Can Quantum Computers Break Bitcoin? What Quantum Computing Means for Your BTC

Not today, and not with any machine publicly known to exist. No quantum computer built so far can derive a Bitcoin private key, and the Willow chip Google announced in December 2024 has 105 physical qubits, the raw building blocks of a quantum computer. Google's own researchers estimate an attack would need fewer than half a million, which is still thousands of times more. What changed in 2026 is how fast that gap is closing. In March a Google Quantum AI research paper cut the estimated hardware needed to break Bitcoin's keys nearly twentyfold, and counted about 6.9 million BTC, roughly a third of the supply, sitting at addresses whose public keys are already visible on the blockchain.

So the short answer has three parts. The real threat is to the digital signatures that prove you own your coins, not to mining. It is easiest against coins whose public key is already exposed, which most holders can avoid, though on the fastest machine designs coins being spent would be at risk at about the same time, and only a network upgrade fixes that. And the fix exists on paper, in the form of post-quantum signatures, new signature types built to withstand quantum computers, but Bitcoin has not yet agreed which one to adopt or when. That coordination problem, more than the physics, is what a long-term holder should be watching.

Most of that exposed third is made up of coins from Bitcoin's first years and coins at addresses that have already sent payments, a large share of them at exchanges. If your own coins sit at an address starting bc1q, 1 or 3 that you have never sent from, their public key is most likely not on the blockchain yet, and the checklist near the end covers the exceptions.

What a quantum computer would actually attack

Bitcoin leans on two different kinds of cryptography, and quantum computers threaten them very differently.

The first is the hash function SHA-256, a one-way function that turns any data into a fixed-length fingerprint. Miners grind through it to produce blocks, and most address formats use it to store a fingerprint of your public key rather than the key itself. The second is the digital signature scheme, ECDSA, joined by Schnorr signatures since the 2021 Taproot upgrade, both built on an elliptic curve called secp256k1. Your private key produces signatures, and your public key lets anyone check them. Ownership of bitcoin rests on one assumption, that nobody can work backwards from a public key to the private key that made it.

For ordinary computers that assumption holds comfortably. A large quantum computer able to correct its own errors, running Shor's algorithm, would break it, because Shor's algorithm solves the underlying elliptic curve problem efficiently. Anyone with such a machine and your public key could compute your private key and sign your coins away, and since Bitcoin transactions cannot be reversed, there would be no one to appeal to.

Mining is a different story. The quantum tool for hash functions is Grover's algorithm, which offers only a quadratic speedup. The Google paper argues this is not something to worry about for decades, because error correction overheads all but consume the speedup and Grover's algorithm does not parallelise well. Even under what the authors call a fantastical assumption about hardware speed, they put a quantum miner at about 0.25 TH/s, more than a hundred times slower than a single S19 Pro mining rig at roughly 110 TH/s. Mining is secured by raw computing work rather than by signatures, so it is the part of the system quantum computing barely touches.

Which bitcoin is exposed, and how much

Everything comes down to one question. Can an attacker see your public key, and for how long?

Researchers split the risk into two windows. In a long exposure attack, on coins at rest, the public key is already sitting on the blockchain, so an attacker has unlimited time to work on it, and even a slow quantum computer would eventually get there. In a short exposure attack, on coins being spent, the target is a transaction in flight. When you send bitcoin, your public key is broadcast with the transaction and sits in the public mempool, the waiting room for unconfirmed transactions, until a miner includes it in a block, about ten minutes on average. An attacker would have to derive your key and push a competing transaction inside that window. The Google paper estimates that a fast superconducting quantum computer, prepared in advance, could derive a key in about nine minutes. If such a machine existed, it would succeed against a typical single-signature transaction a little under 41% of the time under idealised assumptions. In principle every coin is exposed this way at the moment it moves, which is why the network as a whole eventually has to change its signatures.

Long exposure is the part you can do something about, and it depends on the address type.

The early P2PK outputs are the famous problem, because those coins are locked straight to the public key rather than to a fingerprint of it. They hold a little over 1.7 million BTC according to the Google paper, including coins from the earliest mining era, and coins believed to belong to Satoshi Nakamoto account for about a million of them. Most of those coins have not moved since 2009 and their keys are widely assumed lost, which means nobody can migrate them to safety. Taproot is the more surprising entry. Its bc1p addresses publish a version of the public key directly, which the Google authors describe as a security regression from a quantum point of view, even though Taproot improved privacy and flexibility in other ways.

Address reuse turns the safer formats into exposed ones. A bc1q address hides its public key only until you spend from it. If you spend part of the balance and leave the rest at the same address, the key is now public and the remaining coins carry long exposure risk. Reuse is also common among large services, and the paper links some of the largest exposed balances to big exchanges.

