Will Quantum Computers Break Bitcoin?

Key Takeaways

Quantum computers running Shor’s algorithm could eventually break Bitcoin’s elliptic curve signatures (ECDSA/Schnorr), exposing coins once their public keys are revealed.
Grover’s algorithm weakens but does not break Bitcoin’s hash functions. Even with quantum speed-ups, SHA-256 and RIPEMD-160 remain effectively uncrackable for the foreseeable future. Mining and address security are not immediate concerns.
Current quantum hardware (superconducting, ion traps, neutral atoms, photonics) is advancing but still far from the millions of error-corrected qubits needed to attack Bitcoin.
Soft forks could introduce post-quantum signature schemes (like Dilithium or Falcon) without breaking backward compatibility. A gradual migration in the 2020s–2030s gives Bitcoin enough time to become quantum-resistant before any real attack is feasible.

Quantum computing has long been discussed as a potential threat to cryptographic systems, including Bitcoin’s.

Bitcoin (BTC) relies on elliptic curve cryptography (ECDSA on the secp256k1 curve) for digital signatures and on hash functions (SHA-256 and RIPEMD-160) for its proof-of-work (PoW) and address generation.

The concern is that a sufficiently powerful quantum computer could break Bitcoin’s cryptography. For example, by deriving private keys from public keys or finding preimages for hashes, one can undermine the system’s security.

Many oversimplified claims have emerged on both sides, from predictions of Bitcoin’s imminent doom to dismissals that quantum is a non-issue. In this CCN Reports issue, I break down the quantum question in plain terms: how worried should Bitcoiners and the crypto industry as a whole really be?

Try Our Recommended Crypto Exchanges

Quantum Algorithms Threatening Bitcoin

Among quantum algorithms, only a couple are relevant for Bitcoin’s security. They have been the focus of both technical research and community debate, since they touch the foundations of how transactions are verified and protected. The security question ultimately comes down to Shor’s and Grover’s algorithms.

Shor’s Algorithm (Breaking ECDSA)

Peter Shor’s quantum algorithm (1994) can efficiently solve the integer factoring and discrete logarithm problems, the hard math underlying RSA and elliptic-curve cryptography.

**Figure 1**: Shor’s Quantum Circuit | **Credit**: Science.org

For Bitcoin, this means a sufficiently large quantum computer running Shor’s algorithm could derive private keys from public keys in polynomial time, essentially defeating ECDSA. In practice, an attacker with such a quantum computer could forge Bitcoin signatures or steal funds by computing the private key for any public key that has been revealed.

The good news is that Bitcoin’s design offers some protection. Bitcoin addresses are typically hashed (P2PKH format), so the public key isn’t visible on-chain until the owner spends from that address. Coins in unspent P2PKH addresses (with never-revealed pubkeys) are not immediate targets. However, any coin spent from a traditional address or stored in a public-key-only address (like the older P2PK type used in early Bitcoin) becomes vulnerable, its public key is exposed, and could be cracked by Shor’s algorithm.

Notably, about 5 million BTC (roughly 25% of supply) reside in addresses with exposed public keys, including Satoshi-era coins and any reused addresses. These would be the prime targets if a quantum adversary arose.

**Figure 2**: How Much Bitcoin Is Quantum-Vulnerable? | **Credit**: BIP (Post Quantum Migration and Legacy Signature Sunset), Toghrul Aliyev (@itsToghrul)

In essence, Shor’s algorithm is the existential threat: it undermines the elliptic curve discrete log assumption that secp256k1’s security rests on. Once a quantum computer is powerful enough, ECDSA (and even Bitcoin’s newer Schnorr signatures) would no longer be secure, which would break Bitcoin’s entire authentication model.

Grover’s Algorithm (Attacking Hashes)

Lov Grover’s algorithm (1996) is a different quantum algorithm that gives a quadratic speed-up for brute-force search problems. It doesn’t crack cryptographic hashes outright, but it can reduce the work needed for tasks like finding a preimage (given a hash, finding an input that produces it) or finding hash collisions. In Bitcoin’s context, Grover’s algorithm could, in theory, speed up attempts to reverse hash functions or find lucky nonces for mining.

**Figure 3**: Quantum Circuit Diagram of Grover’s Algorithm | **Credit**: Wikipedia

However, the impact is limited. For a hash of n bits, Grover’s algorithm reduces the work from 2^n to about 2^(n/2) operations. Bitcoin uses 256-bit hashes (SHA-256) in its proof-of-work and a 160-bit hash (RIPEMD-160) for addresses. Grover’s algorithm would effectively cut the security of SHA-256 to 128 bits and RIPEMD-160 to 80 bits.

