The world’s largest cryptocurrency, Bitcoin, stands at the precipice of a looming existential threat: quantum computing. While no quantum computer capable of breaking Bitcoin’s cryptography exists today, research from Google published in 2026 suggests that a sufficiently advanced machine could compromise the blockchain’s core security in under nine minutes—just one minute faster than the average time it takes to settle a Bitcoin block. Analysts warn that such a threat could materialize as early as 2029, putting at risk roughly 6.5 million bitcoins, worth hundreds of billions of dollars, including coins held by Bitcoin’s pseudonymous creator, Satoshi Nakamoto. The stakes couldn’t be higher: a successful quantum attack would undermine Bitcoin’s foundational principles of ‘trust the code’ and ‘sound money,’ shaking the $1.3 trillion digital asset ecosystem to its core.
Why Quantum Computing Poses an Existential Risk to Bitcoin’s $1.3 Trillion Network
Bitcoin’s security relies on a cryptographic one-way function known as the Elliptic Curve Digital Signature Algorithm (ECDSA). When a user creates a wallet, a private key is generated, from which a public key is derived. To spend bitcoin, users prove ownership by generating a cryptographic signature that the network can verify without ever exposing the private key. This system has been deemed computationally unbreakable by classical computers, which would require billions of years to reverse-engineer a private key from a public key.
The Two Paths to Quantum Compromise
A future quantum computer, however, could exploit Shor’s algorithm to reverse this one-way function, allowing attackers to derive private keys from exposed public keys. This vulnerability manifests in two critical scenarios: long-exposure and short-exposure attacks. Long-exposure attacks target bitcoins held in old addresses, such as Pay-to-Public-Key (P2PK) addresses used by Satoshi Nakamoto and early miners, where the public key is permanently visible on the blockchain. Roughly 1.7 million bitcoins—valued at over $100 billion at current prices—remain trapped in these exposed wallets. Short-exposure attacks, on the other hand, exploit transactions waiting in the mempool (the network’s unconfirmed transaction pool), where public keys and signatures are temporarily visible. Quantum attackers could theoretically derive private keys during this brief window before the transaction is confirmed.
The $1.3 Trillion Stakes: How Much Bitcoin is at Risk?
The total supply of Bitcoin is capped at 21 million coins, with approximately 19.8 million already mined. Of these, about 6.5 million bitcoins—nearly one-third of the circulating supply—are held in addresses that could be vulnerable to quantum attacks. This includes not only the coins in old P2PK addresses but also those in Taproot (P2TR) addresses, the current standard activated in 2021. While Taproot addresses are more efficient, they still permanently expose public keys on-chain, creating a permanent target for quantum computers. The potential loss isn’t just financial; it’s existential for Bitcoin’s credibility as a decentralized, immutable ledger.
Proposals Under Review to Quantum-Proof Bitcoin: A Race Against Time
- BIP 360: Introducing Pay-to-Merkle-Root (P2MR) addresses to eliminate permanent public key exposure on-chain.
- SPHINCS+ and SLH-DSA: Post-quantum cryptographic signatures standardized by NIST in 2024 to replace ECDSA.
- Tadge Dryja’s Commit/Reveal Scheme: A soft fork to protect mempool transactions using a two-phase transaction process.
- Hourglass V2: A controversial proposal to limit the spending of exposed bitcoins to prevent a market crash.
BIP 360: Removing Public Keys to Neutralize Long-Exposure Attacks
One of the most discussed solutions is Bitcoin Improvement Proposal (BIP) 360, which introduces a new address format called Pay-to-Merkle-Root (P2MR). Unlike current Taproot addresses, P2MR addresses do not permanently embed the public key on-chain. Instead, they use a Merkle root—a cryptographic hash that verifies the legitimacy of a transaction without exposing the underlying public key. This change would neutralize long-exposure attacks, as quantum computers would have no public key to target. However, BIP 360 only protects new transactions and addresses; it does nothing for the 1.7 million bitcoins already held in vulnerable P2PK and older Taproot addresses.
Post-Quantum Signatures: SPHINCS+ and the Tradeoff Between Security and Scalability
To address the broader cryptographic vulnerability, developers are exploring post-quantum signature schemes like SPHINCS+, which was standardized by the National Institute of Standards and Technology (NIST) in August 2024 as FIPS 205 (SLH-DSA) after a decade of research. SPHINCS+ replaces ECDSA with hash-based cryptography, which is resistant to Shor’s algorithm and other quantum attacks. The tradeoff, however, is size: Bitcoin’s current ECDSA signatures are 64 bytes, while SPHINCS+ signatures can exceed 8 kilobytes. This would dramatically increase block space usage, leading to higher transaction fees and slower confirmation times.
Adopting SPHINCS+ would essentially force Bitcoin to choose between security and scalability. The larger signatures would clog the network, pricing out smaller users and potentially centralizing mining power among those who can afford the fees.
In response, researchers have proposed more efficient alternatives like SHRIMPS and SHRINCS, which aim to reduce signature sizes while maintaining post-quantum security. These schemes are still in early development but represent a critical step toward balancing security with practicality.
