force search quadratically — for example, against hash functions like SHA-256. A quadratic gain is serious against short passwords, but against SHA-256 it reduces effective security from 256 to about 128 bits, a level cryptography still considers safe. Doubling the hash size would neutralize Grover — and Bitcoin does not even need to do that today.

This distinction matters because coverage of "Bitcoin and quantum computing" tends to treat both threats as one. They are not: proof-of-work mining is, in practice, protected; what is at risk are the signatures that authorize spending coins.

What in Bitcoin depends on each primitive

Two families of cryptography hold up the protocol, and each has a different relationship with quantum computing:

• ECDSA over secp256k1 authorizes spending every UTXO — the unspent "coin" a transaction can consume. This is the signature Shor's algorithm threatens.
• SHA-256 and RIPEMD-160 do two things: they chain blocks together (mining) and turn a public key into an address by hashing it. A hash cannot be reversed with Shor's algorithm; it protects the public key as long as it stays unrevealed.

That second point is the key to understanding real exposure: as long as an address's public key stays hidden behind its hash, it is out of Shor's reach. The catch is that on Bitcoin, the public key becomes visible the moment its owner spends for the first time — it has to appear in the transaction for the network to verify the signature.

Who is exposed right now — and who is not

There is no single answer to "how much Bitcoin is vulnerable"; it depends on the criteria used. Recent surveys converge on a range but disagree on the detail:

The gap between "8%" and "32%" is not a calculation error — it is a choice of criteria. Two categories are worth separating:

• Structural exposure (at rest): addresses whose format reveals the public key even without a spend, such as the old P2PK (Pay-to-Public-Key) outputs common in 2009–2010 blocks. About 1.7 million BTC sit in this format, and roughly 1.1 million are attributed to Satoshi Nakamoto — untouched since they were mined, with no sign of activity.
• Operational exposure: modern addresses (P2PKH, P2WPKH, P2TR) whose public key only appears when the owner spends — and that became exposed because the owner reused the same address instead of generating a new one for every receipt. Among the largest vulnerable wallets by balance, address reuse, not script type, is usually the cause, and it affects wallets belonging to major exchanges too.

What stays protected: a P2PKH, P2WPKH (SegWit) or P2TR (Taproot) address that has never been spent from — and whose owner never reused it — keeps its public key hidden behind the hash. There is no public key to attack until the first spend.

The real-time attack: the 10-minute window

Even a "safe" address has a temporary exposure window: the moment its owner broadcasts a transaction, the public key enters the witness (or the unlocking script) and becomes visible to every node on the network before the transaction is even confirmed. Bitcoin takes, on average, ten minutes to confirm a block — in theory, enough time for a quantum computer to compute the private key, build a competing higher-fee transaction, and try to steal the funds before the original confirms.

The Google Quantum AI, Stanford and Ethereum Foundation whitepaper, published on 31 March 2026, modeled this scenario and estimated a roughly 41% success rate for this "real-time transaction hijack" against Bitcoin, under conditions favorable to the attacker — a figure that drops below 3% on networks with faster blocks, such as Litecoin, and below 0.08% for Zcash. The same study cut the estimated resources needed for this class of attack by about 20 times compared to earlier work, stating that a superconducting computer with fewer than 500,000 physical qubits — which does not yet exist — could in theory solve the key in about nine minutes using between 1,200 and 1,450 logical qubits (with error correction) and tens of millions of Toffoli gates.

It is worth separating two layers here. The logical qubits the study cites assume fully functional error correction — something the industry has not yet demonstrated at scale. Translating "1,200 logical qubits" into real hardware today would require a much larger number of noisy physical qubits; earlier estimates, such as Gidney and Ekerå's work on factoring with Shor's algorithm, put comparable tasks at many millions of physical qubits. The 2026 reduction matters because it shows the direction of the research — fewer resources with each new study — not because the attack is already practical.

