Can quantum computers crack Bitcoin?
No — not today, and nothing close to the required machine exists as of 2026. The real long-term threat is Shor's algorithm against Bitcoin's ECDSA signatures, which would need thousands of error-corrected logical qubits running over a hundred billion gate operations; current hardware has demonstrated one good logical qubit. The risk is credible enough that roughly a quarter of all BTC sits in addresses with already-exposed public keys, and Bitcoin developers merged the draft quantum-resistant proposal BIP-360 in February 2026.
Yes — Shor's discrete-logarithm variant breaks secp256k1 in principle (1994) The same 1994 paper that broke RSA in theory also gave a polynomial-time quantum algorithm for discrete logarithms, which covers the elliptic-curve discrete logarithm problem underlying Bitcoin's ECDSA signatures. Given a public key, an ideal quantum computer could compute the private key. Classically this is utterly infeasible at 256 bits.
Costed on paper: ~2,330 logical qubits and ~1.3 x 10^11 Toffoli gates for a 256-bit curve key The standard resource estimate for elliptic-curve keys, from a simulated implementation of the full point-addition circuit. Notably, 256-bit ECC falls to a smaller quantum computer than RSA-2048 does at comparable classical security — elliptic-curve keys, including Bitcoin's, are earlier in the firing line than RSA.
Grover speeds up SHA-256 mining and hash attacks only quadratically — no structural break Bitcoin's proof-of-work and address hashing rest on SHA-256 and RIPEMD-160, which Shor's algorithm does not touch. Grover's algorithm gives at most a quadratic speedup, cannot be efficiently parallelised, and each quantum hash evaluation is far slower than an ASIC's. Mining and hashed addresses are not meaningfully threatened; the signatures are the target.
No — no quantum computer has ever derived any real-world private key Independent 2026 assessments of the quantum threat to Bitcoin and Ethereum find no near-term capability. Even the most-discussed scenario — racing to derive a key from a public key exposed in the mempool before a transaction confirms — would require not just a fault-tolerant machine but one running the full Shor circuit in minutes, far beyond every published roadmap.
No quantum capability today — but ~25% of BTC sits in quantum-exposed addresses (per Deloitte) A Deloitte analysis found about a quarter of circulating bitcoin is held in P2PK outputs or reused P2PKH addresses where the public key is already public. These coins are safe today but would be the first targets if a cryptographically relevant machine ever existed — and dormant coins cannot be protected without their owners moving them.
A migration path exists on paper: BIP-360, merged as a draft in February 2026 BIP-360 (originally Pay-to-Quantum-Resistant-Hash, now specified as Pay-to-Merkle-Root) avoids ever exposing a classical public key on-chain. It was merged into the BIP repository as a draft in February 2026 and has run on a testnet, but activation on mainnet, signature-size trade-offs, and above all migrating millions of existing UTXOs — including dormant ones — remain unresolved. A plan is not a deployment.
What exactly would a quantum computer attack in Bitcoin?
"Cracking Bitcoin" bundles two very different targets. The first is SHA-256 — mining and address hashing. Grover's algorithm offers only a quadratic speedup there, each quantum step is much slower than an ASIC hash, and the speedup collapses when you try to parallelise it. Mining is not the story.
The second target is ECDSA signatures on the secp256k1 curve, and this one is structural: Shor's algorithm computes discrete logarithms in polynomial time, meaning a large enough fault-tolerant machine could derive a private key from a public key. The catch is the word public. A modern address is a hash of the key, so the key stays hidden — until you spend. Old pay-to-public-key outputs (including most Satoshi-era coins) and reused addresses have their keys permanently exposed on-chain, which is how roughly a quarter of all BTC ends up in the future firing line.
There is also a timing attack: every spend reveals the public key in the mempool, giving an attacker a window of minutes to derive the key and broadcast a competing transaction. That requires not just a big quantum computer but an implausibly fast one.
How big is the gap between today's hardware and a key-stealing machine?
The benchmark estimate (Roetteler et al., 2017) puts a 256-bit curve key at about 2,330 logical qubits and ~126 billion Toffoli gates. Logical qubits are the expensive kind: each one is stitched together from hundreds to thousands of physical qubits doing continuous error correction. In physical terms the attack lands in the millions of qubits, in the same league as the RSA-2048 estimates.
Against that requirement, the demonstrated 2026 state of the art is a single logical qubit that beats its best physical component, on a chip of ~105 physical qubits. No quantum computer has ever derived any private key of any real-world size. The gap is around three orders of magnitude in qubit count and many more in sustained, error-corrected operations — and for the mempool-race attack, additional orders of magnitude in speed.
Compare what actually exists on the QPU index and side by side.
What would have to change — and what is Bitcoin doing about it?
Three things would move this from theoretical to dangerous: fault-tolerant machines scaling from one logical qubit to thousands; error rates and code overheads improving enough to make that affordable; and resource estimates continuing to fall the way RSA estimates have — a 20x drop between 2019 and 2025 from algorithmic improvements alone. Watch logical-qubit counts and error-corrected gate speeds, not raw qubit numbers.
Bitcoin's response is under way but early. BIP-360 defines an address type that never exposes a classical public key and hooks in post-quantum signatures standardised by NIST in August 2024 (ML-DSA, SLH-DSA). It was merged as a draft in February 2026. The unsolved problem is not cryptography but migration: coins only become safe when their owners move them, and millions of BTC sit in dormant, already-exposed addresses whose owners may be gone. What the network eventually does with unmigrated vulnerable coins — leave them to be taken, or freeze them — is a live governance dispute, not a settled plan.
Practical advice today is unchanged since 2010: never reuse addresses, so your public key is exposed only in the brief window when you spend.
Classifications follow the QPU137 editorial policy: every applied label carries a date, source, scale, and hardware, or it does not render. Found an error? Report it.