Quantum computing has moved from a distant theoretical discussion into one of the more serious long-term security questions facing Bitcoin.

But much of the public discussion still gets the threat wrong.

A sufficiently powerful quantum computer would not simply “mine every Bitcoin,” instantly rewrite the blockchain or magically guess every wallet’s seed phrase.

The most important quantum vulnerability is much more specific.

It concerns the digital signatures that prove who is allowed to spend Bitcoin.

Bitcoin currently relies on elliptic-curve cryptography for its main signature systems. Legacy and SegWit transactions use ECDSA in relevant spending paths, while Taproot introduced Schnorr signatures under BIP340. Both rely on the security of the secp256k1 elliptic curve and ultimately on the difficulty of the elliptic-curve discrete logarithm problem for classical computers. A sufficiently capable fault-tolerant quantum computer running Shor’s algorithm could change that assumption by deriving a private key from a corresponding exposed public key.

That risk became more concrete in 2026.

A research paper released by researchers affiliated with Google Quantum AI, UC Berkeley, Stanford and the Ethereum Foundation and updated on August 11, 2026 presented substantially optimized resource estimates for attacking the secp256k1 curve used by Bitcoin. The researchers model circuits requiring roughly 1,200–1,450 logical qubits and 70–90 million Toffoli gates. Under a specific modeled superconducting architecture with a physical error rate of 10−3, they estimate that such a computation could potentially run in minutes using fewer than half a million physical qubits.

That does not mean a machine capable of stealing Bitcoin exists today.

It does mean the conversation has changed.

The important Bitcoin security question is no longer whether quantum algorithms could theoretically attack elliptic-curve signatures. That has been understood for years.

The question is now:

Can Bitcoin migrate its spending infrastructure before cryptographically relevant quantum computers become practical?

The Real Quantum Threat Is Bitcoin Ownership Authentication

To understand the problem, it helps to separate Bitcoin’s different cryptographic functions.

Bitcoin uses hashing extensively. SHA-256 is involved in proof-of-work and many other parts of the protocol.

Bitcoin also uses digital signatures to prove that a transaction has been authorized by the holder of a private key.

Those two cryptographic functions do not face the same quantum threat.

Shor’s algorithm is particularly dangerous to public-key cryptography based on discrete logarithms. In Bitcoin’s case, that includes both ECDSA and Schnorr signatures.

If an attacker knows a Bitcoin public key and owns a sufficiently capable quantum computer, the theoretical goal would be to calculate the private key corresponding to that public key.

Once the private key is recovered, the attacker can create what appears to the Bitcoin network to be a valid signature.

From the network’s perspective, the forged transaction is cryptographically legitimate because the protocol has no way of knowing whether the signature came from the original owner or from someone who derived the private key using quantum computation. The August 2026 research describes this as a fundamental disruption of Bitcoin’s present cryptographic ownership model.

That is why quantum computing is primarily a signature-security problem for Bitcoin.

Shor’s Algorithm Does Not Simply “Hack the Blockchain”

It is important not to turn the technical threat into a misleading headline.

A quantum attacker would not necessarily decrypt the entire Bitcoin blockchain.

The blockchain is already public.

They would instead attack the cryptographic relationship between a public key and its private key.

Under normal classical computing assumptions, deriving a secp256k1 private key from its public key is computationally infeasible.

Shor’s algorithm changes the mathematics on a sufficiently capable quantum computer.

That is why public-key exposure becomes so important.

If an attacker does not know the public key, there is nothing for Shor’s algorithm to directly attack through that particular route.

This creates very different levels of quantum exposure across Bitcoin output types.

Not Every Bitcoin Is Equally Exposed to a Quantum Attack

This is one of the most important points missing from many articles about Bitcoin quantum risk.

Some Bitcoin outputs already expose their public key on-chain for long periods.

Others commit only to a hash and do not reveal the public key until the bitcoin is actually spent.

Bitcoin’s current draft BIP360, which proposes Pay-to-Merkle-Root or P2MR, categorizes this distinction as long-exposure versus short-exposure quantum attacks.

A long-exposure attack targets a public key that is already permanently visible.

The attacker can theoretically work on recovering that private key for as long as the coins remain at the vulnerable output.

A short-exposure attack is much harder.

The public key may only become visible when the legitimate owner broadcasts a transaction. A quantum attacker would then need to derive the private key and replace or outrun the original transaction before it confirms.

