Is my bitcoin safe from quantum computers?

The honest answer is neither “yes” nor “no”. It depends on a single fact about each address you hold: whether its public key is already written on the blockchain. This article explains that rule, walks through every address type, and tells you what is knowable today without a countdown.

What a quantum computer would break, and what it would not

Every bitcoin is locked by a spending condition. For the overwhelming majority of coins that condition is a signature: to move the funds you must prove you hold the private key that matches a public key. Bitcoin uses elliptic-curve cryptography on the curve secp256k1 for this, with ECDSA signatures on older address types and Schnorr signatures on Taproot.

The security of both rests on the same assumption: given a public key, it is infeasible to work out the private key. On a classical computer that is true, and by a wide margin. The best known attack would take longer than the age of the universe.

In 1994 Peter Shor published a quantum algorithm that solves exactly this kind of problem, the discrete logarithm, efficiently. On a sufficiently large, error-corrected quantum computer, Shor's algorithm turns a public key into its private key. That is the whole threat, and the product you are reading about is named after it.

Hash functions are a different story. Bitcoin addresses of most types do not contain the public key itself but a hash of it, produced by SHA-256 and RIPEMD-160. The relevant quantum attack on a hash is Grover's algorithm, which only offers a quadratic speed-up. Against a 160-bit or 256-bit hash that still leaves an attack far beyond any conceivable machine. Hashes are, for practical purposes, quantum-safe. Mining is likewise not the concern here.

So the question is never “is bitcoin quantum-safe?” in the abstract. It is: for this particular coin, is the public key visible, or only its hash?

The rule that decides everything

A public key ends up on the blockchain in two ways.

1. You spend. Every signature must be checked against the public key, so the transaction that spends from an address includes the key in full. From that block onwards the key is public, permanently, for anyone to read. Sending more coins to that same address afterwards puts them on a key that is already exposed.
2. The address type publishes it by design. Taproot outputs, the ones starting with bc1p, contain the (tweaked) public key directly instead of a hash. The very first coins ever mined, in 2009 and 2010, used a format called pay-to-public-key that also wrote the raw key into the output.

An address of a hashed type that has never spent shows the world only a hash. The key stays hidden until the first outgoing transaction.

That is the entire model. It is not about which wallet software you use, or how strong your seed phrase is, or whether you hold the coins yourself. It is about whether the key is out.

Address by address

You can tell most of this from the first characters of the address.

Three things worth noticing in that table.

Taproot is the surprising row. Taproot is the newest and, in most respects, the best output type Bitcoin has: cheaper, more private in the multisig case, more flexible. But it made a deliberate trade: the output is a public key, so there is no hash to hide behind. A Taproot address holding a balance has its key visible right now, whether or not it has ever spent. This is not a flaw that anyone missed. It was a known trade-off, taken at a time when the quantum question felt far away, and it is one of the motivations behind the post-quantum proposals now being discussed.

“After the first spend” is permanent. If you spent from an address once, five years ago, and it currently holds coins again, those coins sit on an exposed key. Address reuse is usually discussed as a privacy problem. It is also the single most common way that otherwise safe coins become exposed.

Multisig is more subtle. A multisig held in a P2SH or P2WSH output hides the whole script until the first spend, and then reveals every key in it. A multisig held in Taproot may reveal only the key-path key, or a script path, depending on how it is spent. A tool that reads per-address statistics, like ours, cannot see inside a script that has never been revealed. That is a real limit, and we say so on the results page.

Two different attacks: coins at rest and coins in flight

Once you have the rule, the threat splits neatly into two scenarios that are often blurred together.

The long-range attack: coins at rest

An attacker with a quantum computer scans the blockchain for outputs whose public key is visible, derives the private keys at leisure, and spends the coins. There is no hurry: the keys have been public for years and will stay public. This is the attack that hashed, never-spent addresses defend against, and the one that Taproot and reused addresses are open to.

The short-range attack: coins in flight

When you spend from a hashed address, your transaction reveals the public key at the moment it is broadcast. Until it is confirmed and buried under enough blocks, an attacker who could derive the key within minutes could craft a competing transaction with a higher fee and take the coins first. A hashed address protects coins while they sit still. It does not protect them at the moment you move them.

The short-range attack needs a machine that is not just large but fast, which is a much higher bar. It is also the attack that nothing in today's Bitcoin defends against, because every existing signature scheme reveals the key when used. Only a new, post-quantum signature type fixes it. That is where BIP-360 comes in, further down.

