# Is Bitcoin Secure Against Quantum Computing, and When Should Users Prepare?

Jessica Washington · September 30, 2026

> What Is Bitcoin’s Post-Quantum Security Status? Bitcoin is not presently vulnerable to a known practical quantum attack, but its core signature...

## What Is Bitcoin’s Post-Quantum Security Status?

Bitcoin is not presently vulnerable to a known practical quantum attack, but its core signature system is not considered quantum resistant. Transactions commonly use ECDSA over the secp256k1 elliptic curve, and a sufficiently capable fault-tolerant quantum computer could use Shor’s algorithm to recover the private key corresponding to a public key. That is a cryptographic break, not merely a faster version of today’s attacks. As of September 30, 2026, no quantum computer has publicly broken Bitcoin, and no demonstrated cryptographically relevant quantum computer exists. The prudent conclusion is that Bitcoin has time to migrate, but postponing preparation until a working attack is announced would be risky because an attacker could copy public blockchain data, break exposed keys offline, and prepare harmful transactions before the weakness became widely understood.

**Also worth reading:** [How Can Bitcoin Wallets Become Post-Quantum Ready Before Cryptography Becomes Measurable?](https://cryptgo.co/knowledge/how_can_bitcoin_wallets_become_post-quantum_ready_before_cryptography_becomes_measurable.php) · [How Should Crypto Investors Prepare for Post-Quantum Wallet Migration in 2026?](https://cryptgo.co/knowledge/how_should_crypto_investors_prepare_for_post-quantum_wallet_migration_in_2026.php) · [How Does Quantum Resistant Blockchain Architecture Defend Distributed Ledgers Against Post-Cryptographic Threats?](https://cryptgo.co/knowledge/how_does_quantum_resistant_blockchain_architecture_defend_distributed_ledgers_against_post-cryptographic_threats.php)

The timeline remains uncertain. Industry estimates have placed a cryptographically relevant quantum computer anywhere from roughly 10 to 20 or more years away, although newer resource estimates have shown that earlier forecasts cannot be treated as fixed deadlines. Physical qubit counts alone do not determine readiness; error rates, circuit depth, logical-qubit overhead, fabrication quality, and the cost of sustained computation matter more. Bitcoin’s 2013 public-key history also changes the threat model because old transactions permanently reveal participating public keys. In contrast, many uneconomically spent outputs have never exposed the relevant pubkey on-chain, so they would have a different exposure profile even though their funds remain governed by the same signature scheme.

Bitcoin developers are researching migration paths rather than treating the date as a confirmed emergency. A conservative migration would require a broadly supported consensus change, a new transaction format, wallet and exchange support, custody procedures, and years of testing. The absence of panic today should therefore be interpreted as time, not immunity. Users who control long-lived Bitcoin should understand their address type and custody model, reduce avoidable key reuse, monitor standards proposals, and treat post-quantum readiness as a multi-year engineering program rather than a single software update.

## Why Quantum Computing Breaks Bitcoin’s Signatures

Elliptic-curve cryptography lets a signer generate a private key and derive a public key and Bitcoin address without revealing the private value. ECDSA’s security depends on mathematical problems for which ordinary computers have no known efficient solution. Shor’s algorithm changes that condition because a large fault-tolerant quantum computer can solve the relevant integer-factorization and discrete-logarithm problems. If applied to secp256k1, it would allow an attacker to derive a private key from a public key and sign arbitrary transactions. Once that happens, the attacker does not need to defeat Bitcoin’s proof-of-work network; they can create a valid competing transaction using the stolen key.

This attack differs from mining with greater computing power. Proof of work protects the ordering and finality of the ledger by making block production expensive, but transaction validity still depends on signatures. A quantum-derived signature could therefore pass normal validation even if the adversary controlled no mining equipment. The attacker would still need an accepted transaction or conflicting transaction to enter the mempool, and network propagation and confirmations would affect its outcome, but a valid key compromise would remove one of the system’s central assumptions. This is why post-quantum Bitcoin analysis focuses primarily on signature replacement and historical public-key exposure, not simply on making mining quantum resistant.

