The Short Answer
Bitcoin is not at risk from quantum computers today, and it is unlikely to be for years. No quantum computer that exists comes close to the scale and reliability required to break the cryptography that secures bitcoin. Getting there would take several major engineering breakthroughs, not just incremental progress.
The answer has two parts. The threat is genuine: the math that quantum computers are good at happens to be the same math that protects Bitcoin ownership. And the threat is distant and addressable: experts place a capable machine at least a decade out, and the network has a well-understood way to upgrade its defenses before that day arrives. The goal of this article is to give you both halves of that picture so you can judge the risk for yourself.
Why This Question Keeps Coming Up
Every few months a research milestone makes headlines, often phrased as "quantum computer could break Bitcoin." These reports usually describe a demonstrated qubit count, which is not the same as a working attack. A machine can have thousands of physical qubits and still be unable to run the algorithm that would threaten bitcoin, because those qubits are noisy and need extensive error correction to do useful work. Demonstrated hardware is a long way from functional cryptographic attack.
What Quantum Computers Actually Threaten
Bitcoin relies on two different kinds of cryptography, and quantum computers affect them very differently. Understanding which is which is the key to understanding the real risk.
Shor's Algorithm vs. Bitcoin's Signatures
Ownership of bitcoin is proven with digital signatures. When you spend, your wallet produces a signature using your private key, and the network checks it against your public key. Bitcoin uses two signature schemes built on elliptic curve cryptography: ECDSA, used by legacy and SegWit version 0 outputs, and Schnorr (BIP 340), used by Taproot outputs since 2021. Both depend on a problem that is easy to verify and, for ordinary computers, effectively impossible to reverse: deriving the private key from the public key.
This is exactly the kind of problem a large quantum computer is suited to. Shor's algorithm, run on a sufficiently powerful and error-corrected quantum machine, could recover a private key from its corresponding public key. If an attacker could do that, they could forge a signature and move bitcoin that was protected by that key. The quantum threat to Bitcoin works at the level of individual keys: any key whose public key is exposed becomes recoverable, while the network itself keeps running normally.
Grover's Algorithm vs. SHA-256
The other half of Bitcoin's cryptography is hashing, built on SHA-256. Hashing secures proof-of-work mining, links blocks together, and is part of how addresses are derived. The quantum algorithm that applies here is Grover's algorithm, and it is far weaker against this target.
Grover's algorithm offers only a quadratic speedup. In practical terms, it could reduce the effective security of SHA-256 from 256 bits to roughly 128 bits. That sounds like a large cut, but 128-bit security is still well beyond any feasible brute-force attack for the foreseeable future. Mining and the hash-based structure of the chain are therefore far less affected by quantum progress than signatures are. If quantum computers ever did erode SHA-256 meaningfully, the network could migrate to a stronger hash function through Bitcoin's consensus upgrade process. The pressing concern is signatures, not hashing.
| Component | Cryptography | Quantum algorithm | Severity |
|---|---|---|---|
| Ownership / signatures | ECDSA and Schnorr (elliptic curve) | Shor's algorithm | The main concern: a large machine could recover private keys from exposed public keys. |
| Mining and hashing | SHA-256 | Grover's algorithm | Much smaller: only a quadratic speedup, leaving roughly 128-bit security intact. |
Which Bitcoin Addresses Are at Risk
Not every address carries the same exposure. The deciding factor is whether the public key is visible. A quantum attacker needs your public key to attempt recovery of your private key, so the question becomes: when does your public key become visible, and for how long? The answer depends on your address type and on whether you reuse addresses.
Taproot Addresses Are at Risk Once Funded
Taproot addresses, the modern bech32m format that begins with bc1p, are a special case. A Pay-to-Taproot (P2TR) output exposes a version of the public key as soon as the address is funded, before you ever spend from it. The key is part of the output itself. That means a P2TR balance sitting on the chain is at risk from the moment it receives funds, and it stays that way until a quantum-safe spending path such as the BIP 360 proposal or an equivalent upgrade activates.
This is the opposite of how many people assume newer addresses behave. Taproot brought real benefits for privacy, efficiency, and scripting, but in the specific context of quantum exposure, a funded P2TR address is in the at-risk category, not the hidden one.
Older Formats Hide the Key Until You Spend
The older address formats behave differently. P2PKH (legacy, beginning with 1), P2SH (beginning with 3), P2WPKH and P2WSH (the SegWit version 0 formats beginning with bc1q) do not put your public key on the chain when they receive funds. Instead, they commit to a hash of the public key. While the funds sit untouched, only that hash is visible, and a hash does not give a quantum attacker what they need.