The time window might be measured in minutes rather than years.

That distinction dramatically changes the quantum resources required.

Old P2PK Bitcoin Is Particularly Important

Some of Bitcoin’s earliest outputs used Pay-to-Public-Key, or P2PK.

In P2PK, the public key is directly stored in the locking script.

There is no hash hiding it.

That means a sufficiently powerful quantum attacker would already have everything required to begin an offline key-recovery attack.

BIP360 explicitly classifies P2PK outputs as vulnerable to long-exposure quantum attacks. It also highlights early mining-era coins as an obvious example.

This is where the quantum issue becomes economically and politically complicated.

Some old BTC may belong to users who still control their keys and could eventually migrate.

Some almost certainly belongs to users who lost access years ago.

Some has remained untouched since Bitcoin’s earliest history.

A quantum computer does not know the difference between:

an intentionally dormant wallet

and

a permanently lost wallet.

If the public key is exposed and the signature system becomes breakable, cryptography alone cannot prove whether the person moving the bitcoin is the original owner.

That creates a governance problem, not merely an engineering problem.

P2PKH Gives Bitcoin a Useful Layer of Protection

Many familiar legacy Bitcoin addresses use Pay-to-Public-Key-Hash, or P2PKH.

Instead of placing the full public key directly in the output, the address commits to a hash derived from the public key.

Until the bitcoin is spent, the underlying public key may remain undisclosed.

BIP360 therefore classifies properly used P2PKH outputs as resistant to the basic long-exposure attack, provided the relevant public key has not already been exposed through address reuse or previous spending behavior.

This is not full post-quantum security.

Once the owner spends those coins, the public key needs to become available so nodes can validate the transaction.

At that point, a sufficiently fast quantum computer could theoretically attempt an on-spend attack.

The August Google-affiliated research describes exactly this scenario: the attacker’s source of the public key becomes the public Bitcoin mempool, and the attacker races to derive the private key before the legitimate transaction is confirmed.

That requires a far more capable machine than simply attacking an exposed public key over months or years.

Address Reuse Makes Quantum Exposure Worse

This creates another reason Bitcoin address reuse is undesirable.

If someone spends from a Bitcoin address and later sends more BTC back to an output associated with the same exposed key material, the public key may already be available from previous blockchain history.

The attacker would no longer need to wait for the next transaction.

They could begin working against the exposed public key while the coins remain stationary.

BIP360 specifically identifies reused outputs as a long-exposure concern.

Quantum computing therefore adds a security dimension to wallet hygiene that previously was discussed primarily in terms of privacy.

Good Bitcoin operational practices cannot make current elliptic-curve signatures permanently quantum-safe.

But they can influence how early particular coins become vulnerable.

Taproot Has an Interesting Quantum Trade-Off

Taproot improved Bitcoin in many areas, but quantum security introduces an unusual trade-off.

A standard P2TR Taproot output commits directly to a public key in a way that makes the key visible before spending.

BIP360 therefore currently classifies P2TR as vulnerable to long-exposure attacks.

This does not mean Taproot is insecure against today’s computers.

It means its public-key structure provides less hiding from a future cryptographically relevant quantum attacker than a properly unused hashed-key output such as P2WPKH.

That is an important distinction.

Taproot’s current cryptography is extraordinarily strong against conventional attackers.

Quantum-resistance analysis asks a different question:

What happens if elliptic-curve discrete logarithms stop being computationally hard?

How Much Bitcoin Is Potentially Quantum-Exposed?

Current research gives different numbers because methodologies and definitions of exposure differ.

The August 2026 Google-affiliated white paper estimates that approximately 6.9 million BTC across the output categories it studied are vulnerable under its exposure methodology at the time of writing.

A separate June 2026 paper, Quantum Horizon, estimated roughly 6 million BTC as quantum-exposed, while arguing that only around 2.3 million BTC may be irreducibly exposed because much of the remaining amount could theoretically be migrated by owners before a practical attack becomes available.

These figures should not be interpreted as:

“six million bitcoins can be stolen today.”

They cannot.

The estimates concern what could become vulnerable if a sufficiently capable cryptographically relevant quantum computer exists while those outputs remain protected by current elliptic-curve schemes.

The distinction between quantum-exposed and currently stealable is critical.

