Is Your Bitcoin Safe?

Why This Matters

Quantum computing poses arguably the biggest long-term threat to Bitcoin and the entire cryptocurrency ecosystem. If a quantum computer becomes powerful enough, it could derive private keys from public keys — effectively stealing any Bitcoin stored in a wallet with an exposed public key. That moment has a name: Q-Day.

For years, the crypto community has largely dismissed this threat. "We're decades away," the argument goes. But on March 31, 2026, a paper from Google Quantum AI changed the calculus. The researchers demonstrated that improved quantum algorithms could break the elliptic curve cryptography used by Bitcoin with roughly 20 times fewer resources than previously estimated — approximately 1,200 logical qubits and fewer than 500,000 physical qubits, with attack circuits running in minutes, not hours.

The estimated market exposure: more than $600 billion across Bitcoin, Ethereum, and stablecoins, according to CryptoRank's analysis of the paper.

Nobody is saying a quantum attack is imminent. Google itself does not claim such a machine exists today. But the gap between "theoretical" and "practical" just narrowed dramatically. And in a system where billions of dollars are at stake and protocol upgrades take years, "not yet" is not the same as "not urgent."

Fortunately, Bitcoin is not standing still. In February 2026, a proposal called BIP-360 was added to Bitcoin's official improvement proposal repository — the project's first official step toward quantum resistance. This article explains the threat, the defense, and what you should do today.

How Bitcoin's Cryptography Works

To understand the quantum threat, you need to understand what Bitcoin actually uses to keep your coins safe. There are two cryptographic pillars:

Pillar 1: Digital Signatures (ECDSA)

When you send Bitcoin, you prove ownership by signing the transaction with your private key. Bitcoin uses the Elliptic Curve Digital Signature Algorithm (ECDSA) over a specific curve called secp256k1. The math works like a one-way door:

• Private key → Public key: Easy. Multiply a large number by a point on the elliptic curve. Any computer can do this instantly.
• Public key → Private key: Essentially impossible with classical computers. You would need to perform approximately 2¹²⁸ operations — more than the number of atoms in the observable universe.

This asymmetry is what makes Bitcoin work. Your public key (or a hash of it) serves as your address. Your private key proves you own the coins. Nobody can reverse the math — with a classical computer.

Pillar 2: Hashing (SHA-256)

Bitcoin's second cryptographic primitive is SHA-256, used for:

• Proof-of-Work mining: Miners repeatedly hash block headers to find a valid nonce.
• Address generation: Most modern Bitcoin addresses are the hash of a public key (e.g., P2PKH, P2WPKH), adding an extra layer of protection.
• Merkle trees: Transaction integrity within each block.

The key distinction: ECDSA is the vulnerable target. SHA-256 is not. This difference is critical to understanding which Bitcoin are at risk and which are relatively safe.

Source: Bitcoin protocol specifications, NIST post-quantum cryptography standards

What Quantum Computers Can Break

Quantum computers threaten Bitcoin through two algorithms. Only one is truly dangerous.

Shor's Algorithm — The Real Threat

Shor's algorithm, published by mathematician Peter Shor in 1994, can solve the Elliptic Curve Discrete Logarithm Problem (ECDLP) in polynomial time. In plain English: given a public key, a sufficiently powerful quantum computer running Shor's algorithm could calculate the corresponding private key. Once you have the private key, you control the wallet.

For Bitcoin's secp256k1 curve, this would require an estimated 1,200–1,450 logical qubits and under 500,000 physical qubits using advanced error correction, according to the March 2026 Google Quantum AI paper. Prior estimates put this figure closer to 10 million physical qubits — making Google's findings a 20x reduction in the expected hardware requirements.

Critically, the attack only works when the public key is known. If your coins sit behind a hash (as in P2PKH or P2WPKH addresses), Shor's algorithm has nothing to work with — until you spend and the public key is revealed.

Grover's Algorithm — Moderate, Not Existential

Grover's algorithm provides a quadratic speedup for brute-force searches. Applied to SHA-256, it effectively halves the security level from 256 bits to 128 bits. While 128-bit security sounds like a dramatic reduction, it remains astronomically strong — well beyond any foreseeable attack capability.

A quantum-equipped miner would gain a modest advantage in the Proof-of-Work race, but it would not break mining or undermine Bitcoin's consensus mechanism. The real danger is Shor's algorithm targeting ECDSA — not Grover's algorithm targeting SHA-256.

How Much Bitcoin Is at Risk?

Not all Bitcoin addresses are equally vulnerable. The risk depends entirely on whether the public key has been exposed.

Address Types by Vulnerability

Source: Bitcoin protocol, BIP-360 specification

The Numbers

Project 11's Bitcoin Risk List — the most comprehensive tracker of quantum-vulnerable Bitcoin — counts exactly 6,876,473 BTC in wallets with exposed public keys, worth roughly $470 billion. That is approximately a third of Bitcoin's total supply.

