--- title: Will quantum computers break Bitcoin? description: In theory yes, in practice not yet. How the attack would work, how exposed Bitcoin is today, and what BIP-360 does and does not fix. url: "https://hardyindex.com/guides/will-quantum-computers-break-bitcoin" section: Understand the threat updated: 2026-08-12 methodology_version: 1.1 --- # Will quantum computers break Bitcoin? **In theory, yes: a large enough quantum computer could break the cryptography securing Bitcoin, by deriving a private key from a public one. In practice, no such machine exists, and Bitcoin now has two draft proposals for defences. The Hardy Index rates Bitcoin 17.0 out of 100 on quantum readiness.** *As of 12 August 2026. This is a security-readiness assessment, not investment advice.* This is the mechanism, explained without the maths. How a quantum computer would actually take coins, how much of Bitcoin is in reach, and what Bitcoin is doing about it. ## How would a quantum computer break Bitcoin? A quantum computer would break Bitcoin by calculating a private key from a public key that is already visible on the blockchain. It would then sign a transaction with that key, and the network would accept it as genuine, because it is genuine by every rule Bitcoin has. The attack does not break the blockchain, and it does not mint new coins. It forges an owner. That is worth being precise about, because it tells you which coins are at risk: the ones whose public key an attacker can already see. A Bitcoin public key becomes visible in two ways. Some very early outputs published the key directly when the coins were received. Every other address publishes its key the moment it spends, because the signature has to be checked against it. An address that has spent once has shown its key for good. There is also a narrower live-transaction attack. A quantum computer fast enough could grab a public key from a transaction waiting to be confirmed and race to spend the same coins first. That needs speed rather than patience, and it is the harder version of the attack. ## What is ECDSA, and why is it vulnerable? ECDSA is the signature scheme Bitcoin uses to prove a payment was authorised by the coin's owner. It is vulnerable because Shor's algorithm can reverse the maths it relies on. Bitcoin also uses Schnorr signatures on the same secp256k1 curve, and both break the same way. The security of ECDSA rests on one gap. Multiplying a private key by a fixed point on an elliptic curve is easy, and working backwards from the result is not. An ordinary computer would need longer than the age of the universe to do it. Shor's algorithm, running on a large quantum computer, turns that into a calculation of a few minutes. This is why the fix has to be a new signature scheme rather than better key management. NIST, the United States standards body, [published its first post-quantum signature standards in August 2024](https://csrc.nist.gov/pubs/fips/204/final): ML-DSA in FIPS 204 and SLH-DSA in FIPS 205. Those are the replacements chains are working toward. Mining is a separate question, and a much calmer one. Bitcoin mining uses SHA-256 hashing, which quantum computers weaken rather than break. The threat here is to ownership, not to the chain itself. ## How exposed is Bitcoin right now? Roughly a quarter to a third of all Bitcoin sits at addresses whose public keys are already visible. That is the largest measured exposure of any chain in the Hardy Index. Estimates differ because analysts draw the line differently, and they agree on the order of magnitude. - Deloitte found roughly 4 million BTC in original pay-to-public-key outputs and reused addresses with revealed keys, about 25% of supply. - Galaxy Digital estimated roughly 7 million BTC in exposed addresses in March 2026. - Glassnode put the figure at 6.04 million BTC, or 30.2% of supply. - Citi Institute reported in January 2026 that public key exposure applies to about 25% of coins, worth $500 billion to $600 billion. It also noted that on many other blockchains the majority of coins are vulnerable. Exposure cannot be reversed for the coins concerned. A key that has appeared on a public ledger stays there. Some of those coins, including the earliest holdings, belong to people who are no longer around to move them. That is a large part of what makes this problem political rather than merely technical. That is why exposure is one of the six dimensions in every Hardy Score, and why Bitcoin scores 17.0 out of 100 overall. [The full Bitcoin profile](https://hardyindex.com/chains/bitcoin) shows the score on each dimension with the source behind it. ## Is Bitcoin doing anything about it? Yes, but nothing that protects anyone yet. Two proposals reached Draft status in the Bitcoin Improvement Proposals repository on 11 February 2026, and neither is activated, and neither introduces a post-quantum signature scheme. - [BIP-360](https://github.com/bitcoin/bips/blob/master/bip-0360.mediawiki) defines Pay-to-Merkle-Root, an output type similar to Taproot with the quantum-vulnerable key path removed. No public key appears on-chain when the output is created. The specification states explicitly that it does not introduce post-quantum signature schemes. - [BIP-361](https://bips.dev/361/) proposes sunsetting legacy signatures in two phases. Sends to vulnerable address types would stop roughly three years after activation, and ECDSA and Schnorr spends would be restricted two years after that. BIP-361 is where the argument lives. Coins whose owners never migrate, including lost coins and the earliest holdings, would stop being spendable. The choice it forces