The exposure for these formats comes at spend time. When you spend from one of them, your transaction reveals the full public key so the network can verify your signature. That public key first appears in the mempool, the holding area for unconfirmed transactions, and only later gets recorded on-chain when the transaction confirms. The protection these formats offer lasts only until the first spend.
Mempool Exposure vs. On-Chain Exposure
It helps to keep two states separate, because one exposure is temporary and the other is permanent.
- Mempool exposure is the window between broadcasting a spend and its confirmation. During this window the public key is visible to anyone watching the network, but the transaction is not yet settled. In principle a fast enough quantum attacker could try to recover the key and race a competing transaction before confirmation. This window is short, and no machine capable of winning that race exists.
- On-chain exposure is the lasting state: the public key is permanently recorded in a confirmed transaction. This is the situation for any funded Taproot address and for any older address you have already spent from and then reused.
The single worst habit for quantum exposure, and for privacy generally, is address reuse. If you spend from an address and then receive more bitcoin to the same address, you are leaving a balance behind an already-revealed public key. That balance no longer enjoys the "hidden until spend" protection.
| Address type | Public key exposed? | When |
|---|---|---|
P2TR (Taproot, bc1p) |
At risk | As soon as the address is funded, before any spend, until a quantum-safe path activates |
| P2PKH, P2SH, P2WPKH, P2WSH | Hidden until you spend | Public key enters the mempool at spend time, then is recorded on-chain |
| Any reused address | At risk | Permanently, once spent from, for any balance left behind |
The Realistic Timeline
How worried should you be, and on what schedule? The most honest answer is that the timeline is deeply uncertain, and anyone claiming a precise date is guessing. What can be said is qualitative and grounded.
What Today's Machines Can and Cannot Do
Quantum hardware has advanced quickly, and headline qubit counts keep climbing. The number that matters for Bitcoin, though, is not raw physical qubits but error-corrected logical qubits running a useful algorithm. Physical qubits today are noisy, and turning many noisy physical qubits into a few reliable logical ones is an unsolved engineering problem at the scale a Bitcoin-breaking attack would require. A demonstrated qubit count measures hardware, not functional cryptographic capability.
Expert Consensus and Migration Horizons
Across the field, the common estimate places a cryptographically relevant quantum computer at least a decade away, with progress in error correction lagging progress in qubit count. That uncertainty cuts both ways, which is why standards bodies have started setting migration deadlines rather than waiting for certainty.
The U.S. National Institute of Standards and Technology (NIST) has published deprecation targets for the affected cryptography, including ECDSA, that begin near the end of this decade. Google's quantum team has publicly recommended similar migration horizons for sensitive systems. These are not predictions that bitcoin will be broken on a date. They are deadlines for moving sensitive systems to new cryptography well ahead of any plausible attack, on the principle that migration takes years and should start early. For Bitcoin, the same logic applies: the time to research and propose upgrades is now, while no machine threatens the network.
What Holders Can Practically Do
There is nothing you need to do today out of panic, and you should be skeptical of any product or service that tells you otherwise. There are, however, simple habits that reduce your exposure at no cost, and they are worth adopting now.
Avoid Address Reuse
Use a fresh address for each incoming payment. Modern wallets do this automatically by generating a new address every time you receive. Reusing an address is the main way holders leave funds behind an already-exposed public key, so letting your wallet rotate addresses for you is the single most effective habit. It improves your on-chain privacy at the same time.
Do Not Leave Funds on Spent-From Addresses
If you have spent from an address in the past, treat any remaining or future balance on it as more exposed than a fresh one. When you move funds, and where your wallet allows it, send the full balance to a new address rather than leaving change behind on the old one. Sweeping older, reused addresses into fresh ones over time is a reasonable hygiene step, not an emergency.
Keep Bitcoin in Self-Custody So You Can Act
The practical defense against a future threat is the ability to move quickly when migration paths arrive. That ability depends on holding your own keys. If your bitcoin sits with a custodian, you inherit the custodian's migration timeline. With a self-custodial wallet such as the Blockstream app, paired with a Jade Plus hardware wallet, you keep the keys and the freedom to upgrade your holdings to a quantum-safe spending path as soon as the network offers one.
None of this requires acting today. The point is to be positioned to act, with good habits already in place, rather than scrambling later.
How Bitcoin Can Upgrade to Resist Quantum Computers
Bitcoin is not frozen in place. It has changed before through a deliberate, consensus-driven process, and the same process is how it can add quantum-resistant defenses. That process is careful by design, which is a strength when the stakes are this high.
