The Core Vulnerability: Public Key Exposure
Bitcoin's quantum vulnerability is not about breaking SHA-256 — that would require Grover's algorithm and roughly 2^128 operations even on a quantum computer, which remains computationally infeasible. The vulnerability is in the signature scheme: secp256k1 ECDSA.
When you sign a Bitcoin transaction, you reveal your public key. Shor's algorithm can derive a private key from a public key on the secp256k1 curve. An attacker with a sufficiently capable quantum computer could therefore take any exposed public key from the Bitcoin blockchain and compute the corresponding private key — then sign a transaction spending that wallet's funds before the legitimate owner can respond.
Alice and Bob Research published revised estimates in October 2026 placing the physical qubit requirement at approximately 29,588 qubits using optimised surface code error correction — significantly lower than the 317 million figure from Webber et al. (2022). The lower estimate uses improved magic-state distillation protocols and reflects genuine progress in error correction efficiency.
Address Type Risk Comparison
| Address Type | Public Key Exposed? | Quantum Risk | Approximate BTC Affected |
|---|---|---|---|
| P2PK (Pay-to-Public-Key) | Always, by design | Critical | ~1.7M BTC (including Satoshi's early coins) |
| P2PKH — reused (already spent) | Yes, after first spend | High | Majority of circulating supply |
| P2TR (Taproot) — keypath spend | Yes, when spent via keypath | High | Growing share of Taproot outputs |
| P2PKH — fresh (never spent) | No, until first outgoing TX | Medium | Unknown — addresses that received but never sent |
| P2SH (multisig) | Yes, when redeemed | High (after spend) | Significant DeFi/exchange cold storage |
P2PK: Immediately Vulnerable
Pay-to-Public-Key is the oldest Bitcoin address format, used in Satoshi's early coinbase rewards and the original Bitcoin Core wallet. In P2PK outputs, the recipient's public key is written directly into the scriptPubKey. There is no hashing step. These addresses expose the public key at all times — no transaction is required to reveal it.
Approximately 1.7 million BTC sit in P2PK outputs. This includes coins from Bitcoin's first year of operation that have never moved. These would be among the first targets for any attacker with a capable quantum computer.
P2PKH Reused Addresses: High Risk
Pay-to-Public-Key-Hash (P2PKH) is the most common address format — the familiar 1xxx addresses. In a fresh P2PKH address, the public key is hashed (SHA-256 then RIPEMD-160), and only the hash appears on-chain. The actual public key is not revealed until the address is spent from for the first time.
Once you send a transaction from a P2PKH address, your public key appears in the spending transaction's scriptSig and is permanently recorded on-chain. Any subsequent funds sent to that same address are exposed: the public key is already known, and a quantum attacker can derive the private key.
Bitcoin best practice has always been to use a fresh address for each receive. In practice, address reuse is common — particularly for exchange deposit addresses, donation addresses, and wallets that do not implement HD derivation. Every address that has been used as both a sender and a recipient falls into this high-risk category.
P2TR (Taproot): Conditionally Exposed
Taproot addresses (bc1p...) use Schnorr signatures over secp256k1 — not ECDSA, but the same underlying elliptic curve. Schnorr signatures are equally vulnerable to Shor's algorithm.
When a Taproot output is spent via the keypath (the common case — no script conditions triggered), the Schnorr public key is revealed in the witness. That output is then exposed in the same way as a spent P2PKH address. Taproot's script path (where a MAST script root is used instead of the key directly) provides slightly more complexity but does not change the fundamental curve vulnerability.
Fresh P2PKH Addresses: Lower Risk, Not Zero Risk
An address that has never sent a transaction has never exposed its public key. For P2PKH, only the hash of the public key is on-chain. Shor's algorithm cannot reverse SHA-256 efficiently — you would need the pre-image (the public key) to apply the elliptic curve attack.
However, this protection disappears the moment you spend from that address. Any address used to receive funds that you later need to spend will expose its public key at spending time. The window of exposure is brief — a few seconds to a few minutes between broadcasting the spending transaction and it being mined — but a quantum attacker monitoring the mempool could in principle derive the private key and submit a competing transaction.
This is the "race condition" attack: if quantum computers are fast enough to factor a secp256k1 key in under one block time (~10 minutes for Bitcoin), every spend becomes a race between the legitimate transaction confirming and the attacker's competing transaction.
What Bitcoin Holders Should Do Now
The practical steps depend on which address types hold your funds:
- P2PK addresses: Move funds to a fresh P2PKH or P2TR address immediately. These coins are the most exposed and require action before quantum hardware advances further.
- Reused P2PKH addresses: Plan to migrate. Set a threshold — if a quantum computer at 29,588 qubits becomes credibly feasible within your planning horizon, move these coins first.
- Fresh P2PKH addresses: Follow standard UTXO hygiene: spend in a single outgoing transaction rather than consolidating over time, and always send change to a new address.
- Watch BIP-360: The P2QRH (Pay-to-Quantum-Resistant-Hash) proposal would add a native post-quantum address type to Bitcoin. As of late 2026, this is a draft proposal with no activation date. Following its progress gives you a migration target once it activates.
The Timeline Question
IBM's most capable publicly disclosed hardware as of late 2026 has fewer than 200 physical qubits at production-grade fidelity — a gap of roughly two orders of magnitude from the 29,588 figure. However, the trajectory is the important variable. IBM's public roadmap targets thousands of physical qubits by the end of this decade. PsiQuantum and QuEra are pursuing photonic and neutral-atom approaches that could scale differently.
The 29,588 qubit figure assumes near-term error correction improvements, not hardware that exists today. But it changes the nature of the risk from "decades away, theoretical" to "within the plausible planning horizon for long-lived assets." Bitcoin held in P2PK outputs that do not move for another five to ten years may face genuine exposure.