is between coins being frozen and coins eventually being stolen, and Bitcoin has no way to make that decision quietly. That is why the Hardy Index places Bitcoin in Tier 4: Debating rather than lower. The threat is acknowledged and the work is documented in public. What does not exist is consensus, an activation path or a date. [How the tiers are defined](https://hardyindex.com/methodology) sets out where that line sits. ## What does this mean if you hold Bitcoin? It means your risk is real but not immediate, and the useful steps are small. No machine can take your coins today. The most valuable thing you can do now costs nothing: stop reusing addresses, so your public key stays hidden until the moment you spend. Google's Quantum AI team gave the same advice alongside its 2026 resource estimate. It [recommended that people refrain from exposing or reusing vulnerable wallet addresses](https://research.google/blog/safeguarding-cryptocurrency-by-disclosing-quantum-vulnerabilities-responsibly/), and that blockchains transition to post-quantum cryptography. The rest is watching. If Bitcoin activates a post-quantum output type, migrating to it will be a wallet update and a move to a new address. [How to protect your crypto from quantum computers](https://hardyindex.com/guides/how-to-protect-crypto-from-quantum-computers) covers the steps in order, and [the Hardy Index](https://hardyindex.com/) shows where every other chain you hold stands. ## Frequently asked questions ### Can quantum computers break Bitcoin today? No. Breaking Bitcoin would need a quantum computer that can derive a private key from a public key. Google Quantum AI estimated in March 2026 that this would take fewer than 1,200 logical qubits and fewer than 500,000 physical qubits. The largest processors publicly announced are far smaller, and IBM does not expect to deliver a large-scale fault-tolerant machine until 2029. ### How much Bitcoin could a quantum computer steal? Estimates run from about 4 million to about 7 million BTC. Deloitte found roughly 4 million BTC across original pay-to-public-key outputs and reused addresses, around 25% of supply. Galaxy Digital estimated roughly 7 million BTC in March 2026, and Glassnode put it at 6.04 million, or 30.2%. Those are the coins whose public keys are already visible on-chain. ### Does BIP-360 make Bitcoin quantum-safe? No. BIP-360 defines a new output type that keeps public keys off the chain until coins are spent, which reduces exposure for new outputs. It does not introduce a post-quantum signature scheme, and the specification says so explicitly. It also has Draft status, meaning it is documented for discussion rather than agreed or activated. ### Would a quantum computer break Bitcoin mining? Not in the same way. Mining relies on SHA-256 hashing, and the best known quantum attack on a hash function is Grover's algorithm. Grover offers a quadratic speed-up, not the exponential break that Shor's algorithm gives against elliptic-curve signatures. The realistic quantum threat to Bitcoin is to ownership of coins, not to mining. ### What happens to lost Bitcoin if quantum computers arrive? Lost coins at exposed addresses are the hardest case in the whole debate. Their owners cannot migrate them, because nobody can sign for them. BIP-361 proposes making legacy signatures unspendable at a fixed block height, which would freeze those coins rather than let a future attacker take them. That trade-off is contested and unresolved. ## Where to go next - [Bitcoin: the full quantum readiness profile](https://hardyindex.com/chains/bitcoin): Hardy Score 17.0, with the sourced note behind every dimension. - [The Hardy Index ranking](https://hardyindex.com/): All 23 rated chains, ranked by Hardy Score, as of 12 August 2026. - [Is my crypto safe from quantum computers?](https://hardyindex.com/guides/is-my-crypto-safe-from-quantum-computers): The calm overview, if you want the shorter version first. - [Q-Day, and when quantum might break crypto](https://hardyindex.com/guides/q-day-when-will-quantum-break-crypto): What the expert estimates say about timing. - [How to protect your crypto, step by step](https://hardyindex.com/guides/how-to-protect-crypto-from-quantum-computers): The practical steps, in order, with the trade-offs named. ## Sources 1. [BIP-360: Pay-to-Merkle-Root (P2MR)](https://github.com/bitcoin/bips/blob/master/bip-0360.mediawiki): Bitcoin Improvement Proposals (primary, checked 12 August 2026) 2. [BIP-361: Post Quantum Migration and Legacy Signature Sunset](https://bips.dev/361/): Bitcoin Improvement Proposals (primary, checked 12 August 2026) 3. [Safeguarding cryptocurrency by disclosing quantum vulnerabilities responsibly](https://research.google/blog/safeguarding-cryptocurrency-by-disclosing-quantum-vulnerabilities-responsibly/): Google Research (primary, checked 12 August 2026) 4. [FIPS 204: Module-Lattice-Based Digital Signature Standard](https://csrc.nist.gov/pubs/fips/204/final): National Institute of Standards and Technology (primary, checked 12 August 2026) 5. [Quantum Threat: the trillion-dollar security race is on](https://www.citigroup.com/rcs/citigpa/storage/public/Citi_Institute_Quantum_Threat.pdf): Citi Institute (primary, checked 12 August 2026) 6. ['That is the end of Bitcoin': the quantum race for $470 billion](https://www.forbes.com/sites/boazsobrado/2026/08/02/that-is-the-end-of-bitcoin-the-quantum-race-for-470-billion/): Forbes (secondary, checked 12 August 2026) --- Cite as: The Hardy Index, "Will quantum computers break Bitcoin?", https://hardyindex.com/guides/will-quantum-computers-break-bitcoin, as of 12 August 2026.