Is Quantum Computing a Threat to Bitcoin? A Plain-Language Guide to the Mechanics and the Risk

Bottom line: Bitcoin is safe today. But coins whose public key has been exposed carry future risk

The idea that quantum computers could someday break Bitcoin's cryptography resurfaces periodically, but as of mid-2026, no quantum computer capable of actually deriving a Bitcoin private key exists. The real substance of the threat is a design-level challenge: a theoretical algorithm called "Shor's algorithm" could eventually break the public-key cryptography that digital signatures rely on. Bitcoin's developer community has already begun discussing migration strategies (still at the proposal stage). This article lays out, based on primary sources, what could actually break, which coins carry more risk, and where things stand today.

What could actually break — Shor's algorithm and public-key cryptography

The digital signatures underpinning how Bitcoin works rely on ECDSA using elliptic-curve cryptography (the secp256k1 curve), and, since Taproot, Schnorr signatures as well. Both rely on a one-way mathematical hardness: "computing a public key from a private key is instant, but working backward from a public key to derive the private key would take an astronomically long time on a conventional computer."

"Shor's algorithm," published by mathematician Peter Shor in 1994, showed that this class of discrete-logarithm problem could theoretically be solved in a realistic timeframe on a sufficiently powerful quantum computer. If a quantum computer at that level were ever built, it could derive a private key from a public key — that's the core of the threat.

This isn't a weakness unique to Bitcoin — it's a shared challenge for public-key cryptography systems like ECDSA and RSA used across banks and government systems worldwide. That's exactly why the US National Institute of Standards and Technology (NIST) formally finalized new quantum-resistant cryptographic standards (ML-KEM/FIPS 203, ML-DSA/FIPS 204, SLH-DSA/FIPS 205) on August 13, 2024, urging industries to begin migrating early.

Grover's algorithm and mining — don't conflate the two

Discussions of quantum computing often conflate this with mining (SHA-256 hash computation) also being broken. In reality, the quantum attack vector against hash functions is a different algorithm called "Grover's algorithm," which only speeds up brute-force search quadratically (by a square-root factor). Its effect amounts to weakening a 256-bit hash to roughly "128-bit equivalent" strength — nowhere near the devastating impact Shor's algorithm could have on ECDSA. The current consensus is that quantum computing does not fundamentally change the dynamics of mining competition or 51% attacks.

Which bitcoin is actually at risk

Not all bitcoin carries the same risk. The key factor is whether the public key has already been exposed on the blockchain.

• Early P2PK-format coins: Before address types as we know them were standardized, Bitcoin's earliest days mainly used the P2PK format, which put the raw public key directly on-chain as the address. These have had exposed public keys from the start.
• Any address that has ever sent a transaction: Modern standard address formats (P2PKH, bech32, etc.) use a hash of the public key as the address rather than the public key itself, so the public key stays hidden as long as the address has only received funds. But once you send a transaction from that address, the public key gets revealed on-chain as part of the signature.
• Temporary exposure during broadcast: Even an address that has never sent before has its public key briefly visible on the network during the minutes between broadcasting a transaction and its confirmation in a block.

Ledger's analysis (February 2026) estimated that such "public-key-exposed" coins amount to roughly 25% of circulating supply by value. A June 2026 academic preprint similarly estimated several million BTC are in a comparably "quantum-exposed" state, and noted that a portion of that (coins whose owners have lost their keys and can effectively no longer move them) would remain a structural risk with no available fix. Estimates vary by methodology, but multiple analyses agree on the broad point that a non-trivial share of supply has already exposed its public key.

Where things stand: as of mid-2026, no quantum computer capable of deriving keys exists yet

A preprint study released in June 2026 estimated the probability of a cryptographically relevant quantum computer (one powerful enough to practically break this cryptography) emerging at roughly one-in-six by 2035, around 30% by 2040, and around 60% by 2050. The same study concluded that if migration proceeds early enough, the risk could be neutralized before the technology even arrives — suggesting the real bottleneck is less about the technology itself and more about the governance needed to drive migration.

How Bitcoin's developer community is preparing — BIP-360 and BIP-361 (still proposals)

• BIP-360 (proposed by Hunter Beast and others, December 18, 2024): proposes a new address format called "Pay-to-Quantum-Resistant-Hash" (P2QRH), also referred to as "Pay-to-Merkle-Root" (P2MR). Structurally similar to Taproot, it aims to strip out the elliptic-curve signature exposed in the "key-path spend" that a quantum computer could target, laying groundwork for eventually incorporating a NIST-standardized quantum-resistant signature scheme like ML-DSA. As of mid-2026 it sits as a "Draft" in the Bitcoin Core BIP repository and has not been activated on the network.
• BIP-361 (proposed by Jameson Lopp and others, February 11, 2026): a framework proposal for a phased migration deadline encouraging funds to move from older addresses with exposed public keys to new quantum-resistant addresses. One example schedule would restrict new payments to legacy addresses roughly three years after activation (Phase A), then disable legacy ECDSA/Schnorr signatures entirely roughly two years after that (about five years after activation total, Phase B), effectively freezing unmigrated funds. This "freezing" element has drawn strong pushback from parts of the community as conflicting with Bitcoin's principles of immutability and neutrality, and remains contested as of mid-2026. It, too, is at "Draft" stage as of the same date, and implementation would require broad community consensus — including node operators, miners, and exchanges — through the same process as past soft forks.

What individuals can do

There's no need for excessive worry. For now, this is "a future design challenge worth understanding for educational purposes" — not something that should drive investment decisions or sudden action. That said, some sensible everyday habits include:

• Avoid reusing addresses, generating a new address each time you receive funds (a habit that avoids unnecessarily exposing your public key).
• Don't leave funds sitting on an exchange — store them securely yourself.
• Follow the progress of proposals like BIP-360 and BIP-361 through primary sources like the official repositories, rather than judging by sensational headlines alone.

Frequently asked questions

Q. Could a quantum computer steal my bitcoin right now? A. No. As of mid-2026, there are no confirmed cases of anyone actually deriving a Bitcoin private key using a quantum computer. This is a future design challenge worth understanding for educational purposes — it should not factor into investment decisions today.

Q. Which bitcoin faces the greater risk? A. Coins whose public key has already been exposed on-chain — early P2PK-format coins, or any address that has ever sent a transaction. Modern address formats (bech32, Taproot, etc.) that have only received funds and never sent are relatively safer, since the public key stays hidden inside a hash.

Q. Would mining also break under quantum computing? A. The consensus view is that quantum computing's effect on the hash function mining depends on (SHA-256) is limited to a quadratic speedup via Grover's algorithm — nowhere near the devastating impact Shor's algorithm could have on ECDSA.

Q. By when do we need a fix? A. No firm deadline has been set. Proposals like BIP-360 and BIP-361 only get implemented after community consensus and a soft fork — as of mid-2026, both remain in draft/discussion stage.

Sources

• NIST — NIST Releases First 3 Finalized Post-Quantum Encryption Standards (Aug 13, 2024)
• Bitcoin Improvement Proposals — BIP-360: Pay to Quantum Resistant Hash (Draft, proposed Dec 18, 2024)
• Bitcoin Improvement Proposals — BIP-361: Post Quantum Migration and Legacy Signature Sunset (Draft, proposed Feb 11, 2026)
• Ledger — Quantum Computing's Threat to Blockchain (Feb 26, 2026)
• arXiv — Quantum Horizon: An evaluation of quantum computing as a threat to Bitcoin and Ethereum (Gershteyn & Alber, June 12, 2026)
• River Financial — Will Quantum Computing Break Bitcoin?