Source: Project 11 Bitcoin Risk List, CryptoRank analysis

The Mempool Window

Even "safe" addresses have a brief vulnerability window. When you spend Bitcoin from a P2PKH or P2WPKH address, your public key is revealed in the transaction sitting in the mempool waiting for confirmation. In theory, a quantum attacker could derive your private key during this window (typically ~9 minutes for the next block) and broadcast a competing transaction stealing the remaining funds. Google's paper estimates this "on-spend" attack would have roughly a 41% success rate per attempt, according to CryptoRank.

This is why never reusing addresses and spending full UTXOs (leaving no change to a now-exposed address) matter even with hash-protected address types.

When Could Q-Day Arrive?

The honest answer: nobody knows. And the range of expert opinions is uncomfortably wide.

Expert Estimates

Source: Public interviews and statements, CryptoRank, The Quantum Insider

Note the pattern: those closest to quantum computing research tend to be more alarmed than those in the Bitcoin community. After Google's March 2026 paper, Justin Drake said his confidence in a Q-Day by 2032 had "risen sharply."

Quantum Hardware Milestones

Source: Google Quantum AI, IBM, Microsoft, IonQ public roadmaps

The gap between today's ~1,400 physical qubits and the ~500,000 needed is enormous. But progress in quantum computing has historically been non-linear — breakthroughs in error correction, new qubit technologies (topological qubits, photonic systems), and algorithmic improvements can compress timelines dramatically. Google's 20x reduction in estimated requirements came not from hardware advances but from better algorithms.

The Q-Day Prize

Project 11 has put up a 1 BTC bounty (the "Q-Day Prize") for anyone who can break elliptic curve cryptography using a quantum computer. The deadline: April 5, 2026. Nobody has claimed it. But the existence of the prize underscores the seriousness with which researchers are treating the timeline.

BIP-360: Bitcoin's First Step

On February 11, 2026, a Bitcoin Improvement Proposal called BIP-360 was added to Bitcoin's official BIP repository — marking the project's first formal step toward quantum resistance. The proposal was authored by Hunter Beast (pseudonymous developer), Ethan Heilman, and Isabel Foxen Duke.

What BIP-360 Does

BIP-360 introduces a new output type called Pay-to-Merkle-Root (P2MR), with addresses starting with bc1z. The core idea: remove the mechanism that exposes public keys on-chain.

Here's the problem it solves: Taproot (P2TR) introduced "key-path spending," which reveals a tweaked public key on the blockchain. This was a design choice for efficiency — but it creates a quantum attack surface. BIP-360 eliminates key-path spending entirely, committing instead to the Merkle root of a script tree. The public key is never exposed.

In the proposal's own words: "A simple, low-risk [change] that creates options for using Bitcoin in a quantum-resistant way and a conservative first step in this effort."

What BIP-360 Does NOT Do

• Does not replace ECDSA or Schnorr signatures. The existing signature schemes remain in place. BIP-360 only removes the key-path exposure pattern. Fully post-quantum signatures would be a much larger protocol change.
• Does not protect against on-spend attacks. When you spend from a P2MR output, the public key is still briefly revealed in the transaction data. Defending against this requires future upgrades.
• Does not migrate existing coins. Old UTXOs in P2PK, P2PKH, P2TR, or any other format remain in their current state. Users must choose to move funds to bc1z addresses. Bitcoin is a decentralized network — nobody can force a migration.
• Does not specify a post-quantum signature algorithm. As PostQuantum.com notes, BIP-360 is a framework that "leaves space for NIST-standardized ML-DSA or SLH-DSA" in the future.

BTQ Technologies: Proof It Works

On March 20, 2026, BTQ Technologies announced the first working implementation of BIP-360 on their Bitcoin Quantum testnet (v0.3.0). The testnet has attracted 50+ miners, processed 100,000+ blocks, and includes contributions from 100+ developers. It also implements Dilithium-based post-quantum signature opcodes — going beyond BIP-360's scope to test what a fully quantum-resistant Bitcoin might look like, according to Bitcoin.com's reporting.

This is significant: BIP-360 is no longer just a specification on paper. It has been built, tested, and validated in a live (testnet) environment.

The Fun Fact

Hunter Beast originally wanted bc1z addresses to use "r" for "resistant" — but SegWit versioning rules meant the upgrade would have jumped from version 1 to version 3, skipping version 2. This apparently upset some Bitcoin developers. So "z" it is.

Beyond BIP-360

BIP-360 is a first step — deliberately minimal and conservative. Several other proposals address the gaps it leaves behind.

Hourglass: Damage Control

Also authored by Hunter Beast, Hourglass takes a different approach: instead of preventing quantum attacks, it limits their impact. The mechanism is simple — restrict P2PK coins to one input per block and prevent the creation of new P2PK outputs.

