Every few months somebody announces a new quantum chip and feeds fill up with “bitcoin is dead” takes and equally confident “nothing to see here” takes. Both are wrong in interesting ways, but… what does “quantum-safe” means for Bitcoin? How an attack would concretely work? What is the profile of, and how would a rational attacker would actually do with the capability to quantum-attack Bitcoin?

What does “quantum safe” even mean?

Bitcoin uses two unrelated pieces of cryptography, and they fail very differently under quantum computing.

The hashing is fine. SHA-256 (mining, block ids, address derivation) is only threatened by Grover’s algorithm, which gives a quadratic speedup: 256 bits of preimage security become an effective 128, which is still an absurd amount. And for mining specifically, a quantum computer would be racing farms of ASICs that cost cents per terahash; the quantum machine loses that race for any foreseeable future. The only caveat for this would be a quantum algorithm specifically solving to meet-in-the-middle the double-sha process, taking advantage of the zeros required at the start of the hash.

But more importantly, signatures are not safe. Ownership of coins is enforced by ECDSA and Schnorr signatures over the secp256k1 curve, and Shor’s algorithm solves the discrete logarithm problem underneath both. A sufficiently large quantum computer takes a public key and computes the private key from it.

The saving grace is that most Bitcoin scripts don’t put the public key on chain. A typical address (P2PKH, P2WPKH) is a 160-bit hash of the public key, and hashes resist quantum attack. The public key itself is only revealed the moment you spend. So most coins, sitting on a never-spent-from address, are fine for now.

The “not fine” list:

  • P2PK outputs, the original pay-to-public-key style from 2009-2010, have the public key sitting naked on chain. This includes the ~1M BTC attributed to Satoshi.
  • Reused addresses. The first time you spend from an address, your public key is published forever. Any balance remaining on (or later sent back to) that address is exposed. Address reuse has always been bad for privacy; here it becomes bad for solvency.
  • Taproot (P2TR) puts a tweaked public key directly in the output, so every taproot UTXO is exposed by construction.

Add it up and studies estimate that somewhere around a quarter of all Bitcoin sits in outputs whose public key is already public. “Not fine” means: the day a big enough quantum computer exists, those coins belong to whoever runs it, and the theft is cryptographically indistinguishable from the legitimate owner spending.

How the attacks actually get executed

There are two attack shapes, and the distinction matters because they require wildly different machines.

The long-range attack: retrieving private keys at leisure. Scan the blockchain, collect every exposed public key, sort by balance, and grind Shor’s algorithm against them one by one. Nobody can stop you and there is no deadline, the dormant P2PK coins from 2010 haven’t moved in fifteen years and their owners may not even be alive. This works even with a slow quantum computer that needs weeks per key.

The short-range attack: racing the mempool. Every ordinary transaction reveals its public key at broadcast time. If your quantum computer can derive the private key faster than the transaction confirms (minutes to hours) you can sign a competing transaction sending the coins to yourself, with a higher fee. Now every spender is vulnerable, not just the exposed-key list. This is the doomsday version, and it needs a machine several orders of magnitude faster than the long-range one.

For calibration: a 2022 estimate put breaking one 256-bit elliptic curve key in a day at ~13 million physical qubits, and in an hour at ~317 million. The biggest machines today have on the order of a thousand noisy qubits. That’s not “never”, since error correction is improving faster than qubit counts, and “harvest now, decrypt later” already works against exposed keys. It’s not never, but it’s not next year either.

Taking a look at the current reused addresses, it’s mostly big exchanges’ hot wallets. Coinbase is notoriously missing there; other exchanges should upgrade.

If you had the quantum computer, what would you do?

This is my favorite part, because the economics constrain the attacker more than the cryptography does. Suppose the machine in your basement can derive one private key per day. Three strategies:

A) The Shorting. You never need to steal anything. Open the largest short position on Bitcoin the derivatives markets will give you, then publicly prove the capability (move one satoshi from a famous dormant P2PK address, or post the private key of a known-but-empty one). The price collapses, you profit on the way down with clean hands, arguably having stolen from no one. It’s the highest legality-to-profit ratio, it’s probably executable exactly once, and it is self-limiting: exchanges halt, counterparties fail, and your billion-dollar win depends on someone solvent being on the other side of the trade. Which is not really that liquid, I think it’s about 8-9 figures.

The Extortion. Derive keys for dormant whales and either take the coins slowly (laundering billions without moving the market is its own unsolved problem) or contact living owners and sell them their own keys back. The cruel detail is that stealing dormant coins might go unnoticed for years, but every coin you touch and sell applies pressure to the price of the remaining loot. Slow, risky, and it turns you into the most wanted person on the planet.

The Savior. Announce the capability, steal nothing, and offer to help. Prestige, book deals, and a place in history… Honestly, the most rational play if you’re not already a criminal, because it’s the only one where your capability retains value instead of destroying the asset it targets. The community response would follow the path already being paved: BIP-360-style post-quantum output types, migration of active coins, and then the genuinely hard question that has no technical answer: what to do with the vulnerable dormant coins. Freeze them and you’ve confiscated property to protect it, including Satoshi’s. Leave them and you’ve created a multi-hundred-billion dollar bounty that guarantees the attack happens. I don’t think the Bitcoin community has an answer to this yet, and the debate will be uglier than the block size war.

So? Is Bitcoin quantum-dead?

No. It fails gracefully for the careful and catastrophically for the careless. If you never reuse addresses and stay off taproot for cold storage, a quantum computer has to beat the confirmation time to touch you. If your coins sit behind an exposed public key, and someone has a quantum computer powerful enough today, they’re already harvested, just not yet decrypted. The physics gives us years of warning through qubit counts and error-correction milestones; slow enough for Bitcoin’s governance process to solve the migration debate.