Quantum Computing Risk: How It Could Affect Bitcoin Cryptography

Quantum computing risk is the possibility that a quantum computer large and reliable enough could weaken the cryptography Bitcoin relies on. A quantum computer is a machine that uses quantum physics to solve certain problems much faster than today’s computers can. Cryptography is the mathematics Bitcoin uses to check who may spend BTC and to link its blocks.

Which Quantum Algorithms Matter to Bitcoin?

Quantum computing matters to Bitcoin mainly through two algorithms, Shor’s algorithm and Grover’s algorithm. An algorithm is a fixed set of steps for solving a problem.

What Does Shor’s Algorithm Do to Bitcoin Signatures?

Shor’s algorithm could let a large and reliable enough quantum computer derive a Bitcoin private key from the matching public key. Whoever operates such a computer could then sign for the key’s owner.

A private key is the secret number that creates digital signatures, which show that its holder authorized a spend. Bitcoin uses the elliptic curve digital signature algorithm (ECDSA) or Schnorr signatures. A Bitcoin private key is a 256-bit number, which means it is written with 256 bits, and a bit is a digit that is either 0 or 1.

A public key is the shareable value calculated from the private key by a one-way step. An elliptic curve is a curve defined by an equation, and the key calculation takes place on its points. Bitcoin’s signatures use an elliptic curve called secp256k1.

On an elliptic curve, the discrete logarithm problem is the problem of finding a private key when only the matching public key is known. On classical computers, meaning computers that use no quantum effects, the problem is designed to be infeasible. Shor’s algorithm is a quantum algorithm that solves the problem, on a large enough quantum computer, in a number of steps that grows at a manageable rate as the key gets longer.

What Does Grover’s Algorithm Do to Bitcoin Hashing?

Grover’s algorithm could reduce a search for an input that produces a given Bitcoin hash to about the square root of the original number of steps. The square root of a number is the number that gives the original when multiplied by itself, so the square root of 1 million is 1,000.

Grover’s algorithm is a quantum algorithm that searches an unstructured set of N items in about the square root of N steps. An unstructured set has no order to exploit, so a classical search has to test items one by one and needs about N divided by 2 steps. The drop from N steps to the square root of N steps is called a quadratic speedup.

A hash function is a function that turns an input of any length into a fixed-size output called a hash. SHA-256 is a hash function with a 256-bit output, and Bitcoin relies on it for block hashing, transaction IDs, and single-key addresses. Finding an input that produces a given hash is a search, because a hash function is designed to run forward and not backward.

A 256-bit hash has 2 to the power of 256 possible outputs, a number with 78 digits. In the simplest reading, the square root of 2 to the power of 256 is 2 to the power of 128, so a quadratic speedup could reduce such a search to roughly 2 to the power of 128 steps, which lowers the effort without removing it.

A standards body notes that, for Grover’s algorithm in general, the full speedup needs the steps to run one after another in a long serial computation that is hard to realize, so attacks spread across many machines gain less.

Can Quantum Computers Break Bitcoin?

Quantum computers could break Bitcoin’s signatures if one became large and reliable enough to run Shor’s algorithm on a 256-bit elliptic curve. The answer depends on the machine’s size and reliability, so it is not a yes-or-no question.

A qubit is the quantum version of a bit: where a bit is 0 or 1, a qubit can also hold a combination of both. A physical qubit is an actual hardware qubit.

A standards body page last updated in May 2026 describes the machines it covers as having hundreds of interconnected qubits, with an error about once in every 1,000 operations. An operation is one step that a machine performs on its qubits.

One 2022 estimate in published research puts the machine needed to break a 256-bit elliptic-curve key at about 317 million physical qubits if the attack must finish within 1 hour, and at about 13 million if it may take 1 day. The estimate assumes an error rate of about 1 per 1,000 operations and, in the 1-hour case, a cycle time of 1 microsecond. A cycle is one repeating round of a machine’s operations, and a microsecond is one millionth of a second.