Several research groups have counted these coins, and somewhere between 6 and 7 million BTC, roughly 30 to 35% of all bitcoin, sits at addresses whose public key is already on display. The figures below differ because each study counts slightly differently and on a different date, not because coins have been moving in or out of the group.

Glassnode's split is the useful one for a holder. It counts 1.92 million BTC as structurally exposed, meaning the address type itself shows the key, as with the early P2PK coins and Taproot, and 4.12 million BTC as operationally exposed through reuse, partial spending or custody habits, about 1.6 million BTC of it linked to exchanges. Most of the exposure, in other words, comes from behaviour rather than from the protocol, and behaviour can change before any quantum computer arrives. By Google's count, about 2.3 million of its 6.9 million exposed coins sit at addresses that have not spent anything in at least five years, and those are the coins most likely to be left behind in any migration.

How close is a quantum computer that could do it

The number that matters is not how many qubits a chip has, but how many reliable ones it can run a long calculation on. Physical qubits are noisy. Error correction bundles many physical qubits into one logical qubit that behaves reliably, and an attack on Bitcoin needs logical qubits running tens of millions of operations without failing.

The Google paper, first published on 30 March 2026, estimates that breaking a 256-bit elliptic curve key needs either fewer than 1,200 logical qubits and 90 million of the costly operations known as Toffoli gates, or fewer than 1,450 logical qubits and 70 million of them. On a superconducting chip with error rates like Google's current processors, the authors put that at fewer than half a million physical qubits running for minutes, nearly a twentyfold drop, by Google's own comparison, from a 2023 estimate by quantum researcher Daniel Litinski for a different, photonic design. Google did not publish the attack circuit itself. It released a zero-knowledge proof that lets outsiders verify the estimate without learning how to run the attack, a sign of how seriously its researchers now take the risk.

Against that, today's hardware is small. Willow's 105 qubits matter because Google showed errors falling as the system scaled, which is the property a large machine needs, not because 105 qubits can attack anything. IBM's roadmap aims to deliver a machine called Starling by 2029 with 200 logical qubits, about a sixth of the logical qubits in Google's estimate, and the same announcement describes a later system, Blue Jay, with 2,000. The comparison is rough, since the two companies build different architectures and count operations differently, but it shows that a machine of the size an attack needs already sits on a published roadmap.

Expert opinion spans a wide range. The Global Risk Institute's timeline report, published in March 2026, asked 26 quantum computing experts how likely a machine able to break RSA-2048, a widely used encryption standard, within 24 hours is over different horizons. Published estimates suggest Bitcoin's curve needs a smaller machine than that, so the survey is if anything a conservative guide. Averaged across the experts, the chance within ten years comes out at 28% to 49% and within 15 years at 51% to 70%, earlier than in previous surveys. At the calmer end, asset manager CoinShares argued in February 2026 that the relevant technology was at least ten years off and that attacks on coins being spent were decades away. Less than two months later the Google paper argued that a fast quantum computer able to attack exposed coins would likely be able to attack coins being spent too.

You will also see headlines saying Google expects quantum computers to break Bitcoin by 2029. That is a misreading. In March 2026 Google set 2029 as the deadline for its own migration to post-quantum cryptography, under the title "Quantum frontiers may be closer than they appear". It is a planning deadline, not a forecast of the day a machine works. The Google paper also warns that progress tends to come in jumps, so the first sign that a working machine exists might be coins moving on the blockchain rather than an announcement.

The fair summary is that no one can name the year with confidence. In the survey, half of the experts put the odds at about even or better within a decade, most called it likely within 15 years, and the estimates of what an attack requires keep falling.

How Bitcoin would defend itself

The cryptography already exists. In August 2024 NIST published its first three post-quantum standards, FIPS 203 for encryption and two signature schemes, ML-DSA in FIPS 204 and the hash-based SLH-DSA in FIPS 205. Bitcoin needs signatures, so the last two are the relevant ones.

The problem is size. A Schnorr signature is 64 bytes. Even in its smallest standard form an SLH-DSA signature is nearly 8 kilobytes, and Blockstream's Jonas Nick estimated in May 2026 that blocks filled with them would carry about 0.36 transactions per second instead of 6.5. Compact hash-based designs such as Blockstream's SHRINCS aim to bring everyday signatures down to about 580 bytes, with larger ones kept for backup and recovery, but the same post opens with a plain admission, "There is no concrete proposal for a post-quantum signature scheme in Bitcoin today." As of 1 November 2026 the list of Bitcoin Improvement Proposals (BIPs), the formal documents through which changes to Bitcoin's rules are proposed, still includes no numbered post-quantum signature proposal.