How much bitcoin is exposed today

Nobody has an exact figure, because “exposed” requires tracing every output type and every reuse pattern across the whole chain. But the order of magnitude is well established and it is large.

• Roughly 1.7 million BTC sit in the early pay-to-public-key outputs from 2009 to 2011, including the coins usually attributed to Satoshi. Those keys have been readable since the day they were mined. Most of those coins have never moved and, in all likelihood, their owners are gone. Nobody can migrate them.
• A widely cited analysis by Deloitte in 2020 estimated that, counting P2PK outputs together with coins on reused addresses, about a quarter of all bitcoin had its public key exposed. Taproot did not exist yet. The more recent figure in BIP-361, a migration proposal from early 2026, puts it at over 34% of all bitcoin as of March 2026.
• Large custodians and exchanges have historically reused addresses heavily, so a meaningful share of the exposed set is concentrated in a small number of very large balances.

The point of these figures is not alarm. It is that the exposed set is not a rounding error, and that a large part of it can never be moved to safety by anyone. That is the part of the problem that a signature upgrade alone does not solve, and it is why the discussion in the Bitcoin community about what to do with those coins is difficult.

How far away is the machine

We will not give you a year, and we would suggest treating anyone who does with suspicion.

What is knowable is the size of the gap. Breaking a 256-bit elliptic-curve key with Shor's algorithm needs, by current estimates, on the order of a few thousand logical qubits running a very long circuit with low error. Because today's physical qubits are noisy, each logical qubit has to be built from many physical ones through error correction. The published resource estimates come out at millions of physical qubits at today's error rates. The largest quantum processors as of this writing have on the order of a thousand physical qubits and can sustain only a handful of error-corrected logical qubits for short computations.

Two things are true at once, and it is worth holding both:

• The exposure is already real and permanent. The keys are on the chain now. If the machine arrives in 2035 it will find them exactly where they are today.
• The capability does not exist. Nothing can run Shor's algorithm at anything like the required scale, and the engineering distance is measured in orders of magnitude, not in generations of a product.

Progress in the field has been faster than most people expected a decade ago, and the resource estimates keep falling as the algorithms improve. That is a reason to understand your exposure now, at no cost, rather than to move coins this afternoon.

What you can actually do today

All of this is arithmetic over public data, which means you can check it yourself. In order of usefulness:

1. Find out which of your coins are on exposed keys. Look up each address you hold and ask two questions: has it ever spent, and is it Taproot? If the answer to both is no, those coins are not exposed at rest. If either is yes, they are. ShorWatch does this check for you, for a single address or for a whole wallet from its extended public key, in your browser.
2. Stop reusing addresses. Every modern wallet generates a fresh address for each receipt. If you have a long-standing “donation address” or a habit of sending to the same place, that address has almost certainly spent at some point and everything arriving on it lands on a public key.
3. Consider consolidating exposed coins onto fresh hashed addresses. If you hold a meaningful balance on reused or Taproot addresses, one transaction moves it to a never-used bc1q address, where it is protected at rest. This is a judgment call, not a rule: it costs a fee, it links the coins for anyone watching the chain, and Taproot has genuine advantages you would be giving up. It also does nothing for the short-range attack, because no existing address type can. For most people the sensible move is to know the split first and decide with the numbers in hand.
4. Be very wary of anyone selling urgency. A product that tells you a quantum computer is two years away and you must act now is selling fear, not analysis. So is one that claims to make your coins “quantum-proof” today. The honest state of the art is: know your exposure, minimise it cheaply where you can, and follow the protocol upgrade.

What changes with BIP-360

BIP-360, titled Pay-to-Merkle-Root, is the leading proposal for a new Bitcoin output type built with the quantum question in mind. It is often described as “post-quantum signatures for Bitcoin”, and that is not what it is. It takes Taproot and removes the key path, so that an output commits only to a tree of scripts and no public key sits on the chain while the coins are at rest. It does not add new signature schemes, it does not protect a transaction while it waits to be confirmed, and it does not touch any coin that is already exposed. It is a draft, it is still being revised, and it would need a soft fork to activate.

Even once it exists, the hard part is not the cryptography. It is the migration. Every coin that wants protection has to be moved by its owner into the new output type, in an on-chain transaction that competes for block space with everyone else doing the same. Coins whose owners are gone will never move. That migration, not the signature scheme, is the slow and contentious part, and it is why understanding your own exposure early matters: when the new outputs arrive, the people who already know what they need to move will be the ones who move first.

We cover the proposal in detail in What is BIP-360?