Can Quantum Computers Steal Bitcoin? A Plain-English Guide

Every few months, a headline warns that quantum computers will "break Bitcoin." The concern is real, but the phrase hides two very different questions: could a quantum computer steal coins by attacking Bitcoin's digital signatures, and could quantum hardware outperform today's ASIC miners?

No existing quantum computer can do either at a cryptographically relevant scale today. The timeline for a machine powerful enough to threaten Bitcoin's elliptic-curve signatures is uncertain, which is exactly why researchers and Bitcoin developers are discussing migration options before such a machine exists.

The more important long-term risk is to Bitcoin's digital signatures, especially outputs whose elliptic-curve public-key information is already visible on-chain. Quantum mining is also theoretically possible, but its practical engineering requirements appear much more demanding.

Key Takeaways

• No publicly known quantum computer today can recover Bitcoin private keys from secp256k1 public keys.

• Bitcoin's digital signatures are the more direct long-term quantum risk. Shor's algorithm could theoretically derive a private key from an exposed elliptic-curve public key.

• Quantum computers can also accelerate proof-of-work search through Grover's algorithm, which gives a quadratic advantage in query complexity. However, realistic fault-tolerant quantum mining appears to require extraordinarily large hardware and energy resources.

• Some Bitcoin outputs expose elliptic-curve public-key information immediately, including P2PK, bare multisig and Taproot outputs. Other common output types can hide that information until it is revealed during spending.

• Reusing an address or output structure after its public key has been exposed can create long-exposure quantum risk.

• BIP-360 and BIP-361 are currently draft proposals, not activated Bitcoin rules.

What Is a Quantum Computer, Really?

A regular computer stores information as bits, which are either 0 or 1. A quantum computer uses qubits, which can represent a blend of 0 and 1 at the same time and can be linked together in special ways.

That does not make quantum computers faster at everything. They are not super-powered laptops. They are only dramatically better at a few specific types of problems. Unfortunately for cryptography, one of those problems is the math behind the digital signatures Bitcoin uses.

Today's quantum machines are also small and error-prone. Breaking Bitcoin's signatures is estimated to require huge numbers of stable, error-corrected qubits, far more than anyone has built.

Bitcoin Uses Two Kinds of Cryptography

To understand the threat, it helps to know that Bitcoin relies on two different tools:

1. Hash functions (SHA-256 and RIPEMD-160). These turn any data into a fixed "fingerprint." They power Bitcoin mining and are used to create most Bitcoin addresses.

2. Digital signatures (ECDSA and Schnorr). These prove you own your coins. Your private key creates a signature, and anyone can check it using your public key.

Think of it like a mailbox. Your address is the mail slot that anyone can drop money into. Your public key is the design of the lock. Your private key is the only key that opens it. Normally, knowing the lock design does not help a thief make a key. A large quantum computer could change that.

The Bitcoin Optech topic page on quantum resistance explains the split clearly. A quantum technique called Grover's algorithm would roughly halve the security of hash functions, which is a manageable loss. Another technique, Shor's algorithm, could break elliptic-curve signatures like ECDSA entirely. Bitcoin's newer Schnorr signatures face the same problem because they use the same kind of keys.

Can Quantum Computers Steal Bitcoin Through Mining?

Bitcoin mining and Bitcoin signature security are separate quantum-computing problems.

Mining relies on repeated SHA-256 hashing. Grover's algorithm can theoretically search an unstructured space in roughly the square root of the number of classical attempts, giving a quadratic quantum advantage rather than the exponential-style advantage Shor's algorithm provides against elliptic-curve cryptography.

That theoretical advantage does not automatically make quantum mining practical. Fault-tolerant implementations of SHA-256 require large reversible circuits, error correction, high operating speed and substantial physical resources. Recent 2026 work examining those engineering costs concluded that achieving a meaningful advantage over today's enormous ASIC mining network would require extreme amounts of quantum hardware and energy under current assumptions.

OneMiners' discussion of quantum computing and Bitcoin mining reaches a similar practical conclusion: signature theft is a more immediate cryptographic concern than replacing ASIC mining with quantum machines. Treat that article as a company-authored perspective, however, rather than the primary technical authority.

