Quantum Computing and Cryptocurrency: Threats and Solutions
Quantum computing represents the most significant long-term cryptographic threat to cryptocurrency. While today's quantum computers are far too small and error-prone to break the cryptography that secures Bitcoin and other blockchains, the technology is advancing rapidly. Understanding the nature of the threat, the realistic timelines, and the defenses being developed is essential for anyone making long-term cryptocurrency storage decisions.
This guide provides a technically grounded assessment of quantum computing's implications for cryptocurrency security — what is actually at risk, what is not, and what steps you can take today.
The Basics of Quantum Computing
Classical vs. Quantum Computation
Classical computers process information as bits — each bit is either 0 or 1. Quantum computers use qubits, which can exist in a superposition of 0 and 1 simultaneously. When qubits are entangled, operations on one qubit can affect others, enabling certain computations to be performed exponentially faster than any classical approach.
Important nuance: Quantum computers are not universally faster than classical computers. They provide speedups only for specific types of problems that have quantum algorithms. Many computational tasks see no benefit from quantum computing.
The Problems That Matter for Crypto
Two quantum algorithms are relevant to cryptocurrency:
-
Shor's algorithm — Efficiently solves the integer factorization and discrete logarithm problems. This directly threatens the elliptic curve cryptography (ECDSA, Schnorr) used for signing cryptocurrency transactions.
-
Grover's algorithm — Provides a quadratic speedup for searching unstructured databases. This affects hash functions (SHA-256, RIPEMD-160) and symmetric encryption, effectively halving their bit security.
What Quantum Computers Threaten
Elliptic Curve Digital Signatures (ECDSA)
Bitcoin, Ethereum, and most other cryptocurrencies use ECDSA with the secp256k1 curve for transaction signing. The security of ECDSA rests on the elliptic curve discrete logarithm problem (ECDLP): given a public key (a point on the curve), it is computationally infeasible to derive the private key (the scalar multiplier).
Shor's algorithm can solve the ECDLP efficiently on a sufficiently large quantum computer. This means:
- Given a public key, a quantum computer could derive the private key.
- With the private key, the attacker can forge transaction signatures and steal funds.
This is the primary quantum threat to cryptocurrency.
When Is a Public Key Exposed?
The threat from Shor's algorithm applies only when the attacker knows the public key. In Bitcoin, the public key is exposed at different times depending on the address type:
| Address Type | Public Key Exposure | Quantum Risk |
|---|---|---|
| P2PKH (Legacy, 1...) | Exposed when spending | At risk after first spend |
| P2SH (3...) | Exposed when spending | At risk after first spend |
| P2WPKH (bc1q...) | Exposed when spending | At risk after first spend |
| P2TR (Taproot, bc1p...) | Exposed in the address itself | At risk immediately |
| Pay-to-Public-Key (P2PK) | Public key is the address | At risk immediately |
Key insight: Bitcoin addresses that use pay-to-public-key-hash (P2PKH, P2SH, P2WPKH) do not expose the public key until a transaction is signed from that address. Until that point, only the hash of the public key is visible on the blockchain, and Shor's algorithm cannot reverse a hash.
However, once you spend from an address (revealing the public key in the transaction), the public key is on the blockchain permanently. An attacker with a quantum computer could then derive the private key and steal any remaining funds at that address.
Taproot (P2TR) addresses expose the public key directly (the address encodes a tweaked public key, not a hash). This means Taproot addresses are theoretically more vulnerable to quantum attack than hash-based address types, though the key tweaking adds a minor complication.
Addresses at Greatest Risk
-
Satoshi's coins — Early Bitcoin used Pay-to-Public-Key (P2PK) format, where the public key IS the address. Approximately 1.1 million BTC in Satoshi's presumed coins are in P2PK format and are directly vulnerable.
-
Reused addresses — Any address that has been used to send a transaction has its public key exposed. Funds sent to it after that point are vulnerable.
-
Taproot addresses — Public key is visible in the address.
-
Long-pending transactions — If a transaction sits in the mempool for an extended period before confirmation, a quantum attacker could extract the public key from the transaction and race to produce a conflicting transaction with the derived private key.
What Is NOT Threatened (or Less Threatened)
Hashing Algorithms (SHA-256, RIPEMD-160)
Grover's algorithm provides a quadratic speedup for hash preimage searches, effectively halving the bit security:
- SHA-256: 256-bit security becomes 128-bit security against quantum attack.
- RIPEMD-160: 160-bit security becomes 80-bit security against quantum attack.
128-bit security is still considered strong (requiring 2^128 operations), and current hash-based protections are not in immediate danger from quantum computing.
