Can Quantum Computers Actually Break Bitcoin?

Quantum computing is one of the first objections newcomers raise about Bitcoin. The standard answer goes something like this: no such machine exists yet, it is ten to twenty years away, and Bitcoin will have upgraded by then.

That answer is not wrong, but in 2026 it is no longer enough. Over the past year the estimated resources needed for the attack fell not by a factor of two but by nearly twenty. Two proposals addressing the quantum threat have landed in the Bitcoin repository. And one of them puts a question on the table that Bitcoin has never had to answer before: what do we do about coins nobody moves?

Let us be precise about this.

There are two threats, not one

Quantum computing touches Bitcoin along two completely separate lines. Conflating them is where most discussions go wrong immediately.

Shor's algorithm targets signatures. Bitcoin's proof of ownership rests on the difficulty of the elliptic curve discrete logarithm problem: computing a public key from a private key is easy, and reversing it is effectively impossible. Shor's algorithm, on a large enough quantum computer, breaks that assumption. Know the public key, recover the private key. This is the real threat.

Grover's algorithm targets mining and hashing. Here the picture is entirely different. Grover offers only a quadratic speedup - 2^256 becomes 2^128, which is still a cosmically large number. And proof of work has an automatic shock absorber built in: the difficulty adjustment. If quantum miners appear, the network simply raises the difficulty. SHA-256 does not break; a generation of mining hardware changes, which Bitcoin has lived through several times already.

So claims that quantum computers will void the 21 million cap or rewrite the chain rest on very little. The danger lives entirely on the signature side - and more precisely, in public keys that are already visible.

What breaks is not your wallet, it is an exposed public key

This is the heart of the subject, and the part most coverage skips.

A Bitcoin address is not a public key. It is a hash of one. And quantum computers do not invert hash functions. Which means that coins sitting in an address that has never been spent from have no exposed public key at all - there is simply nothing for Shor's algorithm to attack.

The problem is that public keys reach the chain through several doors.

First, P2PK outputs. In Bitcoin's earliest years, mining rewards were paid directly to public keys rather than to addresses. No hash. The public key sits in plain view in the output script, and has done so for over fifteen years.

Second, address reuse. The moment you spend from any address, your signature reveals the public key. Keep using that address, and the remaining balance is guarded by an exposed key rather than by a hash. This is the same habit that privacy guidance has always told you to avoid.

Third, Taproot key path. A P2TR output places the tweaked public key directly in the script. That is by design, and it was an excellent choice for privacy and efficiency - but from a quantum perspective it means the balance is exposed from the moment it is created.

How much is exposed

Estimates vary by source, but they agree on the order of magnitude.

Glassnode's May 2026 count put it at 6.04 million BTC, or 30.2% of issued supply. That figure splits into two very different categories: 1.92 million BTC of structural exposure (P2PK and similar) and 4.12 million BTC of operational exposure from address reuse. BIP-361 itself states that over 34% of the supply has exposed public keys, and tallies from Google researchers and Coinbase's advisory board land in the 6.5 to 7 million range.

The spread comes down to methodology - how broadly you define reuse, whether provably burned outputs are excluded, how lost coins are handled. Millions of BTC move between estimates depending on those choices. But no methodology moves the conclusion far from "roughly 30% of supply."

One chunk inside that total is especially hard to deal with: roughly 1.7 million BTC in Satoshi-era P2PK outputs. These coins have not moved in fifteen years. Nobody knows whether their owners are alive or still hold the keys. They are, in practical terms, coins that no one can move to safety - and the entire debate that follows is really a debate about them.

The short window: the mempool

Coins hiding behind a hash are safe only until they are spent. The act of spending reveals both a signature and a public key.

Between broadcast and confirmation there is a gap of minutes to tens of minutes. In principle a fast enough quantum computer could take the public key visible in the mempool, recover the private key, and race a competing transaction with a higher fee in front of yours. RBF and the fee market are open to attackers on exactly the same terms.

BIP-360 explicitly acknowledges that it does not protect against this shorter-duration attack. In fairness, this attack is also far harder than the long-exposure kind: it has to finish in minutes rather than years.

So how long do we have?

On 31 March 2026, a paper from Google's Quantum AI team moved the baseline substantially. Craig Gidney and colleagues estimated that the 256-bit elliptic curve discrete logarithm problem can be solved with fewer than 1,200 logical qubits and under 90 million Toffoli gates. On superconducting hardware at a 1e-3 physical error rate, that circuit runs in minutes on fewer than half a million physical qubits. The previously accepted threshold was 2,330 logical qubits or more - close to a twentyfold reduction.

Where does the hardware actually stand? QuEra's result published in Nature in January 2026 holds the current record at 96 verified logical qubits, and the Microsoft-Quantinuum H2 system demonstrated 12 logical qubits at roughly a 1e-3 logical error rate. Two to three orders of magnitude still separate what exists from what the attack needs.

The honest conclusion: there is no danger today, but "ten to twenty years" has become a phrase rather than an estimate. That remaining gap is an engineering roadmap, not a law of physics, and the roadmap has been pulling forward for three years running. In any case the precise forecast is not what matters. What matters is that migration must take less time than the threat takes to arrive.

