Is Bitcoin Quantum Safe? The Honest 2026 Assessment

TL;DR: Bitcoin is not quantum safe. Its secp256k1 ECDSA signature scheme is vulnerable to Shor's algorithm, which a fault-tolerant quantum computer with roughly 4,000 logical qubits could use to derive any private key from its exposed public key. Approximately 1.7 million BTC sits in P2PK outputs with public keys permanently on-chain — the highest-risk category. P2PKH and SegWit addresses are safer in the short term because the public key only appears when spending, but they are still vulnerable if the owner sends a transaction after capable quantum hardware exists. BIP 360 proposes a post-quantum address type (P2QRH) but has no activation timeline.

Is Bitcoin Quantum Safe?

No. Bitcoin is not quantum safe. Bitcoin's core cryptography — the secp256k1 elliptic curve used for all ECDSA transaction signatures — is broken by Shor's algorithm on a fault-tolerant quantum computer. Shor's algorithm derives a private key from any exposed public key in polynomial time, compared to the ~2^128 classical operations needed to brute-force secp256k1. No quantum computer in 2026 can perform this attack, but the hardware is advancing on a measurable trajectory, with academic consensus placing a credible threat in the 2030-2035 window.

Bitcoin was designed in 2008 using the best available cryptography of the time. secp256k1 ECDSA provides excellent classical security — it has never been broken classically, and the key sizes are well-suited to the computational environment Bitcoin operates in. The quantum problem is not a design flaw in the classical sense; it is a property of the underlying mathematics that was not a practical concern in 2008 and is only becoming one now.

Understanding Bitcoin's quantum exposure requires distinguishing between different address types, because the attack surface differs substantially depending on how an address was created and whether it has ever signed a transaction.

Which Bitcoin Addresses Are Most at Risk?

Bitcoin addresses fall into three quantum risk categories. P2PK (Pay to Public Key) addresses embed the full public key in the output script, permanently exposing it regardless of transaction history — these carry the highest quantum risk. P2PKH (Pay to Public Key Hash) and SegWit (P2WPKH, P2TR) addresses only expose the public key when spending, creating a narrower but still real attack window. Any address that has never sent a transaction and whose public key has never appeared on-chain is currently safe, but must eventually expose its public key to spend.

P2PK outputs — highest risk. Early Bitcoin used P2PK outputs, which embed the compressed or uncompressed public key directly in the scriptPubKey. This means the public key is visible on-chain from the moment the output is created, before any transaction is signed. Approximately 1.7 million BTC sits in P2PK outputs, including the coinbase rewards from the first several hundred thousand blocks widely attributed to Satoshi Nakamoto. A quantum adversary can archive these public keys today and derive the corresponding private keys when capable hardware arrives — no time pressure, no mempool race.

P2PKH addresses — medium risk. P2PKH (Pay to Public Key Hash) addresses, the most common address type for much of Bitcoin's history (beginning with "1"), commit to a hash of the public key rather than the public key itself. The public key is only revealed when the owner spends funds — it appears in the scriptSig of the spending transaction. If an address has never spent, its public key is not on-chain. Once it spends, the public key is permanently recorded. At current Bitcoin UTXO set data, a large portion of P2PKH addresses with value have signed at least one spending transaction, making their public keys harvestable.

SegWit addresses (P2WPKH, P2TR) — lower short-term risk. Native SegWit and Taproot addresses also only expose the public key when spending. Taproot (P2TR) uses Schnorr signatures over secp256k1 — still vulnerable to Shor's algorithm, but with the same "public key exposed at spend" property as P2WPKH. An address that has only received Bitcoin and never sent remains safe until spending is required. The attack window for any of these address types is the time between transaction broadcast and block inclusion — approximately 10 minutes at average Bitcoin block times.

How Many Qubits Does It Take to Break Bitcoin?

Breaking a single Bitcoin secp256k1 private key using Shor's algorithm requires approximately 317 million physical qubits in one hour, or 13 million physical qubits given one day, according to Webber et al. (AVS Quantum Science, 2022). Under current surface code error correction assumptions, this corresponds to roughly 4,000 error-corrected logical qubits. IBM's most capable 2026 processor has around 156 physical qubits. The gap is approximately three orders of magnitude in physical qubit count, placing a credible attack in the 2030-2035 window under current academic consensus.