What it does list are two drafts that prepare the ground. BIP-360, Pay to Merkle Root, would add a new address type that keeps Taproot's features but never puts the public key on chain. Its authors are explicit that it protects coins at rest only, and that protecting coins being spent will need post-quantum signatures later. BIP-361, Post Quantum Migration and Legacy Signature Sunset, whose authors include Jameson Lopp, goes further. Once a post-quantum output type exists, its first phase would stop anyone sending coins to vulnerable addresses about three years after activation, and a second phase two years later would restrict spending with today's signatures behind a quantum-safe rescue process. In plain terms, coins still at old address types about five years after activation could no longer be spent the normal way, and the authors say no such rescue is currently known for the earliest P2PK coins. It also depends on a post-quantum signature proposal that has not been written yet.

Then there are the coins nobody can move. Bitcoin's options for lost P2PK coins boil down to doing nothing and letting whoever builds a quantum computer take them, burning them by making them unspendable after a deadline, or slowing their release. The Hourglass proposal takes the third route, limiting P2PK spends to one per block and, in its 2026 revision, to one bitcoin per block. Each option offends someone. Burning breaks the principle that nobody can confiscate your coins, while doing nothing risks a supply shock if a million or more long-dormant coins return to the market.

Any of these changes would most likely come as a soft fork, which tightens the rules so that older software still follows the chain, but a soft fork still needs broad agreement among developers, miners, businesses and node operators. Bitcoin moves slowly by design. Chaincode Labs counts about seven and a half years from the first ideas behind Taproot to its activation in 2021, and estimates roughly two years for an emergency contingency plan and about seven for a full migration path. Even after activation, the Google paper notes that moving every coin to new addresses would take several months of block space if the network did nothing else. That lead time, more than any single hardware milestone, is why researchers are urging the work to start now.

What you can do as a BTC holder today

Most of the useful steps are ordinary good practice that predates quantum concerns, and none of them requires selling anything.

Start by knowing what you hold. Your wallet shows your receiving addresses, and the first characters tell you the format, though many wallets show an account type instead, Native SegWit for bc1q and Taproot for bc1p. Coins in a bc1q, 1 or 3 address that has never sent a transaction have no public key on the Bitcoin blockchain, with two exceptions that are easy to miss. If you held coins before a chain split such as the 2017 Bitcoin Cash fork and claimed the forked coins with the same keys, those public keys are visible on the other chain. And signing a message to prove you own an address, which some services ask for to verify a wallet, reveals the key to whoever receives the signature. Coins in a bc1p Taproot address show their key from the moment they arrive. If long exposure is the thing that worries you, the Google authors suggest that sticking to bc1q addresses and avoiding Taproot for storage protects coins at rest, though not coins being spent.

Avoid address reuse. Modern wallets use a fresh address for every payment you receive and for change, so the main risks come from old habits, such as receiving payments to one fixed address and spending from it over time, or an old wallet that sent change back to the address it spent from.

If you want a short list for this week, it is this. Paste each address that still holds coins into a block explorer, a public website that shows any address's history. If it shows an outgoing payment and still holds a balance, or one of the exceptions above applies, send that balance to a fresh, never-used bc1q address in your own wallet, which closes the exposure for now. Savings at a bc1p address can move to a bc1q address the same way, for the cost of one network fee. Moving coins today is safe, because the brief exposure during a spend only matters once a large quantum computer exists. After that, nothing else is needed until a post-quantum address type is available.

Be careful who sees your extended public key, often shown as an xpub. Portfolio trackers and some services ask for it so they can watch every address in a wallet. Today that is mainly a privacy issue, but the Google paper points out that a future quantum attacker who obtained it could go after many keys from one wallet at once. Share it only with tools you trust.

Keep the bigger risks in view. Phishing, leaked seed phrases and fake wallet apps cost holders money every day, while quantum attacks cost them nothing yet. The basic precautions protect you today and will still matter after any quantum upgrade.

If your bitcoin sits with a custodian, an exchange or a yield platform, the keys are theirs to manage and so is the migration. That makes two fair questions to ask any custodian. Do they reuse deposit or storage addresses, and what is their plan for moving to post-quantum addresses once Bitcoin supports them? The same applies to wrapped bitcoin on other chains. The Google paper names bridge administrator keys, which control the coins locked behind wrapped tokens, among the keys a quantum attacker could target.