Without Hourglass, a quantum attacker could theoretically steal all ~7 million exposed BTC in a single day. With Hourglass, the process would stretch across approximately 34,000 blocks (~8 months). Quantum computers would have to compete against each other to claim the same keys — and would effectively become miners bidding for block space, which would actually benefit Bitcoin miners through higher fees.

Hourglass is a safety net: imperfect, but a massive improvement over doing nothing.

Post-Quantum Signature Schemes

For true, long-term quantum resistance, Bitcoin will eventually need to replace ECDSA/Schnorr with post-quantum signature algorithms. The leading candidates:

Source: NIST post-quantum cryptography standards, BTQ Technologies

None of these are in official Bitcoin Improvement Proposals yet. BTQ Technologies has tested Dilithium opcodes on their testnet, but production deployment is years away. As Binance's analysis notes, BIP-360 "formally puts quantum resistance on Bitcoin's road map for the first time" — but the road is long.

The Freeze/Burn Debate

Some voices in the Bitcoin community — including cypherpunk Jameson Lopp and Bitcoin Core developer Matt Corallo — have proposed freezing or even burning BTC that is deemed lost or dormant. This would include Satoshi's coins.

The argument: if those coins are going to be stolen by a quantum attacker anyway, better to remove them from circulation than let an attacker dump them on the market and crash the price.

The counterargument is powerful: once you modify the protocol to invalidate coins, you undermine the foundational principle that no third party controls your Bitcoin. As the Coin Bureau's Guy summarized: "That kind of intervention would set a dangerous precedent. Once you start modifying the protocol to confiscate or invalidate coins, you undermine the very principles that made Bitcoin valuable in the first place."

It would damage Bitcoin's narrative as a digital store of value, shake institutional confidence, and set a precedent that could be exploited for political or regulatory purposes in the future. The Hourglass proposal offers a less destructive middle ground.

The Implementation Reality

Bitcoin upgrades are notoriously slow. This is by design — a $1+ trillion network cannot afford to move fast and break things. But the pace of change creates a tension with the quantum timeline.

How Long BIP-360 Will Take

According to Ethan Heilman, co-author of BIP-360:

"Three years until it activates. This assumes two and a half years to get the BIPs done and the code reviewed and tested, assuming everyone wants it, half a year to activate."

But activation is only the beginning. After that:

"If we're lucky, 90% will have updated 5 years after the activation. The bigger the perceived danger, the faster this will happen."

That is 8 years from proposal to broad adoption — and that only covers BIP-360, the first and simplest step. Full post-quantum signatures would require additional, more complex soft forks.

Historical Precedent

Source: Bitcoin protocol upgrade history, BIP-360 author estimates

The uncomfortable math: if BIP-360 reaches broad adoption around 2034 and full post-quantum signatures need another 7+ years after that, Bitcoin might not be fully quantum-resistant until the early 2040s. Whether Q-Day arrives before or after that date is the central uncertainty.

This is why Heilman emphasizes: "The bigger the perceived danger, the faster this will happen." A credible quantum threat would compress timelines dramatically. But waiting for the threat to materialize before acting is the worst possible strategy for a network that takes a decade to deploy changes.

What You Can Do Today

There is no immediate quantum threat to Bitcoin. No panic required. But there are practical steps you can take today to position your coins for the best possible protection — both now and when quantum-resistant upgrades arrive.

1. Never Reuse a Bitcoin Address

Every time you spend from an address, the public key is revealed on-chain forever. Reusing that address means any future incoming funds sit behind a known public key — a sitting target for a future quantum attacker. Most modern wallets generate new addresses automatically. Make sure yours does.

2. Use P2WPKH Addresses for Long-Term Storage

Native SegWit addresses starting with bc1q provide the best quantum protection available today. Your public key is hidden behind a double hash (SHA-256 + RIPEMD-160) and is only exposed when you spend. For cold storage holding coins you don't plan to move for years, bc1q is the safest current option.

3. Avoid Taproot for Long-Term Cold Storage

Taproot addresses (bc1p) expose a tweaked version of your public key on the blockchain. While this requires a more sophisticated quantum attack than raw P2PK, it is still more vulnerable than hash-protected addresses. For coins you plan to hold for the long term, bc1q is safer than bc1p.

4. Keep Your Wallet Software Updated

When BIP-360 activates and wallets begin supporting P2MR (bc1z) addresses, you will want to migrate your funds as early as possible. Staying on current wallet versions ensures you won't miss the update. Follow your wallet provider's release notes.

5. Spend Full UTXOs When Possible

When you send a transaction, if change is returned to the same address, that address now has an exposed public key with funds still sitting in it. Spending the full UTXO (or using a new change address, which most wallets do by default) eliminates this risk.

Quick Reference

Source: Bitcoin best practices, BIP-360 recommendations