Bitcoin's difficulty adjustment would eventually respond if effective network mining power changed substantially, helping restore the targeted average block interval. But difficulty adjustment does not by itself eliminate the security or centralization implications of one miner suddenly gaining a major computational advantage.

So the safer conclusion is: quantum mining has a genuine theoretical advantage, but today's practical quantum threat is much more focused on Bitcoin's elliptic-curve signatures than on replacing ASIC miners.

Where the Real Risk Is: Exposed Public Keys

The most serious long-term quantum threat comes from Shor's algorithm. A sufficiently capable fault-tolerant quantum computer could solve the elliptic-curve discrete logarithm problem and recover a private key from exposed secp256k1 public-key information.

Not every Bitcoin output exposes that information in the same way.

Some output types hide public-key information behind a hash until the output is spent. Common examples include P2PKH and P2WPKH. Script-hash outputs such as P2SH and P2WSH also initially reveal a hash rather than the full spending script, although spending them can reveal scripts containing public keys.

Other output types expose elliptic-curve key information immediately. Early P2PK outputs put a public key directly on-chain, and Taproot/P2TR outputs contain an x-only elliptic-curve output key by design.

This creates two broad attack scenarios discussed in BIP-360:

• Long-exposure attacks: vulnerable public-key information is already visible on-chain, giving a future quantum attacker an extended period to calculate the corresponding signing key.

• Short-exposure attacks: public-key information becomes visible only when a transaction is broadcast, forcing the attacker to recover the key and create a competing spend before the original transaction gains sufficient confirmation.

Long-exposure attacks are generally considered the more plausible first threat because they do not require the quantum computer to finish the key-recovery calculation within a short transaction-confirmation window.

This Medium explanation of what quantum computers can and cannot do to cryptocurrency makes the same basic distinction between dormant exposed keys and faster "in-flight" attacks. It is useful as an accessible explanation, but the BIP and Bitcoin Optech should carry the technical claims.

Which Bitcoin Is Most Exposed?

BIP-360 provides a useful simplified view of long-exposure risk:

"Lower long-exposure risk" does not mean quantum-proof. Most ordinary Bitcoin spending still relies on elliptic-curve signatures, so a sufficiently fast quantum computer could potentially attempt a short-exposure attack after a public key is revealed during spending.

How Much Bitcoin Is Already Quantum-Exposed?

Project Eleven maintains the Bitcoin Risq List, a live tracker of addresses it classifies as vulnerable because public-key information is already exposed.

As of October 12, 2026, the tracker listed approximately 7.1 million BTC as exposed to potential quantum key-recovery attacks. The exact figure changes as coins move, so it is better to link the live tracker than to treat any one number as permanent.

Earlier 2026 snapshots were around 6.9 million BTC. Project Eleven's breakdown showed that address reuse accounted for most of that exposure, with P2PK and Taproot accounting for significant additional amounts.

The tracker is a useful open-source measurement project, but its number represents a particular definition of "quantum-exposed" Bitcoin. It should not be interpreted as saying that 7.1 million BTC can be stolen today — no known quantum computer currently has the capability required to perform that attack.

How Close Is the Threat?

Nobody can give a reliable date for a cryptographically relevant quantum computer.

What has changed in 2026 is the resource estimate, not the existence of such a machine.

A March 2026 paper from researchers at Google Quantum AI, Stanford and the Ethereum Foundation estimated that solving a 256-bit elliptic-curve discrete-logarithm problem applicable to secp256k1 could require roughly 1,200–1,450 logical qubits. Under a particular superconducting error-correction model, the authors estimated fewer than 500,000 physical qubits, with modeled execution times of roughly 18–23 minutes.

Those numbers are dramatically lower than many older estimates, but they are still theoretical engineering requirements. No publicly known machine currently has anything close to that fault-tolerant capability.

The important lesson is therefore not that "Q-Day" has a known date. It is that algorithmic and error-correction improvements can reduce the hardware requirement even without equivalent improvements in physical quantum computers, so Bitcoin migration planning should not wait until a working attack has already been demonstrated.

