# Can Quantum Computers Break Bitcoin? What Is Known in 2026 > Learn what quantum computers could threaten in Bitcoin, why exposed public keys matter, what NIST has standardized, and what BIP 360 does—and does not—solve. Published: 2026-04-04 | Updated: 2026-11-10 | Author: MRHB Team Canonical: https://mrhb.network/blogs/quantum-threat-bitcoin/ See also: https://mrhb.network/llms.txt --- > **Important:** No public evidence shows that a quantum computer can derive Bitcoin private keys at the scale required today. The risk is real in theory, but exact timelines, vulnerable-coin totals and attack speeds remain uncertain. ## Quick answer Bitcoin uses digital signatures to check whether someone can spend funds. A sufficiently powerful, fault-tolerant quantum computer could in theory use a public key to work out the private key behind it. That would threaten the signatures that protect some spending conditions. As of the evidence checked for this guide, no public demonstration has shown that capability against a real Bitcoin key. The practical questions are which keys are exposed, what spending rules could replace today’s signatures and how users would move funds if a migration were adopted. ## What part of Bitcoin is at risk? Bitcoin uses digital signatures to prove that a spender controls the required key. Traditional ECDSA signatures and Taproot's Schnorr signatures rely on elliptic-curve cryptography. A cryptographically relevant quantum computer running Shor's algorithm could threaten the mathematical problem that keeps the private key hidden from the public key. This is a **signature** problem, not a general statement that all Bitcoin cryptography fails at once. Bitcoin also uses hash functions in addresses, transaction structures and proof of work. Quantum algorithms may change the security margin of some hash problems, but that is different from deriving an elliptic-curve private key from a public key. ## Can a quantum computer do this today? Researchers have estimated what it would take to recover a full-size Bitcoin private key. A [Google Quantum AI study](https://research.google/pubs/securing-elliptic-curve-cryptocurrencies-against-quantum-vulnerabilities-resource-estimates-and-mitigations-2/) and a [separate trapped-ion study](https://arxiv.org/abs/2609.05625) model different machines. Their estimates depend on the hardware and how reliably it could run the calculation. In the evidence reviewed on 10 November 2026, neither study reports a quantum computer recovering a real Bitcoin private key. NIST says quantum machines capable of breaking widely used public-key cryptography may be years or decades away, while also advising organisations to begin migration because large cryptographic transitions take time. This creates two errors to avoid: - **Panic:** treating an experimental quantum milestone as proof that Bitcoin keys can be stolen now. - **Complacency:** waiting for a demonstrated attack before designing, testing and coordinating migration. The honest position is “prepare without inventing a countdown.” ## Why does public-key exposure matter? In the attack discussed here, a public key gives the attacker something to work from. How long that key is visible affects how much time an attacker would have. Some Bitcoin output types hide a public key behind a hash until the coin is spent. This limits how long the public key is visible before confirmation—provided the key or address is not reused and the public key has not leaked elsewhere. Other outputs expose a public key for a long time. BIP 360 identifies examples including pay-to-public-key outputs, reused keys and Taproot outputs with visible output keys. Extended public keys and wallet descriptors can also reveal public-key information. The exact exposure depends on output type, wallet behaviour and what information has been shared. ## Long-exposure versus short-exposure attacks BIP 360 uses two useful terms. ### Long-exposure attack The public key is visible for a long period while funds remain spendable. A future attacker could work on recovering the private key without racing a normal confirmation window. Examples include outputs with public keys already visible and keys revealed through reuse or other wallet data. ### Short-exposure attack The public key becomes visible only when a transaction is broadcast. The attacker must recover the key and create a competing spend before the transaction is safely confirmed. This requires a much faster attack. It is still important because most spending eventually reveals authentication data. Hiding public keys can reduce long exposure. It does not create a complete post-quantum signature system. ## Does address reuse make quantum risk worse? It can. The Bitcoin developer guide advises against key reuse partly because unique hashed-key addresses keep a public key hidden until spend. Reusing a key after its public key has been revealed removes that protection for remaining funds controlled by the same key. This is not a reason to invent an emergency wallet move. Follow established wallet security, avoid address reuse and do not act on unverified “quantum migration” links or seed requests. The [hot-versus-cold wallet guide](https://mrhb.network/blogs/hot-wallet-vs-cold-wallet/) explains present-day key