Tadge Dryja’s Commit/Reveal Scheme: A Temporary Shield for the Mempool
Lightning Network co-creator Tadge Dryja has proposed a soft fork called the Commit/Reveal scheme to protect transactions in the mempool. The idea is to split transactions into two phases: first, a user publishes a commitment—a hashed version of the transaction that reveals no details. Later, they broadcast the actual transaction. A quantum computer could derive the private key from the revealed public key, but it would be unable to forge a valid transaction because the network would check for the prior commitment. Only the legitimate user’s pre-registered fingerprint would match, rejecting any competing transactions. While effective, the two-phase process increases transaction costs, making it a stopgap measure until more permanent solutions are implemented.
Hourglass V2: Slowing the Bleeding of Exposed Bitcoins
Proposed by developer Hunter Beast, Hourglass V2 targets the 1.7 million bitcoins held in exposed P2PK addresses. The proposal acknowledges that these coins are already vulnerable and seeks to mitigate the risk of a catastrophic market crash by limiting sales to one bitcoin per block. This ‘bank run’ analogy aims to prevent a sudden flood of 1.7 million bitcoins hitting exchanges and exchanges, which could crash prices overnight. However, the proposal is highly controversial within the Bitcoin community, as it introduces a form of censorship that conflicts with Bitcoin’s core ethos of uncensorable transactions.
Bitcoin was designed to resist all external interference, including regulatory or protocol-level restrictions on spending. Hourglass V2, in essence, violates that principle by imposing artificial limits on how users can dispose of their own coins.
The Governance Challenge: How Bitcoin’s Decentralized Upgrade Process Slows Defense
Bitcoin’s upgrade process is notoriously slow, requiring consensus among developers, miners, and node operators—a process known as a soft fork or hard fork. Given the urgency of the quantum threat, the community’s historical caution may prove costly. Past upgrades, such as the 2017 SegWit activation and the 2021 Taproot upgrade, took years of debate and coordination. The quantum-proofing proposals currently under discussion are no exception. While the recent Google research has accelerated discussions, there’s no guarantee that a consensus will emerge in time to prevent a potential quantum attack by 2029.
Historical Context: How Bitcoin Has Prepared for Cryptographic Threats Before
Bitcoin has faced cryptographic threats before, most notably the 2010 ‘Value Overflow Incident,’ where a bug allowed the creation of 184 billion bitcoins. The incident was resolved through a hard fork, demonstrating Bitcoin’s ability to adapt to unforeseen vulnerabilities. More recently, the 2021 Taproot upgrade improved privacy and scalability by introducing Schnorr signatures and MAST (Merkelized Abstract Syntax Trees). However, quantum computing represents a far greater challenge, as it threatens the foundational cryptography that underpins the entire network.
The Broader Implications: Could a Quantum Attack Kill Bitcoin?
A successful quantum attack on Bitcoin would have devastating consequences. Beyond the immediate financial losses—potentially wiping out hundreds of billions in value—it would shatter trust in the network’s immutability and security. Bitcoin’s value proposition as ‘digital gold’ and a censorship-resistant store of value would be severely undermined. Moreover, it could trigger a regulatory crackdown, as governments and institutions may deem Bitcoin too risky to hold or transact. The ripple effects would extend to the broader cryptocurrency market, where Bitcoin’s price movements often dictate trends across the industry.
Key Takeaways: What Bitcoin Holders and Investors Need to Know
- A quantum computer could crack Bitcoin’s cryptography in under 9 minutes, according to Google’s 2026 research, with the threat potentially materializing by 2029.
- Roughly 6.5 million bitcoins, including coins held by Satoshi Nakamoto, are at risk due to exposed public keys in old and current address formats.
- Proposals like BIP 360, SPHINCS+, and the Commit/Reveal scheme aim to mitigate risks, but each comes with tradeoffs in scalability, cost, or complexity.
- Hourglass V2’s proposal to limit spending of exposed bitcoins is controversial and may violate Bitcoin’s core principles of uncensorable transactions.
- Bitcoin’s slow upgrade process could delay defenses, leaving the network vulnerable if a quantum threat materializes sooner than expected.
Frequently Asked Questions
Frequently Asked Questions
- Can a quantum computer really break Bitcoin’s security right now?
- No, current quantum computers lack the power to break Bitcoin’s cryptography. However, Google’s 2026 research suggests that a sufficiently advanced quantum computer could do so in under 9 minutes, with the threat potentially becoming real by 2029.
- How much Bitcoin is at risk from a quantum attack?
- Approximately 6.5 million bitcoins, worth hundreds of billions of dollars, are held in addresses that could be vulnerable to quantum attacks, including coins in old P2PK addresses and current Taproot addresses.
- What is the most promising solution to quantum-proof Bitcoin?
- BIP 360’s Pay-to-Merkle-Root (P2MR) addresses are widely seen as the most promising solution for long-exposure attacks, as they eliminate permanent public key exposure. For broader cryptographic security, post-quantum signatures like SPHINCS+ are being explored, though they introduce scalability challenges.
