Is Bitcoin safe from quantum computers today?

Yes, today — because no quantum computer with sufficient qubits and quality exists. Bitcoin's secp256k1 ECDSA is theoretically vulnerable to Shor's algorithm, and Alice & Bob's October 2026 research revised the required physical qubit count to approximately 29,588. Current quantum computers are below this threshold but IBM, Google, and PsiQuantum have credible roadmaps toward this scale within 5-10 years.

Which Bitcoin addresses are most at risk from quantum computers?

P2PK addresses (which expose the public key directly on-chain) are fully exposed with no time constraint. P2PKH and Taproot addresses that have previously sent transactions have their public keys permanently on-chain from the spending transaction. Addresses that have only ever received Bitcoin and never sent reveal only a hash of the public key, making them harder (but not impossible) to attack.

Does Taproot make Bitcoin quantum-resistant?

No. Taproot uses Schnorr signatures over secp256k1 instead of ECDSA, but both are vulnerable to Shor's algorithm applied to the elliptic curve discrete logarithm problem. Taproot's primary purpose is improved privacy and scripting efficiency, not quantum resistance.

Can Bitcoin migrate to post-quantum signatures?

In principle, yes. It would require a consensus change (likely a hard fork), replacement of secp256k1 with a NIST PQC signature scheme (ML-DSA or FN-DSA), coordinated wallet migration across the entire ecosystem, and protocol adjustments for the larger signature sizes. The coordination challenge is significant — coins in unresponsive wallets would remain vulnerable unless burned or confiscated by social consensus.

What is the 317 million qubit figure and why is it outdated?

The 317 million qubit figure came from a 2022 University of Sussex paper calculating the resources needed to attack Bitcoin within a strict 10-minute transaction window, assuming early-era surface code error correction at 10^-3 physical error rates. Alice & Bob's October 2026 analysis uses modern 10^-4 error rates, improved magic-state distillation, the no-time-constraint attack model, and Regev algorithm refinements, arriving at ~29,588 physical qubits.

Is Bitcoin Quantum-Safe in 2026? A Technical Answer

The Direct Answer

Bitcoin is not quantum-safe. Its signature algorithm, secp256k1 ECDSA, can be broken by Shor's algorithm running on a sufficiently large fault-tolerant quantum computer. Alice & Bob's October 2026 research revised the physical qubit requirement for this attack down to approximately 29,588 qubits — roughly 10,000 times fewer than the 317 million cited in 2022 analyses.

This does not mean Bitcoin is vulnerable today. No quantum computer currently exists that meets the requirements. But the engineering path to a capable quantum computer is now clearly defined and consistent with hardware roadmaps from IBM, Google, and PsiQuantum on a 5-to-10 year timeline.

Why Bitcoin Is Vulnerable: The Cryptographic Mechanism

Bitcoin's security ultimately rests on the difficulty of one mathematical problem: given a public key derived from a private key via elliptic curve multiplication, find the private key.

Elliptic curve multiplication is easy in one direction. Given a private key k and a generator point G on the secp256k1 curve, computing the public key Q = k*G takes milliseconds. Reversing this — finding k given Q and G — is the elliptic curve discrete logarithm problem (ECDLP). For classical computers, no efficient algorithm for ECDLP is known. The best classical algorithms run in exponential time on the key size.

Shor's algorithm, designed for quantum computers, solves ECDLP in polynomial time — specifically, in approximately O(n^3) operations on a log2(n)-qubit quantum computer, where n is the bit size of the key. For Bitcoin's 256-bit secp256k1 keys, this requires approximately 2,330 logical qubits running Shor's algorithm. With modern surface code error correction at physical error rates of 10^-4, 2,330 logical qubits requires approximately 29,588 physical qubits.

Address Types and Their Quantum Exposure

Not all Bitcoin addresses are equally at risk. The exposure depends on whether the public key has been revealed on-chain:

P2PK (Pay-to-Public-Key): Fully Exposed

Early Bitcoin transactions, including most coins from the first two years of the network, used P2PK outputs. These store the full public key directly in the UTXO. Any address in this format has its public key permanently on-chain and is fully exposed to a quantum attack without any time constraint.

