Quantum Computers vs. Bitcoin: Could They One Day Break Its Security?

Quantum computers are often described as one of the technologies that could one day threaten Bitcoin's security. That does not mean today's quantum machines could break the Bitcoin network, or that holders of the cryptocurrency should start to panic. For now, the risk is mainly theoretical. At the same time, it is real enough that governments, technology companies and Bitcoin's own developers are preparing for it.

Bitcoin is built on cryptography. It is what allows users to prove they have the right to spend their bitcoins without revealing their private key to anyone. The correctly implemented cryptographic methods Bitcoin uses today are practically unbreakable with classical computers. A sufficiently powerful quantum computer, however, could solve certain mathematical problems dramatically faster.

So the question is not whether today's quantum computers can attack Bitcoin. They cannot. What matters more is whether a machine powerful and stable enough to actually defeat one of its key protections will appear in the future.

A quantum computer would not threaten every part of Bitcoin equally

The phrase "breaking Bitcoin" often covers several different things, because Bitcoin does not rely on just one cryptographic mechanism.

To sign transactions, Bitcoin has traditionally used ECDSA digital signatures based on the secp256k1 elliptic curve. The more modern Taproot uses Schnorr signatures, also built on the secp256k1 curve. This is precisely the part of the system that a sufficiently powerful quantum computer could put at risk.

Under normal circumstances, a public key can easily be calculated from a private key. Going the other way, however, is practically impossible for classical computers. The security of digital signatures depends on this.

A powerful quantum computer running what is known as Shor's algorithm could, in theory, solve the mathematical problem on which this protection rests. It could then derive the private key from the public key. An attacker could create a valid signature and move the bitcoins without ever having owned the original private key.

The situation is different for hash functions such as SHA-256, which also plays an important role in Bitcoin mining. Grover's quantum algorithm could theoretically speed up some operations, but it would not amount to the same complete break that Shor's algorithm represents for digital signatures. According to Bitcoin Optech, the theoretical security of a 256-bit hash against certain attacks would fall to roughly 128 bits, which is still an exceptionally high level of security.

The biggest quantum risk to Bitcoin is therefore not that someone could simply "break the blockchain", but the possibility of obtaining the private keys to some bitcoins.

The public key plays a crucial role

Even here, not all bitcoins face the same level of risk. With some types of Bitcoin addresses, the public key is not directly visible until the owner spends the funds. Until then, only its hash may be stored on the blockchain. As soon as the user sends a transaction from such an output, however, the public key has to be revealed so the network can verify the signature.

If the same key continues to be used afterwards, it remains publicly available on the blockchain. Other types of Bitcoin outputs reveal the public key even before the funds are spent. The difference between public keys exposed over the long term and those exposed only briefly is also what proposals to make Bitcoin more quantum resistant in the future are designed to address.

In a hypothetical future with a sufficiently powerful quantum computer, there would be two basic scenarios. In the simpler case, an attacker would have plenty of time to crack a public key, because it has long been recorded on the blockchain. A more difficult attack would require obtaining the private key in the short window between a transaction being broadcast and its confirmation in a block.

This second scenario would require not only a sufficiently powerful quantum computer, but also the ability to complete the calculation extremely quickly.

Today's quantum computers cannot break Bitcoin

The key point is that this scenario is not practically feasible today. In July 2026, the US National Institute of Standards and Technology, NIST, stated that current quantum computers are still too small and unstable to pose a threat to today's cryptography. No one can say exactly when, or whether at all, a so-called cryptographically relevant quantum computer capable of genuinely attacking current systems will be built. Progress, however, continues.

In 2026, researchers from Google and several universities published a new estimate of the computing power needed to break 256-bit elliptic curve cryptography, which includes the secp256k1 curve used by Bitcoin. According to their work, an optimised version of Shor's algorithm could require roughly 1,200 to 1,450 logical qubits and tens of millions of quantum operations.

That does not mean it would be enough to build a computer with 1,200 of today's qubits. Logical qubits have to be protected against errors, and implementing them may require a far larger number of physical qubits. Stability and error correction remain among the biggest obstacles to practical quantum computing.

Newer estimates therefore suggest that a quantum attack may not be impossible forever. At the same time, it is not a capability that any existing computer has today.

Cryptography is already preparing for the quantum era

Bitcoin is also not the only system the problem would affect. Sufficiently powerful quantum computers could threaten much of the cryptography used on the internet, in the financial system, in public administration and in securing communications. That is why so-called post-quantum cryptography has been under development for several years.

In 2024, NIST approved the first three post-quantum cryptography standards, designed to withstand attacks by future quantum computers. They include the new digital signature schemes ML-DSA and SLH-DSA.

The institute is also urging organisations not to wait with the transition to the new technologies. On its page dedicated to post-quantum cryptography, it states that now is the time to start migrating to the new standards, before quantum computers become a practical threat.

For Bitcoin, the situation is more complicated. One algorithm cannot simply be swapped for another through an update on a central server. Any change would have to go through the Bitcoin development process and then be supported by wallets, exchanges, custody services and other parts of the ecosystem.

Post-quantum signatures may also have different parameters and larger data requirements than the signatures Bitcoin uses today, which would need to be taken into account in any proposed change.

Bitcoin is already preparing possible solutions

The debate is not purely academic, however. There are already concrete proposals for changes to Bitcoin.

One of them is BIP 360, which proposes a new type of Bitcoin output called Pay-to-Merkle-Root, or P2MR for short. One of its aims is to increase resistance to future attacks on elliptic curve cryptography by ensuring that the public key does not have to remain exposed over the long term.

The proposal itself notes, however, that it mainly protects against attacks in which the attacker has a longer period of time to crack the public key. Protecting against a very fast attack on a key revealed, for example, while a transaction waits in the mempool would probably require introducing a genuine post-quantum signature scheme.

BIP 360 is still listed as a draft and is not part of the active rules of the Bitcoin network.

Another proposal, BIP 361, published in 2026, goes even further. Once a post-quantum output type has been introduced, it proposes gradually phasing out the vulnerable ECDSA and Schnorr signatures. Bitcoin holders would be given enough time to move their funds to a more quantum resistant system.

BIP 361 is also only a proposal for now. It is listed as a draft and its adoption is not certain.

The purpose of such proposals is to prepare a migration path before any acute threat emerges. Changing Bitcoin's core cryptography would have to be prepared and tested well in advance.

Quantum computers are no reason to panic. But they cannot be ignored

The idea of a quantum computer stealing bitcoins from wallets around the world within minutes currently belongs more to the realm of hypothetical scenarios than practical risks.

Today's quantum machines have neither the power nor the stability needed to break Bitcoin's cryptography. Even NIST cannot say when a computer powerful enough to genuinely threaten current cryptographic methods will appear.

On the other hand, the mathematical principle of the attack is well known. If a sufficiently powerful quantum computer were ever built, Bitcoin's current signature mechanisms could genuinely be at risk.

The good news is that the problem does not come as a surprise to developers. Post-quantum algorithms already exist, the global cryptography community is working on deploying them, and the first proposals for a possible transition are being developed directly for Bitcoin as well.

Quantum computers therefore do not pose an immediate threat to bitcoin holders today. They are, however, one of the technological risks the world's largest cryptocurrency will have to prepare for before a theoretical question turns into a practical problem.

The content of this article is for informational purposes only and does not constitute investment advice or a recommendation to purchase any specific asset. Investing in crypto assets carries a high level of risk. The value of crypto assets can fall as well as rise, and you may lose the entire amount you have invested. Crypto assets are not protected by deposit guarantee schemes. Past returns are not a guarantee of future results.