The Biggest Problem May Be Dormant Bitcoin

Coins controlled by active owners have a potential migration path.

Wallet software can eventually support new output types.

Exchanges can move funds.

Institutional custodians can rotate keys.

Active users can transfer BTC from vulnerable cryptography into post-quantum-secure outputs.

Dormant coins create a much more difficult problem.

Suppose a million BTC sits in old addresses whose owners lost the private keys.

Today those coins are effectively removed from circulating supply.

Now suppose a future quantum attacker recovers the keys.

Those coins could suddenly become spendable again.

The Bitcoin network cannot easily distinguish the original owner from the quantum attacker because the attacker can produce a valid signature under the existing cryptographic rules.

That leads to a deeply controversial policy question:

Should Bitcoin allow quantum-vulnerable dormant coins to remain spendable forever, or should old signature schemes eventually be restricted?

There is no consensus answer today.

BIP361 Tries to Address the Migration Problem

A draft Bitcoin Improvement Proposal published in 2026 attempts to define one possible migration path.

BIP361 — Post Quantum Migration and Legacy Signature Sunset is currently a draft informational proposal. It assumes that Bitcoin first gains a suitable post-quantum output mechanism and then outlines a phased process for moving away from ECDSA and Schnorr.

Under its current design, an initial phase would prevent new funds from being sent to quantum-vulnerable address types.

A later phase would place restrictions on legacy ECDSA/Schnorr spending and route those funds through a proposed quantum-safe recovery process after a pre-announced transition period.

The proposal is important.

It is not an adopted Bitcoin rule.

The Bitcoin BIPs repository explicitly notes that publication of a BIP does not mean the proposal has community consensus or is scheduled for activation. BIP361 remains listed as a draft.

This distinction matters because quantum migration is as much a consensus question as a cryptographic one.

BIP360 Takes a More Incremental Approach

Another 2026 proposal, BIP360, specifies Pay-to-Merkle-Root or P2MR.

The objective is narrower.

Instead of immediately replacing Bitcoin’s entire signature system, P2MR is designed to provide a script-tree output that does not directly expose an elliptic-curve public key before spending.

Bitcoin Optech summarizes P2MR as being resistant to long-exposure CRQC attacks because the output commits to the Merkle root of a script tree using SHA-256 rather than directly committing to a public key.

However, BIP360 itself is explicit about the limitation.

P2MR alone does not solve the short-exposure attack in which a public key becomes visible while a transaction sits unconfirmed.

Full protection against that problem likely requires actual post-quantum signatures.

So P2MR should be understood as a possible migration tool, not as a complete quantum-proof Bitcoin design.

Post-Quantum Digital Signatures Already Exist

Bitcoin does not need researchers to invent the entire field of post-quantum cryptography from scratch.

The US National Institute of Standards and Technology has already finalized several post-quantum cryptographic standards.

NIST finalized ML-DSA under FIPS 204 as its primary post-quantum digital-signature standard and SLH-DSA under FIPS 205 as a stateless hash-based signature standard offering a different cryptographic foundation. NIST describes ML-DSA as being designed to remain secure even against adversaries possessing large-scale quantum computers.

That means the cryptographic building blocks for post-quantum signatures exist today.

Bitcoin’s problem is how to integrate such protection without creating unacceptable costs or new security problems.

Why Bitcoin Cannot Just Replace ECDSA Tomorrow

Bitcoin’s existing signatures are compact and highly optimized.

Post-quantum signatures can be significantly larger.

For a conventional application, a few extra kilobytes may not seem important.

For a blockchain, every byte can be transmitted, stored and processed across many nodes.

A 2026 research paper examining post-quantum blockchain migration argues that signature size and verification overhead become system-wide infrastructure costs when multiplied across a globally replicated network. The authors specifically warn that directly replacing current signatures with larger post-quantum schemes can increase storage, bandwidth and validation requirements.

Another benchmark study comparing post-quantum signature schemes with ECDSA found that some PQ algorithms can offer competitive verification performance, but blockchain deployment still requires considering signature sizes, network overhead and implementation trade-offs rather than simply comparing CPU speed.

So Bitcoin’s post-quantum problem is not:

“Do quantum-safe signatures exist?”

It is:

“Which signature construction fits Bitcoin’s security, decentralization and resource constraints well enough to gain consensus?”

