Does Quantum Computing Actually Threaten Bitcoin? What's Real and What's Hype
The genuine cryptographic vulnerability quantum computers could eventually exploit, and why 'eventually' is doing a lot of work in that sentence today.
By Firoz Khan|10 September 2026|Updated 11 October 2026|3 min read
Headlines periodically warn that quantum computers will 'break Bitcoin', and there's a genuine cryptographic vulnerability underneath the claim. There's also a substantial gap between the theoretical threat and the current, practical capability of real quantum hardware, a gap that headlines routinely collapse.
What's actually vulnerable
Bitcoin and most other blockchains use elliptic curve cryptography to secure private keys, and a sufficiently powerful quantum computer running a known algorithm could, in theory, derive a private key from its corresponding public key, something classical computers cannot practically do. That would let an attacker spend funds from an exposed wallet.
Why 'in theory' is carrying real weight right now
Breaking real-world elliptic curve cryptography at Bitcoin's key sizes requires a fault-tolerant quantum computer with a number of stable, error-corrected qubits far beyond what any lab has demonstrated publicly to date. Current quantum hardware is measured in a relatively small number of noisy, error-prone qubits, several orders of magnitude short of what credible security estimates say would be required.
Some numbers help. A 2022 study by University of Sussex researchers, published in AVS Quantum Science, estimated that breaking Bitcoin's encryption within a day would take about 13 million physical qubits, and within an hour about 317 million. Physics World reported at the time that the best quantum computers had a little over 100 qubits. Google's Willow chip, announced in December 2024, has 105 qubits. Later estimates vary, and some are lower, but even those sit thousands of times beyond current hardware.
Which wallets are actually more exposed
A wallet address that has never made an outgoing transaction has never exposed its public key on-chain, only its address, a hashed, different value, which adds a meaningful extra layer of protection. A wallet that has sent transactions has revealed its public key publicly, making it, in a genuine future quantum-capable scenario, the more exposed category of the two.
Newsletter
Make sense of money and crypto
Practical guides, useful calculators, and straightforward insights, delivered to your inbox.
Unsubscribe anytime. See our Privacy Policy.
What the industry is actually doing about it
Post-quantum cryptography, encryption designed specifically to resist quantum attacks, is an active area of research and standardisation, and major blockchain developer communities have discussed migration paths well in advance of any practical threat materialising. This is being treated as a long-range engineering problem to solve ahead of time, not an emergency, which is the appropriate response to a threat still likely years to decades away on credible estimates.
NIST published its first three finalised post-quantum standards, FIPS 203, 204 and 205, on 13 August 2024. A 2026 preprint on arXiv, which has not been peer reviewed, puts the chance of a cryptographically relevant quantum computer at about one in six by 2035, near 30% by 2040 and about 60% by 2050. It estimates that of Bitcoin's roughly six million quantum-exposed coins about 2.3 million are irreducibly at risk, and it concludes that the binding constraint is governance, not technology. It also notes that a survey of the top twenty cryptocurrencies finds none fully post-quantum. Treat those probabilities as one group's estimate, not a forecast.
What the three NIST standards are
NIST published three standards. FIPS 203 (ML-KEM, derived from CRYSTALS-Kyber) is for general encryption. FIPS 204 (ML-DSA, derived from CRYSTALS-Dilithium) is for digital signatures. FIPS 205 (SLH-DSA, derived from Sphincs+) is also for digital signatures and is intended as a backup in case ML-DSA proves vulnerable, because it relies on a different mathematical approach. NIST urges organisations to start integrating them now, because full migration takes time.
Why signatures are the part that matters for crypto
A blockchain does not rely much on encryption. It relies on digital signatures to prove that the owner authorised a payment. That is why the signature standards, FIPS 204 and 205, are the ones most relevant to a future migration, and why the problem described above concerns exposed public keys rather than the hashing used in mining.
What this means for a holder
There is nothing a holder needs to do today. If a chain moves to post-quantum signatures, you would move funds to new addresses under whatever process it sets out, and following the announcements of the projects you hold is the practical step. Keep your seed phrase secure and do not reuse addresses unnecessarily, since an address that has never sent a transaction has not exposed its public key. The FCA says crypto is largely unregulated in the UK and that you should be prepared to lose all the money you put in.
Where to read more
- The cryptography behind crypto: keys, hashes and signatures explained
- Bitcoin myths and misconceptions: other claims about Bitcoin worth checking
- The Bitcoin whitepaper, simplified: the design that is being protected
- Crypto forks explained: how a chain changes its rules
A reminder
The FCA risk warning still applies to higher-risk crypto content. Always assess how much risk you are willing to take before buying.
Related reading