Quantum Computers and Bitcoin: How Big Is the Threat?

Short answer: A large quantum computer could calculate a private key from a public key and use it to steal bitcoin. The coins most at risk are those whose public key is already on the blockchain, about 7 million BTC. No such computer exists yet. Bitcoin can protect itself with an upgrade, but that takes years of lead time.

Every few months a lab announces a record, and soon after you read: "Quantum computers will crack Bitcoin." For you as a long-term holder, this is not an academic question. If you plan to hold your coins for 10 or 20 years, you need to know whether they will stay safe over that time. This article shows, without panic and without sugarcoating, what a quantum computer could attack in Bitcoin, how far the technology has come, what developers are planning and what you can do today.

What a quantum computer does differently

An ordinary computer works with bits that are either 0 or 1. A quantum computer works with qubits, which can be in a superposition of several states at once. That doesn't make it faster at everything; for most tasks it offers nothing.

For a few mathematical problems, though, there are quantum methods that far outperform anything known. One of them is exactly the problem Bitcoin's signatures rely on. The mathematician Peter Shor described this method in 1994, and it has been called Shor's algorithm ever since.

The catch: qubits are extremely sensitive to interference. Long calculations therefore need error correction, in which many physical qubits together form one stable logical qubit. Only with enough logical qubits does a quantum computer become dangerous to Bitcoin.

Quantum computers and Bitcoin: what exactly could be attacked

Bitcoin uses two kinds of cryptography. A quantum computer affects them very differently.

1. The signatures (ECDSA and Schnorr). Every Bitcoin address belongs to a key pair. The public key is easy to calculate from the private key, but not the other way round. That is why only you can spend your coins. With Shor's algorithm, the way back would suddenly be possible. Anyone who knows your public key could then sign with your coins.

2. The hash function SHA-256. It is used in mining and in many addresses. Against hash functions, only a weaker quantum trick helps, Grover's algorithm. Roughly speaking, it halves the security from 256 to 128 bits. That is still considered secure.

So the danger lies in the signatures. How mining works and why it protects the network is explained in the overview Bitcoin mining explained.

Which bitcoin are at risk?

What matters is whether your public key is already visible. With most address types, the blockchain at first only holds a hash, a kind of fingerprint of the key. The key itself only becomes visible when you spend from the address.

In total, Glassnode counted 7.12 million BTC with a visible public key, 35.4% of all bitcoin (as of Nov 10, 2026). Other counts range from 4 to 7 million, depending on how they treat reused addresses.

A large share of this sits with exchanges, which often use the same addresses for years. Glassnode counted 11.6% of all bitcoin on exchange addresses with a visible key. If you leave coins on an exchange, you carry this risk too, on top of the risk of an exchange collapse.

The short moment when you send

Even a fresh address reveals its public key as soon as you send from it. Your payment then waits a few minutes for confirmation in the next block. A very fast quantum computer could calculate the private key in that time and slip in its own payment with a higher fee.

Researchers from Google Quantum AI, Stanford and the Ethereum Foundation worked this through in March 2026. Their result: a future fast quantum computer would need about 9 minutes per key on average. Under assumptions ideal for the attacker, it would succeed with just under 41% of payments before confirmation. Only an upgrade to new signatures closes this gap.

How far are quantum computers today?

This is the heart of the question of how big the threat is. Two numbers matter: how many qubits an attack needs, and how many exist today.

All three estimates arrive at about 1’200 to 1’500 logical qubits. They differ mainly in how many physical qubits one logical qubit needs and how fast the technology computes. Important: these numbers have fallen sharply in recent years. A widely cited estimate from 2022 still came to about 13 million physical qubits for an attack within one day.

And today? The best devices have about 100 very accurate physical qubits, such as Quantinuum's Helios with 98 qubits. Larger devices with more than 1’000 qubits exist, but they are much more error-prone. With error correction, at most a few dozen logical qubits have run so far, and only in short test calculations. To reach about 1’200 logical qubits that compute without error for hours, a factor of about 100 or more is still missing.

Nobody knows when this will happen. The US standards agency NIST still plans with a clear window: from 2030 it advises against methods such as ECDSA, and from 2035 they are no longer approved. For Bitcoin this means there is time, but not unlimited time.

What Bitcoin can do against quantum computers

Bitcoin can't be rebuilt overnight. New signatures need an upgrade that users and nodes agree to, and after that every holder has to move their coins to new addresses. Since 2026, there have been two concrete drafts for this.

BIP-360 (Pay-to-Merkle-Root, P2MR): a new address type that works like Taproot but doesn't show a public key in the address. It protects coins at rest, but not the short moment when you send. It has been in the Bitcoin proposals repository as a draft since February 2026; it has not been activated.

BIP-361 (Post Quantum Migration and Legacy Signature Sunset): a three-phase plan by Jameson Lopp and others. About three years after activation, payments to vulnerable addresses would no longer be possible. Five years later, old signatures would become invalid, and coins on vulnerable addresses would then be frozen. A possible rescue route using zero-knowledge proofs is still open. The proposal is controversial, and it requires quantum-safe signatures that have not yet been chosen for Bitcoin.

The hardest question: what happens to coins nobody moves, such as Satoshi's? Leave them, and an attacker could steal and sell them. Freeze them, and Bitcoin interferes with someone else's property for the first time. Nothing has been decided.

The sats calculator works out how many satoshis an amount in euros or francs is.

What you can do today

Nothing is urgent today. But with a few habits you can lower your risk right now.

1. Don't reuse addresses. Get a new address for every payment you receive. Modern wallets do this automatically, including for change. That way your balance almost always sits on addresses whose key nobody knows.
2. Hold your coins yourself. Exchanges often use addresses for years. In your own wallet, you decide when to move. How to start is shown in Setting up your first wallet.
3. Don't hand out your xpub. Your wallet's "xpub" reveals all your public keys at once. Only give it to your own software or your own Bitcoin node, not to outside services.
4. Don't use Taproot for large long-term holdings. With "bc1p…" addresses, the key is in the address itself. For saving over years, a "bc1q…" address you never spend from is, as things stand, the more cautious choice.
5. Keep your wallet and firmware up to date. When a quantum-safe address type arrives, wallets and hardware wallets will bring it via an update. Follow the manufacturers' instructions and then move calmly.
6. Check your backups. To move, you need your seed phrase and, for multisig wallets, all the components. How to store everything safely is shown in the guide Storing bitcoin safely.

How big is the threat to Bitcoin really?

Low in the short term, serious in the long term. Today there is no quantum computer that could calculate even a single Bitcoin key. But the devices needed have shrunk sharply in the estimates of recent years, and large companies are building specifically toward them.

The hash function, mining and the fixed supply remain secure, and signatures can be replaced, as Bitcoin already showed once with Taproot in 2021. The challenge is time and agreement: choosing a method, activating it and getting millions of holders to move before the computers are ready.

For your long-term planning, this means quantum computers belong to the events no model predicts. The Bitcoin Power Law, too, only describes the trend so far, as the methodology openly says. If you hold your coins yourself, don't reuse addresses and follow updates, you are well prepared. The order of the basics of safe custody is shown in the Academy under "Understand & secure". More articles on mining, nodes and technology are collected in the category Mining & Technology.