Bitcoin Mining (Proof of Work)
Grover's algorithm could theoretically provide a speedup for mining (finding a nonce that produces a hash below the target), but the advantage is only quadratic (square root), and the economics of quantum mining do not currently justify the enormous cost of quantum hardware. The difficulty adjustment mechanism would also compensate for any mining speedup.
Symmetric Encryption (AES)
Grover's algorithm halves the effective key length of symmetric ciphers (AES-256 becomes equivalent to AES-128 security). AES-256 with 128-bit quantum security remains strong.
Timeline: When Will Quantum Computers Be a Threat?
Current State of Quantum Computing (2025)
As of 2025, the largest quantum computers have approximately 1,000-1,500 physical qubits. However, these are "noisy" qubits with high error rates. To run Shor's algorithm against secp256k1:
- Estimated requirement: Approximately 2,500 logical qubits.
- Physical qubits needed: Due to error correction overhead, this requires roughly 1-20 million physical qubits (depending on qubit quality and error correction scheme).
- Current gap: We are approximately 3-4 orders of magnitude away from having enough physical qubits with sufficient quality.
Expert Timeline Estimates
| Source | Estimate for Cryptographically Relevant QC | Year |
|---|---|---|
| NIST | "Not in the next decade, possibly in the next two" | 2035-2045 |
| IBM Quantum Roadmap | 100K+ qubits by 2033 (not sufficient alone) | N/A |
| Google Quantum AI | Significant milestones in error correction by 2030 | N/A |
| Various academic estimates | 15-30 years for ECDSA-breaking capability | 2040-2055 |
| Pessimistic scenario | Unexpected breakthrough accelerates timeline | 2030-2035 |
The consensus among cryptographers is that the threat is real but not imminent. Most estimates suggest 15-30 years before quantum computers can break ECDSA. However, progress in quantum computing has sometimes exceeded expectations, so complacency is not warranted.
The "Store Now, Decrypt Later" Threat
Even though quantum computers cannot break ECDSA today, an adversary could be recording all blockchain data now with the intention of exploiting it once quantum capability exists. For Bitcoin, all public keys that have ever been exposed (from transactions) are permanently recorded on the blockchain. This data cannot be retroactively protected.
This "harvest now, decrypt later" strategy means that any public keys exposed today may be vulnerable in 15-30 years. For long-term holdings, this is a relevant threat.
Post-Quantum Cryptography (PQC)
NIST Post-Quantum Standards
NIST has been leading a multi-year process to standardize post-quantum cryptographic algorithms. The first standards were finalized in 2024:
ML-KEM (formerly CRYSTALS-Kyber)
A lattice-based key encapsulation mechanism (for encryption/key exchange):
- Based on the Module Learning With Errors (MLWE) problem.
- No known efficient quantum algorithm for this problem.
- Relatively small key sizes and fast operations.
ML-DSA (formerly CRYSTALS-Dilithium)
A lattice-based digital signature scheme:
- Based on the Module Learning With Errors and Short Integer Solution problems.
- Potential replacement for ECDSA in cryptocurrency.
- Signature sizes are larger than ECDSA (~2,400 bytes vs. ~72 bytes).
SLH-DSA (formerly SPHINCS+)
A hash-based digital signature scheme:
- Security based entirely on hash function properties.
- No reliance on mathematical structures that could be quantum-vulnerable.
- Very large signatures (~17,000-49,000 bytes) but extremely conservative security assumptions.
- Useful as a backup if lattice-based assumptions are broken.
Post-Quantum Signatures vs. ECDSA
| Property | ECDSA (secp256k1) | ML-DSA (Dilithium) | SLH-DSA (SPHINCS+) |
|---|---|---|---|
| Quantum resistant | No | Yes | Yes |
| Public key size | 33 bytes | ~1,312 bytes | ~32-64 bytes |
| Signature size | ~72 bytes | ~2,420 bytes | ~17,000-49,000 bytes |
| Verification speed | Fast | Fast | Slower |
| Key generation speed | Fast | Fast | Moderate |
| Mathematical basis | Elliptic curve DLP | Lattice problems | Hash functions |
The significant increase in signature size is the main challenge for blockchain adoption. Bitcoin blocks are limited in size, and larger signatures mean fewer transactions per block.
Implications for Specific Cryptocurrencies
Bitcoin
Bitcoin's response to quantum computing will likely involve:
- New address types — A soft fork introducing a new address type using post-quantum signatures (similar to the SegWit or Taproot upgrades).
