No — as of today, Bitcoin is not quantum resistant. The question of whether is bitcoin quantum resistant has a precise answer: Bitcoin’s signature scheme relies on elliptic-curve cryptography (ECDSA and, since Taproot, Schnorr), and a sufficiently large cryptographically-relevant quantum computer running Shor’s algorithm could recover a private key from an exposed public key. That capability does not exist yet. No public quantum machine can break a 256-bit elliptic-curve key today, and credible estimates place that milestone several years out. What genuinely matters is not whether the threat is real — it is — but how fast Bitcoin can migrate coins to post-quantum signatures before a capable machine arrives. Two draft proposals steer that migration: BIP-360 (Pay-to-Merkle-Root) introduces quantum-resistant address types, and BIP-361 proposes a phased sunset of legacy signatures. This article separates the verifiable mechanics from the marketing.
Last verified: 26 July 2026. Figures on qubit counts, Q-day estimates and BIP status change quickly; anything that could not be confirmed against a primary source is marked unverified or not published below.
Is Bitcoin quantum resistant right now?
Right now, Bitcoin is not quantum resistant, and no one serious claims otherwise. Every standard Bitcoin transaction is authorized by a digital signature built on the secp256k1 elliptic curve. Legacy and SegWit inputs use ECDSA; Taproot inputs use Schnorr. Both are secure against classical computers but both are breakable, in principle, by Shor’s algorithm on a large fault-tolerant quantum computer. That is the core of the bitcoin quantum threat: the mathematics that protects your keys assumes that deriving a private key from a public key is computationally infeasible, and Shor’s algorithm dissolves exactly that assumption.
The reassuring part is that “breakable in principle” is doing a lot of work. Reversing a 256-bit elliptic-curve key is far beyond any machine that exists in 2026. If you want a grounding in how Bitcoin works before going deeper, the mechanics matter here: your exposure depends less on the abstract threat and more on whether your public key is visible on the chain. That distinction is the single most misunderstood point in this entire debate, and it is where most fear-driven coverage goes wrong.
So can quantum computers break bitcoin today? No. Will bitcoin become quantum resistant? Almost certainly yes, through a coordinated soft-fork migration rather than a single dramatic switch. The honest framing is that Bitcoin has a known, bounded, and actively-worked problem — not an imminent break, and not a hoax.
Concretely, the risk is not limited to what happens the instant a capable machine switches on. Cryptographers describe the intermediate threat as “harvest now, decrypt later”: an adversary can record every public key Bitcoin has ever put on-chain today, store that data cheaply, and simply wait. If your public key is already visible — say, in a Satoshi-era P2PK output, or a Taproot address that has never been spent from — that data is effectively sitting on someone’s hard drive right now, ready to be fed into Shor’s algorithm the day a capable machine exists. That is why “no quantum computer can break Bitcoin today” is true but incomplete: for millions of coins, the exposure event already happened; only the decryption step is missing.
The gap between “breakable in principle” and “breakable in practice” is still enormous, and it helps to put a number on it. The largest publicly disclosed quantum processors in 2026 — machines in the class of Google’s Willow and IBM’s Condor chips — hold a few thousand noisy physical qubits. Breaking a 256-bit elliptic-curve key needs a fault-tolerant machine running Shor’s algorithm on the order of thousands of stable logical qubits, and each logical qubit today requires hundreds to thousands of physical qubits to error-correct. No lab has come close to that. So the honest 2026 snapshot is: the attack is fully understood on paper, the hardware to run it does not exist, and the estimates for when it might are measured in years, not months.
Two exceptions are worth flagging so the threat isn’t overstated. First, Bitcoin’s mining layer — the SHA-256 proof-of-work that secures the ledger — is not meaningfully weakened by any known quantum algorithm; that is a separate question, covered in detail below. Second, exposure is not uniform: an unspent, never-reused address that only publishes a hash of its public key is not sitting in anyone’s “harvest now” dataset the way a P2PK or reused address is. Which category your coins fall into changes your practical risk far more than any Q-day estimate does — the next section walks through exactly which address types are exposed and which aren’t.