Not every address reveals a complete public key in the same way. A legacy pay-to-public-key-hash address usually commits to a hash of a public key, so the key becomes visible when its owner spends from the output. A pay-to-script-hash or native SegWit address can conceal the spending condition until use, although spending conditions, change outputs, and wallet behavior may still reveal keys. Taproot introduced Schnorr signatures and script spending, which can improve privacy but also creates a case where keys relevant to a Taproot output may be published during spending. Exposure is therefore cumulative, and a user cannot reliably “unexpose” a key after broadcasting the original transaction.

## How Large and Credible Is the Quantum Threat?

The threat is technically credible even though its arrival date is disputed. In 2024, Google Quantum AI researchers reported that breaking elliptic-curve cryptography could require fewer than one million noisy physical qubits under a particular resource model, but a 2024 industry estimate commonly cited by media placed a Bitcoin-breaking machine in the range of a million qubits and operational resources far beyond those estimates. These figures do not directly contradict one another because they use different assumptions, correction overhead, algorithms, and definitions of success. Neither proves that a machine can be built cheaply or operated continuously. A headline qubit number should not be treated as a countdown unless it includes error correction, logical depth, execution time, and engineering overhead.

Organizations such as Galaxy have launched Bitcoin quantum-readiness work, while researchers have tested quantum-resistant transaction ideas, including a StarkWare demonstration reported in 2025. Coinbase has also warned that post-quantum work remains unfinished and time-sensitive. These efforts are useful because they turn an abstract hazard into concrete questions about address formats, signature aggregation, transaction size, smart contracts, bridges, and wallet recovery. However, a demonstration transaction is not the same as a production migration. Its algorithms, hard forks, public-key formats, verification costs, and cryptographic assumptions may change before network adoption. A credible solution must work for the entire Bitcoin ecosystem, not only a modified test environment.

For Bitcoin holders, the probability-weighted risk is more important than a single date. A machine capable of breaking keys is not automatically an economic threat if it cannot be operated at scale, but cryptocurrency creates unusual incentives: stolen coins can be retained, moved quickly, mixed, or sold on hidden markets. Conversely, prolonged preparation carries costs because signatures may become larger, validation may become slower, protocol changes may introduce bugs, and users may pay migration or custody expenses without receiving immediate protection. The rational response is staged investment in backups, key hygiene, monitoring, and standardization, followed by execution before a cryptographically relevant machine is confirmed.

## Which Post-Quantum Alternatives Are Being Considered?

Post-quantum cryptography replaces vulnerable mathematical assumptions rather than merely increasing secp256k1 key sizes. NIST selected ML-KEM for key establishment and ML-DSA and SLH-DSA for signatures as standards in 2024. ML-KEM is not a Bitcoin transaction-signature substitute, while the standardized signature schemes can serve that general role. Bitcoin’s signature, aggregation, script, and address requirements make direct substitution difficult. A public key and signature for an ML-DSA or SLH-DSA transaction would be much larger than today’s compact ECDSA or Schnorr data, increasing transaction bytes and potentially affecting fees, block capacity, confirmation times, and relay policies.

| Feature | Current Bitcoin signatures | Post-quantum signature candidate | Hybrid or migration design |
| --- | --- | --- | --- |
| Mathematical basis | secp256k1 elliptic curve | ML-DSA, SLH-DSA, or another standardized scheme | Classical and post-quantum signatures combined |
| Main quantum weakness | Shor’s algorithm can solve discrete logarithms | Designed to resist known quantum attacks | Protection depends on correct composition and classical fallback |
| Typical data size | Compact secp256k1 or Schnorr signatures | Usually substantially larger, with scheme-dependent overhead | Largest of the two signature systems plus format overhead |
| Main benefit | Small, mature, fast, and widely supported | Addresses the core quantum signature threat | Allows controlled transition while testing compatibility |
| Main drawback | Not post-quantum secure | Larger transactions and new implementation risk | More complexity, development, and validation work |
| Bitcoin readiness | Deployed on the main network | Standards exist, but no adopted Bitcoin format in 2026 | Requires ecosystem coordination, consensus rules, and staged activation |

There is no single universally best alternative. ML-DSA is lattice based and offers comparatively modern engineering, but its public keys, signatures, and hashes must be selected and parameterized carefully. SLH-DSA is hash based, which reduces reliance on lattice assumptions, but its operational characteristics and data size differ. A hybrid design could retain secp256k1 while adding a post-quantum signature, preserving some familiarity but temporarily increasing transaction weight. Another proposal may create new address types and leave legacy behavior intact until users opt in. Each route trades migration cost against security assurance and implementation complexity.

