Key Takeaways
- Quantum computers pose a long-term risk, but no immediate threat.
- Bitcoin is not the only system affected: banks, HTTPS encryption, passwords and industrial legacy infrastructure (e.g. hospital IT, government systems) rely on the same cryptographic methods.
- Within Bitcoin, it is primarily the signature technology ECDSA that is at risk, not mining via SHA-256.
- SHA-256 remains robust even against quantum computers, as only a limited speed advantage is possible and the difficulty adjustment automatically compensates for it.
- Bitcoin can adapt through protocol updates and post-quantum cryptography. BIP-360 already provides a concrete proposal.
What Is a Quantum Computer and How Does It Differ from a Conventional Computer?
To understand the actual threat, one must first address a widespread misconception. Quantum computers are not super-fast conventional computers, they operate on fundamentally different principles.
Classical computers work with bits, clearly defined states: 0 or 1. Like a light switch that is either on or off. Quantum computers use so-called qubits, which, thanks to an effect called superposition, can adopt multiple states simultaneously, essentially on and off at the same time. This allows certain operations to be performed in parallel, which offers enormous advantages for very specific problems.
A second important principle is entanglement. Qubits can be linked together so that changing one qubit immediately affects the state of another. This opens up entirely new computational approaches that are simply not possible with classical architectures.
Nevertheless, quantum computers are not a general-purpose tool. They are superior only for specific mathematical problems, such as factoring large numbers or solving discrete logarithm problems. For typical everyday applications like word processing, databases or streaming, classical computers remain more efficient and practical.
For digital security, however, precisely one of these specialised areas is critical: cryptography. And it underpins Bitcoin, banks, HTTPS and virtually all encrypted systems on the internet. Two quantum algorithms are particularly relevant for attacks on cryptographic systems: the Shor algorithm, which can attack asymmetric encryption such as RSA or ECDSA, and the Grover algorithm, which searches hash functions such as SHA-256 more rapidly.
Which Areas Are Threatened by Quantum Computers?
Bitcoin is often at the centre of public debate, yet it is only a small part of the overall picture. The quantum threat affects virtually every form of modern digital encryption.
Banks and Payment Systems
The entire global banking system relies on RSA and Elliptic Curve Cryptography, cryptographic methods that are vulnerable to the Shor algorithm. SWIFT transactions, credit card payments, online banking and interbank settlement are all affected. Unlike Bitcoin, however, banks can decide centrally to migrate to quantum-resistant methods and enforce this transition through regulation, making the process fast and plannable.
HTTPS and Internet Encryption
Every website with an encrypted connection (the padlock symbol in the browser) uses the TLS protocol to transmit data between user and server in encrypted form. TLS relies on mathematical methods such as ECDSA and is therefore also vulnerable to the Shor algorithm. Major providers such as Google Chrome and Cloudflare are already deploying first quantum-resistant algorithms such as ML-KEM. The full transition of the internet will nonetheless take years.
Passwords and Login Systems
Passwords are generally stored on servers not in plain text but as hashes, using methods such as bcrypt, Argon2 or SHA-256. These hashes are in principle vulnerable to Grover’s algorithm, but only with the limited quadratic speed advantage it provides. Longer passwords and stronger hashing methods offer sufficient protection here. The real problem lies not in the stored password but in its transmission: when logging in, the password is sent to the server over a TLS-encrypted connection, and it is precisely this transmission path that is compromised by quantum computers.
Legacy Infrastructure
Industrial and critical infrastructure such as power plants, water supplies, hospitals or production control systems frequently runs on hardware installed decades ago. These systems sometimes use encryption methods from the early 2000s and cannot be updated technically at all. Replacement would in many cases only be possible through complete reinstallation, which makes these areas particularly vulnerable.
On Which Cryptographic Foundations Does Bitcoin Rest?
Bitcoin is not simply “encrypted”, it rests on two clearly separate cryptographic building blocks. This distinction is essential for correctly assessing the risk posed by quantum computers.
SHA-256 and Proof of Work
Once a Bitcoin transaction is initiated, it is grouped together with many others into a new block, which a miner must confirm using the so-called proof-of-work process. SHA-256 is used for this: a computational method that generates a fixed character string from the block data and an additional number (the nonce), known as the hash. The network only accepts the block if this hash begins with a certain number of zeros. Since the result cannot be predicted, miners test billions of nonces per second. Whoever finds a matching one first adds the block to the blockchain and receives the reward. Importantly, SHA-256 is not a public-key system. It does not directly protect coin holders, instead it ensures the integrity of the entire blockchain. The process is deliberately one-directional: a hash cannot be reversed. This makes it a reliable fingerprint for blocks and transactions.