While that is a significant theoretical reduction, those search spaces (2^128 and 2^80) are still astronomically large. For example, finding a SHA-256 preimage with Grover’s algorithm still requires on the order of 2^128 (~3.4×10^38) operations, which is a number far beyond the reach of any realistic computer.

In practical terms, this means Bitcoin’s hash-based aspects remain safe. Even a powerful quantum computer would find it infeasible to brute-force a Bitcoin address or out-mine the entire network using Grover’s speed-up alone.

Moreover, any quantum advantage in mining would be blunted by the network’s difficulty adjustment (and by classical miners potentially also adopting quantum hardware). Thus, Grover’s algorithm is more of a theoretical weakening of Bitcoin’s hash functions, but not a practical threat in the foreseeable future. The community would need to be mindful of hash lengths in the very long term (many decades out, perhaps increasing hash size if ever needed), but compared to the signature problem, Grover’s impact is minor.

The State of Quantum Computing Hardware in 2025

Assessing the quantum threat timeline requires a look at the state of quantum hardware development.

Superconducting Qubits (IBM, Google)

Superconducting qubits, implemented as tiny superconducting circuits on chips, are among the most mature quantum technologies. IBM and Google have pushed the qubit-count frontier in this area. In 2023, IBM unveiled its Condor processor with 1,121 superconducting qubits, a world record for a general-purpose quantum chip. IBM is even targeting 100,000 qubits by 2033 with modular quantum “supercomputers” linking many chips.

**Figure 4**: IBM Quantum Roadmap | **Credit**: IBM

Google, on the other hand, has emphasized improving qubit quality and error correction. In 2024, Google announced its Willow processor (105 qubits), which demonstrated exponential error suppression as logical qubits grew larger.

In other words, Google showed with Willow that going from a 3×3 to 5×5 to 7×7 qubit surface code lattice (increasing the physical qubits per logical qubit) reduced the logical error rate by about a factor of two at each step. This is the first experimental proof that quantum error correction can actually work in practice and is a major step toward a fault-tolerant quantum computer.

Despite significant progress, most practical superconducting qubits in current devices exhibit coherence times ranging from tens to a few hundred microseconds, with two-qubit gate error rates around 0.1–1%. Exceptional lab results have demonstrated coherence times approaching milliseconds, but these have yet to be consistently realized in large-scale commercial systems.

**Figure 5**: Energy Decay (T₁) and Echo Coherence (T₂ Echo) Measurements of a Planar Transmon Qubit | **Credit**: Mikko Tuokkola, Aalto University

Not to mention that scaling from the ~100 qubits today to the millions likely needed will require solving daunting engineering problems in wiring, cryogenics, and fabrication yield. Google has publicly stated an ambition to reach 1 million physical qubits by the end of this decade, although that remains aspirational.

As of 2025, superconducting devices can entangle on the order of a few dozen qubits in complex circuits (e.g., for quantum simulations or error-correction demonstrations), employing heavy error mitigation to do so. Clearly, much work remains to achieve the qubit numbers and quality needed for Shor’s algorithm, but superconducting platforms are making steady progress.

Trapped Ion Qubits (Quantinuum, IonQ)

Trapped-ion quantum computers use charged atoms (ions) suspended in electromagnetic traps, manipulating them with laser or microwave pulses. Ion qubits are exceptionally high-fidelity: two-qubit gate errors can be as low as 0.1% or even 0.01% in cutting-edge systems, and ions can maintain coherence for seconds or longer. The trade-off is that operations are relatively slow (microsecond pulses, and gating many ions can be slow), and scaling to large numbers of ions in one device is difficult.

Quantinuum (the company formed by Honeywell Quantum and Cambridge Quantum) and IonQ are leaders here. Quantinuum’s latest machine, H2, launched in 2023 with 32 fully-connected ion qubits and was upgraded to 56 qubits in 2024. In an ion trap, “fully-connected” means each qubit can interact with any other, which simplifies certain algorithms. Quantinuum has focused on quality over quantity as its 56-qubit system has achieved quantum volumes and circuit depths that exceed what some 100+ qubit superconducting devices can do, due to much lower error rates.

In fact, Quantinuum demonstrated encoding multiple logical qubits with quantum error correction on the H2, which showed that real error correction is starting to become feasible at modest scales.