What can a quantum computer actually break — and what it can’t
A quantum computer threatens Bitcoin in exactly one place and leaves another completely alone. It endangers the signature layer (public-key cryptography) and it does not meaningfully endanger the mining layer (the SHA-256 proof-of-work hash). Conflating the two is the most common error in the “can quantum computers break bitcoin” discussion, so it is worth pulling them apart precisely. A refresher on blockchain technology helps here, because the vulnerable surface is the cryptographic layer, not the ledger structure itself.
Why SHA-256 mining is not the weak point
Proof-of-work security rests on SHA-256, a hash function. The only known quantum speedup against a generic hash is Grover’s algorithm, which offers a quadratic advantage — it effectively halves the security bits. A 256-bit hash drops to roughly 128 bits of quantum-resistant security, which is still astronomically safe. Grover’s algorithm also parallelizes poorly, so a fleet of quantum machines does not translate into a proportional mining advantage the way ASIC scaling does.
The resource argument is stark. Publicly discussed estimates for a Grover-style attack that could meaningfully out-mine the network land on the order of 10²³ qubits alongside energy requirements that commentators have described as approaching the power output of a star. Those figures are illustrative rather than a single audited number, but the direction is unambiguous: breaking SHA-256 mining with quantum hardware is not a near-term or even a mid-term concern. This is why the claim that “quantum will let someone rewrite the Bitcoin chain” is misplaced. If you take one thing from this section: SHA-256 mining is quantum-safe for the foreseeable future. The signatures are the problem.
Exposed vs safe addresses: reused keys and P2PK
Here is the mechanic that determines your actual risk. An elliptic-curve public key is only vulnerable to Shor’s algorithm once it is visible on-chain. Different address types expose the public key at different moments:
- P2PK (pay-to-public-key) — the raw public key sits directly in the output script. It is exposed the moment the coins are received. Most Satoshi-era coinbase outputs are P2PK. These are the single most exposed coins on the network.
- P2PKH (pay-to-public-key-hash) — the output contains only a hash of the public key. The key itself is revealed only when the coins are spent. An unspent, never-reused P2PKH address keeps its public key hidden behind a hash, adding a second cryptographic layer a quantum attacker must also defeat.
- Reused P2PKH — if you have ever spent from an address and then received to it again, the public key is already published from the earlier spend. A reused address is effectively an exposed address.
- P2TR (Taproot) — this is the nuance most articles get wrong. A Taproot output commits the tweaked x-only public key directly in the scriptPubKey. So a Taproot output publishes its key on-chain even before it is spent. “Never reused” does not mean “key hidden” for Taproot.
The takeaway for quantum resistant bitcoin addresses reasoning: hash-protected, unspent, never-reused P2PKH or P2WPKH outputs are the best-protected category today, while P2PK, reused addresses and Taproot outputs all sit with their public keys already visible. This is not theoretical hand-waving — anyone can inspect these output types directly on the chain, and the difference in exposure is auditable byte-for-byte in the script.
When is Q-day? Why the 2026 estimate moved
“Q-day” is the informal name for the day a cryptographically-relevant quantum computer can break elliptic-curve keys in practice. There is no confirmed date, and anyone quoting one with confidence is guessing. The credible expert consensus in 2026 clusters around a 5-to-10-year window for a machine capable of breaking ECDSA — with wide error bars in both directions.
The estimate has tightened, and it is worth being precise about why. The resource gap between what exists and what is needed narrowed after research from Google Quantum AI revised downward the number of physical qubits thought necessary to break RSA-2048, with commentary suggesting figures below 500,000 physical qubits under improved error-correction assumptions — described in some summaries as roughly a 20× smaller resource gap than earlier estimates. Two cautions apply. First, that work targets RSA; the elliptic-curve case that Bitcoin uses is related but not identical, and specific Bitcoin numbers should be treated as unverified extrapolations unless tied to a named primary source. Second, and most importantly, you must separate logical from physical qubits.
