Quantum computing will not “decrypt Bitcoin.” That phrase is technically wrong and politically distracting.
A sufficiently capable quantum computer could do something narrower and more dangerous: derive a private key from a visible public key, then produce a valid signature and spend coins it does not own. The blockchain would not be hacked. Its rules would be followed with a stolen key.
No existing machine can do this. Today’s best public demonstrations are still learning how to preserve and operate a small number of error-corrected logical qubits. But the resource estimates are falling, post-quantum standards now exist, and Bitcoin upgrades slowly by design. Waiting for an attack is not a serious plan.
The cryptography is solvable. The harder problem is the migration: how to move millions of coins, what to do about owners who never move, and whether the network should eventually reject signatures that are mathematically valid under today’s rules. Quantum computing is therefore not only a security threat. It is a test of Bitcoin’s claim that no committee decides whose money is real.
Two algorithms, two very different threats
Public discussion often combines Shor’s algorithm and Grover’s algorithm into one quantum menace. They do different things.
Shor’s algorithm attacks ownership. Bitcoin uses elliptic-curve cryptography on the secp256k1 curve for ECDSA and Schnorr signatures. Given a public key, a large fault-tolerant quantum computer running Shor’s algorithm could solve the discrete-logarithm problem and recover the corresponding private key. With that key, the attacker could sign a normal transaction.
Grover’s algorithm weakens search. Bitcoin’s proof of work and many internal commitments depend on SHA-256 and other hash functions. In an idealized quantum computer, Grover’s algorithm gives a quadratic speedup: a 256-bit preimage problem has roughly 128-bit quantum security. That is a meaningful reduction, but 2^128 remains an enormous search space. Quantum mining would also face serial gate costs, hardware scarcity, competition from classical ASICs, and the network’s difficulty adjustment.
The practical conclusion is clear. The first systemic quantum risk is not a miner rewriting the chain. It is a key-recovery attacker spending coins from outputs whose public keys are already visible.
Not every coin is equally exposed
Bitcoin has several output types, and they reveal different information.
Early pay-to-public-key (P2PK) outputs place a public key directly on-chain. Modern Taproot outputs also contain a public key in the output. Coins in those formats offer a future quantum attacker unlimited time to work: the public key is visible as long as the coin remains unspent.
Pay-to-public-key-hash formats, including common SegWit addresses, work differently. The output commits to a hash of the public key. The public key is revealed only when the owner spends. If the address has never been reused, a quantum attacker must recover the private key and replace the transaction in the brief interval before confirmation.
That creates two clocks. A long-exposure attack can target an already visible key for months or years. A short-exposure attack must observe a transaction in the mempool, recover the key, and front-run the owner, perhaps in minutes. The latter requires a much faster machine.
Address reuse defeats the concealment. Once a public key has appeared in a previous spend, any remaining or newly received coins controlled by the same key become long-exposure targets. Extended public keys and some wallet descriptors can create exposure off-chain as well.
This nuance cuts both ways. It means the entire supply is not waiting naked for the first quantum computer. It also means the oldest coins, reused addresses, and Taproot outputs are natural first targets. A successful theft from a famous dormant address could cause a market crisis before the attacker had the speed to threaten ordinary transactions.
How far away is the machine?
Nobody can responsibly give a date for a cryptographically relevant quantum computer. Qubit counts in headlines are poor forecasts because a noisy physical qubit is not a reliable logical qubit, and logical qubits alone say little about gate speed, connectivity, error correction, or how long a circuit can run.
Google’s 105-qubit Willow processor crossed an important threshold in 2024. A larger error-correcting code suppressed errors better than a smaller one, and a 101-physical-qubit code preserved one logical memory longer than its best component qubit. That was a scientific milestone, not a cryptographic computer. Shor’s algorithm against secp256k1 requires a large universal fault-tolerant machine executing a deep sequence of reliable operations, not merely storing one encoded state.
The gap is still enormous, but it is no longer useful to describe it with a number from five years ago. A 2026 resource study accepted by PRX Quantum describes circuit designs using fewer than 1,500 logical qubits and estimates that, under specific superconducting-hardware assumptions, fewer than 500,000 physical qubits could recover a secp256k1 key in minutes. That estimate is not a delivery forecast. It assumes error rates, connectivity, control, and manufacturing at a scale nobody has demonstrated. It does show why “millions of qubits” should not be treated as a permanent safety margin.
There is another reason to start early: migration time. NIST finalized its first post-quantum standards in 2024, including the lattice-based ML-DSA and the hash-based SLH-DSA for digital signatures. The U.S. government’s transition planning contemplates phasing out vulnerable public-key cryptography in the 2030s. Bitcoin cannot assume that banks, browsers, and governments will spend a decade migrating while a global decentralized asset will improvise later.
The sensible stance is neither “quantum winter forever” nor “Q-Day in 2029.” It is to treat arrival time as a wide distribution and make migration progress observable.
The first step exists, but it is not the finish
Bitcoin Improvement Proposal 360 is the most concrete protocol step so far. It proposes Pay-to-Merkle-Root (P2MR), a new output type similar to Taproot but without the elliptic-curve key-path spend. The output commits directly to a script-tree root, so it can avoid leaving a long-lived public key exposed.
The proposal is deliberately modest. Its own specification says P2MR protects against long-exposure attacks, not the short-exposure window after a public key is revealed. Full protection still requires a post-quantum signature scheme inside the spending script.
