What could a quantum computer break in bitcoin?

Signatures: derive the private key from the public one. Shor targets elliptic-curve signatures. Hashes and mining are far better protected: Grover gives only a square root.

Which coins are already in the risk zone?

Those on addresses whose public key is already visible. P2PK, previously spent addresses and Taproot already show the key. A fresh unspent address shows only a hash.

Someone DMs you: “Buy QuantumSafeCoin, the only token safe from Q-Day.” What do you reply?

Sounds like a scam: protection comes as a protocol upgrade, not by buying a token. Urgency, “the only one” and paid protection are classic scam signs. Real protection is P2MR and wallet updates.

Q-Day and your crypto

Lesson 20 of 23 in the course “Quantum”. Free, with animations and a quiz.

What exactly breaks

The last level is about your money. Bitcoin rests on two things: the SHA-256 hash (mining and addresses) and a digital signature on an elliptic curve. Shor’s algorithm hits the signature: from the public key it computes the private key, which lets someone spend your coins. Against SHA-256 there’s only Grover, a mere “square root” speed-up, and in mining it would lose to specialised ASIC miners. So the real threat is coins stolen from specific addresses, not “the end of the blockchain.”

Where the key is already exposed

Normally an address is a hash of the public key, and the key itself stays hidden until you spend. But there are exceptions. The very first addresses from 2009–2010 (P2PK) store the key in the open: they hold about 1.7 million BTC, including coins attributed to Satoshi. Then there are addresses already spent from: the key was revealed on the first spend. And Taproot, where the key is visible in the address itself. Estimates put a quarter to a third of all bitcoin at risk. The numbers differ because researchers count reused addresses differently.

The mempool race

Even a clean address reveals its key the moment you send. The transaction first waits in the mempool until miners put it in a block, about 10 minutes on average. If a quantum computer can derive the private key in that time, a thief sends their own transaction for the same coins with a bigger fee, and miners pick it. In March 2026 Google estimated cracking such a key in about 9 minutes on a machine with fewer than 500,000 qubits. No such machines exist yet, but the margin no longer looks huge.

What bitcoin is doing

The community’s main answer is BIP-360. It introduces a new address type, P2MR (Pay-to-Merkle-Root): the key is hidden in a Merkle tree and doesn’t show until you spend. In February 2026 the proposal was added to the official BIP repository. Be clear: that’s not activation, just a spot on the list. Next comes a soft fork with node and miner consensus, and then owners must move their coins to new addresses themselves. That takes years. And there’s a hot debate: what to do with Satoshi’s coins and lost wallets that nobody will move. Freeze them (as BIP-361, for example, proposes) or leave them be?

Ethereum and other networks

Ethereum has a similar problem, only sharper: the public key is revealed after the first outgoing transaction, and active wallets almost always have one. In January 2026 the Ethereum Foundation created a dedicated post-quantum security team and launched two research prizes of $1 million each. The network’s roadmap includes moving to hash-based signatures, which Shor can’t crack. Takeaway: any major network you trust with money should have a clear plan. No plan is a red flag.

What to do right now

No panic and no “sell everything now.” Here’s a simple plan. Don’t reuse addresses: decent wallets give you a new address for every receipt. Keep long-term savings on addresses you’ve never spent from. Update your wallet and follow P2MR news so you can migrate once it’s supported. If your coins sit on an exchange, the exchange will do the migration: ask its support what their plan is. And above all: ignore “quantum-safe” tokens and services that sell protection. Protection will come as a protocol upgrade, not by buying a new coin.

Check yourself

What could a quantum computer break in bitcoin?
Correct answer: Signatures: derive the private key from the public one. Shor targets elliptic-curve signatures. Hashes and mining are far better protected: Grover gives only a square root.
Which coins are already in the risk zone?
Correct answer: Those on addresses whose public key is already visible. P2PK, previously spent addresses and Taproot already show the key. A fresh unspent address shows only a hash.
Someone DMs you: “Buy QuantumSafeCoin, the only token safe from Q-Day.” What do you reply?
Correct answer: Sounds like a scam: protection comes as a protocol upgrade, not by buying a token. Urgency, “the only one” and paid protection are classic scam signs. Real protection is P2MR and wallet updates.

← The race map: how to read the news Post-quantum cryptography →