A logical qubit is an error-corrected, stable unit of computation. Building one requires many noisy physical qubits — often on the order of hundreds to thousands, depending on the error rate and code. Today’s leading processors are measured in the low thousands of physical qubits with error rates that still demand heavy correction. So a headline of “hundreds of thousands of physical qubits” for a break translates into a machine that is orders of magnitude beyond current hardware. The methodology matters more than the number: whenever you see a qubit figure, ask whether it counts logical or physical qubits, what error rate it assumes, and whether it targets RSA or elliptic curves. Without those three qualifiers, a raw qubit count tells you almost nothing about when will quantum computers break bitcoin.
The real debate is migration speed, not the date
This is the reframing that separates signal from noise. Fixating on the exact Q-day date is the wrong question. Even a pessimistic 5-year estimate leaves room to act — if the network can move coins to post-quantum signatures fast enough. The binding constraint is migration throughput, not the calendar.
Consider the arithmetic of a migration. There are hundreds of millions of UTXOs. A meaningful share belong to exposed categories (P2PK, reused, Taproot) and a further, unknowable share are lost — the keys no longer exist, so those coins can never be moved to safety by their owners. Block space is finite. Moving the vulnerable, movable coins to quantum-safe outputs is a multi-year logistical operation even after the software ships. That is why the serious engineering conversation is about consensus rules that create urgency and a schedule — precisely what BIP-360 and BIP-361 attempt — rather than about pinning down a date no one can know. The bitcoin Q-day timeline is really a migration timeline wearing a countdown costume.
What is BIP-360 (Pay-to-Merkle-Root)?
BIP-360 is the proposal that gives Bitcoin a new, quantum-resistant output type. It was originally circulated under the name P2QRH (Pay-to-Quantum-Resistant-Hash) and later reframed around a Pay-to-Merkle-Root (P2MR) construction — you will see both the P2QRH and P2MR labels in the discussion, which is why how do P2QRH P2MR addresses work is such a common question. The full text lives in the bitcoin/bips GitHub repository, which is the primary source to check for its current wording and status. As of this writing it is a draft, not activated on mainnet — treat any “shipped” claim as not published until the repository says otherwise.
The mechanism, in plain terms: a new witness output type commits to a Merkle root of one or more spending conditions, and those conditions can include a post-quantum signature scheme. The scheme in focus is ML-DSA (Module-Lattice Digital Signature Algorithm, derived from CRYSTALS-Dilithium), standardized by NIST as FIPS 204. You can read the standard directly on the NIST FIPS 204 publication page. Lattice-based signatures like ML-DSA are believed secure against both classical and quantum attackers, which is why they anchor the design.
Two practical properties of the design deserve emphasis:
- Post-quantum signatures are large. ML-DSA signatures and public keys are far bigger than a 64-byte Schnorr signature — kilobytes, not tens of bytes. The Merkle-root structure helps by only revealing the spending branch actually used, keeping the on-chain footprint manageable.
- It is opt-in and additive. BIP-360 introduces a new address type holders can move to; it does not, by itself, force anyone off legacy scripts. That forcing function is BIP-361’s job.
On the experience side: the design has moved past pure theory. The team at BTQ publicly demonstrated working P2QRH/BIP-360-style transactions on a testnet, which is the kind of verifiable artifact — inspectable testnet transactions rather than a slide deck — that separates a real proposal from a whitepaper. Anyone evaluating post-quantum cryptography bitcoin claims should look for exactly that: a spec in the bips repo, a NIST-standardized scheme, and reproducible testnet activity. Specific testnet transaction identifiers and dates should be confirmed against BTQ’s own published materials, as those details are unverified here.
What is BIP-361 and the legacy signature sunset?
