Bitcoin's ECDSA secp256k1 signatures could theoretically be broken by a quantum computer running Shor's algorithm with approximately 4,000 logical qubits. In practice, this requires roughly 4 million physical qubits at current error rates. The largest quantum processor in 2026 has approximately 1,200 physical qubits with error rates roughly 1,000 times too high. This page provides a technical breakdown of the gap between current quantum hardware and what would be needed to threaten Bitcoin, plus the post-quantum cryptography upgrades already underway.
Bitcoin uses two cryptographic primitives that a quantum computer could theoretically attack. For transaction signing, Bitcoin employs ECDSA with the secp256k1 elliptic curve. For mining (proof-of-work), it uses SHA-256 hashing. Shor's algorithm threatens ECDSA; Grover's algorithm theoretically weakens SHA-256, but only offers a quadratic speedup (effectively halving the key length from 256 to 128 bits), which is insufficient for a practical attack.
The primary quantum threat to Bitcoin is therefore an attack on ECDSA signatures using Shor's algorithm. Here is what that attack would require versus what exists today:
| Metric | Required to Break ECDSA-256 | Current State (2026) |
|---|---|---|
| Physical Qubits | ~4,000,000 | ~1,200 (IBM Condor) |
| Logical Qubits | ~4,000 | 12 demonstrated (Quantinuum) |
| Two-Qubit Gate Error Rate | <0.001% (10⁻⁵) | ~0.025% (Quantinuum H2 best) |
| Coherence Time Needed | Hours (for full computation) | Microseconds to seconds |
| Gate Operations per Run | ~10⁹ (billions) | ~10³ before decoherence |
A quantum attack on Bitcoin would target the elliptic curve discrete logarithm problem (ECDLP) underlying ECDSA. When a Bitcoin user signs a transaction, they use a private key to produce a signature that includes the corresponding public key. Shor's algorithm can reverse this process: given a public key, it can compute the private key in polynomial time on a sufficiently large quantum computer.
There are two attack scenarios:
Approximately 25% of all Bitcoin (roughly 4-5 million BTC) sits in addresses where the public key has been revealed through prior transactions. An attacker with a cryptographically relevant quantum computer could derive the private keys for these addresses without any time constraint. This includes early Satoshi-era coins using pay-to-public-key (P2PK) format.
When a user broadcasts a transaction, the public key is revealed in the mempool before the transaction is confirmed in a block. An attacker would need to derive the private key, construct a competing transaction, and get it mined — all within roughly 10 minutes (one Bitcoin block interval). This is an extremely demanding constraint even for a powerful quantum computer. Estimates suggest a quantum computer would need to break ECDSA in under 10 minutes, which would require approximately 317 million physical qubits using current architectures.
Every major quantum computing company has published hardware roadmaps. None of them project reaching the qubit counts needed to threaten Bitcoin before the 2030s, and most estimates place the timeline significantly later.
| Company | Current (2026) | Roadmap Target | Could Threaten BTC? |
|---|---|---|---|
| IBM | 1,121 qubits (Condor), 156 qubits (Heron) | 100,000+ qubits by 2033 | Not before mid-2030s at earliest |
| 105 qubits (Willow) | Useful error-corrected QC by 2029 | Error-corrected, not cryptographically relevant. 2040s+ | |
| Quantinuum | 56 qubits (H2), 99.9975% fidelity | Universal fault-tolerant QC | Highest fidelity but far too few qubits. 2040s+ |
| IonQ | 36 algorithmic qubits (Forte Enterprise) | 1,024 qubits by 2028 | Scaling too slow for crypto threat. 2040s+ |
| Atom Computing | 1,180-qubit array | Error-corrected systems | Large array but high error rates. 2040s+ |
| Microsoft | 8 topological qubits (Majorana 1) | 1M qubits (long-term) | Earliest credible path if topology works. Late 2030s+ |
The cryptographic community is not waiting for quantum computers to arrive. NIST finalized three post-quantum cryptographic standards in August 2024, providing algorithms that resist both classical and quantum attacks:
| Standard | Algorithm | Type | Based On | Relevance to Bitcoin |
|---|---|---|---|---|
| FIPS 203 | ML-KEM (CRYSTALS-Kyber) | Key Encapsulation | Lattice-based | Not directly applicable (Bitcoin does not use key exchange) |
| FIPS 204 | ML-DSA (CRYSTALS-Dilithium) | Digital Signature | Lattice-based | Potential ECDSA replacement, but large signatures (~2.4 KB) |
| FIPS 205 | SLH-DSA (SPHINCS+) | Digital Signature | Hash-based | Strong candidate for Bitcoin: relies only on hash function security |
Bitcoin can adopt post-quantum signatures through a soft fork, similar to the Taproot upgrade activated in November 2021. The most discussed approaches include:
No, quantum computers cannot break Bitcoin today or in the near future.
The gap between current quantum capabilities (~1,200 noisy physical qubits) and what is needed (~4 million error-corrected physical qubits) is enormous. Even the most optimistic industry roadmaps place a cryptographically relevant quantum computer in the 2030s at the earliest, with most independent researchers estimating the 2040s or later.
Bitcoin has time to upgrade to post-quantum signature algorithms. NIST finalized three post-quantum standards in 2024 (FIPS 203, 204, 205), and the Bitcoin Core development community is actively researching how to integrate hash-based or lattice-based signatures through a soft fork. Multiple viable upgrade paths exist.
The quantum threat to Bitcoin is real but distant. It is an engineering challenge to be solved over the next decade, not an imminent crisis. Investors and holders should monitor quantum computing progress but should not make financial decisions based on the current state of quantum technology.