This includes some of the largest Bitcoin holdings. Estimates suggest approximately 1.7 million BTC sits in P2PK outputs, many associated with the Bitcoin genesis period.

P2PKH (Pay-to-Public-Key-Hash): Exposed on First Spend

Standard P2PKH addresses store the hash of the public key rather than the public key itself. The public key is only revealed when a transaction is spent from that address, appearing in the scriptSig of the spending transaction.

An address that has never been used to send transactions reveals only HASH160(pubkey). Attacking this requires first breaking HASH160 (SHA256 followed by RIPEMD160), which is a preimage resistance problem rather than a discrete logarithm. This is a Grover-class problem, not Shor-class, and requires far more quantum resources.

However, any P2PKH address that has previously sent transactions has its public key permanently recorded. The majority of actively used Bitcoin addresses fall into this category.

P2WPKH / Taproot (P2TR): No Additional Quantum Protection

SegWit and Taproot addresses use Schnorr signatures over secp256k1. Schnorr signatures are also broken by Shor's algorithm on the same problem (ECDLP over secp256k1). Taproot does not provide additional quantum protection. The public key is revealed in the key-path spend and is then permanently on-chain.

The Attack Timeline Against Bitcoin

Two attack scenarios apply, with different time constraints:

Scenario 1: Attacking P2PK UTXOs (No Time Constraint)

P2PK outputs already have public keys on-chain. An attacker with a capable quantum computer has unlimited time to run Shor's algorithm against these keys. Alice & Bob's 29,588-qubit estimate applies directly to this scenario. The attack takes approximately 10 minutes to 1 hour of quantum computation per key, depending on architecture.

Scenario 2: Attacking a Transaction in Flight (10-Minute Window)

When a user broadcasts a transaction from a P2PKH address, the public key is temporarily exposed in the mempool before the transaction is confirmed. An adversary watching the mempool could attempt to derive the private key and broadcast a conflicting transaction within the ~10-minute Bitcoin confirmation window. This is far more demanding — requiring the full attack within ten minutes rather than hours or days. The 2022 estimate of 317 million qubits applied specifically to this scenario. Even with improved error correction, attacking within the ten-minute window requires substantially more resources than the no-time-constraint scenario.

What Would Bitcoin Need to Change?

Making Bitcoin quantum-resistant requires changes at multiple layers:

Signature Scheme Migration

The secp256k1 ECDSA (and Schnorr) signing scheme must be replaced with a quantum-resistant alternative. NIST's ML-DSA (FIPS 204) or FN-DSA (FIPS 206) are the primary candidates. This requires a consensus change — either a soft fork if backward-compatible addressing can be maintained, or a hard fork if existing UTXO formats must change.

Wallet Migration

All existing Bitcoin in P2PK and spent P2PKH addresses must be migrated to new quantum-resistant addresses before capable quantum computers become available. This requires a coordinated migration campaign across the entire ecosystem: exchanges, custodians, hardware wallets, and individual holders. Coins that are never migrated become permanently vulnerable.

Protocol Changes

Post-quantum signatures (ML-DSA minimum 2,420 bytes) are approximately 38x larger than ECDSA signatures. Bitcoin's block weight limits would need adjustment to maintain comparable transaction throughput, or compression and aggregation schemes would be required.

How QuanChain Addresses This

QuanChain was designed from the start to avoid this migration problem. The network uses ML-DSA and SLH-DSA signatures, never secp256k1. No public key is ever exposed on-chain: QuanChain's TADEQS architecture uses SpendAndRotate atomic key rotation, meaning every spend rotates the key in the same atomic operation, leaving no harvested public key on the ledger.

The question of "is Bitcoin quantum-safe" has a clear answer: no. The question of when this matters has a revised answer as of October 2026: within the plausible lifetime of assets held today.