IonQ, another major player, has commercially available devices with 20+ qubits and has announced a roadmap aiming for >100 trapped-ion qubits within a few years (using modular architectures and photonic interconnects to link ion traps). Trapped-ion systems currently hold records for quantum gate fidelity and have achieved entanglement of 20+ ions. The challenge ahead is mostly engineering: packaging more ions or networking traps while maintaining stability and low error rates.

**Figure 6**: IonQ Quantum Roadmap | **Credit**: IonQ

Unlike superconductors, trapped ions don’t “naturally” scale to 1000s in a single array, so companies are exploring methods like splitting ions into multiple zones or connecting multiple smaller traps via photons.

Overall, ion qubits are extremely promising for early fault-tolerant prototypes (because fewer qubits might be needed when each is so accurate), but increasing qubit count remains a slower process than in superconducting systems.

Top Picks for Bitcoin

Neutral Atom Qubits (Atom Computing, Pasqal)

Neutral atom quantum computing is another approach gaining momentum. It uses neutral atoms (typically rubidium or cesium) trapped in grids of optical tweezers (focused laser beams). These atoms can be arranged in 1D or 2D arrays of dozens to hundreds. Two-qubit gates are done either by exciting atoms to Rydberg states (where they interact strongly if close) or by moving atoms together. The big advantage of neutral atoms is scalability in number, as it’s relatively easy to trap hundreds or potentially thousands of atoms in parallel.

In late 2023, Atom Computing announced it had built a 1,225-site optical array and loaded 1,180 neutral atom qubits into it, which is the first time a universal quantum platform exceeded 1000 qubits. Not all these qubits were fully controlled or entangled (at that stage, it’s a physical qubit count milestone), but it shows the sheer scale possible.

Neutral atom qubits also boast very long coherence times (on the order of tens of seconds for certain hyperfine states). The drawback has been gate fidelity because entangling operations using Rydberg interactions have error rates of a few percent in current experiments, which is much higher than superconducting or ion qubits (though there has been steady improvement).

Companies like Pasqal (France) and QuEra (US) have demonstrated ~100-atom systems used for analog quantum simulations, and are now moving toward fully digital (gate-based) computations on those atoms. Atom Computing (US) has achieved mid-circuit measurements on their platform and emphasizes fast reconfigurability (they can dynamically move atoms or rearrange their qubit layout, which helps optimize circuits).

So, neutral atoms offer huge potential qubit counts, but the focus now is on raising gate fidelities and crosstalk performance. If they can get two-qubit errors down to the ~0.1% range, these systems could become serious contenders for large-scale quantum processors, given how quickly they can ramp up qubit numbers.

Photonic Qubits (PsiQuantum, Xanadu)

Photonic quantum computing uses particles of light as qubits. Photons rarely interact with matter or each other, which makes them naturally robust against decoherence. One can send photons through fiber or optical circuits with little loss of coherence.

However, that same property makes it hard to create entanglement. Photonic quantum computing relies on probabilistic entangling schemes or massive overhead via measurement-based techniques.

PsiQuantum (USA) is the most prominent startup in this space. It’s aiming to build a fault-tolerant photonic quantum computer with 1 million qubits, leveraging silicon photonic chips.

In 2025, PsiQuantum announced a prototype photonic quantum chip (“Q1” Omega) manufactured in partnership with GlobalFoundries. While they haven’t yet demonstrated large-scale entangled operations publicly, their strategy is to use photonics’ inherent scalability (they can print many photonic components on a semiconductor wafer) and powerful error-correcting codes (like fusion-based quantum computing) to leap directly to a machine with millions of physical qubits. Photonic qubits can also operate at room temperature and integrate with classical photonic circuits, which is a plus for scaling.

Another player in the space is Xanadu (Canada), which built a photonic quantum processor (Borealis) that demonstrated quantum advantage in a boson sampling task (using squeezed-state photons). Although that was a specialized computation rather than a universal quantum computing, Xanadu is also working on photonic gates and error correction (e.g., using Gaussian boson sampling outputs as resources for computation).

The bottom line for photonics is that it’s still in earlier stages for general quantum computing. No one has shown a high-fidelity, large entangled photonic circuit yet. But if/when they solve the entanglement and loss problems, photonic approaches could scale rapidly using semiconductor manufacturing techniques. PsiQuantum, for instance, is targeting the late 2020s for a useful large-scale system, though many observers consider that timeline optimistic.

Topological Qubits (Microsoft’s approach)

A topological quantum computer seeks to encode qubits in more exotic states of matter that have built-in error protection. Microsoft has pursued this via Majorana zero modes, essentially, creating quasiparticles in certain superconducting nanostructures that can encode quantum information non-locally, making it much less sensitive to local noise. This approach promised to cut down the overhead for error correction dramatically, but it has proven extremely challenging to realize.

