Are Quantum Computers a Threat to Bitcoin?

Every few months a headline announces that quantum computers are about to break Bitcoin, and a few months later another one announces that they never will. Both cannot be right, and neither is being careless. The disagreement is real, it runs through serious research groups, and it has become sharper rather than softer over the past two years.

What makes the question answerable at all is that it decomposes. Bitcoin does not have one cryptographic exposure to quantum computing. It has two, they are attacked by two different algorithms, and only one of them is in genuine danger. Almost every confused claim about this topic comes from mixing the two together.

Two different attacks, not one

Bitcoin leans on two kinds of mathematics. It uses hash functions to compress data into fixed-length fingerprints, which is what mining searches through and what addresses are built from. And it uses public key cryptography to prove ownership, which is what a signature does when you spend a coin.

Two quantum algorithms target these two families, and they are not equally dangerous.

Peter Shor published his in 1994. It solves a specific class of problem, including the one that public key cryptography depends on, exponentially faster than any known classical method. Against Bitcoin's signature scheme, Shor's algorithm is not an optimisation. It is a solution.

Lov Grover published his in 1996. It searches an unstructured space, and it delivers a square root speedup. A search that would take a classical computer 2^256 steps takes a quantum computer running Grover roughly 2^128 steps. That is an enormous improvement in mathematical terms and almost no improvement in practical terms, because 2^128 is still far beyond anything that can be computed.

So the honest short answer is that quantum computers threaten how Bitcoin proves ownership, and barely touch how Bitcoin produces blocks.

Why mining is not the weak point

Mining is a search. Miners try enormous numbers of candidate values, hash each one, and look for a result below a target. It is exactly the kind of unstructured search Grover's algorithm is built for, which is why the idea of quantum mining sounds plausible.

It fails on two counts, and both are practical rather than theoretical.

The first is speed. Grover's speedup applies to the number of operations, not to the time each operation takes. Quantum gates run many orders of magnitude slower than the fixed-function circuits inside a mining chip. Chaincode Labs put numbers on this in 2025 and estimated that a quantum miner built on optimistic assumptions would reach roughly 13.8 gigahashes per second, more than a thousand times slower than a single modern ASIC at around 500 terahashes per second.

The second is that Grover parallelises badly. Classical mining scales almost perfectly by adding machines, because every machine searches an independent slice of the space. Grover's advantage is sequential, and splitting the search across many quantum computers eats away most of the square root gain.

This is not a new conclusion. Aggarwal, Brennen, Lee, Santha and Tomamichel reached it in a 2017 paper published in Ledger, and their assessment was that Bitcoin's proof of work is "relatively resistant to substantial speedup by quantum computers in the next 10 years". That window has now largely elapsed, and the conclusion has held.

The hash function itself is in the same position. Grover would reduce a preimage search on SHA-256 from 2^256 to about 2^128 steps, which changes nothing anyone can act on.

Why signatures are the weak point

The same 2017 paper reached the opposite conclusion about the other half of Bitcoin. The signature scheme, the authors wrote, "could be completely broken by a quantum computer as early as 2027, by the most optimistic estimates".

The reason is structural. When you own bitcoin, what you really own is a private key. From that private key, the software derives a public key through a one-way operation on an elliptic curve called secp256k1. One way means that going forward is cheap and going backward is, for a classical computer, impossible in any useful sense. Recovering a private key from a public key on this curve is a problem called the elliptic curve discrete logarithm problem, and no classical shortcut is known.

Shor's algorithm is that shortcut. Given a public key, a sufficiently large quantum computer could compute the matching private key, and whoever holds a private key can spend the coins it controls. No consensus rule is broken in the process. The theft would look like an ordinary, perfectly valid transaction, which is precisely what makes it dangerous.

Both of Bitcoin's signature schemes sit on the same curve. ECDSA, used since 2009, and Schnorr, introduced with Taproot in 2021, differ in how they build a signature and not in the mathematics that protects the key. Upgrading from one to the other bought Bitcoin many things. Quantum resistance was not among them.

A public key is only at risk once it is visible

This is the point that most coverage skips, and it is the difference between a catastrophe and a manageable problem.

Shor's algorithm needs a public key as input. It cannot work from an address, because most Bitcoin address types do not contain a public key. They contain a hash of one. The public key stays private until the moment you spend, and only then does it appear in the witness data of your transaction, permanently.

That produces two very different threat models, and BIP-360 gives them names.

A long exposure attack targets a public key that is already sitting on chain in plain view. The attacker has unlimited time. Nothing needs to be rushed, nothing needs to be intercepted, and the owner has no way of knowing it is happening.

A short exposure attack targets the brief window in which a transaction has been broadcast but not yet confirmed. The public key is visible in the mempool, and the attacker has to derive the key and get a competing transaction confirmed first, all inside that window. This is far harder, and it requires an attack measured in minutes rather than days.

Which model applies to a given coin depends entirely on the output type. Pay-to-Public-Key outputs from Bitcoin's earliest years contain the raw public key. Taproot outputs also expose a key by design. Any address that has been used more than once has published its key on the first spend and left the remainder exposed. Standard single-use Pay-to-Public-Key-Hash and native SegWit outputs publish nothing until they move.