How far away it actually is

The largest public quantum processors in 2026 operate in the range of hundreds to a few thousand noisy physical qubits, without the full error correction the calculations above assume — far short of the millions of physical qubits most estimates still consider necessary to reach the 1,200–1,450 logical qubits cited above. Financial-sector reports, such as Citigroup's from January 2026, keep projecting the arrival of a cryptographically relevant quantum computer to somewhere between the end of this decade and the mid-2030s, with no date commanding consensus. Treat any single forecast — including the ones cited in this article — as an estimate subject to revision, not a reliable timeline.

The mitigation path: BIP-360 and the post-quantum standards

In August 2024, NIST (the US standards institute) finalized the first three post-quantum cryptography standards after an eight-year selection process: FIPS 203 (ML-KEM, for key exchange), FIPS 204 (ML-DSA, a lattice-based digital signature) and FIPS 205 (SLH-DSA, a hash-based signature meant as a backup in case ML-DSA turns out to be vulnerable). These families — plus the lattice-based FALCON scheme — underpin the post-quantum signature proposals now on the table for Bitcoin.

The most advanced proposal is BIP-360, published as a formal draft in February 2026 by Hunter Beast, Ethan Heilman and Isabel Foxen Duke, after public discussion dating back to mid-2024. It creates a new output type — nicknamed Pay-to-Quantum-Resistant-Hash (P2QRH), with recent coverage also describing the same mechanism as Pay-to-Merkle-Root — that commits only to a 32-byte hash of a script tree, instead of directly exposing an ECDSA public key. Some technical details are still in flux (sources even disagree on the address prefix, bc1r or bc1z), but the architecture is already consistent across versions:

• Soft fork: deployed as a new SegWit witness version, requiring no hard fork and invalidating no existing addresses. Outdated nodes keep validating blocks; they simply do not see the new rules.
• Voluntary migration: whoever wants to starts receiving funds at a new address format; whoever does not migrate keeps operating normally, at least for now.
• Block-space cost: post-quantum signatures are far larger than today's — from about 666 bytes with FALCON-512 to over 7,800 bytes with SPHINCS+, versus 64 bytes for a Schnorr signature today. That would cut transaction capacity per block by roughly four to five times, pushing fees up.

A test implementation from BTQ Technologies has been running on a dedicated testnet since March 2026, attracting dozens of miners and passing 100,000 mined blocks — a sign the proposal moved off paper, not that it is ready for mainnet. The community itself acknowledges there is still specification work, security review and consensus-building ahead of any activation.

The dilemma of old coins: BIP-361 and the "sunset"

Migrating active users is the relatively easy part. The problem is coins sitting in vulnerable addresses whose owner will not — or cannot — move them: lost wallets, heirs without access, and the roughly 1.1 million BTC attributed to Satoshi Nakamoto, untouched since 2009–2010. A companion proposal, BIP-361, under discussion since April 2026, suggests a "sunset" mechanism: after a set deadline, the network would stop recognizing spends coming from vulnerable formats, permanently freezing any balance that never migrated — hypothetically including coins linked to Satoshi.

The proposal exposes a real tension inside the community: freezing coins challenges the principle that no one — not even the protocol's own creators — can revoke someone's balance; not freezing them leaves a permanent reserve of coins that a sufficiently powerful quantum computer could steal en masse, with potential effects on price and confidence in the network. There is no set activation date, and migration deadlines cited in coverage of the topic range from 2029 to 2035, depending on the institution and who is doing the estimating. Treat that timeline as a starting point for the debate, not a decision already made.

What to do now, in practice

None of this calls for emergency action — but a few habits reduce exposure at no real cost:

• Do not reuse addresses. Use a wallet that generates a new address for every receipt — the default in practically every modern wallet (HD, derived from a single seed). It is the only cause of exposure fully under your control.
• Avoid keeping meaningful balances in P2PK formats or any legacy address you know already had its public key exposed; consider moving funds to a new, never-used address when it makes operational sense.
• Do not treat the confirmation window as an everyday risk. The "real-time hijack" attack described above depends on hardware that does not exist yet; it is a research scenario, not a threat present in every transaction you make.
• Keep your wallet, software or hardware, updated so you can adopt post-quantum addresses once they mature, without having to switch tools in a hurry.
• Your recovery phrase (seed) is not the target of this specific risk — it generates your keys, but the quantum attack targets a public key already exposed on-chain, not a seed kept offline.