In 2022–2023, Microsoft reported evidence that it had finally created and observed Majorana states in the lab and built a prototype “topological qubit” device. They further claimed to have integrated 8 topological qubits on a chip and outlined a roadmap to scale to a million qubits via networks of these devices.

If successful, Microsoft’s topological qubits could be a game-changer. They might achieve error rates far lower than standard superconducting or ion qubits, meaning far fewer physical qubits would be needed for a stable logical qubit.

However, the scientific community remains cautious. Microsoft’s claims have not yet been verified by independent groups, and previous “signals” of Majorana particles in similar experiments turned out to be false positives. Some experts expressed skepticism that Microsoft has truly demonstrated non-Abelian Majorana modes with topological protection.

The effort is high-risk, high-reward. If it works, quantum computing could accelerate quickly (Microsoft talks of a quantum supercomputer in ~10 years based on this), but if the physics doesn’t pan out, it could be a dead end.

As of 2025, no other group has a working topological qubit, and Microsoft’s remains in a developmental stage. It’s certainly not contributing qubit counts comparable to the other approaches yet. I include it here because it represents a potentially different route to scalability that might pay off in the 2030s.

Summary of Quantum Hardware Status

Across all platforms, quantum computing is still in the NISQ era (Noisy Intermediate-Scale Quantum). The largest gate-based devices have a few hundred physical qubits, and none have demonstrated a single fully error-corrected logical qubit operating indefinitely. Threatening Bitcoin likely requires thousands of logical qubits with low error rates, which in turn means perhaps millions of physical qubits, given current error correction schemes. No platform is there yet.

However, steady progress is evident. Qubit counts are rising (from tens to hundreds, aiming for thousands in a few years), and error rates are inching downward (Google’s latest showed logical error < physical error, ion traps approach 99.99% fidelity, etc.).

The overall trajectory suggests that quantum computers could become powerful enough to break Bitcoin’s 256-bit keys within a couple of decades, if progress doesn’t stall. But there is a long journey and many engineering breakthroughs needed between the current 100-qubit prototypes and the million-qubit, low-error machines required for Shor’s algorithm on Bitcoin. This is why experts predict a timeframe on the order of the 2030s or 2040s for a cryptographically relevant quantum computer (as I’ll discuss in the conclusion).

Practical Constraints: Error Correction, Decoherence, and Scaling

Even with optimistic assumptions, building a quantum computer that can break Bitcoin faces major technical hurdles. It’s important to understand these constraints, as they inform both when such a machine might appear and how Bitcoin can respond.

Error Rates and Quantum Error Correction

Today’s qubits are highly prone to errors from environmental noise, imperfect control, crosstalk, etc. Quantum error correction (QEC) is the strategy to tame these errors: one logical (error-resilient) qubit is encoded into many physical qubits, so that if some errors occur, the errors can be detected and corrected via redundancy.

But QEC comes at a steep cost. It requires a large overhead in qubit count and operations. For the popular surface code, to achieve a logical error rate low enough for deep computations, one might need on the order of hundreds of physical qubits per logical qubit.

Consequently, breaking Bitcoin’s 256-bit ECDSA by brute force might require millions of physical qubits even with error correction. For example, one study in 2022 estimated that about 13 million physical qubits (with error rates ~10^−3 and microsecond cycle times) would be needed to crack a 256-bit key in 24 hours, and around 317 million qubits to do it in 1 hour. These figures assume using optimized Shor’s algorithms and dense error correction. They are astronomically beyond current capabilities (by ~7–8 orders of magnitude in qubit count).

As of 2025, no quantum computer has achieved more than a few dozen logical qubits, and those only with very high error rates remaining. Google’s recent experiment, for instance, needed 49 physical qubits to make one logical qubit (distance-5 surface code), and that logical qubit still suffered a few percent error per cycle. The path to thousands of near-perfect logical qubits clearly requires further orders-of-magnitude improvements in both qubit quantity and quality. Quantum error correction is essential for breaking Bitcoin, and it introduces a huge resource barrier that quantum machines have not yet come close to overcoming.

Decoherence and Coherence Time

Qubits lose their quantum state (coherence) after some time due to interaction with their environment. The coherence time, combined with gate speeds, limits how many sequential operations can be done before errors overwhelm the computation.

