Can Quantum Computers Break Bitcoin?

Can quantum computers break Bitcoin is one of the most technically serious questions in cryptocurrency security today, and the honest answer is: not yet, but the conditions under which they could are better understood than most headlines suggest. This article explains exactly how Bitcoin's cryptography works, which algorithms a sufficiently powerful quantum computer could attack, how much quantum hardware would realistically be required, what the credible timelines look like, and the concrete steps Bitcoin holders can take to reduce their exposure before that threshold is crossed.

How Bitcoin's Cryptography Actually Works

Before assessing any quantum threat, it helps to be precise about what cryptography Bitcoin relies on and what each component does.

ECDSA and the Discrete Logarithm Problem

Bitcoin uses Elliptic Curve Digital Signature Algorithm (ECDSA) with the secp256k1 curve to generate key pairs and sign transactions. The security rests on the elliptic-curve discrete logarithm problem (ECDLP): given a public key *Q* and the generator point *G*, it is computationally infeasible for a classical computer to recover the private key *k* such that *Q = k × G*.

On classical hardware, the best-known algorithms (Pollard's rho) require roughly 2^128 operations to crack a 256-bit elliptic curve key. That is effectively impossible with any foreseeable classical computer.

SHA-256 and Proof of Work

Bitcoin also uses SHA-256 in two places: mining (proof-of-work) and address derivation (a public key is hashed through SHA-256 and RIPEMD-160 to produce a Bitcoin address). These hash functions face a different, and somewhat smaller, quantum threat than ECDSA.

What Is Actually Exposed

The critical takeaway: Shor's algorithm is the genuine existential threat to ECDSA. Grover's algorithm weakens SHA-256 but does not break it outright at current security margins.

---

Shor's Algorithm: The Mechanism That Could Break Bitcoin

Peter Shor's 1994 algorithm solves the integer factorization problem and the discrete logarithm problem in polynomial time on a quantum computer. Applied to secp256k1, it could, in principle, derive a private key from a public key.

The Attack Scenario Step by Step

1. An adversary obtains a target Bitcoin address whose public key has been revealed on-chain (this happens whenever an address has *sent* a transaction, because the public key appears in the scriptSig or witness).
2. The adversary runs Shor's algorithm on a fault-tolerant quantum computer to derive the private key from the public key.
3. The adversary constructs and broadcasts a transaction draining the address before the legitimate owner's transaction is confirmed.

The "Exposed Public Key" Condition

This is the nuance most articles miss. Unspent Pay-to-Public-Key-Hash (P2PKH) addresses that have never sent a transaction do not expose their public key. Only the 20-byte hash is visible on-chain. Shor's algorithm cannot attack a hash; it needs the actual elliptic curve point.

Addresses become vulnerable the moment they sign and broadcast a transaction, because the public key is included in the transaction data. This means:

• Reused addresses are permanently exposed after their first outgoing transaction.
• Fresh, never-spent addresses are protected by the additional SHA-256/RIPEMD-160 hash layer — but only until they spend.
• Pay-to-Public-Key (P2PK) outputs (common in early Bitcoin, including Satoshi-era coins) expose the raw public key directly and are immediately vulnerable once quantum hardware is sufficient.

Estimates suggest roughly 4 to 5 million BTC sit in P2PK or reused P2PKH addresses with exposed public keys, representing a meaningful portion of circulating supply.

---

How Much Quantum Hardware Is Actually Needed?

This is where sober analysis diverges sharply from alarmist coverage.

Logical vs. Physical Qubits

Modern quantum computers operate with noisy physical qubits. Fault-tolerant quantum computation requires error correction, meaning hundreds to thousands of physical qubits are needed to maintain a single reliable logical qubit. Shor's algorithm on a 256-bit elliptic curve requires roughly:

• 2,330 logical qubits (per the 2022 Webber et al. resource-estimation paper in AVS Quantum Science)
• With surface-code error correction at realistic noise rates (~10^-3), that translates to approximately 13 million physical qubits

Where Quantum Hardware Stands in 2025

The gap between today's best hardware and the threshold required to threaten Bitcoin is multiple orders of magnitude. No credible researcher argues this gap closes within five years on current engineering trajectories.

The Time-to-Sign Window Problem

Even if a sufficiently large quantum computer existed, an attacker would need to run Shor's algorithm on a 256-bit key within Bitcoin's transaction confirmation window, roughly 10 minutes for one block, or faster if attempting a mempool interception. The Webber et al. paper estimated that cracking a Bitcoin key within one hour would require approximately 317 million physical qubits. Within ten minutes, the requirement rises to about 1.9 billion physical qubits.

These numbers make it clear that the threat is not imminent, but they also make it clear that it is not zero on a decade-plus horizon.