## What Should Bitcoin Users Do Now?

The first practical step is to identify who controls the keys. An exchange account may offer no direct control over a public key or spend path, while a self-custody wallet requires the user to protect a seed or hardware signing device. Users should record the wallet type, backup method, address types in use, and whether any addresses have been publicly spent from. They should also verify that backups are offline or redundantly stored and that recovery devices and software have been tested. A quantum-resistant address is not useful if the private key remains exposed through a compromised computer, poor backup handling, or an untrusted custodial provider.

The second step is to reduce unnecessary public-key exposure where economically practical. Reusing one address for every payment reveals every corresponding public key as funds are spent and makes historical analysis easier. New receiving addresses and modern wallet features can reduce exposure, but users should not move funds solely for a speculative threat without checking fees, tax consequences, and the destination’s support. Hardware wallets, reputable software, multisig or threshold arrangements, and tested backups are not post-quantum solutions, yet they can reduce ordinary theft and operational failures. They also provide time to migrate once better standards and wallet products appear.

The third step is to watch protocol proposals rather than install random “quantum-safe Bitcoin” tools. Users should follow Bitcoin Core development, recognized Bitcoin research, wallet release notes, and major exchange or institutional custody notices. Migration support should be verifiable by source code, test vectors, independent security review, and compatibility with consensus rules. Companies offering quantum-resistant timestamps, dual signatures, or wallet technology may solve a specific portion of the problem, but timestamping a Bitcoin transaction does not automatically make its ownership key quantum resistant. The complete path must include spending, recovery, address validation, script execution, and custody.

## Common Mistakes and Misleading Claims

One common mistake is equating proof of work with post-quantum security. Proof of work resists ledger reorganization under classical assumptions, but it does not repair a compromised private key. Another mistake assumes that unused Bitcoin is safe because its public key is not visible. That may reduce immediate exposure, but it does not prevent a future quantum break, and governance, inheritance, spending, or operational requirements can force exposure later. A third mistake treats a successful quantum-resistant test transaction as proof that Bitcoin has already been fixed. Experimental work can validate mathematics while omitting years of consensus, fee-market, denial-of-service, and wallet-compatibility engineering.

Claims that Bitcoin has a predetermined “quantum-proof date” should also be treated cautiously. Estimates can change with hardware, error correction, government research, commercial secrecy, and new cryptanalysis. Conversely, claims that quantum computers are merely marketing hype ignore that Shor’s algorithm is a known theoretical threat and that cryptographically relevant machines could appear abruptly on a timeline the public cannot monitor. “Harvest now, decrypt later” is especially relevant to a transparent public ledger, even if public-key recovery itself is not immediate. The balanced view recognizes an uncertain date and a known, potentially catastrophic mechanism.

Bitcoin is not just a signature system, so replacing one algorithm may create new dependencies. Hash functions, Merkle trees, script contracts, signature aggregation, Taproot semantics, side chains, bridges, and coordinator software all need review. A post-quantum scheme can itself be weakened by incorrect parameters, deterministic nonce failures, poor randomness, or unexamined hash assumptions. Users should evaluate security claims from the complete implementation, not from the name of an algorithm. Post-quantum readiness is a measured program, not a branding label.

## When Should Users and Organizations Act?

Individual users can begin inventory and backup work now at little direct cost. Long-term holders, exchange operators, custodians, miners, wallet developers, and protocol engineers have a stronger reason to act early because they control systems that may take years to update. A sensible organizational timeline starts with dependency mapping in 2026, adoption of test vectors and cryptographic inventories, prototype wallet and transaction formats, compatibility testing, and independent review. Any consensus proposal should include explicit activation criteria, rollback or recovery planning, and communication for users who cannot update immediately. The exact implementation year cannot be selected responsibly until the Bitcoin community agrees on a technically sound proposal.