For superconducting qubits, coherence times are in the tens of microseconds. For trapped ions or certain atomic qubits, they can be seconds or more. If a quantum algorithm requires millions of steps, but each qubit can only stay coherent for, say, 100 microseconds (maybe a few thousand operations) without error correction, that algorithm can’t succeed without QEC.

Current devices can perform on the order of 10^3 coherent gate operations in a row before the probability of error becomes significant. Breaking Bitcoin might require on the order of 10^8–10^9 logical operations (for running Shor’s algorithm on 256-bit numbers), many orders of magnitude beyond what today’s hardware can manage.

Quantum error correction extends effective coherence by continually correcting errors, but it only works if physical error rates are below a certain threshold. Today’s best qubits are just reaching that threshold (~10^−3 error per gate for the surface code), and even then, only for small codes.

Much longer coherence (or faster gates with the same error rates) will be required to execute the deep circuits needed. Google’s 2024 result was a first step, showing that a larger encoded qubit can last longer than a smaller one. But to mount a full attack on Bitcoin, error-corrected qubits would need effective coherence times measured in hours or days, or gate speeds and error rates that allow billions of serial operations. That remains a distant prospect.

Gate Fidelity and Error Rates

The accuracy of quantum gates (one- and two-qubit operations) is another critical factor. Each operation has some chance of error, and complex algorithms need those chances to be extremely low. Currently, state-of-the-art gate fidelities are: 99.9% (error 10^−3) for two-qubit gates in superconducting systems (and around 99.99% for one-qubit gates), and even better (99.99% for two-qubit) in small ion trap experiments.

Researchers have demonstrated single-qubit gates with error rates below 10^−7 (99.99999% fidelity) in a trapped-ion system, which shows that phenomenal accuracies are physically possible in isolation.

However, multi-qubit operations and scaling introduce even more errors. To run millions of steps, a quantum computer would likely require error rates per gate on the order of 10^−6 or better (so that cumulative errors remain bounded with error correction). This is a few orders of magnitude beyond the ~10^−3 error rates that characterize the best two-qubit gates today.

It’s worth noting that every small improvement in physical error rate has an outsized effect: error correction overhead drops dramatically as gate fidelity approaches the threshold. Thus, there’s a big push to go from 99.9% to 99.99% to 99.9999% fidelity in various platforms.

Superconducting qubits have improved via better materials and calibration. Ion traps achieve high fidelity by precise laser control and longer interaction times. New techniques (like fluxonium qubits, tunable couplers, etc.) are being explored to squeeze more fidelity out. I expect that quantum hardware will continue to improve in error rates, but it’s hard to project how quickly it will reach the 10^−5 or 10^−6 level needed. What is clear is that without such improvements, attempts to run very long algorithms will be impeded, which is why, as of today, factoring even an RSA-2048 (let alone Bitcoin’s ECC) is totally out of reach.

Scaling and Control Challenges

Besides the qubits themselves, building a cryptographically relevant quantum computer raises engineering issues of an entirely different scale. For superconducting qubits, control wiring and cryogenics become a bottleneck. IBM’s 1000+ qubit chip requires a refrigerator and wiring cabinet nearly the size of a room. Going to millions of qubits might entail huge cryostats or distributed modules.

Companies are exploring modular architectures (e.g., linking many smaller quantum processors via optical or microwave links) to scale beyond the confines of one chip or one cryostat. But this introduces complexity in synchronization and communication (quantum interconnects between modules must carry entanglement with high fidelity).

Trapped ion systems face a different scaling issue. One may need multiple vacuum traps networked by photonic links if you can’t trap enough ions in one device. Photonic systems need massive numbers of sources and detectors with precise timing. All platforms will require an immense amount of classical control hardware (for driving pulses, tuning error-correcting feedback, etc.) integrated with the quantum hardware.

As an example, Google’s Sycamore used dozens of microwave lines for 53 qubits. Scale that to 1 million qubits, and one sees the challenge in wiring and control feedback. Moreover, the power and heat dissipation requirements might be enormous. So, engineering a million-qubit machine will likely demand new technological breakthroughs in control electronics, wiring (perhaps cryo-CMOS controllers, etc.), and maybe entirely new approaches (like photonic chip-based interconnects or topological qubits that need far less overhead). These are solvable problems in principle, but they add uncertainty to the timeline, even if qubits themselves improve, integrating millions of them is a moonshot-level project.

All these constraints explain why experts don’t expect Bitcoin’s crypto to be broken overnight. The field remains many orders of magnitude away on multiple fronts: qubit count, error rates, and system integration.

