Can quantum computers crack Bitcoin?

"Cracking Bitcoin" mixes up two very different targets. It helps to know two tools first.

A hash is a fingerprint for data. SHA-256 turns any input into a fixed 256-bit fingerprint. It is easy to make, but you cannot run it backward. Bitcoin uses SHA-256 for mining, the guessing race that adds new blocks. It also uses hashes to build addresses.

A digital signature proves you own your coins. You hold a private key, which is a secret number. From it comes a public key that anyone can see. Think of a wax seal. Anyone can check the seal, but only you own the stamp. Bitcoin's signatures are called ECDSA. They use an elliptic curve named secp256k1.

Target one is SHA-256. Grover's algorithm gives only a quadratic speedup there, which means the work shrinks to its square root. Each quantum step is also much slower than one hash on an ASIC, a chip built only for mining. And the speedup mostly vanishes when you split the work across machines. So mining is not the story.

Target two is the signatures, and this risk is built into the math. Shor's algorithm solves the problem behind them, called the discrete logarithm, in polynomial time. That means the work grows gently as keys get longer, not explosively. A big enough error-corrected machine could work out a private key from a public key. In seal terms, it could rebuild your stamp from the print. Unlike a real seal, the attack needs nothing but the public key and a lot of math.

The catch is the word public. A modern address is a hash of the public key, so the key stays hidden until you spend. But old pay-to-public-key outputs show the key on-chain forever. Most coins from Satoshi's early years are like this. So are addresses that people reused. That is how roughly a quarter of all BTC ends up in the future firing line.

There is also a timing attack. Every spend shows the public key in the mempool, the waiting room for unconfirmed transactions. An attacker would have a few minutes to work out the key and send a rival transaction. That needs more than a big quantum computer. It needs an unrealistically fast one.

The benchmark estimate (Roetteler et al., 2017) puts one 256-bit curve key at about 2,330 logical qubits and about 126 billion Toffoli gates. A Toffoli gate is one basic step of quantum arithmetic.

A logical qubit is the expensive kind. It is built from hundreds to thousands of physical qubits, the real hardware parts. They keep checking each other for errors, and a computer fixes the errors they find. Think of a group project where everyone double-checks everyone else. Unlike a group project, the qubits cannot just copy each other's answers. They compare shared patterns instead, without reading the stored value.

Work the numbers. Say each logical qubit takes 1,000 physical ones. Then 2,330 × 1,000 ≈ 2.3 million physical qubits. So the attack lands in the millions of qubits. That is the same league as the RSA-2048 estimates.

Now compare today. The best result shown by 2026 is a single logical qubit that beats its best physical part, on a chip of about 105 physical qubits. No quantum computer has ever worked out a private key of any real-world size. The gap is about three orders of magnitude (1,000 times) in qubit count. It is many more in long, error-corrected runs. For the mempool race, add more orders of magnitude in speed.

See what actually exists on the QPU index, and compare machines side by side.

Three things would turn this from theory into danger:

• Error-corrected machines growing from one logical qubit to thousands.
• Error rates and error-correction costs improving enough to make that affordable.
• Cost estimates falling further, the way RSA estimates have. They dropped 20 times between 2019 and 2025 from better algorithms alone.

So watch logical-qubit counts and error-corrected gate speeds, not raw qubit numbers.

Bitcoin's response has started, but it is early. BIP-360 defines a new address type that never shows a classical public key. It hooks into post-quantum signatures, meaning ones built to resist quantum attacks. NIST standardised these in August 2024 (ML-DSA and SLH-DSA). BIP-360 was merged as a draft in February 2026.

The hard part is not the math. It is moving the coins. Coins only become safe when their owners move them to new addresses. Millions of BTC sit in old, exposed addresses, and their owners may be gone. It is like changing every lock in a city when some houses are empty and nobody has the keys. So what happens to those coins? Leave them to be taken, or freeze them? That is a live argument, not a settled plan.

Practical advice today is the same as it has been since 2010: never reuse addresses. Then your public key shows only in the short window when you spend.