How much bitcoin is actually exposed

Because the exposure depends on output type and on user behaviour, it can be measured. In May 2026 Glassnode Research published the most careful public measurement to date, defining a coin as exposed if "the public key needed to spend a coin is already visible on-chain".

Their result, as of 20 May 2026:

Two things stand out. The larger share of the problem is behaviour rather than protocol design, which means a large part of it can be fixed by users without any change to Bitcoin. And nearly seventy percent of all bitcoin is not exposed at rest at all.

Other measurements exist and they do not agree, which is worth understanding rather than glossing over. Google's research group reported in March 2026 that "a little over 1.7 million bitcoin (nearly 9% of all bitcoin) is secured by P2PK locking scripts", and put dormant quantum-vulnerable holdings across all script types at up to 2.3 million. The Coinbase Quantum Advisory Council estimated 6.9 million in April 2026. BIP-361 states that "over 34% of all bitcoin have revealed a public key on-chain".

These numbers are not in conflict. They measure different things. Structural exposure, dormant exposure, total at-rest exposure and total ever-revealed keys are four different questions with four different answers. Any article that quotes one of them without saying which is being measured is telling you less than it appears to.

What a logical qubit is, and why the number is so small

Quantum computers are usually sold by physical qubit count, and that number is close to meaningless for cryptography.

Physical qubits are fragile. They lose their state through interaction with their environment, and their gates make errors at rates that would be unthinkable in classical computing. Running a long calculation on raw physical qubits produces noise, not answers.

The fix is quantum error correction, which spreads the information of one reliable logical qubit across many physical ones and continuously detects and corrects errors. The ratio is the overhead, and it is the whole ballgame. IBM's bivariate bicycle code packs 12 logical qubits into 288 physical qubits, roughly 24 to one. Surface codes, the approach behind most superconducting estimates, are considerably more expensive per logical qubit but better understood.

So the meaningful question is never how many qubits a machine has. It is how many error-corrected logical qubits it can hold, entangled, for the duration of a long calculation.

Measured that way, the state of the art is modest. Quantinuum's Helios system, launched on 5 November 2025 with 98 physical qubits, demonstrated 48 fully error-corrected logical qubits at a two-to-one encoding rate. That was a large jump from the 12 the company demonstrated in September 2024, which was itself a jump from 4 in April 2024. IBM's published roadmap targets Starling in 2029, a machine intended to run 100 million gates across 200 logical qubits.

How much quantum computer the attack would take

Against those numbers, here is what published research says an attack on Bitcoin's curve would require. The figures have moved a great deal.

Published	Source	Logical qubits	Toffoli gates
June 2017	Roetteler, Naehrig, Svore, Lauter	2,330	1.26 x 10^11
March 2026	Babbush et al., low-gate variant	1,450	7 x 10^7
March 2026	Babbush et al., low-qubit variant	1,200	9 x 10^7
July 2026	Luo et al.	835	roughly 1.66 x 10^9

The last row deserves a caution. Luo and co-authors reduced the circuit width by trading it against gate count, using roughly twenty times more operations than the competing designs, and their paper gives no circuit depth and no physical compilation. Fewer qubits does not mean an easier machine if each of them has to work far longer.

Physical resource estimates have moved in the same direction. Craig Gidney and Martin Ekerå estimated in 2019 that factoring a 2048-bit RSA number would take 20 million noisy qubits and eight hours. Gidney's own 2025 revision put it at fewer than one million qubits and under a week. In March 2026 the Google-led group estimated fewer than half a million physical superconducting qubits for Bitcoin's curve specifically, and a separate group including John Preskill estimated that 26,000 reconfigurable neutral atom qubits could compute a P-256 discrete logarithm in a few days.

One figure from the Google paper matters more than the rest for Bitcoin. The attack, once the machine has been primed with precomputation, would take roughly nine to twelve minutes. That is shorter than the average time between blocks, which means a short exposure attack from the mempool stops being theoretical.

The estimates are falling faster than the hardware is growing

Put the two sets of numbers side by side and a pattern appears that is easy to miss when the papers are read one at a time.

Between 2017 and 2026, the logical qubits believed necessary fell from 2,330 to 1,200, a little under half. Over the same period the gate count fell from 1.26 x 10^11 to 9 x 10^7, a factor of roughly 1,400. Meanwhile the number of error-corrected logical qubits that anyone has actually demonstrated went from effectively zero to 48.

Both curves are moving. The estimate is moving faster than the machine.

This is the single most important thing to understand about the timeline, and it is also the reason honest researchers refuse to give a date. The remaining distance is not a fixed target that hardware is approaching at a measurable rate. It is a target that keeps stepping toward the hardware as the algorithms improve, and nobody knows how much further it can step.

At the same time, the practical record is sobering. A 2025 review of what has actually been demonstrated found that "only very small integers N ≤ 35 have been successfully factored with Shor's algorithm on a digital QC", and dismissed larger claims as resting on simplifications that make them "equivalent to coin flipping". In April 2026 Project Eleven paid out one bitcoin for the largest quantum attack on elliptic curve cryptography achieved to date. The key that was broken was 15 bits long. Bitcoin's are 256.

