Summary
- Quantum computers can theoretically break Bitcoin’s elliptic-curve cryptography, but no machine capable of doing so exists yet.
- Google researchers say cracking Bitcoin’s encryption may require fewer than 500,000 qubits — below the “millions” often cited.
- BIP-360 and BIP-361 propose quantum-resistant Bitcoin transactions and a phased migration away from legacy signatures.
- Ripple has a four-phase plan to make the XRP Ledger quantum-proof by 2028; Ethereum targets quantum resistance via Strawmap by 2030.
- The real risk is “harvest now, decrypt later” — adversaries collecting encrypted data now to crack it when quantum computers mature.
Quantum computers can theoretically break Bitcoin’s elliptic-curve cryptography, but no machine capable of doing so exists yet. Here’s what crypto investors need to know about the quantum threat, the defenses being built, and the timeline that matters.
What is the quantum threat to Bitcoin?
Bitcoin relies on the elliptic curve digital signature algorithm (ECDSA) to secure every transaction. When a user sends Bitcoin, their private key generates a digital signature that the network verifies using the corresponding public key. This works because no classical computer can reverse-engineer the private key from the public key in any reasonable timeframe.
Quantum computers change that equation. A sufficiently powerful quantum computer running Shor’s algorithm could derive a private key from a public key in minutes — potentially allowing an attacker to forge transactions and steal funds.
As of April 2026, no quantum computer exists that can do this. But the timeline is shrinking.
How close are quantum computers to breaking Bitcoin?
Google published a whitepaper in early 2026 showing that breaking Bitcoin’s elliptic-curve cryptography may require fewer than 500,000 physical qubits — well below the “millions” figure commonly cited. Google researchers estimate a sufficiently powerful machine could crack Bitcoin’s core cryptography in under nine minutes.
In April 2026, researcher Giancarlo Lelli broke a 15-bit elliptic curve key using publicly accessible quantum hardware, claiming a 1 BTC bounty from Project Eleven. Bitcoin uses 256-bit keys, so the gap remains enormous — but the achievement represents a 512-fold improvement over September 2025.
Nobel Prize-winning physicist Serge Haroche warned in April 2026 that Bitcoin could be an early target of quantum computing attacks. A Coinbase panel of six cryptographers concluded the machine “will eventually be built” and migration must begin now.
Can quantum computers attack Bitcoin mining?
No — at least not practically. April 2026 research shows attacking SHA-256 mining would require approximately 10²³ qubits and 10²⁴ watts — approaching the power output of a star. The real vulnerability is in transaction signing (ECDSA), not mining (SHA-256).
What is being done to protect Bitcoin?
BIP-360: quantum-resistant transactions
BIP-360 introduces Pay-to-Merkle-Root (P2MR), a new transaction type using NIST-approved ML-DSA signatures. BTQ Technologies has demonstrated working BIP-360 transactions on testnet.
BIP-361: legacy signature sunset
BIP-361 (authored by Jameson Lopp and others) defines a phased migration away from legacy signatures:
- Phase A (3 years): blocks new funds to vulnerable addresses.
- Phase B (5 years): invalidates ECDSA and Schnorr signatures entirely.
Hashcash inventor Adam Back argues for optional quantum-resistant features now; others push mandatory migration timelines.
Google’s Taproot warning
In March 2026, Google researchers found Bitcoin’s Taproot upgrade may make quantum attacks easier than expected by exposing public keys more broadly. Not unsafe today, but it adds urgency to BIP-360 migration.
How are other blockchains preparing?
Ethereum: Vitalik Buterin’s “Strawmap” (Feb. 2026) targets quantum resistance across consensus, accounts, data availability, and ZK proofs. Glamsterdam and Hegotá forks are confirmed for 2026. Learn more about Ethereum’s quantum resistance plans.
XRP Ledger: Ripple’s four-phase plan targets quantum resistance by 2028. ML-DSA signatures are already running on AlphaNet, and Ripple has partnered with Project Eleven for validator testing. Read about Ripple’s quantum-resistant XRP Ledger roadmap.
Hedera (HBAR): Already uses hash-based cryptography. Migration plans are aligned with NIST post-quantum cryptography (PQC) standards.
NIST post-quantum standards
NIST finalized three PQC standards in August 2024: ML-KEM (encryption), ML-DSA (signatures), and SLH-DSA (hash-based backup). It added HQC as a backup standard in March 2025. Google has committed to full PQC migration by 2029.
What should crypto investors do now?
- Don’t panic — no quantum computer can break Bitcoin today. The threat window is 5–10 years.
- Avoid address reuse — unexposed public keys are safe from quantum attacks.
- Watch BIP-360 and BIP-361 — mandatory migration may require action from all Bitcoin holders.
- Diversify custody — hardware wallets will need firmware updates for post-quantum signatures.
- Follow NIST standards — blockchains adopting PQC standards first gain a trust advantage.
The ‘harvest now, decrypt later’ risk
State-level adversaries may already be collecting encrypted blockchain data to decrypt later with quantum computers. Every exposed public key is a potential future target. The urgency of BIP-360 and BIP-361 is about protecting historical data from tomorrow’s machines.
Frequently asked questions
Can quantum computers hack Bitcoin right now?
No. The most powerful quantum computers in 2026 have roughly 1,500 qubits. Breaking 256-bit ECDSA would require 500,000 or more. No such machine exists.
When will quantum computers be able to break Bitcoin?
The consensus among Google and Coinbase advisors is 5–10 years. The machine is “at least two major engineering leaps away,” but migration itself takes years, which is why preparation must start now.
Is Bitcoin mining vulnerable to quantum attacks?
Practically no. A SHA-256 attack would require approximately 10²³ qubits and star-level energy output — well beyond any foreseeable technology.
What is BIP-360?
A proposed soft fork introducing quantum-resistant Pay-to-Merkle-Root (P2MR) transactions using NIST-approved post-quantum signatures.
What is BIP-361?
A phased sunset of legacy signatures. After year 3, new funds to vulnerable addresses would be blocked. After year 5, ECDSA and Schnorr signatures would be fully invalidated.
Is Ethereum quantum-safe?
Not yet. Buterin’s “Strawmap” (Feb. 2026) targets quantum resistance by approximately 2030 across four layers: consensus, accounts, data availability, and ZK proofs.
Is XRP quantum-safe?
Ripple’s four-phase plan targets 2028. ML-DSA signatures are already running on AlphaNet testnet.
Should I move my Bitcoin to a new address?
If you reuse addresses, your public key is exposed. Moving to a fresh address hides it — good practice regardless of the quantum threat.
What is ‘harvest now, decrypt later’?
A strategy where adversaries collect encrypted data today to decrypt with future quantum computers. Every exposed public key is a potential target once sufficiently powerful quantum machines exist.
Source: https://crypto.news/is-bitcoin-quantum-safe/
