No—not automatically, and not with today’s machines. The serious risk is that a sufficiently powerful, fault-tolerant quantum computer could recover private keys from exposed Bitcoin public keys, forge spending signatures and steal funds. Bitcoin could survive if developers, businesses and users migrate to post-quantum signatures before that capability exists. If they do not, the result could be theft, market panic and the most contentious protocol decision in Bitcoin’s history.
What “kill Bitcoin” could mean
Quantum computing would not erase the blockchain or invalidate every coin at once. “Kill” could describe several different outcomes:
- theft from outputs whose public keys are exposed;
- forced redistribution of dormant or abandoned coins;
- a temporary collapse in confidence and market value;
- a consensus split over emergency rules;
- a successful attack on transaction authorization; or
- a broader loss of monetary credibility.
The key distinction is between cryptographic failure (signatures can be forged), economic damage (coins are stolen or prices fall), and governance failure (the network cannot agree how to respond).
The two-minute technical explanation
Why signatures are the main target
Bitcoin spending is authorized with digital signatures. Traditional outputs use ECDSA over secp256k1; Taproot uses Schnorr signatures over the same elliptic-curve foundation. A private key creates a signature, while a public key lets the network verify it.
Recommended Free Tools
#1 Best Overall
- BITCOIN EXCLUSIVE, PHONE VERIFICATION: Bitkey is designed from the ground up exclusively for bitcoin — a dedicated hardware wallet for secure bitcoin storage. Approve transactions with a tap using your phone and NFC. No device screen is required.
- SELF-CUSTODY, NO EXCHANGE OR CUSTODIAN REQUIRED: You hold two of the three keys in the Bitkey system – one on your phone and one on your Bitkey device. The third is stored on Bitkey’s server and cannot move your bitcoin on its own.
- NO SEED PHRASE: Set up and use Bitkey without creating or storing a seed phrase.
- 2-of-3 MULTISIG: Three keys are stored separately across your phone, Bitkey device, and Bitkey’s server. Any two keys are required to move your bitcoin.
- BUILT-IN RECOVERY: Encrypted backup and recovery tools can help you regain access if you lose your phone or Bitkey device. You can also designate a Recovery Contact.
Shor’s algorithm, running on a sufficiently capable fault-tolerant quantum computer, could solve the mathematical problem behind elliptic-curve public keys and derive private keys. NIST identifies elliptic-curve cryptography as vulnerable to future cryptanalytically relevant quantum computers (NIST migration guidance; NIST overview).
Why hashes and mining are different
Bitcoin also uses SHA-256 for proof of work, addresses and other commitments. Grover’s algorithm offers a quadratic speedup against some brute-force searches, but that is not the same as Shor’s direct key-recovery attack. Error correction, circuit depth, machine throughput, parallelization and Bitcoin’s difficulty adjustment all limit any mining advantage. Research does not justify saying that a quantum machine would instantly mine all bitcoin or automatically produce a 51% attack (Quantum Horizon analysis; mining analysis).
Which bitcoins are most exposed?
A quantum attacker needs a public key. Many Bitcoin address types initially hide that key behind a hash, while others expose it directly. Exposure therefore depends on the script, spending history and whether funds remain at the output.
| Output or behavior | Quantum relevance |
|---|---|
| P2PK, including many early outputs | Public keys are exposed on-chain for long periods, creating long-exposure risk. |
| Reused addresses | After one spend reveals a public key, remaining funds associated with that key can remain exposed. |
| Taproot P2TR | The key-path public key is part of the output, creating a different exposure profile from hashed-key addresses. |
| Unspent hashed-key outputs | The public key is generally hidden until spending, reducing long-exposure time but not eliminating attack risk. |
| Published wallet extended public keys | They can reveal address and public-key information useful to an attacker, depending on wallet design. |
| Lost or dormant exposed coins | Could become targets for whoever derives the key first, creating a monetary-policy dilemma. |
BIP 360 distinguishes long-exposure attacks, where a public key is available for an extended period, from short-exposure attacks, where the attacker must recover a key while a spending transaction waits for confirmation. Its proposed Pay-to-Merkle-Root output removes Taproot’s quantum-vulnerable key path and is aimed mainly at long-exposure risk; it does not by itself solve short-exposure attacks (BIP 360).
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #2
- Unparalleled Security: Protect your assets NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Rest assured with Multi-share Backup, eliminating single points of failure for secure cold wallet recovery
BIP 361 reports that, as of March 1, 2026, more than 34% of all bitcoin had revealed a public key. That is a proposal-specific measurement, not a count of coins that are immediately stealable: a capable quantum computer, suitable spending conditions and an attacker’s ability to act are still required (BIP 361).
How close is the threat?
No current quantum computer can break Bitcoin’s secp256k1 signatures. The missing capability is not merely more ordinary qubits; it is a large, error-corrected machine that can run the required circuits reliably.
A March 2026 Google Quantum AI paper describes secp256k1 attack circuits using fewer than roughly 1,200–1,450 logical qubits and tens of millions of Toffoli gates under its stated assumptions (technical paper). Those are resource estimates, not a demonstrated machine, a physical-qubit count or a date forecast.
