Can Quantum Computers Break Bitcoin? Explained

Can Quantum Computers Break Bitcoin Today?

No, quantum computers cannot break Bitcoin today. A machine with enough reliable qubits to attack Bitcoin's cryptography has not been built.

A regular computer stores information as bits, each one a 0 or a 1. A quantum computer uses qubits, which can hold combinations of 0 and 1 at the same time. That helps with certain kinds of math problems, though not with everyday tasks like streaming video. Qubits are also fragile. Heat and interference cause errors, so researchers need error correction, which uses many physical qubits to make one reliable one.

How many physical qubits would an attack need? In March 2026, Google Quantum AI published a white paper estimating that breaking the elliptic curve cryptography used by Bitcoin and Ethereum could take fewer than 500,000 physical qubits under stated assumptions. That is roughly 20 times lower than earlier estimates. [Source] This is a research estimate of what a future machine would need. It is not a sign that such a machine exists.

Views on timing differ. One CoinGecko analysis argues the hardware needed to threaten the network remains decades away, and that Bitcoin's developers have time to prepare. [Source] Others point to the falling estimates as a reason to plan sooner. Both views rely on predictions about technology that has not been built, so neither can be treated as settled.

The question matters for Canadians the same way it does for everyone else. Bitcoin is a global network, and its rules are not set by any country. Readers who are new to Bitcoin may find this guide on how to buy Bitcoin in Canada useful background before going deeper into the technical side.

Which Parts of Bitcoin Could a Quantum Computer Threaten?

Bitcoin relies on two main kinds of math, and a quantum computer would affect them very differently. Digital signatures are the main concern, while mining is generally viewed as much less exposed.

Mining and hashing. Bitcoin mining uses a hash function called SHA-256, which scrambles data into a fixed-length output that cannot easily be reversed. A quantum method called Grover's algorithm can speed up searching, but only by a modest amount. Researchers generally treat hashing as a smaller concern than signatures.

Digital signatures. To prove you own Bitcoin, you sign a transaction with a private key. Anyone can check the signature using the matching public key, but today's computers cannot work backward from the public key to the private key. Bitcoin uses signature schemes based on elliptic curves, known as ECDSA and Schnorr.

A quantum method called Shor's algorithm is the issue here. On a large enough and reliable enough quantum computer, it could in theory derive a private key from a public key. Whoever holds the private key controls the Bitcoin. That is why the discussion focuses on signatures and on when public keys become visible.

Two details help keep this in proportion:

• A quantum computer needs the public key. It cannot guess a private key from nothing. Whether the public key is visible on the blockchain matters a great deal.
• Bitcoin is not the only system affected. Many banking, messaging, and web systems rely on similar public-key math, so this is a wider cybersecurity topic.

Nothing here says an attack is close. It explains which part of Bitcoin researchers are watching and why. Mining is not expected to be the main pressure point, and signatures are where proposals for change are concentrated.

Why Do Exposed Public Keys Matter?

A public key is exposed when it is visible on the blockchain before the coins are spent. Exposed keys give a future quantum computer more time to work, while keys that stay hidden until spending give it very little.

Bitcoin has used several address types over time, and they handle public keys differently:

• Early pay-to-public-key outputs: Some of the oldest outputs record the public key directly on the blockchain.
• Hashed address types: Many common address types store only a hash of the public key. The key itself is revealed when the coins are spent.
• Taproot (P2TR): This newer type includes a key path, and the proposal known as BIP 360 notes that this key path spend is quantum vulnerable. [Source]

Address reuse also matters. Spending from an address reveals its public key. If any coins are left behind in that same address, their public key is now visible, and a later quantum attack could in theory target them. Most modern wallets create a fresh address automatically for change, which avoids this.

BIP 360 describes two types of risk. A long-exposure attack targets keys that sit visible on the blockchain for a long time. A short-exposure attack would target a key during the short period when a transaction waits to be confirmed. [Source] The second is considered a harder challenge, since it requires a quantum computer fast enough to finish within that waiting window.

Estimates of how much bitcoin sits in addresses with exposed public keys differ, depending on the method and the source, so it is worth treating any single figure with caution. Whatever the exact number, it shows why researchers focus on keys that are visible on the blockchain.

The blockchain is public, and anyone can read it. That openness is part of how Bitcoin works, and it is also why exposure of public keys is the central issue.

What Are Post-Quantum Signatures, and Why Is Upgrading Bitcoin Hard?

Post-quantum signatures are digital signature schemes designed to resist attacks from quantum computers. Bitcoin does not use them today, and adding them would require a network-wide upgrade that has not been agreed.