ECDSA and Wallet Security
While SHA-256 protects the blockchain as a whole, ECDSA (Elliptic Curve Digital Signature Algorithm) secures individual ownership of Bitcoin. Every wallet is based on a mathematically linked key pair: a private key that remains secret and allows only the owner to access their coins, and a public key from which the Bitcoin address is derived. When the owner wishes to send coins, they sign the transaction with their private key. The network can then verify this signature using the public key without ever seeing the private key.
An important nuance: with most address types, the public key remains hidden until a transaction is sent. Only at that point does a potential attack target for quantum computers arise.
How Do the Risk Profiles of Mining (SHA-256) and Wallets (ECDSA) Differ?
Not all parts of Bitcoin are equally threatened by quantum computers. The differences between mining and wallet security are decisive here.
SHA-256 and the Grover Algorithm
Using the Grover algorithm, quantum computers could theoretically find valid hash values faster than classical computers. The advantage lies not in a higher speed per attempt, but in the mathematics itself. While finding a specific hash in principle requires working through 2256 possibilities, Grover’s algorithm reduces this number to its square root, that is, 2128 attempts. The effective security of SHA-256 is thus halved from 256 to 128 bits. The protection is not broken, merely reduced, and 128 bits are still considered secure by current standards.
There is also a built-in safeguard: the mining difficulty adjusts automatically to the available computing power in the network. As soon as blocks are found faster, the network raises the requirements. A quantum computer would have a speed advantage, but this would be offset by the rising difficulty. No existential risk to the blockchain arises at this level.
ECDSA and the Shor Algorithm
The Shor algorithm is the actual risk factor. It can attack the mathematical foundation of ECDSA by efficiently solving discrete logarithms on elliptic curves. In concrete terms, this means that with a sufficiently powerful quantum computer, a private key could be derived from the public key.
What matters here is the visibility of the public key. As long as it remains hidden and only the derived address is visible on-chain, ECDSA offers no direct attack surface. However, two situations are critical: after an outgoing transaction, which exposes the public key, and in cases of address reuse, where the same address is used multiple times. Particularly exposed are also wallet formats where the public key is stored directly on-chain from the outset (e.g. P2PK outputs from the Satoshi era and P2TR Taproot addresses). These wallets are considered the most vulnerable targets of a future quantum attack.
What Is the Taproot Upgrade and What New Attack Surface Has It Created?
An important aspect of the current debate concerns the Taproot upgrade of 2021. Taproot brought significant advantages in terms of privacy, efficiency and smart contract capabilities, but at the same time opened a new attack surface.
With Taproot addresses, the public key is stored permanently on-chain by default, before any transaction has taken place. This is a fundamental difference from formats such as P2PKH or SegWit (bc1q), where the public key only becomes visible when sending. With Taproot, by contrast, it is permanently accessible and evaluable. For a quantum attacker this is a comfortable situation: they have unlimited time to attack the stored public key, without the time pressure of ongoing transactions.
Even more sensitive is the situation with early coins from Bitcoin’s early days. Many so-called P2PK outputs from the Satoshi era likewise have their public keys stored permanently on-chain. These coins are considered particularly exposed should quantum computers ever become cryptographically relevant.
How Far Away Are Quantum Computers That Could Actually Do This?
The decisive question is the timeline, and this is where the greatest gap between headlines and reality lies.
The Current State of Hardware
Modern quantum computers are still far from the required capacity. IBM presented its Nighthawk processor with 120 qubits at the end of 2025. Microsoft introduced the Majorana 1 chip in the same year, designed to enable more stable qubits through a novel topological state of matter. Google’s Willow chip improved error correction exponentially.
These advances are impressive, but the gap to a genuine threat remains enormous. An attack on ECDSA would require an estimated 1,200 to 1,450 logical qubits. A logical qubit consists of many physical qubits that mutually protect against errors. In practice, depending on error rates, hundreds of thousands of physical qubits would be needed. Current systems operate with a few hundred to a few thousand physical qubits, and their error rates are still far too high for cryptographically relevant computations.
What Experts and Industry Roadmaps Say
The range of assessments is wide. Many researchers expect it will be at least 10 to 30 years before a sufficiently powerful quantum computer exists. More optimistic scenarios see a realistic timeframe from the 2030s onwards. Roadmaps from IBM, Google, Microsoft, Amazon and Intel suggest that critical breakthroughs could emerge within 2 to 5 years, requiring a reassessment of the risk.
Coinbase research chief David Duong warned in early 2026 that the threat could become reality faster than previously assumed. On the other side, figures such as Adam Back and Michael Saylor describe the current debate as clearly premature. The truth likely lies somewhere in between. Quantum computers are not an immediate risk, but neither are they a problem that can be deferred indefinitely.
