New to Bitcoin? Start at 1.1
6.5Lesson 5 of 8
Quantum computers and Bitcoin
This lesson answers
- Can quantum computers break Bitcoin?
- Which bitcoin are at risk from quantum computers?
- When will quantum computers be a threat to Bitcoin?
- What is Bitcoin doing about quantum computing?
Bitcoin's signatures rely on a kind of math that ordinary computers can't reverse: from a public key you can't work out the private key. A large enough quantum computer could, in theory. No such computer exists today, and experts disagree widely about when, or whether, one will be built.
What would be at risk
The danger is to coins whose public key is already visible on the chain. A quantum computer could, in theory, work out the private key from it and spend them first.
| Key visible | Very old outputs paid straight to a public key, mostly from Bitcoin's first years; addresses that have already spent coins and still hold some; and Taproot (bc1p) outputs, which carry a key by design. |
|---|---|
| Key hidden | Addresses starting with 1, 3 or bc1q that have received coins but never spent any. They show only a fingerprint of the key until the first spend. |
At block 972,307, about 1.72 million bitcoin sat in outputs that use no address at all. Most of these are the old pay-to-public-key kind from the first years, many of them untouched since, with their keys in plain view.
What is being done
In 2024 the US standards body NIST approved its first signature schemes designed to resist quantum computers. Bitcoin developers have drafted proposals, such as BIP 360, for new address types that could use such schemes or hide keys better. None is part of Bitcoin yet. Any change would follow the usual path: public debate, broad agreement, and then people moving their coins to the new kind of address, which would take years. See forks and upgrades.
The hard question
Coins whose owners have lost their keys, or died, can never be moved to safer addresses. If quantum computers ever became able to take them, some people argue those coins should be frozen by a rule change; others say that would break Bitcoin's promise that nobody can touch your coins. This is debated openly and unresolved.
What it means today
For now, nothing has changed: no quantum computer can break a Bitcoin key. Using a fresh address for each payment, which most wallets already do, keeps public keys off the chain until coins are spent.
Check yourself
Practice, not a test. Think of your answer first, then reveal it.
1Which part of Bitcoin would a large quantum computer threaten first?Reveal
The signatures: working out a private key from a public key that is visible on the chain. Mining and the record's fingerprints are much less exposed.
2Why are coins in a never-used bc1q address less exposed than coins in an old pay-to-public-key output?Reveal
An unused bc1q address shows only a fingerprint of the public key. The key itself appears only when the coins are spent. Old pay-to-public-key outputs show the key from the start.
3Can Bitcoin switch to quantum-resistant signatures?Reveal
Proposals exist, but any change needs broad agreement and then people moving their coins to new address types, which takes years.
Sources
- US National Institute of Standards and Technology, post-quantum cryptography standards FIPS 203, 204 and 205, August 2024.
- BIP 360: a draft proposal for a new output type without Taproot's exposed key.
- BIP 341: Taproot outputs carry a public key.
- Coins in outputs without an address: a Bitcoin node's snapshot of every unspent output at block 972,307 (20 October 2026).