Quantum Threat to Bitcoin: 6.9 Million BTC at Risk or Overblown Fear?

A new whitepaper from Google Quantum AI estimates 6.9 million BTC are vulnerable to quantum decryption, but Bitcoin developers argue the network is already building the defenses needed to survive.

The clock is ticking on classical cryptography. A 30th March 2026 whitepaper from Google Quantum AI has sent ripples through the digital asset market, warning that a Cryptographically Relevant Quantum Computer (CRQC) could theoretically break the encryption securing Bitcoin much sooner than previously thought. The research estimates that roughly 6.9 million BTC - nearly a third of the total supply - sit in addresses vulnerable to future quantum attacks, and models that real-time transaction hijacking could occur within minutes.

However, a heated debate is raging in the Bitcoin community over how soon advances in quantum computing could endanger wallets, and whether developers are responding to the threat with sufficient urgency. Cryptographers and core developers are pushing back against “Q-Day” alarmism. They point to Bitcoin’s multi-layered security and a suite of active mitigation proposals as proof that the world’s largest cryptocurrency is well-positioned to weather the quantum transition.

Understanding the Quantum Threat: What is Q-Day?

Bitcoin’s transaction authorization depends on elliptic curve-based cryptographic signature schemes, specifically ECDSA (the original signature scheme used since Bitcoin’s launch) and Schnorr (introduced with the Taproot upgrade in 2021). As with all modern classical cryptography, these signature systems rely on a mathematical assumption that it is computationally infeasible to derive a private key from a public key using classical computers.

Enter Shor’s algorithm. Shor’s algorithm (if implemented on a sufficiently powerful, fault-tolerant quantum computer) could, in theory, efficiently derive private keys from public keys. This hypothetical event - the moment a CRQC becomes publicly known - is referred to as “Q-Day”.

Google’s latest modeling suggests that breaking Bitcoin’s ECDSA encryption might require fewer than 500,000 physical qubits, allowing an attacker to derive a private key in approximately nine minutes. This compressed timeline is what has elevated the conversation from theoretical physics to immediate financial risk.

However, not all quantum computers pose a risk to Bitcoin.

To execute such an attack, a machine would require hundreds to thousands of logical qubits and large-scale quantum error correction sufficient to maintain sustained fault-tolerant operation.

Because real quantum hardware is noisy, constructing a single logical qubit requires many physical qubits for error correction, putting current machines orders of magnitude away from the threshold needed to threaten Bitcoin.

Furthermore, while elliptic curve cryptography is theoretically vulnerable to Shor’s algorithm on a sufficiently powerful quantum computer, hash functions such as SHA-256 are believed to remain secure against both classical and quantum attacks, though not theoretically unbreakable.

The 6.9 Million BTC Target: Long vs. Short Exposure

Bitcoin’s quantum exposure is a function of when and how public keys become visible onchain. Unlike account-based blockchains such as Ethereum, which permanently expose public keys at the account layer, Bitcoin’s unspent transaction output (UTXO)-based model provides a degree of structural protection. In Bitcoin, public keys are typically revealed only when coins are spent.

The 6.9 million vulnerable BTC identified by Google (aligning with similar estimates by security groups like Project Eleven) primarily face long exposure attacks.

Long exposure attacks target coins whose public keys are already visible onchain.

This includes legacy pay-to-public-key (P2PK) outputs, reused addresses, and previously spent outputs where pubkeys were revealed.

Pragmatically, these exposed coins are primarily comprised of groups such as users who practice poor transaction hygiene by reusing old addresses, and legacy address formats, which crucially include coins thought to have been mined by Satoshi Nakamoto.

Because the pubkey is permanently exposed, an attacker would have unlimited time to attempt key recovery in a CRQC scenario.

Conversely, active transactions face short exposure attacks.

Short exposure attacks target coins whose public keys are revealed only at the time of spending.

In these cases, an attacker would need to derive the private key quickly enough to front-run the transaction during its confirmation window in the mempool (while it is in flight and not yet confirmed on the blockchain).

With Bitcoin’s block confirmation time averaging 10 minutes, Google’s estimated 9-minute key derivation window presents a narrow but severe real-time threat.

Bitcoin’s Quantum Readiness: The Mitigation Pathways

Despite accusations of developer complacency, the ongoing work that may determine Bitcoin’s preparedness in a post-quantum environment is already substantial. The community is advancing several key upgrades:

1. BIP 360 and P2MR (Pay-to-Merkle-Root)

Authored by Hunter Beast, Ethan Heilman, and Isabel Foxen Duke, BIP 360 introduces a Taproot-like output that removes the key path spend.

It preserves tapscript and script-tree semantics while committing only to a Merkle root and omitting the internal key.

The result is a script-tree output that is resistant to long exposure attacks because there is no always visible internal public key to target.

2. SPHINCS+ / SLH-DSA Fallback

For post-quantum signatures, developers are looking at SPHINCS+ (standardized by the National Institute of Standards and Technology (NIST) as SLH-DSA).

Its security relies solely on hash functions, the same cryptographic primitive Bitcoin already depends on for proof-of-work and transaction integrity.

Standard SPHINCS+ signatures are roughly 8 KB (far larger than current Bitcoin signatures), but tuning parameters for Bitcoin’s specific needs can reduce signature sizes to approximately 3 to 4 KB.

Under a proposed framing, wallets would continue using cheap Schnorr signatures for normal spending via P2MR outputs, while holding an SLH-DSA script path in reserve as a fallback if elliptic curve cryptography is broken.

3. Tadge Dryja’s Commit/Reveal Scheme

If a CRQC arrives before post-quantum upgrades are activated, developer Tadge Dryja has proposed an emergency backstop.

Before broadcasting a transaction, a user publishes a compact hash-based commitment onchain that binds their (still-secret) public key to a specific transaction.

Because the commitment requires knowledge of the secret public key, a quantum attacker who sees the commitment cannot forge a competing one.

A notable feature is the proposed activation trigger: a “Proof of Quantum Computer”. The commit/reveal requirement would only kick in after someone demonstrates onchain that they can forge elliptic curve signatures.

4. The “Hourglass” Proposal for Legacy Coins

Even with new secure pathways, the network must deal with the millions of already-exposed legacy coins. The policy debate swings between retroactive confiscation (freezing or burning vulnerable coins after a deadline) and laissez-faire liquidation (doing nothing and accepting that quantum-capable actors will steal these coins).

Hourglass is best understood as an attempt to find a third path: not burning coins, not preventing recovery outright, but constraining the rate at which vulnerable coins can be extracted and sold.

It is a harm reduction proposal whose primary goal is to mitigate market destabilization in a quantum event while preserving a mechanism for legitimate keyholders to recover funds over time.

Governance Over Technology

The quantum threat to Bitcoin is no longer a fringe theory. While the March 2026 Google whitepaper accelerates the theoretical timeline, Bitcoin’s developers have the technical blueprints required to defend the network.

The true hurdle is not cryptographic, but consensus. Migration timelines for the most decentralized blockchain are measured in years, not weeks. Consensus changes require broad coordination across developers, wallet providers, custodians, miners, and node operators, which means post-quantum migration is a governance problem as much as a technical one.

As the ecosystem weighs its options, the next few years will test whether Bitcoin’s decentralized governance can move fast enough to outpace the quantum computers of tomorrow.