How Is Bitcoin Preparing for the Quantum Threat?
The good news is that the problem is known and being actively addressed. Furthermore, Bitcoin is not facing this alone, as the entire internet infrastructure is affected by this development. It is therefore not only Bitcoin developers who must find a path forward, but all other participants as well. In principle, anyone relying on current encryption standards needs a plan to migrate their systems.
NIST Standards for Post-Quantum Cryptography
In 2024, the US standardisation body NIST published the first official post-quantum standards. These include ML-KEM (Kyber), ML-DSA (Dilithium) and SLH-DSA (SPHINCS+). These methods are based on mathematical problems such as lattice problems or hash-based structures, which are also considered hard to solve for quantum computers. The US federal government has additionally issued a mandate to fully replace ECDSA by 2035.
BIP-360: The Concrete Proposal for Bitcoin
Within the Bitcoin community too, work on a solution is actively under way. The most important technical proposal is BIP-360, submitted by developers Ethan Heilman, Hunter Beast and others. In February 2026 it was officially added to the BIP repository, the collection of recognised improvement proposals for Bitcoin.
At the core of the proposal is a new address type called Pay-to-Merkle-Root (P2MR). Unlike Taproot, no public key is permanently stored on-chain here, which closes the structural attack surface for quantum computers. BIP-360 is itself not yet a complete quantum defence, but creates the technical framework into which future quantum-safe signature schemes such as FALCON or Dilithium can be integrated.
In parallel, further developers are working on complementary solutions. A proposal by Jameson Lopp and colleagues from July 2025 envisions, for example, a soft fork that would progressively replace existing ECDSA and Schnorr signatures with a new quantum-resistant format called P2QRH.
Overall, several named researchers and developers are actively working on post-quantum solutions for Bitcoin, including well-known figures such as Pieter Wuille and Jonas Nick. More than 13 different proposals are on the table, initial testnet implementations are running, and the first quantum-resistant transactions have already been successfully carried out on the Liquid sidechain.
What Can Miners and “Hodlers” Do Today?
There are some concrete measures that are already sensible today:
- Never reuse addresses. This keeps the public key hidden for as long as possible.
- Migrate large holdings out of Taproot addresses. Freshly generated P2WPKH addresses (bc1q...) are structurally better protected, as the public key is not permanently stored on-chain.
- Use cold storage. Keys kept offline are never unnecessarily exposed and provide additional protection.
- Follow protocol development. In particular, progress around BIP-360 and upcoming upgrades should be monitored in order to act in time.
For miners:
- No immediate threat to ASIC hardware. Mining via SHA-256 is not a realistic attack target.
- Difficulty adjustment offsets quantum advantages. As long as the network produces blocks on a 10-minute cycle (until the last block is mined, expected around 2140), the automatic difficulty adjustment compensates even for a theoretical Grover advantage.
For questions on quantum security, wallet strategy, or professional Bitcoin hosting, our Bitkern experts are happy to advise you in a non-binding conversation: Book a call
FAQ
Can Quantum Computers mine Bitcoin faster?
Yes, theoretically via Grover’s algorithm. The advantage is however only quadratic and would be offset by the difficulty adjustment. No existential risk to the network arises.
Can Quantum Computers Steal Bitcoin from Wallets?
Only under certain conditions. An attack would be possible if the public key is permanently visible and a sufficiently powerful quantum computer exists. This is not the case today. Taproot addresses and old P2PK outputs are particularly exposed over the longer term.
What Is BIP-360?
A technical proposal that gives Bitcoin a new address type (P2MR) that does not generate permanently visible public keys. It was added to the official Bitcoin repository in February 2026 and is regarded as the first step towards quantum resistance.
When Will Quantum Computers Become a Real Threat?
Most assessments point to 2030 at the earliest, or considerably later. Industry roadmaps from Google, IBM and Microsoft suggest that critical milestones could be reached within the next 2 to 5 years, requiring a renewed risk assessment.
Does Bitcoin Need to Change Its Code?
Probably yes, in the long term. Post-quantum cryptography will need to replace classical signatures. Bitcoin can implement such changes via soft forks, as already demonstrated in the past with SegWit and Taproot. The political consensus within the community will be the greater challenge, not the technology itself.
Is Bitcoin More Vulnerable to Quantum Computers Than Other Systems?
No. Banks, HTTPS connections, IoT devices and older industrial systems rely on the same cryptographic methods and are in some cases even harder to update. Bitcoin is transparently documented and can be adapted via soft forks, whereas legacy hardware is frequently not patchable.