The Webber et al. figure is the most-cited quantitative estimate in the academic literature. It accounts for the circuit depth required to run the elliptic curve point operations in Shor's algorithm, the overhead from surface code error correction at current physical error rates, and the time budget for the attack. The one-hour scenario requires more hardware but completes before Bitcoin's ~10-minute block time expires — making it relevant for attacks on P2PKH and SegWit addresses at spend time. The one-day scenario is sufficient for P2PK attacks, where there is no time constraint at all.

The hardware gap is large but not infinite. Physical qubit counts have roughly doubled every 18 months across IBM, Google, and other leading organizations since 2019. Physical error rates are improving more slowly but are improving. Microsoft's February 2025 Majorana 1 announcement introduces uncertainty about whether topological qubits could compress the error correction overhead and shorten the timeline. The trajectory matters more than the current state.

What Is BIP 360 and Does It Solve Bitcoin's Quantum Problem?

BIP 360 proposes P2QRH (Pay to Quantum Resistant Hash), a new Bitcoin address type supporting post-quantum signature schemes including ML-DSA (CRYSTALS-Dilithium), SLH-DSA (SPHINCS+), and FALCON. It would protect funds explicitly moved into new P2QRH addresses. However, BIP 360 does not protect existing Bitcoin in any current address type, and as of mid-2026 it remains a draft proposal with no activation timeline, no merge into Bitcoin Core, and no scheduled testnet deployment.

BIP 360 is modeled on the SegWit upgrade: a new output type that existing nodes can ignore (soft fork), with a witness discount to make post-quantum transaction fees manageable given the larger signature sizes ML-DSA requires. The proposal has received discussion from Bitcoin Core developers and cryptographers but faces several unresolved questions: which post-quantum algorithms to include, the exact witness discount size, whether to include any migration mechanism for legacy addresses in the same soft fork, and how to handle the transition period when both classical and post-quantum address types coexist.

Even if BIP 360 achieves consensus and activates, the migration problem remains: every Bitcoin holder would need to manually move their funds from current addresses to new P2QRH addresses. There is no automatic protection. The approximately 1.7 million BTC in P2PK outputs, whose owners may be deceased, inaccessible, or simply unaware, would remain permanently vulnerable. A realistic read of BIP 360 is that it is a necessary step but not a complete solution — it gives future holders a safe address type while leaving the legacy exposure intact.

What Can Bitcoin Holders Do Right Now?

Bitcoin's post-quantum migration path does not yet exist at the protocol level. That leaves individual holders with a limited but meaningful set of actions:

• Avoid reusing addresses. Bitcoin's best practice has always been to use a new address for each incoming payment. This limits public key exposure — if an address receives Bitcoin but never sends, the public key remains hidden. Following this practice reduces (but does not eliminate) harvest exposure.
• Move high-value P2PK holdings if accessible. If you control funds in a P2PK output (you can identify these by looking for scriptPubKey patterns starting with an uncompressed or compressed public key directly), moving them to a Taproot address hashes the public key and buys time. This requires a spend transaction, which briefly exposes the key during confirmation — acceptable risk today, higher risk as quantum hardware advances.
• Monitor BIP 360 progress. When P2QRH address support becomes available (likely starting with testnet before mainnet), migrating to it should be a priority for any significant holdings.
• Consider assets where quantum safety is already a design requirement. For holdings that must remain secure through the 2030s, QuanChain's TADEQS architecture provides ML-DSA-87 + SLH-DSA composite signatures and the SpendAndRotate mechanism that ensures no public key persists on-chain in a funded state between transactions.

Comparing Bitcoin's Quantum Exposure to Other Chains

Bitcoin is not uniquely exposed. Every major blockchain using elliptic-curve cryptography — Ethereum (secp256k1 ECDSA for EOAs, BLS12-381 for validators), Solana (Ed25519), Cardano (Ed25519), Algorand (Ed25519), NEAR (Ed25519), Stellar (Ed25519) — shares the same fundamental vulnerability to Shor's algorithm. The mathematical structure that makes elliptic-curve cryptography efficient also makes it attackable by quantum algorithms.

What distinguishes Bitcoin from some of these chains is the P2PK exposure: a category of addresses where the public key is permanently on-chain regardless of transaction history. No other major chain has a comparable category of "already fully exposed" addresses at this scale. For most Solana, Cardano, and Ethereum addresses, the public key is at least gated behind a spend transaction — providing a narrower but real window of safety for non-spending addresses.

The QuanChain vs Bitcoin comparison covers the full technical contrast, and the Quantum Threat Calculator lets you model how different hardware timeline assumptions affect specific BTC holdings. For developers building infrastructure that must remain secure beyond the mid-2030s, the QuanChain developer quickstart covers how to build on a post-quantum blockchain from day one.