Quantum computing and Bitcoin is a legitimate long-horizon risk, not an immediate one. A sufficiently large and reliable quantum computer could, in principle, work out a private key from its public key, which would let an attacker sign transactions for coins whose public keys are visible. No machine capable of this exists today. For a company, the right response is to understand where exposure sits, reduce it through custody practice, and monitor progress on both quantum hardware and Bitcoin's own upgrade path.
Quantum computing and Bitcoin: what is actually at risk
Bitcoin relies on two different kinds of mathematics, and quantum computers affect them very differently.
| Component | What it does | Quantum impact |
|---|---|---|
| Digital signatures (elliptic curve) | Prove the right to spend | Severe in principle: a known quantum algorithm (Shor's) could derive private keys from public keys |
| Hash functions (SHA-256) | Mining and address hashing | Modest: the best known quantum speed-up (Grover's) roughly halves effective security, which remains very high |
So the main concern is signatures, not mining. A quantum attacker would not break the ledger or change the supply. It would try to steal coins whose public keys it can see.
For background on keys and signatures, see public and private keys explained.
Which coins are exposed
A public key is not always visible on the ledger. Exposure depends on address type and usage:
- Hidden until spent. Common address types such as legacy and native SegWit show only a hash of the public key. The public key appears only when coins are spent from that address.
- Exposed at rest. The earliest output types from 2009–2010 reveal the public key directly. Taproot addresses also encode a public key in the address itself.
- Exposed by reuse. If coins are received at an address that has already been spent from, the public key is already public.
- Exposed in transit. When any transaction is broadcast, its public key is visible until it is confirmed. A very fast quantum attacker could in theory try to race it, though this is a harder attack.
See what is a Bitcoin address for the formats.
How far away is the threat?
Honest answer: uncertain. Today's quantum computers are far too small and error-prone to attack Bitcoin's signatures. Breaking them would require a machine with a very large number of reliable, error-corrected qubits.
Expert estimates of when that might be possible range widely, from roughly a decade to much longer, and some doubt it will be achieved at all. We do not suggest relying on any single forecast.
What is clear:
- The wider world is preparing. The US National Institute of Standards and Technology published its first post-quantum signature and key standards in August 2024.
- Bitcoin developers have published proposals for quantum-resistant address types. Any change would need broad agreement and then time for holders to move coins, which could take years.
- The migration challenge is as much social and operational as technical, especially for coins whose owners are inactive.
It is also worth noting what would likely come first. A machine able to attack Bitcoin signatures would equally threaten much of the public-key infrastructure that banks, payment networks and governments rely on. Progress towards it would be widely watched and reported. A company monitoring the field through its custodian and its own risk process should expect to see warning signs well before any practical attack.
What a response could look like
Without predicting a specific outcome, the likely path involves:
- New address types using post-quantum signature schemes, introduced through a soft fork.
- A migration period during which holders move coins to the new addresses.
- Possible restrictions on vulnerable outputs, a contested topic, since it would affect coins whose owners cannot or do not move them.
For a corporate holder that maintains active custody, migration should be an operational task, planned with its custodian, rather than an existential one.
What a company can do now
Practical steps that cost little and reduce exposure:
- Avoid address reuse. Receive each transfer at a fresh address so public keys stay hidden until spending.
- Prefer custody set-ups that keep public keys unexposed for long-term holdings, and ask your custodian which address types it uses and why.
- Ask custodians about their quantum roadmap. Include it in custody due diligence.
- Keep custody active and documented. Holdings that can be moved promptly, under a tested signing process, are easier to migrate.
- Add it to the risk register with an owner, a low current likelihood and a review date. See building a Bitcoin risk register.
Add one question to your annual custodian review: "If a post-quantum address type is adopted, how and how quickly would you migrate our holdings, and what would you need from us?"
None of these steps requires a change in strategy. They are housekeeping that a well-run custody operation should already be doing, with the quantum question giving them an additional reason.
Putting it in proportion for the board
Quantum risk applies across modern finance, not only to Bitcoin. Banking, payments and internet security all rely on similar public-key methods and face the same transition. Bitcoin's distinctive challenge is coordination without a central authority. Its distinctive advantage is that its rules and progress are fully public.
A fair board summary: a real, distant and uncertain risk; manageable through monitoring and custody hygiene; not a reason by itself to avoid or exit a holding, but one to review annually.
How The Bitcoin World helps
We help companies assess long-horizon technical risks like quantum computing and build them into custody due diligence and risk reporting. Custody and execution are carried out by licensed third-party institutions. See our custody architecture service.