Bitcoin Developers Are Already Actively Discussing the Problem

Quantum resistance was once a relatively occasional Bitcoin developer topic.

That changed substantially in 2025 and 2026.

Bitcoin Optech’s quantum-resistance tracker now lists active work covering P2MR, post-quantum migration, hash-based signature constructions, lattice-based signatures, post-quantum Lightning considerations, cryptographic agility and mechanisms for dealing with legacy quantum-vulnerable coins.

The existence of these proposals should not be interpreted as evidence that a quantum attack is imminent.

It shows that developers increasingly consider the transition problem serious enough to investigate before the emergency exists.

That timing is important.

Migrating a decentralized monetary network under calm conditions would already be difficult.

Attempting the same migration after a quantum attacker has demonstrated private-key recovery would be dramatically harder.

What Changed in the August 2026 Quantum Research?

The August paper matters because quantum risk depends heavily on resource estimates.

Shor’s algorithm has been known since the 1990s.

The question is how much fault-tolerant quantum hardware is necessary to run it against secp256k1 quickly enough to matter.

The new Google-affiliated research reports two optimized circuits: one using no more than approximately 1,200 logical qubits and 90 million Toffoli gates, and another using no more than roughly 1,450 logical qubits and 70 million Toffoli gates.

Under one modeled superconducting fault-tolerant architecture, the researchers estimate execution in minutes using fewer than 500,000 physical qubits.

This is a research estimate under defined hardware and error-correction assumptions.

It is not a report that someone currently owns a 500,000-qubit cryptographically relevant machine.

That distinction is crucial.

The result narrows the engineering target.

It does not announce that the target has already been reached.

There Is Still No Demonstrated CRQC Capable of Breaking Bitcoin

The June 2026 Quantum Horizon analysis explicitly states that no cryptographically relevant quantum computer capable of breaking Bitcoin’s elliptic-curve signatures exists today. It also emphasizes the remaining gap between contemporary hardware and the fault-tolerant systems needed for cryptographic attacks.

The paper’s probabilistic timeline modeling is deliberately broad rather than giving one predicted date. Its model places roughly a one-in-six probability on a CRQC by 2035, around 30% by 2040 and approximately 60% by 2050. The authors themselves emphasize the large uncertainty surrounding these estimates.

These numbers are not an industry consensus countdown.

They are one research model.

The more useful conclusion is that nobody can responsibly provide an exact quantum-break date.

Bitcoin security planning therefore has to work under uncertainty.

Quantum Computers Are Not About to Take Over Bitcoin Mining

The second major misconception is that quantum computers could simply outperform every Bitcoin ASIC and dominate proof-of-work.

Quantum computing does affect search problems through Grover’s algorithm, which provides a quadratic rather than exponential speedup under ideal conditions.

That is fundamentally different from Shor’s impact on elliptic-curve signatures.

The June Quantum Horizon analysis concludes that Grover’s algorithm does not represent the same existential threat to Bitcoin proof-of-work because fault-tolerant execution costs, limited parallelization benefits and Bitcoin’s own difficulty adjustment dramatically reduce the practical advantage.

A dedicated March 2026 paper analyzing quantum Bitcoin mining reaches an even stronger conclusion. Its fault-tolerant resource model found that achieving economically meaningful quantum mining advantages would require extreme quantities of physical qubits and electrical power under realistic network difficulty. The paper argues that practical Grover-based mining collapses under the physical cost of quantum error correction and oracle execution long before it becomes a realistic way to dominate Bitcoin mining.

So the serious quantum discussion should focus much more on transaction authorization than on quantum ASIC replacement.

Does Grover’s Algorithm Break SHA-256?

No—not in the same way Shor’s algorithm breaks elliptic-curve signatures.

Grover’s algorithm can reduce the effective work required for brute-force search by roughly a square-root factor in idealized conditions.

Bitcoin Optech notes that a 256-bit hash primitive can therefore be thought of as retaining roughly 128 bits of security against the relevant idealized Grover-style search.

That is a reduction.

It is not the same as making SHA-256 trivial.

A 128-bit brute-force security level remains extremely large.

Bitcoin’s hash-based structures are therefore generally considered far more robust against quantum computing than its elliptic-curve signature layer.

This is exactly why many Bitcoin post-quantum proposals attempt to lean more heavily on hashes.

Could a Quantum Attacker Steal a Transaction While It Is Being Sent?

In principle, yes.