What Bitcoin is building against it

Work is underway on two separate fronts, and they answer different questions.

The first front is the replacement signature. The reference standards already exist. NIST published FIPS 203, 204 and 205 on 13 August 2024, and FIPS 205 standardises SLH-DSA, a stateless hash-based scheme derived from SPHINCS+. Hash-based signatures are attractive for Bitcoin because they rest only on the security of hash functions, which is the part of Bitcoin's cryptography that quantum computing does not meaningfully threaten.

The problem is size. Bitcoin's Schnorr signatures are 64 bytes. SLH-DSA signatures run to several thousand. Every byte competes for the same limited block space, so a naive swap would cost Bitcoin most of its transaction capacity.

That is the problem SHRINCS is built to solve. Mikhail Kudinov and Jonas Nick of Blockstream Research proposed it in December 2025 and published a draft BIP for an OP_CHECKSHRINCS opcode on 27 August 2026. It combines SPHINCS+ for stateless signing with an unbalanced XMSS construction for stateful signing, and the public key is a hash of both. The stateful path produces signatures of roughly 580 bytes. If the state is lost, the same key falls back to the stateless path at roughly 4,300 to 4,500 bytes.

The catch is what "stateful" means in practice. A stateful hash-based key may sign only once from each internal position, and the wallet must remember which positions it has used. Restoring an old backup rolls that counter back to a value already spent, and signing again from there can compromise the key. Nick states the failure mode plainly: a rolled-back counter means "a subsequent signature reuses that state, which can compromise the user's funds". This is a genuine departure from how seed phrase recovery works today, where a backup restores everything you need and nothing else is required.

The second front is migration, and it is not a cryptography problem at all. Two draft proposals frame it.

BIP-360, drafted by Hunter Beast, Ethan Heilman and Isabel Foxen Duke, is the conservative step. It defines a new output type called Pay-to-Merkle-Root that removes Taproot's quantum-vulnerable key path spend. It deliberately specifies no post-quantum signature scheme, describing itself as a first step and deferring the signature question to a later proposal.

BIP-361, drafted by Jameson Lopp and five co-authors and created on 11 February 2026, is the aggressive one. It proposes a phased sunset. Roughly three years after activation, sending to quantum-vulnerable addresses would be prohibited. Roughly two years after that, legacy signatures would stop validating, and any bitcoin not migrated would be permanently frozen.

That second phase is where the technical question turns into a political one, because it means deciding what happens to several million bitcoin whose owners are almost certainly not coming back. Adam Back has argued the opposite case, that optional upgrades and roughly a decade of voluntary migration are safer than a scheduled deadline, on the grounds that Bitcoin's developers can coordinate quickly if the threat accelerates. Neither position has consensus, and the question of how Bitcoin changes at all is what will settle it.

What nobody knows yet

Three honest uncertainties remain, and they point in different directions.

The first is whether the hardware arrives. Every estimate above assumes that error-corrected logical qubits can be scaled from 48 to over a thousand while staying entangled through a calculation of tens of millions of gates. Nobody has demonstrated that this is possible. The roadmaps say it is, and roadmaps in this field have a long record of slipping.

The second is whether there is a ceiling. In March 2026 the Oxford physicist Tim Palmer published a theory in PNAS proposing that the state space of quantum mechanics is finely discrete rather than continuous, which would cap the number of usefully entangled qubits at roughly 200 for quantum dots, 300 for photonic qubits, 400 for ion traps, and around one thousand as an absolute upper bound. Above that ceiling, he argues, algorithms that depend on spreading a calculation across the full state space lose their advantage. If the theory is right, large factoring never happens.

Three things about it deserve to be stated clearly. The paper is peer reviewed, which is more than most contrarian claims in this area can say. It also proposes a departure from standard quantum mechanics, so it is a minority position rather than the settled view, and Palmer presents it as falsifiable within about five years. And the paper does not mention Bitcoin anywhere. Its subject is RSA-2048.

An older argument is often cited alongside it. In 2007 the physicist Paul Davies derived a limit of roughly 400 entangled particles from the total information content of the observable universe. What is usually left out is that Davies immediately called his own analysis "overly simplistic", and singled out Shor's algorithm as the likely exception, because its input state is "algorithmically simple by definition". Read in full, the argument is weaker support for a hard ceiling than its usual summary suggests.

The third uncertainty is whether Bitcoin can move in time. Migration is measured in years even under optimistic assumptions, and it requires wallets, exchanges, custodians and individual users to act. Regulators have set their own clock. NIST's transition guidance deprecates ECDSA after 2030 and disallows it after 2035, which puts a date on the wider world's move regardless of what Bitcoin decides.

None of this resolves into a yes or a no. It resolves into a shape: a specific, well-understood exposure in one part of the system, a measurable population of coins at risk, a defence that is designed but not deployed, and a machine that does not exist and may or may not be buildable. The longer analysis of how those numbers move works through what the trend lines actually support, and a separate essay asks the question underneath all of it, which is whether replacing a signature scheme would change Bitcoin at all.