As of 2025, IBM’s largest chip (1121 qubits) is still ≪1% of the way to the scale needed, and that’s without error correction. However, the progress trend is steady and not to be ignored. The coming decade will likely see the first demonstrations of logical qubits and small error-corrected processors (maybe with tens of logical qubits). If that succeeds, scaling could accelerate. The takeaway for Bitcoin is that the threat, while not immediate, is plausible in the long term, giving a precious window to upgrade the protocol before any adversary can actually wield a quantum computer against the network.

How Bitcoin Can Survive Quantum Computers With Post-Quantum Cryptography

How can Bitcoin prepare for the eventual arrival of quantum computing?

Fortunately, Bitcoin is not a static system, it can be upgraded, albeit carefully, through the decentralized consensus process. The primary defense will be to swap out vulnerable cryptography (ECDSA and even SHA-256/RIPEMD-160 if needed) for post-quantum cryptography (PQC), which are algorithms believed to be secure against quantum attacks.

In 2022, after years of evaluation, NIST selected several PQC algorithms for standardization: for digital signatures, schemes like CRYSTALS-Dilithium (lattice-based) and FALCON (lattice-based), and for encryption/key exchange, CRYSTALS-Kyber (lattice-based), among others.

By 2024, draft standards for these were published. These algorithms are the leading candidates for Bitcoin’s future. For example, Bitcoin could adopt Dilithium or Falcon in place of ECDSA for transaction signatures. The challenge is not so much the mathematics (which are public and well-studied) but the integration: making such an upgrade in a backward-compatible way and ensuring the new algorithms are sufficiently efficient for Bitcoin’s usage.

Post-Quantum Bitcoin: Soft Fork Upgrade Path

The ideal way to introduce quantum-safe crypto to Bitcoin would be via a soft fork, which means adding new rules that do not invalidate old ones. This could be done by defining a new transaction output type (or a new script opcode) that uses a PQC signature verification.

Bitcoin developers, including Casa CTO Jameson Lopp, have already discussed this pathway in BIP-360, which proposes a phased soft fork to gradually transition the network away from cryptographically outdated address formats while maintaining backward compatibility.

For instance, Bitcoin could have a new version of pay-to-public-key that expects a Dilithium public key and signature instead of an ECDSA pair. It could be introduced as anyone-can-spend from the perspective of old nodes (similar to how SegWit and Taproot were deployed), so that it doesn’t break their validation, they simply would not enforce the new rule, but new nodes and miners would.

In practice, it might look like a new SegWit version (e.g., version 2 witness program) where the witness data is a PQC signature and the program commits to a PQC public key. Because Bitcoin now has a flexible script versioning system (thanks to SegWit), this is quite feasible.

A concrete example: there’s been discussion of a new output type called P2PQ (“pay to post-quantum public key hash”), analogous to P2PKH but using, say, a hash of a lattice-based public key. Old nodes would see it as an unknown version and not enforce the signature, but upgraded nodes would require a correct PQC signature to spend.

The key point is that Bitcoin can add support for PQC without requiring a hard fork or abandoning old addresses immediately. It can coexist. Over a period of years, users could move their coins from old ECDSA addresses to new PQC addresses. During that time, both types of addresses would be spendable (so no one is forced to upgrade until they’re ready), but eventually almost all funds would migrate.

One might wonder why not implement PQC right now?

In fact, Bitcoin developers are cautious, PQC algorithms are new and still being vetted. It’s wise to let them mature a bit (get more cryptanalysis, improve performance) before rushing them into the most valuable cryptocurrency.

Additionally, any change to Bitcoin’s consensus rules is undertaken slowly and deliberately. A likely timeline is: in the next few years, develop and test PQC integration in test networks or sidechains. By the late 2020s, activate a soft fork that enables PQC-based addresses. Give users perhaps another decade to migrate, and by the time quantum computers are actually a threat, Bitcoin would predominantly be using quantum-resistant keys.

There have even been clever proposals to enhance Bitcoin’s crypto-agility by creating hybrid or “two-layer” keys. For example, one concept is to use a hash-based one-time signature behind the scenes of a normal ECDSA key. User wallet would generate a post-quantum one-time key and then hash it to produce your Bitcoin address (mapping that hash into a valid secp256k1 private key). In normal times, one just uses ECDSA, but if a quantum attack becomes imminent, a soft fork could allow the user to reveal and use that hash-based signature instead (proving ownership via the post-quantum scheme). This is called Digests as Secret Keys (DASK), and it illustrates that developers are exploring failsafes to be prepared for worst-case scenarios.