- Migration period — Users would need to move funds from old (quantum-vulnerable) addresses to new (quantum-resistant) addresses.
- Signature aggregation — Research into aggregating post-quantum signatures to reduce their blockchain footprint.
- Hash-based addresses remain useful — Unused P2PKH addresses (where the public key has never been revealed) provide quantum resistance through hash protection.
The Bitcoin community is actively discussing post-quantum proposals, though no specific implementation timeline has been set.
Ethereum
Ethereum faces similar challenges:
- Ethereum accounts always expose their public key after the first transaction (the public key is recoverable from ECDSA signatures via ecrecover).
- Ethereum's account-based model and address reuse pattern mean most active accounts have exposed public keys.
- Ethereum's more flexible upgrade mechanism (hard forks) may allow faster adoption of post-quantum signatures.
- The larger signature sizes of PQC are less constrained on Ethereum due to its different block structure and gas model.
Vitalik Buterin has discussed quantum resistance as a long-term priority for Ethereum, and account abstraction (ERC-4337) provides a pathway to supporting arbitrary signature schemes.
Other Blockchains
Some blockchains are proactively addressing quantum resistance:
- QRL (Quantum Resistant Ledger) — Designed from the ground up with hash-based signatures (XMSS).
- Algorand — Has published research on post-quantum signature integration.
- IOTA — Uses Winternitz One-Time Signatures (hash-based, quantum-resistant) but with practical limitations.
What You Can Do Today
1. Use Hash-Protected Address Types
For Bitcoin, use P2PKH, P2SH, or P2WPKH addresses (which only expose a hash of the public key) rather than P2TR (Taproot) if quantum resistance is a priority. However, once you spend from any address, the public key is exposed.
2. Never Reuse Addresses
Use a fresh address for every transaction. Once you spend from an address, move any remaining funds to a new, unused address. This ensures your public key is exposed for the minimum possible time. HD wallets (BIP-44) facilitate this by generating new addresses automatically.
3. Minimize Public Key Exposure Time
For large cold storage holdings, consider a workflow where:
- Funds are received at an address whose public key has never been exposed.
- When you need to spend, you move all funds in a single transaction (leaving no remainder at the exposed address).
- Change is sent to a fresh, unexposed address.
This minimizes the window during which an attacker could exploit a known public key.
4. Monitor Post-Quantum Developments
Stay informed about:
- NIST post-quantum standardization progress.
- Bitcoin and Ethereum protocol upgrade proposals related to quantum resistance.
- Advances in quantum computing hardware and error correction.
- Potential soft forks or hard forks that introduce quantum-resistant address types.
When quantum-resistant address types become available, migrate your holdings promptly.
5. Consider Quantum-Resistant Seed Phrase Security
Your seed phrase itself is protected by PBKDF2 and SHA-512 hashing, which are not efficiently broken by quantum computers (Grover's algorithm only provides a quadratic speedup on hashing). A 256-bit seed phrase retains 128-bit security against quantum attack, which is considered sufficient.
The SafeSeed Seed Phrase Generator generates 256-bit entropy seed phrases that maintain strong security even against future quantum threats to hashing. Combined with proper address management (avoiding reuse, using hash-protected addresses), your seed phrase-based cold storage can be prepared for the quantum era.
Common Misconceptions
"Quantum computers will break Bitcoin overnight"
False. Even when quantum computers become powerful enough to run Shor's algorithm against ECDSA, the attack requires significant computation time per public key and targets specific vulnerable addresses. The Bitcoin network would have advance warning (as quantum computing milestones are publicly tracked) and would implement post-quantum upgrades before the threat materializes.
"All cryptocurrency is equally vulnerable"
False. Vulnerability depends on whether the public key is exposed. Funds in unused P2PKH addresses are protected by hash functions that resist quantum attacks. Funds in addresses that have transacted (public key visible) are more vulnerable.
"We need to switch to quantum-resistant crypto now"
Not urgently. The threat is 15-30 years away by most estimates. Post-quantum cryptographic standards are still maturing, and premature adoption could introduce new vulnerabilities (from insufficiently analyzed algorithms). However, awareness and planning should begin now.
"Quantum computing makes cryptocurrency worthless"
False. Quantum computing is a cryptographic challenge, not an existential threat. The same quantum-safe algorithms that will protect banking, military communications, and internet security will protect cryptocurrency. Blockchains will upgrade their signature schemes, just as they have upgraded address types and scripting capabilities in the past.
"128-bit security against quantum is not enough"
For the foreseeable future, 128-bit security is considered more than sufficient by the cryptographic community. NIST's post-quantum standards are designed around 128-bit security levels. Breaking 128-bit security requires 2^128 operations, which remains far beyond any projected computational capability.