BIP-361 approaches the problem from the opposite end. Where BIP-360 gives you a safe place to go, BIP-361 proposes the schedule that eventually makes it unsafe to stay on legacy elliptic-curve signatures — a phased legacy signature sunset. As with BIP-360, the authoritative text is in the bitcoin/bips repository, and its status should be read as a draft under discussion; treat activation, block heights and phase names as unverified until the primary document confirms them.
The rationale is the migration-speed problem from earlier. Without a deadline, most holders will never proactively move coins, and exposed UTXOs will accumulate right up to Q-day. A phased sunset converts a vague “someday” into a consensus-enforced timetable, giving the ecosystem — wallets, exchanges, custodians — a concrete target to build against.
The three-phase migration explained
The proposal is structured as a three-phase migration, tightening in stages rather than flipping a single switch. The general shape of a phased sunset is:
- Phase 1 — Enablement and warning. Post-quantum outputs (via BIP-360) become spendable and standard. Tooling, wallets and exchanges add support. Nothing is disabled yet; the clock starts and the ecosystem is put on notice.
- Phase 2 — Restrict new exposure. The network begins restricting the creation of new vulnerable outputs and/or new spends that reveal legacy public keys, steering all fresh activity toward quantum-safe types. Holders still have a window to move existing coins.
- Phase 3 — Sunset of legacy spends. Spending via legacy elliptic-curve signatures is disabled by consensus. Coins not migrated by this point become unspendable under the new rules — effectively frozen — because the only way to move them would be a signature type the network no longer accepts.
The exact block heights, durations and precise per-phase rules are design parameters that are still being debated and are not published as final. The three-phase structure is the concept to understand; the specific numbers are the thing to verify against the live BIP text before relying on them.
What happens to lost and Satoshi-era coins
This is the most consequential — and most contested — part of the whole design, and it is what people mean when they ask what happens to satoshi coins quantum. The uncomfortable logic runs like this: a large quantity of Bitcoin sits in exposed outputs whose owners are unreachable or whose keys are lost. Satoshi-era P2PK coins are the textbook example — the public keys are already on-chain, and no one is going to move them.
On Q-day, those exposed coins are precisely what a quantum attacker would target first, potentially minting a flood of “stolen” coins into circulation. A legacy sunset like BIP-361 effectively freezes quantum-vulnerable coins before that can happen: if legacy spends are disabled by consensus, an attacker who reconstructs an old private key still cannot spend the coins, because the network rejects the legacy signature type. The trade-off is blunt and deliberate — the same rule that stops the thief also permanently locks out any genuine owner (including a hypothetical returning Satoshi) who never migrated. There is no way to freeze the coins for attackers while leaving them spendable for lost-key owners; the two are the same action. Whether the network should take that step is a governance question, not a technical one, and it remains unresolved.
BIP-360 vs BIP-361: how they differ
The two proposals are complementary halves of one migration, which is why the difference between BIP-360 and BIP-361 confuses people. BIP-360 is the destination (a quantum-safe address type); BIP-361 is the eviction notice (a schedule that makes the old address types unsafe to keep using). One without the other is incomplete: a safe destination no one is required to use, or a deadline with nowhere to go.
| Dimension | BIP-360 (Pay-to-Merkle-Root) | BIP-361 (Legacy signature sunset) |
|---|---|---|
| Purpose | Introduce a quantum-resistant output type | Phase out legacy elliptic-curve signatures on a schedule |
| Mechanism | Pay-to-Merkle-Root committing to post-quantum spending conditions | Three-phase consensus tightening that eventually disables legacy spends |
| Signature / address type | ML-DSA (FIPS 204); P2QRH / P2MR outputs | Affects existing P2PK, P2PKH, P2WPKH and P2TR spends |
| What it changes for holders | Gives you a quantum-safe address to move coins into | Sets a deadline by which unmigrated coins become unspendable |
| Nature | Additive, opt-in | Restrictive, network-wide |
| Status (26 Jul 2026) | Draft in bitcoin/bips; testnet demonstrated; not on mainnet | Draft under discussion; phases and heights not published as final |
Read together, they answer the migration-speed problem: BIP-360 makes safety possible, and BIP-361 makes migration happen before Q-day rather than after.
