Will Quantum Computers Break Bitcoin? What's Real in 2026

An IBM Quantum System One being installed at Fraunhofer in Ehningen, Germany. Photo: IBM Research / Wikimedia Commons, CC BY 2.0.

Every few months a headline warns that quantum computers are about to "crack Bitcoin." In 2026 the topic got more serious attention, because Google's quantum team published new research showing that the cryptography behind Bitcoin could, in theory, be broken with fewer resources than earlier estimates suggested. That is worth understanding. But "could, in theory, on a machine that does not exist yet" is very different from "your coins are at risk tomorrow."

This guide explains, in plain language, what quantum computers could and could not do to Bitcoin, what the developer community is working on, and what a beginner in Europe can sensibly do today.

Want to try a crypto exchange? You can sign up for HTX with my HTX invite link. (Affiliate link: Advice Me may earn a commission. Not a recommendation, check the risks and whether HTX is available in your country first.)

Important disclaimer

This is not financial advice. Cryptocurrency is volatile and you can lose money. This article is general education about technology and security; it does not recommend buying, selling, or holding Bitcoin or any other asset. Research timelines in quantum computing are uncertain, and expert opinions differ. Do your own research and never share your seed phrase or private keys with anyone—including anyone claiming to "quantum-proof" your wallet.

What part of Bitcoin is actually vulnerable?

Bitcoin relies on two different kinds of cryptography, and quantum computers affect them very differently:

• Digital signatures (elliptic curve cryptography, secp256k1). When you spend Bitcoin, your wallet signs the transaction with a private key. Anyone can check the signature using your public key. Today, working backwards from a public key to the private key is practically impossible. A large, error-corrected quantum computer running Shor's algorithm could, in principle, do exactly that. This is the real concern.
• Hashing (SHA-256) used in mining and addresses. Quantum computers are only expected to give a much smaller speed-up against hash functions (via Grover's algorithm). This is generally considered a far lesser risk than the threat to signatures.

In short: the issue is not that quantum computers would "mine all the Bitcoin." The issue is that a powerful enough machine could forge signatures for coins whose public keys are visible.

What did Google's 2026 research say?

In 2026, Google Quantum AI published a whitepaper on elliptic curve cryptocurrencies and quantum risk. Its key findings, as Google describes them:

• Shor's algorithm for breaking 256-bit elliptic curve keys could run with fewer than 1,200 logical qubits and 90 million Toffoli gates, or fewer than 1,450 logical qubits and 70 million Toffoli gates.
• On a superconducting machine with standard hardware assumptions, that could take minutes using fewer than 500,000 physical qubits—roughly a 20-fold reduction compared with earlier estimates.
• Google used a zero-knowledge proof to validate the results without publishing the attack details, and recommended that blockchains begin moving to post-quantum cryptography.

Two important caveats. First, a "logical qubit" is an error-corrected qubit built from many physical qubits, and no one has publicly demonstrated a machine anywhere near this scale. Second, the paper is a resource estimate—a map of what would be needed—not a demonstration of an attack.

Which coins would be most exposed?

Exposure depends on whether a coin's public key is already visible on the blockchain:

Situation	Public key visible?	Relative quantum exposure
Old "pay-to-public-key" (P2PK) outputs, including many early-mined coins	Yes, permanently	Highest ("long-exposure")
Addresses that have been reused after spending from them	Yes	High
Taproot (P2TR) outputs	Yes (key embedded in output)	High in theory
Fresh hashed addresses (e.g. P2PKH, P2WPKH) never spent from	Not in that output; keys may still be exposed elsewhere	Lower, until you spend
A typical signature-based spend waiting in the mempool	Yes, briefly	"On-spend" risk with a very fast quantum computer

This table describes exposure mechanisms, not the probability or timing of an attack. An address alone cannot establish complete safety: public keys can also be disclosed through shared extended public keys (xpubs) or wallet descriptors. BIP-360 explicitly discusses these additional exposures.

