Could quantum computers break bitcoin? What's at risk and what's being done

Every few months a headline asks whether quantum computers will “break bitcoin”. The honest answer is: not today, possibly one day, and the people who maintain the cryptography the world relies on are already preparing.

This guide explains what quantum computers threaten, what they don’t, what the official timelines say and what bitcoin and Ethereum developers are doing about it.

What protects your crypto

Two kinds of cryptography do most of the work in a blockchain:

• Digital signatures. Your private key signs transactions, and anyone can check the signature with your public key. Bitcoin and Ethereum use elliptic curve signatures: ethereum.org says Ethereum uses ECDSA for account signatures, and bitcoin has traditionally used ECDSA over the secp256k1 curve, later adding Schnorr signatures. See public keys, private keys and addresses.
• Hash functions. These turn data into a fixed-length fingerprint. Bitcoin uses SHA-256, for example in mining. See bitcoin mining explained.

Why quantum computers are a threat to signatures

Quantum computers work in a fundamentally different way from ordinary ones. ethereum.org describes them as able to solve specific mathematical problems exponentially faster than classical machines.

The problem for crypto is one of those mathematical problems. NIST says the signature algorithms in its current standards, including ECDSA and RSA, are vulnerable to Shor’s algorithm on a “cryptographically relevant quantum computer”. If such a machine existed, it could work out a private key from a public key, which is exactly what today’s cryptography relies on being impossible.

What’s less at risk

Hash functions are in a much better position. NIST says its symmetric cryptography, including hash functions, is significantly less vulnerable to known quantum attacks than public-key cryptography, and that symmetric primitives with at least 128 bits of classical security are believed to meet its first post-quantum security category.

That’s why the main concern for crypto isn’t mining, but the signatures that protect wallets.

Which coins have their public key on display?

A quantum attack needs a public key to work on. NIST explains that addresses are usually made by hashing the public key, so for many address types the public key itself only appears on the blockchain when coins are spent. The BIP 360 draft lists the outputs whose public keys are exposed for a long time:

That’s why the BIP 360 authors focus on “long exposure” attacks, and why not reusing addresses helps.

Why switching is hard: bigger signatures

Post-quantum signatures are much larger than today’s. Compare:

An ML-DSA-44 signature is roughly 38 times the size of a Schnorr signature, and its public key is 1,312 bytes. On bitcoin, fees depend on how much space a transaction takes, so larger signatures would mean bigger, costlier transactions, or fewer transactions per block.

How close is the threat?

Nobody knows exactly.

• Today: ethereum.org states that no quantum computer can break Ethereum’s cryptography today, because the hardware required doesn’t yet exist at scale.
• Getting closer: it adds that recent research suggests the gap is closing faster than expected. It cites a March 2026 paper by Google Quantum AI estimating that breaking the 256-bit elliptic curve cryptography used for Ethereum account signatures could take roughly 1,200 logical qubits, about 20 times fewer than earlier estimates.
• Expert views: when NIST announced its new standards in 2024, it noted that some experts predict a device capable of breaking current encryption could appear within a decade.

Back in 2018, NIST’s blockchain overview already flagged that a practical quantum computer could greatly weaken existing cryptographic algorithms, and that switching to stronger algorithms could require a hard fork. See what is a hard fork?

The new standards and the deadlines

On 13 August 2024, NIST published its first three finalized post-quantum standards, after an effort lasting about eight years:

• FIPS 203 for general encryption (derived from CRYSTALS-Kyber);
• FIPS 204, the ML-DSA signature algorithm (from CRYSTALS-Dilithium);
• FIPS 205, the SLH-DSA hash-based signature algorithm (from SPHINCS+).

NIST’s head of the project urged organizations to start using them immediately, because full integration takes time.

NIST’s draft transition plan, published in November 2024, proposes that quantum-vulnerable signatures like ECDSA be deprecated after 2030 (at the lower security level) and disallowed after 2035. The UK’s National Cyber Security Centre sets similar milestones for organizations:

These deadlines are for government and industry systems, not blockchains. But they show the direction of travel.

What Ethereum is doing

ethereum.org says preparation is happening now, long before the hardware exists:

• Four areas have been identified for post-quantum upgrades: validator signatures (BLS), the commitments used for data availability (KZG), account signatures (ECDSA) and zero-knowledge proof systems.
• The Ethereum Foundation formed a dedicated Post-Quantum Security team in January 2026.
• A proposal called EIP-8141 would let individual accounts choose their own signature method, so users could switch to quantum-safe signatures without waiting for a single network-wide migration.

What bitcoin developers are proposing

Changing bitcoin’s signatures would mean changing its consensus rules, which needs broad agreement. One draft proposal, BIP 360, suggests a new output type called Pay-to-Merkle-Root (P2MR). Its authors describe it as protection against “long exposure” attacks: attacks on public keys that are visible on the blockchain long enough for a quantum computer to work on them. They note that full protection against faster attacks, during the minutes a transaction waits to confirm, may require post-quantum signatures in bitcoin.

The draft lists the outputs its authors consider most exposed to long exposure attacks:

• very old pay-to-public-key outputs, the authors’ example being Satoshi’s coins;
• reused addresses, where spending once has revealed the public key;
• Taproot outputs (addresses starting with bc1p).

BIP 360 is a draft, not an adopted change. It’s one sign of how developers are approaching the problem.

What you can do now

• Don’t panic, and don’t fall for scams. “Quantum-proof” coins and urgent “migration” messages are an obvious hook for fraudsters. Never move funds because of an unsolicited message.
• Avoid reusing addresses. Bitcoin.org already recommends a fresh address for each payment, for privacy, and the BIP 360 authors note that reused outputs have exposed public keys.
• Use maintained wallets and keep them updated, so you can adopt new address types if networks introduce them.
• Follow official channels of the networks you use for any future upgrade instructions.

For more on how blockchains defend themselves, see what is a 51% attack? and what is a blockchain?