This is the short-exposure or on-spend attack.

A user owns BTC in an output where the public key was previously hidden behind a hash.

The user creates a normal transaction.

To validate the spend, the transaction reveals the public key.

It enters the public mempool.

A sufficiently fast quantum attacker sees that key, derives the private key, creates a competing transaction sending the BTC elsewhere and attempts to get the attack transaction confirmed first.

The attack has an enormous timing constraint.

A long-exposure attacker can work against an old exposed public key for months.

An on-spend attacker may have only the unconfirmed transaction window.

That is why BIP360 treats long-exposure protection as an earlier priority while acknowledging that full protection eventually requires post-quantum signatures.

A Quantum Attack Would Not Necessarily Affect Every Wallet at Once

Another common misconception is that the first cryptographically relevant quantum computer automatically drains the entire Bitcoin network.

The likely progression would be more complicated.

Public keys already exposed for years would present easier targets because there is no time constraint.

Outputs with hidden keys would initially be better protected from offline attack.

Active users could migrate.

Wallet developers and exchanges could accelerate post-quantum support.

Only more advanced, faster machines would make mempool-based on-spend attacks practical.

This creates a period during which migration could theoretically occur.

The difficult question is how much warning Bitcoin would actually receive.

If quantum progress is publicly visible and gradual, the network may have years to react.

If a powerful capability is developed secretly, the response window could be much shorter.

That uncertainty is why cryptographic migration usually begins before existing algorithms have been demonstrably broken.

NIST’s own post-quantum standardization effort follows this preventive philosophy: quantum-resistant standards have already been finalized even though large-scale cryptographically relevant quantum attacks are not presently available.

The Hardest Bitcoin Problem Is Governance, Not Just Mathematics

Researchers already know several cryptographic approaches that can resist known quantum attacks.

The harder question is getting millions of users, wallets, exchanges, custodians, miners, node operators and software projects to migrate safely.

Bitcoin does not have a central company that can declare:

“ECDSA support ends next Tuesday.”

Consensus changes require extensive review and broad adoption.

Wallets need updates.

Hardware wallets need support.

Cold-storage procedures need migration plans.

Multisignature arrangements may need restructuring.

Exchanges need deposit and withdrawal systems updated.

Old coins need to move.

The June Quantum Horizon paper therefore argues that the binding constraint may ultimately be governance speed rather than the availability of post-quantum cryptographic concepts.

That is a critical point.

A post-quantum Bitcoin solution sitting in a research paper does not protect funds.

It protects funds only after users can actually migrate to it.

Migrating Too Early Also Has Risks

If quantum migration were completely free, Bitcoin could simply adopt every new cryptographic scheme immediately.

It is not free.

Post-quantum algorithms are newer.

They have received less real-world deployment and scrutiny than Bitcoin’s current secp256k1 infrastructure.

They may require larger signatures.

Some use more complex implementation techniques.

Introducing a new signature system can create new bugs or consensus risks.

The August Google-affiliated paper explicitly notes that post-quantum schemes are comparatively young and that migration requires balancing new cryptographic risks against the future risk posed by quantum computers.

BIP360 similarly argues for incremental changes rather than immediately replacing the entire signature stack while CRQCs remain unavailable.

The challenge is therefore one of timing.

Move too late, and vulnerable funds may be exposed.

Move too early and too aggressively, and Bitcoin could introduce unnecessary complexity before the alternative cryptography has matured.

Could Quantum Computing Destroy Bitcoin’s Value?

A poorly managed quantum transition could create severe economic disruption.

That possibility should not be minimized.

If an attacker demonstrated the ability to derive private keys from exposed Bitcoin public keys, the market would immediately face uncertainty about dormant coins, exchange wallets, migration rules and the security of unconfirmed transactions.

Even coins that were technically protected could experience a price shock because the market would need to reprice the credibility of Bitcoin’s ownership system.

But that does not mean quantum computing inevitably destroys Bitcoin.

The relevant vulnerability is known.

Post-quantum cryptographic primitives exist.

Bitcoin developers are actively researching migration paths.

A substantial portion of exposed BTC could theoretically be moved before a practical attack, assuming sufficient warning and owner access.

The outcome depends heavily on timing and coordination.

What Should a Bitcoin Holder Do in 2026?

There is currently no need for an ordinary Bitcoin holder to react as though a quantum theft machine is operating today.