On August 13, 2024, the US National Institute of Standards and Technology finalized its first post-quantum standards. Two of them cover digital signatures: FIPS 204, built on ML-DSA, and FIPS 205, built on SLH-DSA. [Source] They are general-purpose standards for many kinds of systems. They were not designed specifically for Bitcoin.

Fitting them into Bitcoin is hard for a few reasons:

• Size: Post-quantum signatures are generally much larger than the signatures Bitcoin uses today. Bitcoin's blocks hold a limited amount of data, so larger signatures could mean fewer transactions per block and higher fees if nothing else changes.
• Agreement: Changes to Bitcoin's rules need broad agreement among developers, node operators, miners, and users. Historically, large upgrades have taken years of discussion and testing.
• Existing coins: Coins held in addresses with exposed keys would need to be moved to new address types, and not everyone may do that in time. How to handle that is still debated.

Several proposals are under discussion. BIP 360 proposes a new output type, Pay-to-Merkle-Root (P2MR), which works like Taproot but removes the key path spend that a quantum computer could target. It is listed as a draft, which means it is a proposal under discussion and not part of Bitcoin's rules. [Source] Other ideas include new signature schemes designed to be smaller than the general standards.

None of these proposals has been activated. Draft proposals can change, be replaced, or never be adopted, so it is better to follow the developers' progress than to assume a particular outcome.

What Should Canadian Bitcoin Holders Know About Storage?

How Bitcoin is stored decides who deals with addresses and keys. If a platform holds the Bitcoin, the platform manages the keys. If you self-custody, you manage them yourself. Neither removes risk.

Bitcoin held on a crypto trading platform. The platform's custody arrangement controls the private keys and decides how addresses are created and managed. The investor depends on the platform's systems and on how it handles future protocol changes. Netcoins, for example, names Fireblocks and BitGo as its custody partners. It is reasonable to read any provider's current custody disclosures and ask how it plans to handle upgrades. For a closer look at how custody works, see this guide to centralized crypto custody and self-custody.

Bitcoin in a self-custody wallet. You hold the private keys, which gives more direct control and adds responsibility. Some wallet practices that people discuss in connection with quantum risk are also good general habits:

• Avoid reusing addresses. Most modern wallets generate fresh addresses automatically.
• Protect the recovery phrase. Losing it, or having it stolen through phishing, can mean permanent loss of access.
• Follow the wallet maker's guidance when new address types or upgrades become available.

Moving funds is not risk-free. Sending coins to a wrong address, or mishandling a recovery phrase during a transfer, can cause permanent loss, and transactions are generally not reversible. Anyone considering a change to how they store Bitcoin can read wallet documentation and speak with a qualified professional. The Netcoins guide to the best Bitcoin wallets for Canada users covers common wallet types in more detail.

No upgrade has been activated that changes how Bitcoin addresses handle quantum risk, so there is no standard step that every holder is expected to take. Wallet makers will likely publish instructions if and when one arrives.

A final point on proportion. Everyday security issues, such as phishing, weak passwords, lost recovery phrases, and fake websites, can cause losses today. Quantum risk is a long-term research topic, while those risks exist now.

How Likely Is a Quantum Attack, and What Is Still Uncertain?

No one can say how likely a quantum attack on Bitcoin is, or when it might be possible. Estimates depend on hardware progress, error correction, and research that is still moving fast.

Several things remain uncertain:

• Hardware: Building machines with enough reliable qubits is a major engineering challenge. Progress in one area, such as error correction, can change timelines quickly, in either direction.
• Research estimates: Resource estimates have dropped over time, as the Google white paper shows, and further papers could lower or raise them. [Source]
• Bitcoin's response: Developers could adopt a fix, adopt it late, or disagree about the approach. Some proposals are drafts, and none has been activated.
• Wider systems: Banks, governments, and web services face the same underlying problem, and their response may shape what tools become available.

Because Bitcoin's code is open, discussion happens in public, and developers have been debating the issue for years. That does not guarantee a smooth outcome. It does mean the risk is being watched by many people.

It is also worth being careful with headlines. Phrases such as "Q-Day," the term some people use for the day a quantum computer can break today's public-key cryptography, can sound like a scheduled event. It is not. No such date is known.

For readers who want to keep learning, a few practical habits help: follow the official proposals, read from sources that cite their research, and be cautious of anyone selling a product by exaggerating quantum fear.

Quantum computing does not change the basic nature of crypto. Prices can be volatile, and any holding can lose value. For a step-by-step look at buying crypto, see this guide for Canadians on buying Bitcoin.

People Also Ask About Quantum Computers and Bitcoin

Can quantum computers break Bitcoin today? No, a quantum computer large and reliable enough to break Bitcoin's cryptography has not been built.

