---
layout: post
title: "Is Bitcoin Quantum-Safe?"
date: 2026-05-13
---

Every few months somebody announces a new quantum chip and feeds fill up with
"bitcoin is dead" takes and equally confident "nothing to see here" takes. Both
are wrong in interesting ways, but... what does "quantum-safe" means for
Bitcoin? How an attack would concretely work? What is the profile of, and how
would a rational attacker would actually *do* with the capability to
quantum-attack Bitcoin?

### What does "quantum safe" even mean?

Bitcoin uses two unrelated pieces of cryptography, and they fail very
differently under quantum computing.

The hashing is fine. SHA-256 (mining, block ids, address derivation) is only
threatened by [Grover's
algorithm](https://en.wikipedia.org/wiki/Grover%27s_algorithm), which gives a
quadratic speedup: 256 bits of preimage security become an effective 128, which
is still an absurd amount. And for mining specifically, a quantum computer
would be racing farms of ASICs that cost cents per terahash; the quantum
machine loses that race for any foreseeable future. The only caveat for this
would be a quantum algorithm specifically solving to meet-in-the-middle the
double-sha process, taking advantage of the zeros required at the start of the
hash.

But more importantly, signatures are not safe. Ownership of coins is enforced
by ECDSA and Schnorr signatures over the secp256k1 curve, and [Shor's
algorithm](https://en.wikipedia.org/wiki/Shor%27s_algorithm) solves the
discrete logarithm problem underneath both. A sufficiently large quantum
computer takes a public key and computes the private key from it.

The saving grace is that most Bitcoin scripts don't put the public key on
chain. A typical address (P2PKH, P2WPKH) is a 160-bit hash of the public key,
and hashes resist quantum attack. The public key itself is only revealed the
moment you spend. So most coins, sitting on a never-spent-from address, are
fine for now.

The "not fine" list:

- P2PK outputs, the original pay-to-public-key style from 2009-2010,
  have the public key sitting naked on chain. This includes the ~1M BTC
  attributed to Satoshi.
- Reused addresses. The first time you spend from an address, your
  public key is published forever. Any balance remaining on (or later sent
  back to) that address is exposed. Address reuse has always been bad for
  privacy; here it becomes bad for solvency.
- Taproot (P2TR) puts a tweaked public key directly in the output, so
  every taproot UTXO is exposed by construction.

Add it up and [studies estimate](https://www.deloitte.com/nl/en/services/consulting-risk/perspectives/quantum-computers-and-the-bitcoin-blockchain.html)
that somewhere around a quarter of all Bitcoin sits in outputs whose public
key is already public. "Not fine" means: the day a big enough quantum
computer exists, those coins belong to whoever runs it, and the theft is
cryptographically indistinguishable from the legitimate owner spending.

### How the attacks actually get executed

There are two attack shapes, and the distinction matters because they require
wildly different machines.

**The long-range attack: retrieving private keys at leisure.** Scan the
blockchain, collect every exposed public key, sort by balance, and grind Shor's
algorithm against them one by one. Nobody can stop you and there is no
deadline, the dormant P2PK coins from 2010 haven't moved in fifteen years and
their owners may not even be alive. This works even with a slow quantum
computer that needs weeks per key.

**The short-range attack: racing the mempool.** Every ordinary transaction
reveals its public key at broadcast time. If your quantum computer can derive
the private key faster than the transaction confirms (minutes to hours) you can
sign a competing transaction sending the coins to yourself, with a higher fee.
Now every spender is vulnerable, not just the exposed-key list. This is the
doomsday version, and it needs a machine several orders of magnitude faster
than the long-range one.

For calibration: [a 2022
estimate](https://www.avs.org/AVS/files/c7/c7f43594-b0a7-4bbe-89ba-eee907564f6f.pdf)
put breaking one 256-bit elliptic curve key in a day at ~13 million physical
qubits, and in an hour at ~317 million. The biggest machines today have on the
order of a thousand noisy qubits. That's not "never", since error correction is
improving faster than qubit counts, and "harvest now, decrypt later" already
works against exposed keys. It's not *never*, but it's not next year either.

Taking a look at the current reused addresses, it's mostly big exchanges' hot
wallets. Coinbase is notoriously missing there; other exchanges should upgrade.

### If you had the quantum computer, what would you do?

This is my favorite part, because the economics constrain the attacker more
than the cryptography does. Suppose the machine in your basement can derive one
private key per day. Three strategies:

**A) The Shorting.** You never need to steal anything. Open the largest short
position on Bitcoin the derivatives markets will give you, then publicly prove
the capability (move one satoshi from a famous dormant P2PK address, or post
the private key of a known-but-empty one). The price collapses, you profit on
the way down with clean hands, arguably having stolen from no one. It's the
highest legality-to-profit ratio, it's probably executable exactly once, and it
is self-limiting: exchanges halt, counterparties fail, and your billion-dollar
win depends on someone solvent being on the other side of the trade. Which is
not really that liquid, I think it's about 8-9 figures.

**B) The Extortion.** Derive keys for dormant whales and either take the coins
slowly (laundering billions without moving the market is its own unsolved
problem) or contact living owners and sell them their own keys back. The cruel
detail is that stealing *dormant* coins might go unnoticed for years, but every
coin you touch and sell applies pressure to the price of the remaining loot.
Slow, risky, and it turns you into the most wanted person on the planet.

**C) The Savior.** Announce the capability, steal nothing, and offer to help.
Prestige, book deals, and a place in history... Honestly, the most rational
play if you're not already a criminal, because it's the only one where your
capability retains value instead of destroying the asset it targets. The
community response would follow the path already being paved:
[BIP-360-style](https://github.com/cryptoquick/bips/blob/p2qrh/bip-0360.mediawiki)
post-quantum output types, migration of active coins, and then the genuinely
hard question that has no technical answer: what to do with the vulnerable
dormant coins. Freeze them and you've confiscated property to protect it,
including Satoshi's. Leave them and you've created a multi-hundred-billion
dollar bounty that guarantees the attack happens. I don't think the Bitcoin
community has an answer to this yet, and the debate will be uglier than the
block size war.

### So? Is Bitcoin quantum-dead?

No. It fails gracefully for the careful and catastrophically for the careless.
If you never reuse addresses and stay off taproot for cold storage, a quantum
computer has to beat the confirmation time to touch you. If your coins sit
behind an exposed public key, and someone has a quantum computer powerful
enough today, they're already harvested, just not yet decrypted. The physics
gives us years of warning through qubit counts and error-correction milestones;
slow enough for Bitcoin's governance process to solve the migration debate.