Will Quantum Computers Break Bitcoin?
What a quantum computer actually breaks (and what it doesn't)
"Breaking Bitcoin" conflates two very different attacks, and only one of them is realistic.
Signatures — the real target. Every Bitcoin spend is authorized by an ECDSA or Schnorr signature over the secp256k1 elliptic curve. The security assumption is that deriving a private key from a public key is computationally infeasible. Shor's algorithm breaks exactly that assumption: on a large fault-tolerant quantum computer, recovering a private key from a public key becomes a matter of hours, not billions of years. Anyone whose public key is visible on-chain could have their coins spent by an attacker.
Mining — mostly a non-issue. Bitcoin mining is SHA-256 hashing, and hash functions are far more resistant to quantum attack. Grover's algorithm offers only a quadratic speedup — roughly halving effective security — which is why serious analyses focus on signatures, not proof-of-work. A quantum computer will not "mine all the bitcoin."
How many coins are exposed right now?
Bitcoin has partial protection by design: modern addresses are hashes of public keys, and the key itself is only revealed when you spend. But that protection has holes:
- Early pay-to-public-key outputs — including the coins attributed to Satoshi Nakamoto — expose the raw public key permanently.
- Reused addresses reveal their public key on first spend; any balance left behind or sent back is attackable.
- In-flight transactions reveal the key when broadcast, opening a (harder) race-attack window before confirmation.
Deloitte's analysis of the Bitcoin blockchain estimates that around 25% of all bitcoin sits in outputs with exposed public keys. Those coins are "harvest-now-decrypt-later" targets: nothing needs to be recorded or intercepted, because the blockchain itself is the permanent public record of every key.
The timeline: what the numbers say in 2026
The honest framing is a race between quantum engineering and cryptographic migration:
| Milestone | Status |
|---|---|
| Largest superconducting chips | ~100–1,000 physical qubits (Google's Willow: 105) |
| Qubits needed to threaten secp256k1 | Recent estimates have fallen ~20× — reported at under 500,000 physical qubits, down from ~20 million in 2019-era estimates |
| Error correction | The real bottleneck: attacks need millions of gate operations on stable logical qubits, which no machine can run today |
| Post-quantum standards | Done — NIST finalized FIPS 203/204/205 in August 2024 |
Two things are simultaneously true: nobody credible claims Bitcoin breaks this decade's hardware, and the required-resource estimates keep moving in only one direction — down. The U.S. government's own migration deadline for classical public-key cryptography in national security systems is the 2030s. Blockchains face a harsher version of the same deadline, because their exposure is retroactive.
Why blockchains have it worse than banks
Bitcoin's likely path is a soft-fork migration to post-quantum signatures, an upgrade debate that has already begun in the developer community. It is solvable — but it requires every holder to actively move coins to new address types, and coins whose owners are absent (or deceased, or Satoshi) can never migrate. What happens to those coins is one of the genuinely unresolved questions in Bitcoin's future.
What a post-quantum blockchain looks like today
The cryptography is not speculative. NIST's post-quantum standards — finalized in 2024 — include SLH-DSA / SPHINCS+ (FIPS 205), a stateless hash-based signature scheme, and XMSS (SP 800-208), a stateful one. Hash-based signatures rely only on the security of hash functions — the same assumption Bitcoin's mining already depends on — and are considered quantum-resistant with today's knowledge.
Byze is a working example of that approach on a live mainnet: a Bitcoin-derived UTXO Layer-1 where every transaction carries dual post-quantum signatures (XMSS + SPHINCS+) instead of ECDSA, paired with RandomX CPU-friendly proof-of-work so ordinary computers can mine it. The trade-offs are real — hash-based signatures are larger than ECDSA's 64–72 bytes, and stateful schemes like XMSS demand careful key management — but they're engineering costs, not open research questions. Ethereum, for comparison, has post-quantum work on its roadmap agenda; chains built post-quantum from genesis simply don't carry the migration debt.
FAQ
- Can a quantum computer break Bitcoin today?
- No. Breaking Bitcoin's signatures needs millions of error-corrected operations; today's chips have ~100 physical qubits and can't run circuits that deep. The threat is future — but concrete enough that NIST has already standardized the replacements.
- What does a quantum computer attack — mining or wallets?
- Wallet signatures. Shor's algorithm derives private keys from exposed public keys. Mining (SHA-256) only faces Grover's quadratic speedup, which halves security rather than destroying it.
- How many bitcoins are vulnerable?
- Roughly 25% of supply, per Deloitte — early pay-to-public-key coins plus reused addresses, all with permanently exposed public keys.
- What is harvest-now-decrypt-later?
- Recording encrypted data or public keys today to attack them once hardware catches up. Blockchains are maximally exposed: the public ledger is the harvest.
- Are any blockchains already quantum-resistant?
- Yes — chains using NIST-standardized hash-based signatures. Byze runs XMSS + SPHINCS+ on every transaction on a live mainnet.
Sources: Aggarwal et al., "Quantum attacks on Bitcoin" (arXiv:1711.04235) · Deloitte, Quantum computers and the Bitcoin blockchain · NIST Post-Quantum Cryptography project (FIPS 203/204/205) · Forbes, Google research on quantum resource estimates (2026) · River Learn, Will quantum computing break Bitcoin?