One 2023 estimate in published research puts the machine needed to break a 256-bit elliptic-curve key, by computing its discrete logarithm with Shor’s algorithm, at 126,133 cat qubits running for about 9 hours. The estimate assumes cat qubits, a qubit design with built-in error protection, and a cycle time of 500 nanoseconds, which is half a microsecond.

The two estimates use different qubit designs, so their qubit counts are not directly comparable. The estimates also differ in cycle time and in the running time allowed, and they do not say how much each assumption accounts for the difference. This entry does not compare either estimate with the machine described above.

As of October 2026, newer estimates, published as preprints that have not been peer reviewed, report smaller machines than the 2022 and 2023 figures, so those figures are not a stable bound. Neither the 2022 estimate nor the 2023 estimate says when a quantum computer of the size each describes could exist, and this definition gives no date.

Which Parts of Bitcoin Rely on Signatures and Which on Hashes?

Signatures and keys rely on elliptic-curve mathematics, while single-key addresses, block links, and proof of work rely on hash functions. Proof of work is the system in which miners spend computing effort to create a block that other computers can check. An output is an amount of BTC locked by a condition, usually a signature from a key.

Component	Relies on	Effect of the relevant algorithm
Transaction signatures (ECDSA and Schnorr)	The elliptic-curve discrete logarithm problem	Shor’s algorithm: a large enough quantum computer could derive a private key from a public key.
Outputs that hold a public key directly	The same problem, with the public key stored in the output itself	Shor’s algorithm: a large enough quantum computer could derive the private key from the public key that the output already shows.
Single-key addresses, which are built from a hash of a public key	SHA-256, then RIPEMD-160 (a second hash function), and then a signature once the output is spent	Grover’s algorithm: a quadratic speedup in searching for an input to a given hash.
Proof of work and block links	SHA-256 applied twice	Grover’s algorithm: a quadratic speedup for search in general, and the full speedup needs a long serial computation.

Which Public Keys Are Exposed, and What Does That Change?

An exposed public key is a public key that is visible on the blockchain, the public record of Bitcoin transactions. A public key becomes visible when an output is spent, because the data that unlocks a legacy or SegWit version 0 single-key output includes the full public key.

A pay-to-public-key output, an older output type, stores a public key in the output itself. A Taproot output, a type that Bitcoin added in November 2021, also stores a public key in the output itself. Pay-to-public-key and Taproot outputs therefore show the key from the moment they exist.

A legacy or SegWit version 0 single-key address that has received BTC only once keeps its public key hashed until funds sent to it are first spent.

A quantum attack, meaning an attack run on a quantum computer, has to derive a private key from a public key. For a key that is already visible, such an attack does not have to wait for a spend.

Nodes are computers that connect to the Bitcoin network and check blocks. A mempool is the waiting area where nodes hold transactions that no block includes yet. For a key kept behind a hash, the key appears when its owner broadcasts a spend, and a quantum attack on that key could begin only from that point, while the transaction waits in the mempool.

What Would Make Bitcoin Quantum-Resistant?

Bitcoin would count as quantum-resistant if it adopted post-quantum cryptography. Post-quantum cryptography is cryptography designed to resist attacks by quantum computers. Quantum resistance is a design goal, not a proof.

In August 2024, a standards body published its first post-quantum standards: one for key establishment, which lets two parties agree on a shared secret key, and two for digital signatures. The two signature standards are named for the mathematics they use, one for lattice-based signatures and one for hash-based signatures. The same standards body describes its lattice-based signature standard as believed to resist attacks even by a large-scale quantum computer.

The post-quantum standards from 2024 are general-purpose: they were not written for Bitcoin and are not part of Bitcoin’s rules. A change to Bitcoin’s rules takes the form of a soft fork, which nodes that have not upgraded still accept, or a hard fork, which they can reject.

As of October 2026, the proposals for Bitcoin checked for this entry are not adopted, and at least one is a proposal to add a new output type, a new way of locking BTC, through a soft fork.

What Does Quantum Computing Risk Not Mean?

Quantum computing risk, also called quantum risk, is not a prediction. The term names a possibility and carries no date.