exposure and backup trade-offs. Quantum resistance is a separate signature-design question. ## What has NIST standardized? NIST published its first principal post-quantum standards in 2024: - **ML-KEM** for key establishment; - **ML-DSA** for digital signatures; and - **SLH-DSA**, a stateless hash-based digital signature standard derived from SPHINCS+. NIST's October 2026 transition guidance tells organisations to inventory quantum-vulnerable cryptography and plan migration. These standards matter because they provide reviewed algorithms for general systems. They do **not** automatically become Bitcoin transaction rules. Bitcoin would need a compatible proposal, implementation, review, activation plan and wallet ecosystem. ## What is BIP 360? **BIP 360: Pay-to-Merkle-Root (P2MR)** is a Draft Bitcoin Improvement Proposal. It proposes a script-tree output similar to Taproot but without the elliptic-curve key-path spend. Its goal is to let users construct outputs resistant to the defined long-exposure attack, while preserving script-tree functionality. Important limits: - It is not activated consensus behaviour. - It does not itself add a post-quantum signature algorithm. - It does not fully protect the short period when a quantum-vulnerable public key may be revealed during spending. - Wallets, nodes and users would need compatible support if it were adopted. BIP 360 is evidence of active design work—not proof that Bitcoin is already quantum-resistant. ## What else would migration require? ### A transaction signature design Bitcoin needs a post-quantum signature option with acceptable security, verification cost, key size and signature size. ### A deployment path Developers and users must agree how new outputs are recognised, relayed, mined, spent and supported by wallets and hardware. ### User migration Holders need safe tools and enough time to move from vulnerable spending conditions. Scammers will likely exploit any migration period. ### A legacy-coin policy Some coins may remain in old output types or belong to lost owners. Freezing, allowing, limiting or otherwise treating those coins involves technical, property and governance questions. ### Layer-by-layer review Custody services, multisignature systems, hardware wallets, exchanges, payment channels and backup processes may each need changes. A base-layer proposal does not update every dependent system. Programmable account systems face similar coordination questions around signers, modules and upgrades; the [smart-contract-wallet guide](https://mrhb.network/blogs/smart-contract-wallets/) explains those dependencies without presenting them as a Bitcoin solution. ## What should Bitcoin users do now? ### Use established wallet hygiene - Keep wallet software and hardware firmware current through official sources. - Avoid address reuse where the wallet supports fresh receive addresses. - Protect recovery material and extended public keys. - Verify destinations and transaction details. - Maintain tested backups. ### Do not follow speculative migration instructions No article, social post or direct message should ask for a seed phrase to “quantum-proof” funds. Treat urgent coin-migration offers as suspicious. ### Watch proposal status, not headlines Check whether a BIP is Draft, Proposed or activated. Look for reviewed wallet support and consensus documentation rather than an unofficial countdown. ### For organisations, inventory exposure Custodians and wallet providers can map output types, key reuse, xpub handling, signing devices, recovery processes and software dependencies. Planning is useful even when the hardware timeline is unknown. ## Frequently asked questions ### What is “Q-Day”? It is an informal name for the point when a cryptographically relevant quantum computer can break important current public-key systems. It is not a scheduled date. ### Can Google or another company break Bitcoin now? No public evidence supports that claim. Experimental quantum processors are not the same as a fault-tolerant machine capable of large-scale key recovery. ### How many bitcoins are quantum-vulnerable? There is no single stable number appropriate for this guide. Estimates depend on output types, key reuse, leaked public-key data, ownership assumptions and the attack model. ### Is Taproot quantum-resistant? Taproot uses Schnorr signatures over elliptic-curve cryptography and exposes an output public key, so it is relevant to future quantum-key-recovery analysis. It is not a post-quantum signature system. ### Does SHA-256 make Bitcoin quantum-safe? No. Hash functions and digital signatures play different roles. Signature migration still matters. ### Is BIP 360 active? No. As checked on 10 November 2026, BIP 360 is a Draft proposal. ### Should users move coins because of a quantum headline? Do not make urgent transactions based only on a headline. Verify sources, proposal status and wallet guidance; moving funds creates ordinary phishing and transaction risks now. ## Final takeaway Follow the status of Bitcoin’s migration proposals and the guidance from the wallet you use. An exposed public key matters to the theoretical attack, but no public demonstration has recovered a real Bitcoin key this way. Treat claims of an imminent deadline as claims that need evidence.