Performance and Implementation Considerations

Switching to PQC will not be seamless, there are trade-offs. Post-quantum signature schemes have much larger signature sizes and/or public keys than ECDSA.

For instance, a Dilithium signature is a few kilobytes (vs 64 bytes for ECDSA), and even compact schemes like Falcon have ~1 KB signatures. It means transactions will become bigger if they include PQC signatures, which in turn means fewer transactions per block (or higher fees per byte). Verification speed is also a factor. PQC algorithms can be computationally heavier (though many are still quite fast, on the order of milliseconds or less to verify). It’s important that any PQC chosen for Bitcoin be optimized and perhaps parameterized for Bitcoin’s use (e.g., choosing a slightly smaller parameter set if it’s deemed secure enough, to save space).

There is also the risk that a chosen PQC scheme could later be found weak, it has happened before with some candidates during the NIST process. Bitcoin might opt to hedge by supporting multiple PQC algorithms in parallel, so that, for instance, an address could be made secure by requiring two signatures: one from a lattice-based scheme and one from a hash-based scheme. That way, even if one is broken, the funds are safe. This, of course, would further bloat transaction sizes and complicate validation logic. Such decisions will require extensive discussion and consensus in the Bitcoin community.

Game-Theoretic Dynamics

One positive aspect of the quantum threat is that it creates a convergence of incentives in Bitcoin’s ecosystem. Everyone holding or using Bitcoin has an interest in maintaining its security. Miners don’t want to see mass thefts (which would crash the value of coins and thus their revenue), users obviously don’t want their coins stolen, and exchanges and businesses need confidence in signatures to continue. So unlike some past upgrades that pitted different interests (block size debates, etc.), the quantum upgrade should conceptually have broad support.

The trickiest part may be dealing with lost coins and long-dormant addresses. As mentioned, there are coins (like Satoshi’s) that likely will never be moved with any key, if those public keys are exposed (and many early ones are), a quantum attacker could steal them.

Some have proposed a protocol change to freeze or revoke those coins before that happens (essentially treating them as burned if not moved by a certain date). A phased soft fork could, for example, declare that after 20YY, coins in old-style addresses can no longer be spent (or can only be spent if a proof is provided that you still possess the private key in some form).

But this is highly controversial. It goes against the principle that valid coins should always be spendable by whoever has the key. The debate here is about protecting those who cannot protect themselves (holders who lost keys or died and thus can’t migrate their coins). If nothing is done, a quantum thief in, say, 2035 might steal those coins and possibly flood the market. If a soft fork preemptively freezes them, the value might be preserved (since those coins were effectively out of circulation anyway).

However, such an action would need overwhelming consensus, since it’s akin to modifying ownership by protocol fiat, which is something Bitcoin has never done. It’s likely that, rather than rushing into that, the community will try a simpler path, meaning publicize the quantum risk well in advance and encourage anyone with old coins to move them. Many long-dormant addresses did start moving after 2020 (perhaps due to owners realizing the risk of keeping coins in P2PK addresses after quantum discussions surfaced).

Economic incentives can help too. If it’s clear that coins in vulnerable addresses will be stolen by a quantum attacker eventually, rational actors (who still have access) will move them to safety (or sell them). That leaves truly lost coins, which, by definition, no one can move. Those might end up stolen when Q-day hits, but since they were lost anyway, one could argue that it doesn’t harm active users, though it could increase coin supply unexpectedly, which would affect the price. It is a thorny issue, but it doesn’t affect the technical step of upgrading Bitcoin’s cryptography. It’s more of a policy debate the community may need to have in the 2030s.

Bitcoin’s Resilience Timeline Against Quantum Computers

The process of making Bitcoin quantum-safe should be seen as a gradual migration rather than a sudden switch flipped at the last minute. The ideal scenario is that, well before any quantum computer exists that can threaten Bitcoin, the network will predominantly use post-quantum keys.

It means a soft fork enabling PQC addresses is deployed, say, in the late 2020s. Exchanges, wallets, and users start using them for new outputs through the early 2030s. By the mid-2030s, a significant majority of Bitcoins are on quantum-resistant addresses (perhaps via new SegWit versions or script types). And by the time the first cryptographically relevant quantum computer is announced (maybe late 2030s or 2040s), the remaining vulnerable coins are either a small minority or can be frozen/protected by consensus if needed.