Risks and precautions

Scams exploiting fear of this topic already exist. In 2026, Ledger and Trezor users were targeted with emails and even fake physical letters requesting a "quantum security update" via QR code — a phishing attempt to capture the 24-word recovery phrase, with no connection to any real update. No hardware wallet maker ever asks for your seed phrase by email, letter or QR code, under any circumstances. If you receive a message like this, ignore it and verify directly on the manufacturer's official website.

There is no ready-to-use "quantum-resistant wallet" for Bitcoin today. Any commercial product sold with that promise, before BIP-360 (or an equivalent proposal) is active on mainnet, should be treated with skepticism.

Governance risk is as real as technical risk. Proposals like BIP-361 would change a fundamental Bitcoin rule — the impossibility of confiscating someone else's balance. Debates like this tend to be long, contentious and unpredictable; do not assume a technical solution will arrive with a quick social consensus attached.

The numbers in this article will change over time. Estimates of required qubits, timelines, and even the share of BTC "exposed" have already shifted considerably in a few years, including within 2026 alone. Treat any estimate, from this source or another, as a snapshot of current research, not a definitive forecast.

Checklist

Do not reuse addresses — generate a new one for every receipt. Check whether you hold balances in old formats (P2PK or addresses known to have been reused) and consider migrating when it makes sense. Keep your wallet's software and firmware updated so you can adopt post-quantum signatures once they are ready. Be suspicious of any contact — email, letter or QR code — asking for your seed phrase because of "quantum security." Follow technical sources, such as the Bitcoin BIPs repository and Bitcoin Optech, instead of isolated headlines.

Frequently asked questions

Can a quantum computer break Bitcoin today?

No. No existing quantum computer has enough qubits, with functional error correction, to run Shor's algorithm against an ECDSA key in useful time. Estimates of when that could happen range from "end of this decade" to "mid-2030s," with no consensus.

Are my coins safe in a hardware wallet?

Yes, as far as this specific risk goes. Shor's algorithm attacks the public key exposed on-chain, not your recovery phrase or the physical device. If you never reuse addresses, your public key is only exposed during the brief window of a transaction.

Will Bitcoin mining stop working?

No. Proof of work uses SHA-256, which only gets a limited quadratic speed-up from Grover's algorithm — not enough to give a quantum miner an advantage over today's classical network, even under optimistic technology scenarios.

Are Satoshi Nakamoto's coins at risk?

They carry the same structural risk as any old P2PK address: the public key is already visible on-chain. They are also at the center of the debate over proposals like BIP-361, which discuss whether — and how — the network should handle dormant balances that never migrate to a safe format.

Do I need to switch wallets right now because of this?

There is no need for emergency action. Prioritize not reusing addresses and keeping your wallet updated; migration to post-quantum formats, once it exists on mainnet, should be a voluntary, gradual process, not a race.

Informational and educational content. This is not investment advice, an offer, or a solicitation to buy or sell assets.

Sources: NIST — first finalized post-quantum encryption standards (FIPS 203, 204 and 205); Forbes — Google Quantum AI whitepaper cuts resource estimate for attacking Bitcoin; postquantum.com — mapping Bitcoin's quantum attack surface; CoinShares — quantum vulnerability in Bitcoin, a manageable risk; crypto.news — BIP-360, BIP-361 and Bitcoin's post-quantum migration plan; Citigroup — the trillion-dollar security race against the quantum threat; Cybernews — scammers pose as "quantum experts" to target Bitcoin users; Cryptopolitan — scammers send fake "quantum update" letters to Ledger users. Accessed 11 Sep. 2026.