There is no defensible universal threshold based on a public qubit count. Acting only after a successful key-recovery demonstration would be late because a powerful machine may be kept secret and its output immediately monetized. Waiting until a particular calendar year such as 2030 could also be late if hardware progress accelerates. At the same time, an expensive migration completed before the threat matures can impose unnecessary fees and engineering risk. A staged approach is preferable: improve key management now, standardize post-quantum components, test them against realistic Bitcoin conditions, and activate a network change while a multi-year transition remains possible.

Cost depends on the solution. Ordinary Bitcoin sends still cost network fees determined by transaction size and mempool conditions, and larger post-quantum signatures would generally raise the virtual-size and fee impact. A full protocol migration may require software development, audits, relay changes, hardware updates, exchange remobilization, and user support, so published pricing is not yet meaningful for a Bitcoin-wide transition. Hardware or software products marketed as quantum resistant may carry premiums, but users should compare what they protect, whether the product actually changes signature verification, and whether improvements are independently reviewed. Claims of a 79% cost reduction in a StarkWare experiment, for example, relate to that experiment’s assumptions and do not set the price of migrating all Bitcoin.

## The Defensive Conclusion for Bitcoin Holders

Bitcoin is secure against quantum computing in the narrow sense that no public quantum attack currently exists, but it is not secure by design against a future fault-tolerant Shor implementation. The correct response is neither dismissal nor an immediate panic sale. Users should secure their keys, understand address exposure, test backups, use trusted software, avoid unnecessary address reuse, and follow credible migration research. Developers and institutions should begin integration and testing now, while avoiding a rushed hard fork that could introduce more immediate risk.

The decisive issue is transition time. Once a capable quantum machine becomes available, a public chain cannot be patched as easily as a website because keys already published in old blocks cannot be retroactively changed. Bitcoin can probably adapt, but the migration must preserve ownership and transaction validation for decades of historical data. By September 30, 2026, the practical judgment is therefore straightforward: Bitcoin has no immediate quantum emergency, yet post-quantum security is a real engineering requirement with no guaranteed last safe date. Preparation, validation, and gradual migration are more defensible than relying on hope that the problem will remain distant.

## Quick answers

### Can a quantum computer steal Bitcoin today?

No public quantum computer is currently known to be capable of breaking Bitcoin’s secp256k1 signatures in practice. A sufficiently large fault-tolerant machine could use Shor’s algorithm, but the required logical-qubit scale, error correction, operating time, and cost remain major engineering hurdles.

### Does quantum computing threaten Bitcoin mining?

Mining and spending are separate risks. Quantum technology could eventually reduce the advantage of specialized classical mining hardware, but the more direct concern is signature theft because a forger with a valid private key would not need superior hashing power.

### Are unused Bitcoin addresses quantum safe?

An address that has never revealed the corresponding public key has less immediate exposure, but it is not inherently quantum resistant. Spending from it, using particular script designs, or losing the spending condition can reveal a key that a future quantum attacker could target.

### Why has Bitcoin not adopted post-quantum signatures already?

Post-quantum signatures are generally larger, and changing Bitcoin’s transaction format would require broad consensus and ecosystem support. Wallet, exchange, relay, hardware, and script compatibility must be tested so that a migration does not strand funds or make denial-of-service attacks cheaper.

### Should Bitcoin holders move their coins immediately?

A speculative emergency sale is not justified by current evidence. Holders should prioritize tested backups, trusted custody, key isolation, and awareness of their address types, then monitor Bitcoin Core and wallet standards for a credible migration rather than responding to promotional claims.

Canonical: https://cryptgo.co/knowledge/is_bitcoin_secure_against_quantum_computing_and_when_should_users_prepare.php
Markdown: https://cryptgo.co/knowledge/is_bitcoin_secure_against_quantum_computing_and_when_should_users_prepare.php/index.md