How other chains compare: Ripple and Ethereum
Bitcoin is not alone in confronting this, and asking which cryptocurrency is quantum resistant today has an honest answer: none of the major chains is fully post-quantum in production yet, but several have public roadmaps. Comparing them clarifies where Bitcoin sits — deliberate and conservative, consistent with Bitcoin’s superior security design philosophy of moving slowly and preserving guarantees.
| Chain | Post-quantum approach | Signature scheme | Target timeline |
|---|---|---|---|
| Bitcoin | BIP-360 new output type + BIP-361 legacy sunset (soft-fork migration) | ML-DSA (FIPS 204) | No activation date; drafts under discussion |
| Ripple / XRPL | Post-quantum signatures piloted on a test network ahead of mainnet | ML-DSA reported on AlphaNet | Targeting ~2028 (per public roadmap; verify) |
| Ethereum | Account-abstraction path plus post-quantum signature research (“Strawmap”) | Hash-based / lattice schemes under study | ~2030 direction (roadmap; not a commitment) |
Ripple/XRPL has been more public about a concrete date, with reporting that ML-DSA is being exercised on its AlphaNet test network and a stated aim in the 2028 range. Confirm current status on the XRPL official resources, as roadmap dates shift. Ethereum‘s direction is captured in Vitalik Buterin’s published post-quantum writeup — often referred to as the “Strawmap” — pointing toward a roughly 2030 horizon; the Ethereum roadmap is the place to track it. All three timelines are targets, not guarantees, and belong in the “verify before quoting” bucket. The broader point for anyone weighing is crypto safe from quantum computing: quantum resistance is an active, multi-chain engineering effort, not a solved feature you can check off today.
What should a Bitcoin holder actually do?
Nothing in this section is investment advice, a recommendation to buy or sell, or a claim about price. It is a factual walk-through of exposure so the abstract threat becomes concrete. The most useful thing a holder can do is understand which of their coins are exposed, because the answer is not uniform across address types.
Consider a hypothetical holder with three positions on Q-day, and trace what happens to each:
- (a) A never-reused Taproot (P2TR) address. Intuitively this feels safe, but Taproot outputs publish the tweaked x-only public key directly on-chain. “Never reused” does not hide the key here. So on Q-day this coin’s key is exposed and a quantum attacker could target it. Under a BIP-361-style sunset it is affected by the later phases that restrict and then disable legacy elliptic-curve spends — meaning it must be migrated to a BIP-360 output before Phase 3 to stay spendable.
- (b) A reused legacy P2PKH address whose public key is already on-chain. Because it was spent from before, the public key was revealed at that earlier spend. This coin is exposed on Q-day — arguably the most common real-world exposure — and, like (a), falls under the legacy-spend restrictions in the middle and final migration phases.
- (c) Coins in an early P2PK output (Satoshi-era style). The raw public key sits in the output script, exposed since the moment the coins were received. This is the most exposed category and the prime target on Q-day. If the keys are lost, no owner can migrate them, so a Phase 3 legacy sunset is what would ultimately freeze them out of a quantum attacker’s reach — and out of everyone’s.
Notice what the walk-through reveals: all three positions are exposed, and the genuinely well-hidden case — an unspent, never-reused P2PKH or P2WPKH address whose key is still behind a hash — was not even in this holder’s portfolio. That is the practical lesson about reused address quantum exposure and about lost bitcoin quantum risk: exposure is a property of your specific outputs, and Taproot’s convenience comes with the key already published.
Separating real preparation from marketing
Real preparation is boring and cheap: understand your address types, avoid reusing addresses, keep wallet software current so it can support post-quantum output types when they ship, and follow the bitcoin/bips repository and reputable client releases rather than countdown clocks. Marketing is anything selling urgency — “quantum-proof” hardware or tokens promising safety that Bitcoin itself has not yet standardized, or a product implying you must act this week.