Research papers estimate how big such a machine would need to be, and those estimates have fallen over time. Google Quantum AI's 2026 white paper put the figure at fewer than 500,000 physical qubits under stated assumptions. [Source] Experts disagree about when, or whether, that will be achieved.

Is Bitcoin mining at risk from quantum computers? Mining is generally seen as much less exposed than digital signatures.

Mining relies on hashing, and a quantum method called Grover's algorithm offers only a modest speedup against it. The bigger concern is signatures, because a large quantum computer could in theory derive a private key from a public key. Mining is not the main focus of the proposed fixes.

What is Q-Day? Q-Day is a term for the day a quantum computer could break today's public-key cryptography.

No date is known, and predictions vary widely. The term can make the risk sound like a scheduled event, which it is not. Researchers and developers focus on preparing for a range of possible timelines.

Does it matter for quantum risk whether my Bitcoin is on a platform or in a wallet? Both depend on addresses and keys, and neither removes risk.

If a platform holds the Bitcoin, it manages keys and addresses, and you rely on its systems and disclosures. If you self-custody, you manage them yourself, including avoiding address reuse and protecting your recovery phrase. Each approach has its own risks, and the right one depends on your own situation.

What is a post-quantum signature? A post-quantum signature is a digital signature designed to resist attacks from quantum computers.

The US National Institute of Standards and Technology finalized the first standards in 2024. Bitcoin does not use them today. Adding them would require an upgrade the network has not yet agreed on, and the larger size of these signatures is one of the challenges.

Frequently Asked Questions

What is a public key and a private key? A private key is a secret number that lets you spend your Bitcoin, and a public key is a related number that others use to check your signature. The public key can be shared, and the private key should be kept secret. Today's computers cannot work out the private key from the public key. The quantum risk discussion is about whether a future quantum computer could do that, which is why the visibility of public keys matters.

What is an exposed public key? An exposed public key is one that is visible on the blockchain before the related coins are spent. This can happen with some older address types, with some newer ones, and when an address is reused after spending. Hidden keys are revealed only when the coins are spent. Exposure matters because a quantum attacker would need the public key as a starting point, and a key that stays visible for a long time gives more time to attempt it.

What is Shor's algorithm? Shor's algorithm is a quantum method that could in theory solve the math problem behind elliptic curve signatures. On a large and reliable enough quantum computer, it could derive a private key from a public key. It does not work on today's machines at the scale needed. It is the main reason researchers worry about signatures, while hashing, which Bitcoin mining uses, is generally seen as less exposed.

What is a soft fork? A soft fork is a type of Bitcoin upgrade that tightens the rules in a way that remains compatible with older software. It still needs broad agreement among developers, node operators, miners, and users. Historically, major upgrades have taken years of discussion and testing. Proposals to add quantum resistance, such as BIP 360, would likely need this kind of process, and a proposal can be changed or never adopted.

What is BIP 360? BIP 360 is a draft Bitcoin Improvement Proposal that describes a new output type called Pay-to-Merkle-Root, or P2MR. It works like Taproot but removes the key path spend that a quantum computer could target. A draft is a proposal under discussion and is not part of Bitcoin's rules. It could be changed, replaced, or never adopted, and readers should follow the official proposal for current status.

Quick Glossary

Qubit: The basic unit of a quantum computer, which can hold combinations of 0 and 1 at the same time.

Quantum Computer: A computer that uses qubits and is expected to help with certain kinds of math problems.

Private Key: The secret number that lets you spend Bitcoin.

Public Key: A number related to the private key that others use to check a signature.

Digital Signature: Proof, created with a private key, that a transaction was authorized by the owner.

Post-Quantum Cryptography: Cryptography designed to resist attacks from quantum computers.

Soft Fork: A backward-compatible Bitcoin upgrade that needs broad agreement.

Address Reuse: Receiving or leaving coins in an address that has already been spent from, which makes its public key visible.

Key Takeaways

• Quantum computers cannot break Bitcoin today, because a large and reliable enough machine has not been built.
• Digital signatures are the main concern, and mining is generally seen as much less exposed.
• Public keys that are visible on the blockchain matter most, which is why address reuse is discouraged.
• Proposed fixes, such as BIP 360, are drafts. No quantum-related upgrade has been activated, and timelines are uncertain.
• Everyday security habits, such as protecting recovery phrases, matter now, and quantum risk is a long-term topic.

Closing

Quantum computing and Bitcoin is a topic where real research meets real uncertainty. The risk is not here today, estimates of the hardware needed have fallen, and developers are discussing ways to prepare, with no fix yet activated. Knowing which part of Bitcoin is affected and why public keys matter makes it easier to read news about the topic without panic. To keep learning about the basics, see this step-by-step guide for Canadians on buying Bitcoin.