The 2026 research does not support that conclusion.

What it does support is treating post-quantum migration as a serious long-term Bitcoin infrastructure issue rather than dismissing it.

For users, ordinary security practices remain far more immediately relevant: protecting seed phrases, avoiding phishing, using secure wallet software and restricting exchange/API credentials.

Quantum computing does not make today’s malware, social engineering and credential theft disappear.

And a user who loses their seed phrase to a phishing attack today gains nothing from having worried about a future CRQC.

For long-term holders, the most practical quantum-related behavior is to stay capable of migration.

That means maintaining access to private keys and following future Bitcoin wallet and protocol changes.

The worst position in a future migration would be owning BTC in an obsolete output but being unable to move it.

What Does Quantum Risk Mean for Bitcoin Trading?

Quantum computing is not a useful day-to-day trading signal.

A new research paper can affect market sentiment.

But it does not tell a Bitcoin bot whether BTC should be bought at 10:15 tomorrow morning.

The more important effect is tail risk.

If evidence emerged that a practical elliptic-curve attack was genuinely close, the market could reprice Bitcoin extremely quickly.

That could affect volatility, liquidity and derivatives positioning long before any major theft actually occurred.

Automated strategies should therefore treat credible cryptographic developments as exceptional risk events rather than ordinary technical indicators.

A risk engine can reduce exposure when market structure becomes unstable.

It cannot predict the exact date of a scientific breakthrough.

Bitcoin Quantum Computing 2026: Questions and Answers

Can quantum computers break Bitcoin today?

No demonstrated cryptographically relevant quantum computer capable of recovering Bitcoin secp256k1 private keys exists today. Current research treats the threat as future-facing rather than an active Bitcoin theft capability.

What part of Bitcoin is most vulnerable to quantum computing?

The most serious known vulnerability is the digital-signature layer. Bitcoin’s ECDSA and Schnorr signatures rely on elliptic-curve cryptography that could be attacked by Shor’s algorithm on a sufficiently powerful fault-tolerant quantum computer.

Can Shor’s algorithm recover a Bitcoin private key?

In principle, yes, if the public key is known and the attacker has a sufficiently capable quantum computer. Shor’s algorithm can solve the elliptic-curve discrete logarithm problem underlying secp256k1.

How many qubits would be needed to attack Bitcoin?

An August 2026 Google-affiliated paper reports optimized circuits using approximately 1,200–1,450 logical qubits. Under one modeled superconducting architecture, the authors estimate fewer than half a million physical qubits could be sufficient for minute-scale execution. These are modeled future resource requirements, not descriptions of hardware available today.

Does a 500,000-qubit Bitcoin-breaking computer exist?

The cited research does not claim that such a fault-tolerant machine currently exists. It estimates how a future architecture meeting specific performance and error-correction assumptions could execute the attack.

Are old Bitcoin wallets more exposed?

Some are. P2PK outputs directly expose the public key and are therefore vulnerable to long-exposure attacks if a sufficiently capable CRQC eventually exists. Reused public keys can create similar exposure.

Are ordinary P2PKH addresses quantum-safe?

They can hide the public key before spending if the key has not previously been exposed, which provides protection against long-exposure attacks. They are not fully post-quantum because spending eventually reveals the public key.

Is Taproot quantum-safe?

Current P2TR outputs expose a public key and are therefore classified by BIP360 as vulnerable to long-exposure quantum key recovery. This is a future CRQC issue, not a weakness exploitable by conventional computers today.

Could a quantum attacker steal BTC while a transaction is unconfirmed?

A sufficiently fast CRQC could theoretically attempt an on-spend attack by recovering the private key from the public key revealed in the mempool and broadcasting a competing transaction. This requires substantially faster key recovery than attacking an already exposed dormant public key.

How much Bitcoin is potentially quantum-exposed?

Research estimates vary. The August 2026 Google-affiliated paper estimates approximately 6.9 million BTC under its vulnerability methodology, while a separate June study estimates roughly 6 million exposed BTC and argues that about 2.3 million may be irreducibly vulnerable because the rest could potentially migrate. These are modeled exposure estimates, not coins currently available for quantum theft.

Can quantum computers dominate Bitcoin mining?

