Could Quantum Computing Break Bitcoin? Explained

Quantum computing could theoretically break Bitcoin by using Shor's algorithm to derive a private key from a public key, but today's quantum computers are far too small and error-prone to pose a practical threat, and the Bitcoin community has years of lead time to adopt quantum-resistant cryptography.

Understanding this risk requires separating two questions: is the threat real in principle, and is it real right now. The answer to the first is yes, in theory. The answer to the second is no, not with current technology. For background on how Bitcoin's cryptography works day to day, see our introduction to Bitcoin.

What Bitcoin's cryptography actually protects

Bitcoin relies on two distinct cryptographic tools:

• Elliptic Curve Digital Signature Algorithm (ECDSA): Secures the link between a private key and its corresponding public key, used to sign transactions.
• SHA-256 hashing: Secures mining (proof of work) and address generation.

Quantum computing's known threat is specifically to ECDSA and similar public-key cryptography, not to SHA-256 hashing. This distinction matters because Bitcoin's mining security model, covered in our comparison of proof of work versus proof of stake, is not meaningfully weakened by the same quantum algorithms that threaten signatures.

The theoretical attack: Shor's algorithm

Shor's algorithm, developed in 1994, can factor large numbers and solve the discrete logarithm problem efficiently on a sufficiently powerful quantum computer. Since ECDSA's security rests on the difficulty of the elliptic curve discrete logarithm problem, a large enough fault-tolerant quantum computer could, in theory, derive a private key from an exposed public key.

The catch is the phrase "sufficiently powerful." Breaking a single Bitcoin ECDSA key is estimated to require on the order of millions of stable, error-corrected logical qubits running Shor's algorithm for a sustained period. Current quantum computers have low hundreds of noisy physical qubits, and error correction overhead means the effective logical qubit count is much smaller still. Most serious estimates place a credible threat at a decade or more away, and many researchers argue it could be considerably longer.

Why exposed public keys matter more than you'd think

Not all Bitcoin funds are equally exposed. The risk concentrates on addresses where the public key is already visible on-chain:

Address type	Public key exposure	Relative quantum risk
Pay-to-Public-Key (P2PK), used in early Bitcoin blocks	Public key visible immediately	Higher
Reused Pay-to-Public-Key-Hash (P2PKH) address	Public key revealed once spent from	Higher once spent
Fresh, never-reused P2PKH or SegWit address	Only a hash is visible until spent	Lower until spent

This is one of several reasons address reuse is discouraged; our piece on why reusing a Bitcoin address hurts your privacy covers the related privacy angle. Funds sitting in addresses whose public key has never been revealed on-chain are comparatively safer because an attacker would need the public key first, not just the address hash.

What the mitigation path looks like

The cryptography community, including contributors to Bitcoin's development, has been researching post-quantum signature schemes for years. Mitigation generally involves:

• Adopting quantum-resistant signature algorithms, such as lattice-based or hash-based schemes standardized by bodies like NIST, through a coordinated protocol upgrade.
• Migrating funds from exposed public keys to new quantum-resistant addresses well before large-scale quantum computers exist, similar in spirit to how software wallets encourage moving to a fresh wallet address for privacy.
• Monitoring quantum computing progress as an early warning system, since credible breakthroughs would likely be public and gradual rather than sudden.

Any such upgrade would need broad consensus among node operators, miners, and exchanges, which is a slow but achievable process, as demonstrated by past Bitcoin protocol upgrades.

What this means for holders today

For most people, quantum computing is not an actionable near-term risk. Sensible practices that already improve security — such as using new addresses per transaction and following the guidance in our wallet security guide — happen to also reduce quantum exposure as a side benefit. There's no need to panic-sell or move funds solely due to quantum fears at this stage.

Bottom line

Quantum computing is a legitimate long-term research concern for Bitcoin's signature scheme, not an imminent danger. The gap between today's quantum hardware and what would be needed to break ECDSA is enormous, and the Bitcoin community has both the awareness and the technical tools to migrate to quantum-resistant cryptography well in advance, provided it acts before the threat becomes practical rather than after.