That separation is good engineering. P2MR can reduce today’s attack surface and create a clean place for a future signature opcode without forcing the network to choose an immature algorithm immediately. It can be activated through a soft fork, preserving compatibility for nodes that have not upgraded.
The difficult part is size. A Schnorr public key is 32 bytes and a signature is 64 bytes. Standardized post-quantum signatures are generally measured in thousands or tens of thousands of bytes. Bitcoin has intentionally scarce block space. Replacing every signature naively would reduce transaction throughput, raise fees, enlarge the blockchain, and make node operation more demanding.
Developers are studying lattice signatures, hash-based signatures, aggregation, commit-and-reveal constructions, and zero-knowledge proofs that verify a post-quantum authorization more compactly. Each trades bandwidth, computation, assumptions, implementation risk, and maturity. NIST’s selection is valuable evidence; it is not an automatic answer for a consensus system that may need to validate signatures for generations.
The lost-coin dilemma
Suppose Bitcoin adds a sound post-quantum output and gives holders years to migrate. Most active users, exchanges, custodians, and institutions move. Some coins do not.
They may belong to people who missed the deadline. The keys may be in cold storage. The owner may be dead. The coins may be deliberately dormant. Or the keys may be permanently lost. The blockchain cannot distinguish among these stories.
Once a quantum attacker can recover old private keys, the network faces three uncomfortable choices.
-
Honor the existing signature rules. A quantum-generated signature is valid, so miners include it. This preserves protocol continuity but rewards theft. Dormant coins could suddenly enter liquid supply, and no observer could tell whether the spender was an owner or an attacker.
-
Disable vulnerable signatures before the attack. This protects the network from mass theft but strands any owner who failed to migrate. A rule intended to defend property becomes a collective decision to freeze it.
-
Create a recovery mechanism. Owners could prove knowledge of an old secret using a post-quantum construction and reclaim funds after elliptic- curve spends are disabled. This reduces confiscation risk but adds protocol complexity, privacy questions, and new failure modes.
The argument becomes most intense around coins attributed to early miners, including Satoshi Nakamoto. If those keys are lost, a quantum computer could turn economically dormant supply into active supply. If the network freezes them, critics will say developers changed the rules to protect the price. If it does not, critics will say it knowingly legalized theft.
No cryptographic primitive can answer that question. The answer will come from social consensus expressed through software, miners, economic nodes, wallets, and users.
A credible migration plan
A robust plan should be staged long before an emergency.
First, measure and reduce exposure. Wallets and custodians should inventory output types, address reuse, extended-key handling, and recovery paths. Users do not need to panic-move coins today. They do need modern backups and software capable of participating in a future migration. Wallet defaults should stop creating avoidable long-exposure keys.
Second, activate an upgradeable quantum-safer output. P2MR or a comparable design would let cautious holders move before the final signature choice is settled. Exchanges and hardware wallets need test vectors, descriptors, fee estimation, recovery procedures, and years of operational testing.
Third, select at least two authorization paths. A primary scheme and a conservative backup based on different mathematical assumptions would reduce the danger of discovering a flaw after billions of dollars have migrated. Hybrid signatures can require both classical and post-quantum authorization during the transition.
Fourth, publish triggers. The network needs evidence thresholds for accelerating migration and, eventually, disabling vulnerable spends. A July 2026 developer discussion proposed a cryptographic “tripwire”: a signature by a published nothing-up-my-sleeve key could prove that secp256k1 had been broken and automatically disable elliptic-curve paths in new protected outputs. The idea is not finished, but it correctly asks who gets to declare the emergency.
Finally, decide the legacy policy while the choice is still abstract. A multi-year notice period, transparent activation sequence, and narrowly scoped recovery design are more legitimate than an overnight patch after a theft. The worst time to debate property rights is while a quantum attacker is moving coins.
What this means for Bitcoin’s value
Quantum risk is unlikely to appear in the price as a smooth annual discount. It will arrive through discrete credibility events: a new error-correction result, a smaller resource estimate, a state program, a public key-recovery demonstration on a weaker curve, or a successful Bitcoin testnet migration.
If protocol work stays ahead of hardware, each milestone can increase confidence. Bitcoin would demonstrate that fixed monetary rules do not require frozen technology. If governance stalls while the hardware gap closes, the same milestone can trigger a rush to safer output types and a repricing of dormant-coin risk.
An actual theft would be different. The immediate problem would not be a change to the 21 million cap; quantum computers cannot mint arbitrary bitcoin under current rules. It would be a sudden transfer from inactive or compromised owners to an adversary with no acquisition cost and every incentive to sell or destabilize the market. Confidence in custody and settlement would matter more than the formal supply schedule.
Bitcoin has survived bugs, forks, exchange failures, and political bans because the protocol and its users adapted without changing the core monetary bargain. Quantum computing asks whether they can do that prospectively, before the threat forces a choice between theft and confiscation.
That is why the work should begin while it still feels early.
Sources and method
This analysis separates cryptographic possibility, engineering readiness, and network governance. Resource estimates are scenario-dependent and should not be read as arrival-date forecasts. Technical context is current through January 26, 2026.
- Google Quantum AI, Making Quantum Error Correction Work
- Gidney et al., Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities, accepted by PRX Quantum
- NIST, first finalized post-quantum cryptography standards
- Bitcoin Improvement Proposal 360, Pay-to-Merkle-Root
- Bitcoin Optech, quantum-resistance technical index
- Bitcoin Optech, 2025 quantum-resistance year in review
- Bitcoin Optech Newsletter 412, cryptographic tripwire discussion