The honest status is that there is no post-quantum address on Bitcoin mainnet to move to yet, because BIP-360 is still a draft. So the correct preparation today is informational, not transactional. Anyone telling you to urgently move funds into a specific “quantum-safe” product is selling something the base protocol cannot yet deliver.
Frequently asked questions
Is Bitcoin quantum resistant?
No. Bitcoin’s ECDSA and Schnorr signatures rely on elliptic-curve cryptography that a large quantum computer running Shor’s algorithm could break. No such machine exists today, and proposals BIP-360 and BIP-361 aim to migrate Bitcoin to quantum-resistant signatures before one does.
Can quantum computers break Bitcoin right now?
No. No public quantum computer in 2026 can reverse a 256-bit elliptic-curve key. Current machines have far too few stable, error-corrected logical qubits, and credible estimates put a capable machine several years away.
What is the difference between BIP-360 and BIP-361?
BIP-360 (Pay-to-Merkle-Root) creates a new quantum-resistant address type using ML-DSA signatures — the safe destination. BIP-361 is a phased sunset of legacy elliptic-curve signatures — the schedule that eventually makes staying on old address types unsafe. Both are drafts.
What happens to lost or Satoshi-era coins under BIP-361?
Coins in exposed outputs such as Satoshi-era P2PK that are never migrated would become unspendable once a legacy-signature sunset takes effect. This freezes them out of a quantum attacker’s reach, but also permanently locks out any genuine owner who never migrated. The phase details are not yet published as final.
Does quantum computing threaten Bitcoin mining (SHA-256)?
Not meaningfully. The only quantum speedup against SHA-256 is Grover’s algorithm, which merely halves security to about 128 bits — still astronomically safe. Estimates for a real mining attack reach on the order of 10²³ qubits and star-scale energy, making it a non-issue for the foreseeable future.
When will quantum computers be able to break Bitcoin?
There is no confirmed date. Expert consensus in 2026 clusters around a 5-to-10-year window for a machine able to break ECDSA, with wide uncertainty. Research narrowing the physical-qubit requirement moved estimates, but specific Bitcoin figures remain unverified extrapolations.
Which cryptocurrencies are becoming quantum resistant?
Several major chains have roadmaps but none is fully post-quantum in production. Bitcoin is developing BIP-360/BIP-361, Ripple/XRPL is testing ML-DSA on AlphaNet targeting around 2028, and Ethereum’s research points toward roughly 2030. All dates are targets, not commitments.
What can a Bitcoin holder do to prepare for quantum computing?
Audit your address types, stop reusing addresses so public keys stay hashed, keep wallet software current, and follow the BIP-360/BIP-361 texts in the bitcoin/bips repository. There is no post-quantum Bitcoin address to move to yet, so preparation today is informational, not transactional.
What to do now
- Audit your address types. Using a block explorer or your wallet, identify whether your coins sit in P2PK, reused P2PKH, Taproot, or unspent never-reused hash-based outputs — that tells you your actual exposure order.
- Stop reusing addresses. Generate a fresh receive address for every incoming payment so your public keys stay behind a hash until you spend.
- Read the primary sources yourself. Open BIP-360 and BIP-361 in the bitcoin/bips repository and check their live status rather than trusting secondhand summaries (including this one).
- Verify the standard. Confirm that ML-DSA is what the design uses by checking the NIST FIPS 204 page directly.
- Keep wallet software current. Track your wallet or node client’s release notes so you can adopt a BIP-360 output type promptly once it activates on mainnet.
- Ignore countdown-driven products. Treat any “quantum-proof” token, coin or hardware promising urgency as marketing until Bitcoin standardizes a post-quantum address you can actually use.
- Re-check the timeline periodically. Q-day estimates and BIP status move; revisit the primary sources every few months rather than acting on a single headline.