Current research does not support that as the primary practical quantum threat. Grover’s algorithm provides a quadratic search advantage rather than Shor’s much more destructive effect on elliptic-curve signatures, and fault-tolerant resource costs make large-scale quantum Bitcoin mining extremely demanding.

Does Grover’s algorithm break SHA-256?

It weakens brute-force security in an idealized quantum model by providing a quadratic speedup. Bitcoin Optech describes SHA-256 as retaining roughly 128-bit security against the relevant idealized search rather than becoming trivially broken.

Are post-quantum signature algorithms already available?

Yes. NIST finalized ML-DSA under FIPS 204 and SLH-DSA under FIPS 205 in 2024 as post-quantum digital-signature standards.

Why does Bitcoin not use ML-DSA already?

A Bitcoin migration must consider more than cryptographic security. Signature size, bandwidth, blockchain storage, verification cost, implementation complexity and consensus all matter. Research shows that blockchain-wide post-quantum migration can impose meaningful infrastructure overhead.

What is BIP360?

BIP360 is a draft proposal for Pay-to-Merkle-Root (P2MR), an output type designed to reduce long-exposure quantum risk by committing to a hash of a script tree rather than exposing an elliptic-curve public key in the output. It does not by itself solve short-exposure attacks.

What is BIP361?

BIP361 is a draft proposal describing a possible future migration away from legacy ECDSA and Schnorr signatures after a post-quantum output system exists. It has not been activated as a Bitcoin consensus rule.

Could Satoshi-era Bitcoin become vulnerable?

Some early P2PK coins directly expose public keys, so they are part of the long-exposure quantum-security discussion. The difficult issue is that the network cannot cryptographically determine whether an old coin is intentionally dormant, lost or later accessed by a quantum attacker.

Will Bitcoin definitely be broken by 2035?

No credible research can provide such certainty. One June 2026 model estimated roughly a one-in-six probability of a cryptographically relevant quantum computer by 2035, but it also produced a very broad distribution extending decades further. It should be understood as one probabilistic model rather than a countdown.

Is quantum computing an immediate reason to sell Bitcoin?

The technical evidence does not support the claim that Bitcoin’s signatures can be quantum-broken today. Quantum risk is a legitimate long-term protocol issue, but a trading decision still involves many other market, liquidity and portfolio considerations.

What is the most important thing Bitcoin needs to do?

The central long-term challenge is developing, reviewing and deploying a migration path to post-quantum transaction authorization before a practical CRQC can attack secp256k1. The cryptographic options exist; obtaining safe implementation and network-wide migration is the harder coordination problem.

Final Takeaway

Quantum computing can threaten Bitcoin.

But the technically accurate version of that statement is much narrower than most headlines suggest.

The primary threat is not quantum computers suddenly mining all remaining BTC.

It is not SHA-256 instantly becoming useless.

It is not someone decrypting the blockchain.

The central problem is Bitcoin’s elliptic-curve digital signatures.

A sufficiently capable fault-tolerant quantum computer running Shor’s algorithm could recover private keys from exposed secp256k1 public keys and create valid Bitcoin transactions without knowing the original owner’s private key.

The latest 2026 research makes that risk more relevant.

An August paper from researchers affiliated with Google Quantum AI and other institutions reduced modeled resource requirements to approximately 1,200–1,450 logical qubits, with one superconducting architecture estimate below half a million physical qubits.

But the second half of the story matters equally.

That cryptographically relevant hardware does not exist today.

Bitcoin also has options.

Public keys that remain hidden behind hashes have better protection from long-exposure attacks than keys permanently visible on-chain.

Post-quantum signature standards already exist.

BIP360 is exploring a hash-based output structure intended to reduce long-exposure risk.

BIP361 is exploring how Bitcoin might eventually migrate away from vulnerable ECDSA/Schnorr authorization. Both remain proposals rather than deployed consensus rules.

This means Bitcoin’s quantum problem is increasingly becoming a race between two developments:

how quickly fault-tolerant quantum computers improve

and

how quickly Bitcoin can prepare a credible post-quantum migration path.

The 2026 evidence does not justify panic.

It also no longer justifies dismissing quantum security as science fiction.

The correct position sits between those extremes:

Bitcoin is not quantum-broken today, but its current signature system is not designed to survive a future cryptographically relevant quantum computer.

Preparing before that computer exists is therefore not evidence that Bitcoin has failed.

It is exactly how long-lived cryptographic infrastructure is supposed to evolve.