What is Bitcoin doing about it?

Bitcoin changes slowly and by broad consensus, which is a feature for security but means preparation takes years. One proposal is BIP-360, which has been merged into the official BIP repository as a draft:

• It proposes a new output type called Pay-to-Merkle-Root (P2MR). It works like Taproot but removes the "key-path" spend that exposes a public key.
• This targets the long-exposure problem (coins sitting with visible keys for years).
• It does not by itself add post-quantum signatures, and it does not solve the short "on-spend" window in the mempool. Those would need further changes.
• It is not activated on Bitcoin. Some experimental implementations exist on separate test networks, but that is not the same as adoption by Bitcoin Core and the wider network.

Meanwhile, the broader world is already migrating. In August 2024, the US National Institute of Standards and Technology (NIST) finalised its first three post-quantum cryptography standards (FIPS 203, 204 and 205), giving developers—including Bitcoin developers—vetted building blocks to work with.

What's real vs. what's hype

Real:

• The theoretical threat to elliptic curve signatures is well understood and taken seriously by researchers and Bitcoin developers.
• Resource estimates have been falling as algorithms improve.
• Migration to new address types would take years, so starting early matters.

Hype or misleading:

• "Quantum computers can break Bitcoin today." No public machine is close to the scale in Google's estimates.
• "Bitcoin will go to zero overnight." Bitcoin's software can be upgraded, and proposals are already on the table.
• "Buy our quantum-proof coin/wallet to stay safe." This is a common sales pitch and, sometimes, a scam vector.

Practical steps for beginners in Europe

You do not need to panic or move anything today, but a few habits are good security anyway and also reduce quantum exposure:

1. Avoid address reuse. Use a fresh receiving address when your wallet supports it. This helps privacy, but it does not make an address quantum-proof; Taproot outputs expose a public key even when fresh.
2. Keep your wallet software up to date. Use releases from the wallet provider’s official channel. A software update alone would not automatically protect existing coins: any future migration would depend on network activation, wallet support and the instructions for that upgrade.
3. Check your backup. Understand your wallet’s recovery method; not every wallet uses a seed phrase. Never enter recovery secrets into an online checker. Our wallet backup worksheet helps you record non-secret checks.
4. Ignore urgent "quantum migration" messages. No legitimate service will ask for your seed phrase to protect you from quantum computers. Our FTC scam checklist applies here too.
5. Follow primary sources. Watch the Bitcoin BIPs repository and reputable research blogs rather than social media hot takes.
6. Size your exposure sensibly. Quantum uncertainty is one more reason not to invest more than you can afford to lose.

What to take away

Quantum computers are a genuine long-term challenge for Bitcoin's signature scheme, and 2026 research made the required machine look smaller than previously thought. But that machine does not exist publicly yet, Bitcoin developers are already debating concrete upgrades such as BIP-360, and global post-quantum standards are in place. For beginners, the sensible response is good everyday security—fresh addresses, updated wallets, a tested backup—and a healthy distrust of anyone selling "quantum-proof" fear.

New to Bitcoin? Follow our beginner reading path before changing how you store or send coins.

Editorial update, 11 October 2026: clarified address exposure, wallet recovery and the limits of software updates; removed an unsupported supply-percentage range. This is a source-based explanation, revised with AI assistance, not a firsthand quantum-computer or wallet test.

Sources

• Google Research: Safeguarding cryptocurrency by disclosing quantum vulnerabilities responsibly
• Google Quantum AI whitepaper: Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities (PDF)
• BIP-360 (Pay-to-Merkle-Root) in the official Bitcoin BIPs repository
• NIST: First 3 finalized post-quantum encryption standards (Aug 2024)
• Bitcoin.org: Securing your wallet

Advice Me publishes general information only. It is not financial, investment, legal, or tax advice. Always do your own research and consult a qualified professional before making financial decisions.