Could quantum computers break Bitcoin?

Mining is the common misconception. Bitcoin mining is a hashing race, so people assume quantum machines would dominate it. Google Quantum AI's 2026 paper argues the opposite. Error correction consumes nearly all of Grover's speedup, and Grover does not parallelize well. Even under what the authors call a "fantastical" assumption, a quantum miner would reach about 0.25 TH/s, against about 110 TH/s for one S19 Pro, a common mining machine. They call quantum mining "science fiction" for now. Chaincode is slightly more cautious, flagging possible centralization if quantum mining ever became dominant.

Which address types expose public keys?

Whether your public key is visible depends on the output type and on how the address has been used.

The Google paper calls Taproot's exposure a "security regression" from a quantum standpoint. It also separates two kinds of attack:

• An at-rest attack targets a public key that has been visible for a long time. The attacker can take days or more. This also hits "safe" types such as bc1q if the address was reused, because an earlier spend recorded the public key on-chain for good.
• An on-spend attack targets a transaction waiting in the mempool, the queue of unconfirmed transactions. Every Bitcoin spend reveals its public key at this point, so every existing address type is exposed to a fast enough machine. The attacker must derive the key and broadcast a competing transaction before a block confirms the original.

How many bitcoin are exposed?

Published estimates range from a quarter to a half of supply, and the more precise counts land near a third. All of them are snapshots that change as coins move.

• Google (2026): the 100,000 largest vulnerable addresses hold about 6.7 million BTC. Of that, over 1.7 million BTC, nearly 9% of all bitcoin, sits in P2PK outputs.
• Chaincode (2025): published estimates range from about 25% to upwards of 50% of supply, with one more precise count from Project Eleven at about 6.26 million BTC, or about 30%.

As a rough check, 6.7 million divided by the 20.1 million bitcoin mined by early November 2026 gives about 33%. That mixes a figure from early 2026 with a later supply count, so treat it as approximate.

These coins fall into two groups with different futures. Active holdings, including exchange wallets that reuse addresses, can move to safer outputs. Dormant coins cannot be moved unless their owners return. Google estimates that vulnerable coins untouched for at least five years may total about 2.3 million BTC. That forces what Chaincode calls the "burn or steal" dilemma: freeze coins that may belong to someone, or let the first quantum attacker take them.

How have resource estimates changed?

Estimates of the hardware needed have fallen sharply, mostly through better algorithms and error correction rather than bigger machines. The figures below use different hardware assumptions, so the trend matters more than any single comparison.

Google's circuits need 1,200 logical qubits and 90 million Toffoli gates (a costly type of quantum operation), or 1,450 logical qubits and 70 million gates. Google published a zero-knowledge proof of these results rather than the circuits, so outsiders can verify the claim without getting an attack recipe.

The speed matters more than the headline qubit count. A machine could prepare half the calculation in advance, then finish in about 9 minutes after seeing a public key. Bitcoin blocks arrive about every 10 minutes on average. Under idealized assumptions, Google puts the chance of a successful on-spend attack at slightly under 41%. Slower designs such as neutral atoms would likely manage only at-rest attacks at first.

The hardware gap is still wide. Google's Willow chip, announced in December 2024, has 105 physical qubits, though it showed errors falling as its encoding grew. IBM's Starling is planned for 2029 with 200 logical qubits, about a sixth of Google's lower figure. No one has published a dependable date. Chaincode says a CRQC could arrive within the next decade, and Google has set 2029 as the target for its own migration, which is a planning decision and not a forecast of when attacks begin.

What has NIST standardized?

NIST, the US standards body, has already published replacements, and the catch for Bitcoin is size. In August 2024 it finalized ML-DSA and SLH-DSA for signatures, plus ML-KEM for encryption. NIST IR 8547, finalized in October 2026, says quantum-vulnerable signatures including ECDSA will be deprecated after 2030 and disallowed under NIST standards after 2035. A further standard derived from FALCON is still in development. These rules govern systems that follow NIST standards. They do not bind Bitcoin.

Larger signatures mean fewer transactions per block or heavier demands on node operators, and block size has split the Bitcoin community before. The move itself also takes block space. Chaincode cites estimates of 76 to 142 days to migrate every coin if blocks carried nothing else, and 305 to 568 days at 25% of block space.

What is Bitcoin doing about it?

Bitcoin has serious proposals, but no quantum-resistant upgrade has been activated. Changing consensus rules needs broad agreement among developers, node operators and miners, usually through a soft fork, a backward-compatible rule change.

• BIP-360, Pay-to-Merkle-Root (P2MR). It was merged into the BIPs repository on February 11, 2026, and its status is Draft. Merging means it is documented, not accepted by the network. P2MR is Taproot without the key-path spend, which removes the at-rest exposure. It deliberately adds no post-quantum signatures, so on-spend attacks remain open until a later proposal adds them.
• BIP-361, legacy signature sunset. Also a Draft, and it depends on a post-quantum signature BIP that is still to be specified. It would first stop people sending coins to quantum-vulnerable outputs. Later, about five years after activation, it would restrict old-style spends unless holders pass a quantum-safe rescue protocol. Abandoned keys would remain unspendable, which is the "burn" side of the dilemma.

What can a holder do now?

Basic address hygiene helps against at-rest attacks and costs little, though it is no complete defense. The Google paper's recommendations amount to this:

1. Avoid reusing addresses, since reuse is what exposes many otherwise hidden keys.
2. Know your output type. Coins on old P2PK or Taproot outputs have visible keys.
3. Remember the limit. No current address type stops an on-spend attack, because spending reveals the key.
4. Keep your seed phrase safe as usual. Conventional theft is the threat that exists today.

Other chains face their own versions of this problem. Google's paper finds Ethereum more exposed at rest, because an account reveals its public key after its first transaction. For more on the underlying math, see our cryptography topic.

Key takeaways

1. Quantum computers threaten Bitcoin's signatures through Shor's algorithm. Hashing and mining face far less risk.
2. About a third of all bitcoin sits at addresses with visible public keys, including about 1.7 million BTC in old P2PK outputs.
3. Estimated hardware needs fell from millions of physical qubits to under 500,000 in Google's 2026 paper, but no machine close to that exists.
4. A fast machine could attack any spend in the mempool, so address hygiene alone is not a full fix.
5. NIST's replacement signatures are 38 to 123 times larger than Schnorr, which makes migration costly.
6. BIP-360 and BIP-361 are drafts. Neither is active, and the fate of dormant coins is unresolved.

Sources

• Babbush et al., Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities (Google Quantum AI, 2026)
• Chaincode Labs, Bitcoin and Quantum Computing (2025)
• BIP-360: Pay-to-Merkle-Root
• BIP-361: Post Quantum Migration and Legacy Signature Sunset
• NIST IR 8547: Transition to Post-Quantum Cryptography Standards
• NIST FIPS 204: Module-Lattice-Based Digital Signature Standard
• Webber et al., The impact of hardware specifications on reaching quantum advantage in the fault tolerant regime

How does Bitcoin mining work, and is it still profitable?

Bitcoin miners race to find a block hash below a network target and earn new coins plus fees. See how difficulty, pools and hashprice work, and a worked October 2026 example showing why a 200 TH/s machine needs power below about 9 cents per kWh.

#consensus#markets#mining