---

Grover's Algorithm and Bitcoin Mining

Grover's algorithm provides a quadratic speedup for unstructured search, which applies to SHA-256 mining. A quantum miner could theoretically find a valid proof-of-work hash in roughly 2^128 operations instead of 2^256.

Why This Is Less Alarming Than It Sounds

• Bitcoin's difficulty adjustment recalibrates every 2,016 blocks (~two weeks). If quantum miners entered the network, difficulty would rise, neutralizing the advantage over time.
• Grover's speedup is quadratic, not exponential. Classical ASIC miners can be scaled; quantum mining hardware cannot yet be parallelized in the same way.
• The SHA-256 preimage problem at 128-bit effective security is still well beyond any near-term quantum capability.

Mining disruption from quantum computers is a long-run competitive concern, not a security vulnerability in the same class as Shor's attack on ECDSA.

---

Credible Timelines: What Researchers Actually Say

Different expert groups place the threshold for cryptographically relevant quantum computers (CRQC) at different points:

• NCSC (UK) and CISA (US) guidance both target 2030s as the window where migration to post-quantum cryptography becomes critical.
• NIST completed its first round of post-quantum cryptographic standards in 2024 (FIPS 203, 204, 205), signaling that the standardization work required before any Bitcoin protocol upgrade needs to begin now, not after a quantum milestone.
• Goldman Sachs and Deloitte research notes frame the 2030–2040 window as the planning horizon for enterprises holding digital assets.
• Some researchers (notably those working on quantum hardware at IBM and Google) suggest commercially viable fault-tolerant systems for general computation remain 10–20 years away.

The consensus is not "never" and not "imminently." It is "within a planning horizon that responsible security should already be addressing."

---

What Bitcoin Holders Can Do Right Now

Waiting for a protocol-level solution is not the only option. Holders can take practical steps today.

Address Hygiene

• Use each address only once. Single-use addresses limit the on-chain exposure of public keys to the brief window between broadcast and confirmation.
• Avoid reusing old P2PK or legacy addresses. If you have coins sitting in addresses that have previously sent transactions, moving them to a fresh address reduces the quantum attack surface.
• Prefer P2WPKH or P2TR (Taproot) outputs. These formats do not embed raw public keys in spendable UTXOs until spend time, giving similar pre-spend protection as P2PKH.

Monitor Protocol Development

The Bitcoin community is actively discussing quantum-resistant upgrade paths. Proposals include:

• FALCON or CRYSTALS-Dilithium lattice-based signature schemes (both NIST-standardized in 2024) as potential replacements for ECDSA.
• A soft-fork migration mechanism that would allow holders to migrate UTXOs to quantum-resistant addresses during a grace period.
• Hybrid signature schemes that combine ECDSA with a post-quantum algorithm for transition-period security.

No BIP has been formally merged for quantum resistance as of mid-2025, but the conversation has moved from academic to active developer discussion.

Consider Quantum-Resistant Custody Alternatives

For holders with significant exposure, diversifying into wallets and custody solutions built on post-quantum cryptography from the ground up is a rational risk-management step. Projects like BMIC.ai are building wallet infrastructure on NIST PQC-aligned lattice-based cryptography specifically designed to be secure even if a cryptographically relevant quantum computer appears ahead of schedule.

Keep Private Keys Genuinely Offline

A quantum computer still needs the public key visible on-chain to execute Shor's attack. Hardware wallets that never reuse addresses and keep public keys off-chain until the moment of spend provide meaningful protection within the current protocol.

---

What a Bitcoin Protocol Fix Would Require

A full quantum-resistant upgrade to Bitcoin is technically feasible but socially complex. It would require:

1. Agreement on a post-quantum signature scheme — likely a lattice-based algorithm given NIST's 2024 standardization.
2. A soft-fork or hard-fork activation with sufficient miner and node consensus (historically contentious).
3. A migration deadline after which P2PK outputs or exposed-key outputs would be either frozen or rendered unspendable, incentivizing holders to move funds to quantum-resistant addresses.
4. Larger transaction sizes — post-quantum signatures are significantly larger than ECDSA signatures (FALCON-512 produces ~666-byte signatures vs. ~72 bytes for ECDSA), increasing block space demand and fee pressure.

None of these are insurmountable, but the coordination required means preparation time is measured in years, not months. The lesson from the NIST PQC process, which took eight years from call for proposals to final standards, is that cryptographic transitions move slowly by design.

---

Summary: The Honest Assessment

Quantum computers cannot break Bitcoin today, and current hardware is orders of magnitude below the threshold required. The threat is real, specific, and well-characterized: Shor's algorithm targeting ECDSA on exposed public keys. The conditions that create vulnerability are known and partially avoidable through address hygiene. The hardware gap is large but not infinite on a decade-plus horizon. Protocol-level solutions exist in draft form. The window for orderly preparation is open, but it is not unlimited.