Can quantum computers break bitcoin?

Quantum computers cannot break bitcoin today, and no machine powerful enough is publicly known to exist. The concern is a future, much larger quantum computer that could forge the signatures protecting coins. Bitcoin developers are working on upgrades in advance, because changing the network takes years. For the cryptography itself, see how cryptography secures crypto.

How does quantum computing threaten bitcoin?

Bitcoin uses digital signatures based on elliptic curves. Your private key produces a public key, and working backward is not feasible for ordinary computers.

Bitcoin Optech, a developer newsletter, explains that Shor's algorithm on a sufficiently capable quantum computer would break both of bitcoin's signature types, ECDSA and the newer Schnorr signatures. A second method, Grover's algorithm, would weaken hash functions, but that can be countered by using longer hashes. Optech describes the threat as gradual, with attacks becoming practical as hardware improves.

What happens if bitcoin encryption is broken?

An attacker could take coins from any address whose public key is visible. The BIP-360 draft separates two cases. Long-exposure attacks target public keys that sit on the blockchain for a long time, such as old pay-to-public-key outputs, reused addresses and Taproot outputs. Short-exposure attacks would race to crack a key in the minutes a transaction waits to be confirmed.

Most modern address types hide the public key behind a hash until the coins are spent. The BIP-361 draft says that as of March 1, 2026, over 34% of all bitcoin had a public key revealed on-chain.

What is BIP 360 for quantum resistance?

BIP-360, by Hunter Beast, Ethan Heilman and Isabel Foxen Duke, proposes a new output type now called Pay-to-Merkle-Root (P2MR), earlier known as P2QRH. It works like Taproot but drops the key-spending path, so no public key sits exposed on the chain. Its addresses would start with bc1z. As of its July 2026 revision it is still a draft, and the authors say it does not by itself stop short-exposure attacks.

What would post-quantum bitcoin look like?

Full protection needs new signature schemes. In August 2024, NIST, the US standards agency, finalized its first post-quantum standards, including two for digital signatures, ML-DSA and SLH-DSA. Optech has tracked bitcoin research on several such schemes through 2026.

The harder question is coins whose owners never move them. BIP-361, a draft published in April 2026 by Jameson Lopp and five co-authors, would first block sending coins to vulnerable addresses and later freeze legacy coins that have not migrated, with a recovery path for real owners. Decrypt reported that critics call this confiscation, and Lopp himself said he dislikes the idea but prefers it to the alternative.

Any such change would need broad agreement, likely through a soft fork, as explained in hard fork vs soft fork.