Is Bitcoin Quantum Resistant? What Quantum Computers Could and Could Not Do to Bitcoin

Rather ask questions? Every source on this page is loaded into our public Gemini Notebook: Is Bitcoin Quantum Safe?, where you can query the studies directly (Google sign-in required).

Or watch or listen: our Gemini Notebook overview on Bitcoin and quantum computers (Google sign-in required).

What Part of Bitcoin Is Vulnerable to Quantum Computers?

Bitcoin uses two kinds of cryptography, and quantum computers threaten them very differently:

Chaincode Labs’ 2025 report summarises the hash side plainly: the security of SHA-256 and RIPEMD-160 is “somewhat weakened, but by no means broken.” The signatures are different. Schnorr signatures, introduced with Taproot, use the same curve as ECDSA, so switching between them changes nothing. Every quantum theft scenario for Bitcoin starts with a public key. For the mining side in detail, see Grover’s algorithm and Bitcoin mining; for the resources an attack on the curve needs, see how many qubits it takes to break Bitcoin’s secp256k1.

Which Bitcoin Address Types Are Exposed?

An attacker can only target coins whose public key is visible. Whether it is depends on the output type and on how the owner has used the address:

Glassnode calls the first three rows structural exposure, because the output reveals the key by design, and the rest operational exposure, because it only happens through address reuse, partial spending or custody habits. The distinction matters: operational exposure can be fixed today by moving coins to a fresh address, without any change to Bitcoin.

How Many Bitcoins Are Exposed to Quantum Attack?

Every widely cited figure answers a slightly different question, which is why they disagree. This table sets them side by side:

Use this table: CSV · JSON · Permanent table link. Licensed CC BY 4.0; keep each row’s assumptions when you cite it.

Published estimates of quantum-exposed bitcoin — SynergyX Research, https://synxcrypto.com/is-bitcoin-quantum-safe-2026.php#exposure

The high counts include coins exposed by address reuse, which owners can fix; the low count includes only coins that can never be moved by anyone who has lost the keys. Both views matter. CoinShares argues that most P2PK coins sit in about 32,600 outputs of roughly 50 BTC each, so stealing them one key at a time would be slow and would not flood the market. The larger counts show how much of the supply would need to move, or be decided about, before Bitcoin is safe.

Long-Range and Short-Range Quantum Attacks

Chaincode’s report names the two ways a quantum computer could steal bitcoin:

• Long-range attacks target public keys already exposed on the blockchain. The coins stay vulnerable until they are moved to an output type that hides the key, so the attacker has as long as it takes.
• Short-range attacks, also called front-running or transaction hijacking, target a key revealed while a transaction waits in the mempool. The attacker must derive the private key and broadcast a competing spend before the original is confirmed.

Which machine arrives first decides which attack arrives first. Google Quantum AI’s 2026 paper distinguishes fast-clock machines (superconducting and photonic) from slow-clock ones (neutral atoms and trapped ions), and concludes that “the first fast-clock CRQCs would enable on-spend attacks on public mempool transactions.” A slow machine, like the trapped-ion design IonQ modelled at 25.7 days per key, would threaten only long-exposed coins. How harvest-now-decrypt-later applies to Bitcoin and Ethereum is covered separately.

When Could a Quantum Computer Break Bitcoin?

No existing machine is close: the most capable systems run tens of error-corrected logical qubits, and the 2026 estimates need about 1,200 to 1,450. Published roadmaps reach that range between 2028 and 2033, and experts surveyed by the Global Risk Institute in 2026 put the chance of a cryptographically relevant quantum computer at 28–49% within ten years. The full evidence, with every roadmap and government deadline, is in when will quantum computers break Bitcoin, and the moment itself is explained in Q-Day for Bitcoin and crypto.

What Is Bitcoin Doing About Quantum Computers?

Two proposals sit in the official Bitcoin Improvement Proposals repository, both marked Draft:

• BIP 360 proposes Pay-to-Merkle-Root (P2MR) outputs, which keep Taproot’s script tree but remove the exposed key path. It reduces long-range exposure; it does not add a post-quantum signature by itself.
• BIP 361, “Post Quantum Migration and Legacy Signature Sunset” (Informational, created 11 February 2026), proposes two phases: first stop new payments to quantum-vulnerable outputs over about three years, then restrict spending with legacy signatures about two years later. It depends on a future proposal that adds post-quantum signatures.

Three questions remain open. Which signature: post-quantum schemes are larger, and Coinbase’s advisers estimate that switching to ML-DSA-44 would cut transactions per block roughly five to seven times once the witness discount is counted. How to migrate: the same advisers recommend pairing classical and post-quantum keys in a “1-of-2” arrangement. What to do with coins nobody moves: BIP 361 would eventually freeze legacy spending, while CoinShares argues that forcing a fork to burn coins “violates Bitcoin’s promise of neutral property rights.” The proposals are explained in BIP 360 and BIP 361 explained, and the checks for any claim that Bitcoin has already upgraded are in the Bitcoin quantum-resistance status checklist.

How to Protect Your Bitcoin From Quantum Computers

1. Use a fresh address for every receipt and never send to an address that has already spent.
2. Move coins off reused addresses into new P2WPKH (bc1q…) addresses. This removes operational exposure today, with no protocol change.
3. Think twice about Taproot for long-term storage: its output key is on-chain for as long as the coins stay put.
4. Check your custodian. Glassnode found exposure varying widely: about 5% of Coinbase’s labelled balances were exposed, against 85% at Binance and 100% at Bitfinex.
5. Follow BIP 360 and BIP 361. If a post-quantum output type activates, moving early will be cheaper than moving in a rush.

Disclosure: synxcrypto.com is published by the team that builds SynX. Everything above this note is sourced to the studies listed below; the next paragraph describes our own project.

The other option is to hold value on a chain whose signatures never used elliptic curves. SynX signs every transaction with SPHINCS+-SHAKE-128s, standardised by NIST as SLH-DSA in FIPS 205, whose security rests on hash functions, and uses Kyber-768 (ML-KEM) for key encapsulation, so there is no elliptic-curve public key for Shor’s algorithm to attack. The other chains that make similar claims, and the evidence for each, are compared in the quantum-resistant cryptocurrencies list.

Sources

These sources, with the tables on this page, are also collected in a public Gemini Notebook that answers questions from them (Google sign-in required).

• R. Schultze-Kraft, K. Heeg et al., “Measuring Bitcoin’s Quantum-Exposed Supply”, Glassnode, 20 May 2026.
• A. Milton and C. Shikhelman, “Bitcoin and Quantum Computing: Current Status and Future Directions”, Chaincode Labs, May 2025.
• CoinShares, “Quantum Vulnerability in Bitcoin: A Manageable Risk”, 6 February 2026, and “Burning Quantum-Vulnerable Bitcoin: Why It’s a Bad Idea”, 5 August 2025.
• Coinbase Independent Advisory Board on Quantum Computing and Blockchain, “Quantum Computing and Blockchain”, 21 April 2026.
• R. Babbush, A. Zalcman, C. Gidney et al., “Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities”, Google Quantum AI, March 2026.
• T. Häner et al. (IonQ), secp256k1 in 26 days on a trapped-ion quantum computer, September 2026.
• BIP 360 e BIP 361, Bitcoin Improvement Proposals repository, status checked 23 September 2026.
• M. Mosca and M. Piani, Quantum Threat Timeline Report 2025, Global Risk Institute, 9 March 2026.