Finally, watch the right signals rather than the headlines. A formal, numbered proposal for post-quantum signatures, BIP-360 or BIP-361 moving beyond draft, wallets adding support for new address types, and published progress on logical qubits from Google, IBM and others are all worth more attention than any single dramatic claim. When a new quantum-resistant address type is activated, moving your coins to it will be the step that matters most, and once post-quantum signatures follow, a second move may be needed.

Holding BTC for the long haul

For most holders the quantum question argues for patience and good hygiene rather than panic, and it is one risk among several in any long-term outlook for BTC. It also sits inside a choice every long-term holder makes anyway, between self-custody, where the steps above stay in your own hands, and a platform that holds the keys and puts the coins to work. Both suit different holders, and our BTC yield guide compares the main platform options.

EarnPark's BTC Alpha Vault strategy publishes up to 10% APY as of November 2026, the top of the range on the BTC page, and you can model a deposit in the BTC calculator. It holds roughly half BTC and half stablecoins, rebalances between them, and earns mainly from trading fees and from taking the other side of traders' positions on perpetual futures markets, which is also why results can be negative. EarnPark labels it Market-Exposed, meaning its results move with the market. In a strong BTC rally it gives up part of the upside you would get from simply holding, in a fall it loses less than BTC does, and the stablecoin half brings its own risks, covered in our guide to stablecoin depegs. It pays out monthly, withdrawals settle once a month, and there is no deposit insurance. As with any custodial service, a deposit hands key management, and with it any future move to post-quantum addresses, to the platform and to the venues and onchain protocols its strategies use. Read our risk statement before you decide.

The bottom line

Quantum computing is a real, long-range engineering problem for Bitcoin, not an imminent catastrophe and not a myth. No publicly known machine can break Bitcoin's signatures, the best published estimates of what it would take keep falling, and the experts who study the field increasingly put meaningful odds on the next ten to fifteen years. The coins most at risk are the ones whose public keys are already public, a group that includes the lost early coins nobody can rescue and a much larger pool exposed by address reuse that their owners can still fix.

Bitcoin's defence will be a slow, political upgrade rather than a sudden patch, and the proposals for it are still drafts. A holder who keeps keys unexposed, avoids reuse, asks custodians the right questions and moves to a post-quantum address type once one exists is doing what the researchers themselves recommend.

If you would rather hold part of your BTC on a platform and have it earn, Start earning once you have read the strategy terms.

FAQ

Can quantum computers break Bitcoin?

Quantum computers cannot break Bitcoin today, because no publicly known machine comes close to the size needed. A large error-corrected quantum computer running Shor's algorithm could in future derive private keys from exposed public keys and steal those coins, which is why Bitcoin will need post-quantum signatures. Bitcoin mining is not realistically threatened.

When will quantum computers be able to break Bitcoin?

When quantum computers will be able to break Bitcoin is unknown, and no one can name the year with confidence. A Global Risk Institute survey of 26 experts, published in March 2026, asked about a machine able to break RSA-2048 encryption within 24 hours and on average put the chance at 28% to 49% within ten years and 51% to 70% within 15 years. Bitcoin's curve likely needs a smaller machine than that. Google's 2029 date is a deadline for its own migration to post-quantum cryptography, not a prediction.

Can Bitcoin be hacked?

Bitcoin's protocol has not been hacked in the sense of anyone breaking its cryptography, and today's computers cannot derive a private key from a public key. Holders lose coins mainly through phishing, stolen seed phrases, malware and failed custodians. A future quantum computer would add a new route, targeting coins whose public keys are visible on chain.

How will Bitcoin protect against quantum computing?

Bitcoin is expected to protect against quantum computing by adopting post-quantum signatures, most likely through a soft fork, and asking holders to move coins to new address types. Draft Bitcoin Improvement Proposals include BIP-360, a new address type that never puts the public key on chain, and BIP-361, which would phase out today's signatures after a migration period. As of November 2026 no post-quantum signature scheme has been formally proposed as a numbered BIP, so the timeline depends on developers and the wider community reaching agreement.

Can quantum computers break Bitcoin mining?

Quantum computers are not expected to break Bitcoin mining. Grover's algorithm gives only a quadratic speedup for hashing, and the Google Quantum AI paper estimates that even an idealised quantum miner would be more than a hundred times slower than a single S19 Pro, a widely used mining rig from 2020. The risk sits with digital signatures, not proof of work.

Should I sell my bitcoin because of quantum computing?

Selling bitcoin because of quantum computing is hard to justify on current evidence, since no machine capable of an attack is publicly known to exist and Bitcoin has time to upgrade if the work starts soon. A more useful response is to check that your coins sit at addresses you have never spent from, avoid exposing your public keys, and move to a post-quantum address type once one is activated. Price swings on quantum headlines are a separate risk from the cryptographic one.