What Bitcoin Developers Are Doing About It

Bitcoin developers and researchers are actively discussing several possible quantum-resistance strategies.

One prominent draft is BIP-360: Pay-to-Merkle-Root (P2MR). BIP-360 proposes a new output type that behaves similarly to Taproot's script-tree structure but removes the quantum-vulnerable key-path spend.

The current draft assigns P2MR outputs the bc1z form and is designed primarily to protect against long-exposure attacks by avoiding an exposed internal elliptic-curve key.

BIP-360 does not itself introduce a post-quantum signature algorithm. Ordinary scripts inside the P2MR tree can still contain classical keys, and protection against fast short-exposure attacks would require additional post-quantum signature or recovery mechanisms.

Another draft, BIP-361: Post Quantum Migration and Legacy Signature Sunset, proposes a longer-term migration framework following the availability of a post-quantum output type. Its draft phases would eventually discourage or restrict continued use of vulnerable ECDSA and Schnorr spending rules.

Both BIP-360 and BIP-361 remain draft proposals. Neither has been activated as Bitcoin consensus rules, and their final design, timeline and community acceptance are not guaranteed.

What You Can Do Today

There is no need to panic, but some ordinary Bitcoin privacy and wallet practices also reduce long-exposure quantum risk:

1. Avoid address reuse. Use a fresh receiving address whenever your wallet supports it.

2. Understand Taproot's trade-off. A P2TR address exposes an elliptic-curve output key immediately, unlike fresh P2PKH or P2WPKH outputs that initially reveal only a hash.

3. Avoid returning large balances to addresses whose relevant public-key information has already been exposed.

4. Keep your wallet software maintained and updated. Any future migration will depend on wallet and custody providers supporting new output and signature types.

5. Do not buy "quantum-proof Bitcoin" tokens or send funds to anyone claiming an emergency migration is already required.

6. Follow primary technical sources. Bitcoin Optech's quantum-resistance topic and the official Bitcoin BIPs repository are better places to track real protocol proposals than viral headlines.

Frequently Asked Questions

Can a quantum computer steal Bitcoin right now? No publicly known quantum computer can currently recover Bitcoin secp256k1 private keys at a cryptographically relevant scale.

Will quantum computers make Bitcoin mining obsolete? Quantum algorithms can theoretically accelerate proof-of-work search, but realistic fault-tolerant quantum mining appears to require enormous hardware and energy resources. Signature security is currently considered the more direct quantum concern.

Are my coins safer if I have never spent from an address? It depends on the output type. Fresh P2PKH and P2WPKH outputs initially hide the public key behind a hash, reducing long-exposure risk. Taproot/P2TR outputs expose an elliptic-curve output key from the start.

What is BIP-360? BIP-360 is a draft proposal for Pay-to-Merkle-Root, or P2MR, a new Bitcoin output type designed to remove Taproot's exposed key-path spend and reduce long-exposure quantum risk. It has not been activated.

What is BIP-361? BIP-361 is a separate draft proposing a phased post-quantum migration and eventual restrictions on vulnerable legacy signatures after suitable post-quantum mechanisms exist.

Should I sell Bitcoin because of quantum computing? Quantum risk is real enough to justify engineering preparation, but there is no publicly known cryptographically relevant quantum computer capable of stealing Bitcoin today. Investment decisions should not be based on a claim that a specific "Q-Day" date is known.

Final Thoughts

Quantum computing is a genuine long-term cryptographic issue for Bitcoin, but the threat is more specific than headlines such as "quantum computers will break Bitcoin" suggest.

The clearest risk is to Bitcoin's elliptic-curve signatures and to outputs whose public-key information is already exposed. Quantum proof-of-work mining has a theoretical advantage too, but practical resource estimates make it a very different engineering problem.

Bitcoin researchers are already discussing migration paths such as BIP-360 and BIP-361, but both remain drafts. For ordinary users today, the sensible approach is to avoid unnecessary address reuse, understand what type of output your wallet uses, keep wallet software updated and follow primary technical sources as proposals evolve.

This article is for educational purposes only and is not financial or security advice. Quantum-computing research and Bitcoin protocol proposals change quickly, so verify current information before making security decisions.