Bitcoin relies on elliptic curve cryptography (ECDSA, and increasingly Schnorr signatures since the 2021 Taproot upgrade) to prove ownership of coins: a private key produces a public key, and only someone with the private key can produce a valid signature. A sufficiently large, fault-tolerant quantum computer running Shor's algorithm could, in theory, derive a private key from its corresponding public key, something classical computers cannot do in any practical timeframe.
The exposure is uneven across addresses. A public key is only revealed on-chain once its owner spends from that address (for legacy pay-to-public-key-hash addresses, the key is hidden until the first outgoing transaction). Coins in addresses that have never been spent from have no exposed public key, so a quantum attacker would need to break the underlying hash functions instead, which is a substantially harder and different problem. Coins in reused addresses, or addresses that have already spent and left change or subsequent activity, have exposed public keys and are more at risk once (and if) practical attacks become feasible.
Bitcoin's separate proof-of-work security (based on SHA-256 hashing) is far less threatened by quantum computers: known quantum algorithms for search problems like hash preimages (Grover's algorithm) offer at most a quadratic speedup, which can be countered by using larger hash outputs, unlike the exponential speedup Shor's algorithm gives against the signature scheme. Mining security is therefore considered much more robust against currently known quantum techniques than the signature layer.
Explain more simply
Bitcoin uses two different kinds of math: one to sign transactions (prove you own the coins) and one to secure mining (proof of work). Quantum computers threaten the first kind much more than the second.
Today's quantum computers are nowhere near powerful enough to break Bitcoin's signatures, and if they get close, the software can be upgraded to use quantum-resistant methods, similar to past upgrades.
Real-world analogy
It is like a lock whose key has never left your pocket versus a lock whose key you once showed in public. The public-key-exposed case is the one to worry about first, and locksmiths (developers) are already designing tougher locks for whenever better lock-picking tools might arrive.
Key facts
- Quantum computers threaten Bitcoin's signature scheme (ECDSA/Schnorr) much more than its SHA-256 hashing used for mining.
- Coins in addresses that have never spent (no exposed public key) are much less exposed than reused or already-spent addresses.
- Post-quantum signature upgrades are an active research area, and current quantum computers are far from breaking Bitcoin's cryptography.
Common misconception
“Quantum computers will suddenly break Bitcoin overnight and there is nothing that can be done about it.”
Current quantum computers are far from the scale needed to threaten Bitcoin's cryptography, exposure is uneven (unspent addresses are much safer), and a soft-fork upgrade path to post-quantum signatures is an active area of research well before any real threat is expected.[4]
Go deeper
Researchers and developers have proposed post-quantum signature schemes (such as hash-based or lattice-based signatures) as a future soft-fork upgrade path, allowing users to move funds into quantum-resistant address types before a real threat materialises, much as users have migrated to newer address formats (SegWit, Taproot) for efficiency reasons in the past.
The genuinely difficult part of such an upgrade is not the cryptography but the transition: convincing owners of old, exposed-key or dormant coins (including many early, possibly lost coins believed to belong to Satoshi Nakamoto) to move them before a quantum attack becomes feasible, since coins that are never moved would remain permanently vulnerable once the threat exists. This is an active area of research and standardisation, not an imminent emergency, given that current expert estimates place cryptographically relevant quantum computers as, at best, a matter of many years to decades away, and that estimate carries real uncertainty in both directions.
Quick check
Answer every question correctly (100%) to complete this lesson.
1.Which part of Bitcoin is most threatened by quantum computers?
2.Why are never-spent addresses less exposed to a future quantum attack?
Counts towards your streak in this browser.
Extra exam questions
Every question here counts towards your accuracy, XP and rank. No guessing: every answer is explained.
Quick check
Answer every question correctly (100%) to complete this lesson.
1.What is the main quantum computing concern for Bitcoin?
2.Which addresses are considered more vulnerable to a hypothetical quantum attack?
3.Does today's quantum computing technology pose an immediate practical threat to Bitcoin?
4.What cryptographic scheme does Bitcoin currently use that could theoretically be affected by quantum computers?
5.Is Bitcoin's mining (proof of work) equally vulnerable to the same quantum attack as signatures?
6.What could the Bitcoin community do if quantum computers became a real near-term threat?
7.Which type of Bitcoin address, common in modern wallets, does not expose the public key until funds are spent?
8.Is 'quantum resistance' already fully implemented in Bitcoin today?
Counts towards your streak in this browser.
Sources
- Bitcoin Improvement Proposals, bitcoin/bips repository
How proposed rule changes are written, discussed and specified. A BIP is not an adopted rule.
- Bitcoin Core documentation, Bitcoin Core project
Reference implementation documentation, including validation and release notes.