The Migration Challenge
The most significant practical challenge is not the cryptographic algorithm itself but the migration process:
-
Inactive wallets — Funds in wallets whose owners have lost their keys, died, or abandoned their coins (estimated at 3-4 million BTC) cannot be migrated. These become vulnerable when quantum computers mature.
-
Satoshi's coins — The ~1.1 million BTC in Satoshi's presumed P2PK addresses cannot be moved to quantum-resistant addresses unless Satoshi (whoever they are) is still active.
-
Coordination — A soft fork or hard fork requiring all users to migrate their funds to new address types is a massive coordination challenge.
-
Time pressure — If quantum computing advances faster than expected, the migration window could be uncomfortably short.
Some proposals suggest implementing a "quarantine" period: after a certain block height, transactions from quantum-vulnerable address types would be restricted or require additional proof of ownership. This is highly controversial and would likely face strong resistance from the community.
Research and Future Directions
Signature Aggregation for PQC
One active research area is aggregating multiple post-quantum signatures to reduce their on-chain footprint. Techniques similar to how Schnorr signatures enable key aggregation (MuSig2) are being explored for lattice-based signatures.
Quantum Key Distribution (QKD)
Some researchers have proposed using quantum key distribution for cryptocurrency, but this is generally considered impractical for decentralized networks (QKD requires direct optical channels between parties).
Hybrid Schemes
Hybrid signature schemes that combine ECDSA with a post-quantum algorithm provide security against both classical and quantum attacks. If either algorithm remains secure, the hybrid scheme is secure. This allows a gradual transition without betting entirely on the security of the relatively new post-quantum algorithms.
Zero-Knowledge Proofs
Zero-knowledge proof systems (like STARKs) that rely on hash functions rather than elliptic curve cryptography are inherently quantum-resistant. Their growing use in blockchain scaling (zkRollups) also contributes to quantum resilience.
FAQ
Can quantum computers break Bitcoin?
Not today. Current quantum computers are far too small and noisy to run the algorithms needed to break Bitcoin's cryptography. The most optimistic estimates suggest that cryptographically relevant quantum computers are 15-30 years away. When they do arrive, Bitcoin will likely have already upgraded to quantum-resistant signature schemes.
How many qubits are needed to break Bitcoin?
Estimates vary, but breaking secp256k1 ECDSA would require approximately 2,500 logical qubits, which translates to roughly 1-20 million physical qubits with current error correction technology. The largest quantum computers in 2025 have approximately 1,000-1,500 physical qubits.
Is my cryptocurrency safe from quantum computers?
For the foreseeable future (10-20+ years), yes. If you follow best practices — using hash-protected address types, avoiding address reuse, and keeping your seed phrase secure — your funds have strong protection. When quantum-resistant address types become available, migrate your holdings.
What is post-quantum cryptography?
Post-quantum cryptography refers to cryptographic algorithms that are designed to resist attacks from both classical and quantum computers. NIST has standardized several PQC algorithms (ML-KEM, ML-DSA, SLH-DSA) based on mathematical problems that quantum computers cannot efficiently solve, such as lattice problems and hash function properties.
Should I stop using Taproot addresses because of quantum risk?
The quantum risk to Taproot addresses is theoretical and decades away. The practical benefits of Taproot (lower fees, better privacy, advanced scripting) outweigh the quantum risk for current use. However, for very long-term cold storage (20+ years), hash-protected address types (P2WPKH) provide an extra layer of quantum resistance.
Will Ethereum be affected by quantum computing?
Yes, Ethereum uses the same ECDSA cryptography as Bitcoin and faces similar quantum threats. Ethereum's account model means most active accounts have exposed public keys. However, Ethereum's upgrade mechanisms (hard forks, account abstraction) provide pathways to adopt post-quantum signatures. The Ethereum Foundation has acknowledged quantum resistance as a long-term priority.
Is SHA-256 quantum safe?
SHA-256 is significantly more resistant to quantum attacks than ECDSA. Grover's algorithm reduces SHA-256's effective security from 256 bits to 128 bits, which remains extremely strong. SHA-256 is considered quantum-safe for the foreseeable future.
What happens to lost/abandoned Bitcoin when quantum computers arrive?
Funds in addresses with exposed public keys (from past transactions) that cannot be migrated by their owners would become vulnerable to quantum attack. This includes Satoshi's estimated ~1.1 million BTC and an estimated 3-4 million BTC in lost wallets. How the Bitcoin community handles these coins (if at all) is an open and contentious question.