Post-Quantum Signatures and the Proposal Process
Changes to Bitcoin start as Bitcoin Improvement Proposals (BIPs), published openly and debated by developers, miners, node operators, and the wider economic network. A quantum-resistant upgrade would follow the same path: a proposed new spending path using post-quantum signatures, reviewed in public and adopted only if it reaches broad consensus. The BIP 360 proposal is one published effort to define a quantum-resistant output type, and others may follow. For more on how this works, see how Bitcoin upgrades work.
The standardized building blocks already exist. In August 2024 NIST finalized two post-quantum signature schemes, ML-DSA and SLH-DSA, alongside one key encapsulation mechanism, ML-KEM. Several earlier candidate schemes were broken during the standardization process, which is the point of running an open competition: weaknesses surface before deployment rather than after it. Bitcoin can draw on this vetted work rather than inventing new cryptography from scratch.
Blockstream Research and Where the Work Is Happening
Blockstream Research, working with external co-authors, is among the groups studying how a post-quantum signature scheme could fit Bitcoin's constraints. One line of that research is a hash-based design whose only cryptographic assumption is the security of SHA-256, the same hash function Bitcoin already relies on for proof-of-work, address derivation, and Merkle trees. Reusing an assumption Bitcoin already trusts, rather than introducing a new and less-tested primitive, is a deliberate feature of that approach. A proposed concept named SHRINCS, under active research, explores this direction; it is a research effort with open questions, not a finished proposal or a scheduled release.
Blockstream cannot merge changes into Bitcoin on its own. No single party can. Blockstream can propose BIPs, collaborate with the wider community, and build and test approaches on the Liquid Network, a Bitcoin layer-2, where new cryptography can ship as a smart contract without a network-wide consensus change on Bitcoin itself. That makes Liquid a useful venue for proving out post-quantum designs ahead of any Bitcoin upgrade. For the full picture of the research and the open questions, the deeper resource is blockstream.com/quantum.
Why the Careful Pace Is a Feature
Bitcoin's upgrade process is deliberate. Changes require wide agreement and extensive review, which means the network does not rush in new cryptography on a whim. For an asset whose value rests on getting security right, that caution is what ensures a quantum-resistant upgrade will be thoroughly vetted before it protects real funds.
Frequently Asked Questions
Will quantum computers break Bitcoin?
Not in the foreseeable future. No quantum computer today comes close to breaking the cryptography that secures bitcoin. A machine capable of that would need many more high-quality qubits and far better error correction than anything demonstrated, which requires several major engineering breakthroughs rather than steady progress. If hardware ever does reach that point, Bitcoin can adopt quantum-resistant signatures first, and standards bodies are already setting migration deadlines for the affected cryptography.
Is Bitcoin quantum resistant today?
Bitcoin is not fully quantum resistant today. The digital signatures that protect bitcoin (ECDSA and Schnorr) rely on elliptic curve cryptography, which a large, error-corrected quantum computer could break in theory using Shor's algorithm. The SHA-256 hashing behind mining is far less affected, since Grover's algorithm offers only a quadratic speedup. Developers are actively researching post-quantum signature schemes the network could adopt through its upgrade process to close this gap.
Which bitcoin addresses are at risk from quantum computers?
Taproot (P2TR) addresses expose a version of the public key as soon as they are funded, so they are at risk before any spend, until a quantum-safe spending path activates. Older formats (P2PKH, P2SH, P2WPKH, P2WSH) hide the public key behind a hash until you spend from them, at which point the key enters the mempool and is then recorded on-chain. Reused addresses are the most exposed, because any balance left behind sits behind an already-revealed key.
How soon could quantum computers threaten Bitcoin?
Most experts place a cryptographically relevant quantum computer at least a decade away, with wide uncertainty and error correction lagging behind qubit count. NIST has published deprecation targets for the affected cryptography that begin near the end of this decade, and Google's quantum team has recommended similar migration horizons. These are deadlines for migrating sensitive systems early, set as a precaution rather than as a forecast of any specific attack date, so planning now is prudent even though no machine threatens bitcoin today.
What can I do to protect my bitcoin from quantum computers?
Avoid address reuse, do not leave a balance on an address you have already spent from, and keep your bitcoin in self-custody so you can move it quickly when migration paths arrive. Modern wallets rotate receiving addresses automatically, which handles most of this for you. There is nothing you need to do urgently today, and you should be wary of anything that claims otherwise, but these habits reduce exposure and cost nothing to adopt now.
How could Bitcoin upgrade to resist quantum computers?
Through the same open proposal process used for past upgrades. A developer can publish a Bitcoin Improvement Proposal for a post-quantum spending path, such as the BIP 360 proposal, and the network can adopt it if it reaches broad consensus. The signature building blocks already exist as NIST-standardized schemes, and Blockstream Research, with external co-authors, is studying hash-based designs that rely only on SHA-256, an assumption Bitcoin already trusts.