During the transition, Bitcoin might operate in a hybrid mode, still supporting ECDSA for those who haven’t upgraded, but strongly encouraging (or even fee-discounting) the use of PQC-based transactions. There may also be “swiss-army-knife” addresses that, for instance, require both an ECDSA and a PQC signature to spend, a form of multi-signature that ensures quantum protection (since the attacker would have to break both). This could be an intermediate approach to secure important addresses (like exchange cold wallets) during the migration period.

In the end, Bitcoin’s upgrade will test its governance and coordination. Unlike a centralized service that can be updated overnight, Bitcoin’s changes require consensus among a decentralized community.

The good news is that quantum risk is a clear technological threat rather than a political issue, which makes coordination smoother (akin to how critical bugs are addressed). Developers, miners, businesses, and users will all be motivated to adopt a fix once it’s proven.

Here’s an analogy.

Think of the eventual quantum computer as a sort of asteroid on a collision course, it’s far out, but everyone knows it’s coming. The community’s job is to build the “deflection rocket” (the PQC upgrade) and launch it in time. Launch too early with untested tech and it might fail. Launch too late and the asteroid hits. The balance of evidence suggests there is enough time to prepare and execute the upgrade properly.

Conclusion

Most experts assess that a quantum computer capable of breaking Bitcoin’s cryptography is still many years away, likely on the order of a decade or two (i.e., the 2030s or 2040s). The U.S. National Institute of Standards and Technology, cognizant of the long lead time for upgrading security infrastructure, has recommended that industries aim to transition to post-quantum cryptography by the 2030s.

For Bitcoin, which changes slowly, this means the community should start planning and implementing upgrades in the 2020s, so that the network is largely quantum-resistant by the time quantum attackers emerge. All indications (from studies and industry roadmaps) suggest that there are likely a couple of decades to prepare.

That said, there is inherent uncertainty. A breakthrough could come sooner, or a well-funded adversary might achieve a quantum leap in secret. Therefore, prudence dictates that Bitcoin stakeholders act well before the threat is imminent. The motto should be: don’t panic, but don’t procrastinate.

Encouragingly, the Bitcoin ecosystem has the tools and talent to navigate this transition. The development of quantum-safe cryptography is already well underway globally (with NIST standards finalized in 2024), and Bitcoin developers have been actively following and contributing to this research. When the time is right, deploying a soft fork to introduce PQC-based addresses is technically straightforward, akin to past upgrades like SegWit or Taproot. The challenge lies more in social coordination and thorough testing, both of which Bitcoin’s community has shown it can handle for critical improvements.

In the coming years, experimental quantum-resistant wallets, testnet trials of PQC transactions, and possibly bounty programs to ensure the chosen algorithms are robust are likely to appear. By moving deliberately and transparently, the community can build confidence that the eventual switch-over will be secure.

It’s also worth dispelling some hype. Not all “quantum threats” are equal, and not all solutions need to be immediate. For example, claims that quantum computers could suddenly “break Bitcoin’s mining” or “crack all addresses overnight” are exaggerated; as discussed, mining is only marginally affected, and hashed addresses remain safe until used. So, Bitcoin doesn’t need to, say, abandon proof-of-work or double its hash sizes any time soon. The focus should remain on the real vulnerability: the signature algorithm.

Another point is the risk of premature solutions. There have been altcoins marketing themselves as “quantum-proof” for years, using obscure or untested cryptography, which often comes with other security trade-offs. Bitcoin’s approach will be to use algorithms vetted by the wider cryptographic community and to implement them in a careful, consensus-compatible way. The conservative strategy is why Bitcoin can afford to wait until algorithms like Dilithium/Falcon are standardized and optimized. The industry does not need to jump on a bandwagon of a novel scheme that hasn’t stood the test of time.

So, the outlook is optimistic. Quantum computing, while advancing, is doing so openly and methodically, it is unlikely to catch Bitcoin completely off-guard. The most realistic timeline for a quantum computer threatening Bitcoin’s 256-bit keys is around the late 2030s or 2040s, and Bitcoin is poised to upgrade long before then. By prioritizing research and starting early migration in the next decade, Bitcoin can neutralize the quantum threat before it even materializes.

It will require a collective effort: developers to write the code, miners and nodes to adopt the new rules, exchanges and wallets to educate users and roll out upgrades. But given the existential nature of the threat, I expect cooperation to win out over inertia, the alternative is in nobody’s interest.

Bitcoin has proven resilient through many challenges (bugs, forks, regulatory pressures), and the quantum challenge will be no exception. With diligent preparation, Bitcoin will likely ride out the quantum revolution and continue to function as a secure, decentralized store of value and payment system.