Can quantum computers break bitcoin? Risks and fixes explained

Short answer: not today, and probably not for years, but a large enough quantum computer could in theory break the digital signatures that protect bitcoin, so developers are preparing a fix now. The threat is specific. A quantum machine would not "hack the blockchain" or rewrite its history. It could, in principle, work out a private key from a public key, and that would let it spend coins it does not own.

This explainer covers how that would work, which coins are most exposed, what the timelines look like and what holders can do. It is educational and not investment advice.

How bitcoin is secured today

Bitcoin relies on two kinds of cryptography:

• Digital signatures (ECDSA and, since Taproot, Schnorr, both on the secp256k1 curve). Your private key signs a transaction; anyone can check it against your public key. Ordinary computers cannot reverse the math to get the private key from the public one.
• Hash functions (SHA-256 and RIPEMD-160). They power mining and turn public keys into the shorter addresses you share.

Quantum computers attack these two layers very differently.

Shor's algorithm: the real threat

In 1994 mathematician Peter Shor published an algorithm that lets a quantum computer solve the problems behind RSA and elliptic-curve cryptography far faster than any classical machine. A cryptographically relevant quantum computer running it could take a bitcoin public key and calculate the private key, then sign transactions as the owner.

The catch is scale. Today's processors have from around a hundred to about a thousand noisy physical qubits. Breaking bitcoin's curve would need many thousands of error-corrected logical qubits running for hours or days. In March, Google researchers estimated that a machine with fewer than 500,000 physical qubits could do it under specific assumptions; earlier estimates ran into the millions. Each hardware step, like Google's recent Willow "magic state" result, narrows the gap a little, but no one has shown a machine anywhere near that size.

Grover's algorithm: much less scary

Grover's algorithm speeds up brute-force searches, but only by a square root. Against SHA-256 that is roughly like halving the security level, which still leaves an enormous margin. For mining, quantum machines would also be slow and expensive next to specialised ASIC miners. Most researchers therefore see signatures, not mining, as the weak point.

Which coins are exposed?

What matters is whether your public key is already visible on the blockchain:

The Quantum Alliance, a group of crypto security firms, estimates that about 6.4 million BTC, roughly 30% of supply, sits at addresses with exposed public keys, including around 1.1 million BTC attributed to Satoshi Nakamoto (our report). Even "hidden" keys are revealed briefly when you spend, while the transaction waits to be confirmed, so in the long run every coin needs a quantum-safe home.

When could it happen?

Nobody knows. Estimates quoted in recent coverage range from about 2028–2029 at the aggressive end to well over a decade at the cautious end, and several experts say the honest answer is "unknown". That uncertainty is why custodians such as Coinbase argue the migration should start now: upgrading a global network takes years.

How bitcoin could become quantum-safe

1. New signature schemes. In 2024 the US standards body NIST published its first post-quantum standards, including the ML-DSA and SLH-DSA signature schemes. Their signatures are much larger than bitcoin's 64-byte Schnorr signatures, often several kilobytes, which affects fees and block space.
2. A soft fork adding new output types. Proposals such as BIP-360 would let users move coins to addresses that can be spent with quantum-resistant signatures.
3. A migration period. Wallets, exchanges and custodians would need to move funds, much like the shift to SegWit, only with higher stakes.
4. A decision on lost coins. The hardest question is what to do with coins whose owners will never move them. Ideas range from leaving them alone to freezing or phasing out vulnerable outputs, which clashes with bitcoin's promise that nobody can confiscate funds.

Other chains face the same problem. Ethereum accounts reveal their public key with the first transaction, Starknet has voted on a post-quantum path, and Zcash developers are working on quantum-proofing private swaps.

What you can do now

• Don't panic-sell or rush. There is no practical quantum attack today.
• Avoid address reuse. Modern wallets give a fresh address for every receive; use that feature.
• Keep wallet software and hardware wallet firmware updated, so you can adopt quantum-safe address types when they arrive. See what is a hardware wallet and how to store crypto safely.
• Beware of "quantum-proof" sales pitches. Tokens or services that promise to protect your coins in exchange for your seed phrase are scams; see how to spot crypto scams.