Bitcoin's answer, part one: BIP-360

Written by Hunter Beast, Ethan Heilman, and Isabel Foxen Duke, BIP-360 was submitted in December 2024 and remains in Draft. It defines an output type called P2MR (Pay-to-Merkle-Root), a SegWit version 2 output whose addresses begin with bc1z.

The design is simple: it removes Taproot's key path spend. P2MR behaves almost identically to P2TR but has no internal key, committing only to the Merkle root of the script tree. No public key appears on-chain when the output is created. The cost is witness size - even cooperative spends must take a script path, which makes transactions larger.

One common misreading is worth correcting here. BIP-360 is not a proposal to add post-quantum signatures to Bitcoin. The document says so directly: protection from long-exposure quantum attacks does not depend on activating post-quantum signatures. Those are left to future proposals. Testnet implementations have experimented with ML-DSA signature opcodes inside the P2MR tapscript context, but that is an implementation experiment, not the content of the BIP.

Bitcoin's answer, part two: BIP-361, and a fight about property

The second proposal is where the argument actually is. Submitted in February 2026 by Jameson Lopp and five co-authors, BIP-361 is titled "Post Quantum Migration and Legacy Signature Sunset." The word sunset tells you most of it.

It works in two phases.

Phase A begins three years after activation. Sending funds to quantum-vulnerable addresses becomes disallowed. Existing balances can still be spent, but can no longer receive. It is pressure to migrate.

Phase B arrives two years after that. Verification requirements tighten for ECDSA and Schnorr spends from vulnerable UTXOs.

Press coverage has largely summarized Phase B as "freezing coins." That is imprecise. The BIP describes it alongside quantum-safe rescue protocols - the idea being to exploit knowledge asymmetries that only a legitimate owner has, such as BIP-32 hardened derivation paths, so that a real owner can prove ownership where a quantum attacker cannot. What remains true is that those protocols are not finished, and that either way, coins not moved by the deadline stop being spendable the old way.

The case in favor runs like this. Do nothing, and those six million coins eventually belong to whoever builds the first capable quantum computer. A flood of stolen coins hitting the market damages the property of people who did migrate. Putting an expiry date on a signature algorithm is not confiscation; it is the kind of rule update the protocol has always performed. And because Bitcoin's consensus process is slow, a clear time-boxed path may be the only defense that actually works.

The case against is not weaker. It attaches an expiration date to "your keys, your coins." Coins belonging to people who are offline, imprisoned, dead, or simply unwilling to move would be lost. More importantly, once a precedent exists for making specific UTXOs unspendable, invoking that precedent again gets much easier. If private property and censorship resistance are what Bitcoin is for, then an exception made for good reasons is still an exception. That is precisely the lesson of The Blocksize War.

Neither side is free. And this is not a cryptography problem, it is a governance problem. Both proposals are still Draft, and the activation conversation has not begun.

The web is already migrating - why is Bitcoin harder?

People often say that if quantum computers break Bitcoin, they break banks and the internet too. True, but the comparison flatters Bitcoin.

Web and banking cryptography is replaced by changing server configuration. Major browsers and CDNs have already rolled out hybrid post-quantum key exchange, because it can be swapped centrally.

Bitcoin is the opposite. Past balances live permanently on the chain, and the only person who can move any of them is the individual holding that private key. No developer can do it for you. And a meaningful share of those balances has no owner left to do it at all. Structurally, Bitcoin's migration is one of the harder ones, not one of the easier ones.

What to do now

Do this:

• Stop reusing addresses. The habit privacy guidance already recommended turns out to be quantum preparation as well. A large share of that 4.12 million BTC of exposure came from this single habit.
• Check your old addresses. If funds sit in P2PK outputs or in a long-reused address, moving them to a fresh unused address changes their risk category outright.
• Secure your seed phrase. Whatever migration path is adopted, it will require signing a transaction. Coins whose keys are lost were already unmovable long before quantum computers entered the picture.

Do not do this:

• Do not switch to an altcoin marketing itself as quantum resistant. Swapping the signature algorithm does not solve the problem, and those chains face the same migration question eventually. It trades fifteen years of proven network effect and security budget for a slogan.
• Do not rush. Until a standard is settled there is nowhere to migrate to. bc1z is still Draft.

The question that remains

Bitcoin will have to reach consensus twice.

The first is an engineering question: which post-quantum signature scheme. Every candidate produces large signatures, which turns immediately into a question about block space, fees, and the cost of running a node. Hard, but the kind of hard that has answers.

The second is different. What happens to coins nobody moves. There is no technically correct answer here, because the two things being protected - the safety of the network and the absolute property rights of individual holders - point in opposite directions.

Which is why the weight of this subject has little to do with qubit counts. If quantum computing ever takes Bitcoin down, it will most likely not be because the cryptography broke, but because consensus did not arrive in time. Given how Bitcoin has handled hard decisions so far, the answer will come out of a slow and messy process, as it always does. The difference this time is that there is a deadline.