Google’s recommendation to begin migration planning, and discussion of a 2029 preparation timeline for vulnerable public-key cryptography, should not be read as a prediction that Bitcoin will be broken in 2029 (Google announcement). IBM likewise frames cryptographic migration as work that must precede cryptographic relevance, not as proof of a fixed “Q-Day” (IBM perspective).
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #3
- Secure element (EAL6+ certified) and passphrase protection for bullet-proof physical security
- Two-button pad device interface, designed for user-friendly operation
- Bright OLED display for easy & secure hands-on verification
- PIN & passphrase enabled for on-device protection
- Fully open-source design for transparent security
The responsible conclusion is that the date is unknowable, while the deadline for migration must come earlier. Protocol deployment, wallet updates, exchange integration, hardware support and user transfers all take time. A quantum attacker could also recover a key covertly and wait before broadcasting theft, so reacting after the first public attack may be too late.
Can Bitcoin upgrade?
In principle, yes. The difficult part is not finding a post-quantum algorithm; it is deploying one without breaking Bitcoin’s economics, usability or social consensus.
What standards exist
NIST finalized its first major post-quantum standards in August 2024:
- FIPS 203: ML-KEM, a key-encapsulation mechanism;
- FIPS 204: ML-DSA, a lattice-based signature standard; and
- FIPS 205: SLH-DSA, a stateless hash-based signature standard.
These standards are not plug-in Bitcoin upgrades. Bitcoin needs an appropriate signature scheme and output format, along with rules for transaction weight, verification cost, wallet recovery and long-term algorithm confidence (NIST standards project).
Rank #4
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
BIP 360: Pay-to-Merkle-Root
BIP 360 proposes a new output type that commits to scripts through a Merkle root and removes Taproot’s key path. It is an intermediate mitigation for long-exposure attacks. A public key is still revealed when spending, so a sufficiently fast quantum computer could attempt a short-exposure attack. BIP 360 is a Draft, not an activated Bitcoin consensus rule.
BIP 361: migration and legacy-signature sunset
BIP 361 proposes introducing a post-quantum output type, then progressively restricting payments to legacy quantum-vulnerable outputs and adding later limits or a rescue mechanism for old ECDSA and Schnorr spending. It describes a multiyear phase-in after activation. It is also a Draft; neither proposal is deployed on Bitcoin mainnet (BIP 361; BIP repository).
The cost of larger signatures
Post-quantum signatures generally require larger keys, signatures or verification workloads than elliptic-curve signatures. A migration could mean larger transactions, higher fees, more storage and bandwidth, slower validation, more demanding signing devices and pressure to revisit blockspace economics. Replacing ECDSA with ML-DSA is therefore not a one-line software patch.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.The lost-coins problem
If an attacker can derive keys for exposed outputs, coins whose owners lost their wallets may become spendable by whoever reaches them first. A migration could:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Best Value
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
- leave those outputs available to the first quantum attacker;
- freeze or invalidate vulnerable outputs;
- allow a time-limited rescue transfer;
- create a protocol-defined recovery mechanism; or
- treat dormant coins differently from actively controlled funds.
Every option has a legitimacy cost. Freezing coins may stop theft but also prevent a genuine owner of an old wallet from recovering funds. Allowing a rescue may invite fraudulent claims. This is a monetary-policy and governance decision, not only a cryptography decision, and BIP 361 explicitly identifies it as unresolved.
Are current wallets safe?
A hardware wallet can protect a private key from malware and physical extraction while still using ECDSA or Schnorr, which remain mathematically vulnerable to Shor’s algorithm. “Hardware wallet” is therefore not synonymous with “quantum safe.”
Assess a wallet by whether it:
- generates fresh receiving addresses;
- has avoided address reuse;
- handles Taproot exposure transparently;
- limits unnecessary extended-public-key disclosure;
- can be upgraded to a future Bitcoin output type; and
- provides secure backups and a tested recovery process.
No Bitcoin mainnet-wide post-quantum signature standard is deployed today. Do not move funds into an unreviewed wallet or token simply because it advertises “quantum-safe” technology.
Quick Recap
What holders should do now
- Stop reusing addresses. Fresh outputs reduce unnecessary public-key exposure.
- Review old P2PK and reused outputs. Where you control the keys, plan a transfer using trusted, current wallet software.
- Keep wallet and hardware firmware updated. Upgradeability will matter as consensus rules evolve.
- Do not publish extended public keys unnecessarily. Treat descriptors and xpubs as sensitive financial metadata.
- Maintain secure backups before moving funds. Verify addresses and recovery procedures on a small test transfer.
- Follow official migration guidance. Watch Bitcoin Core, BIP, wallet, exchange and custody announcements for an activated plan.
- Ignore panic deadlines and miracle products. A transfer today is not permanently quantum-safe if a future transaction again exposes a vulnerable public key.
What developers and businesses must solve
- select and standardize post-quantum signatures suitable for Bitcoin;
- define addresses, scripts and fee treatment for larger signatures;
- upgrade hardware wallets, exchanges, custodians, payment processors and mining pools;
- build migration tooling that prevents address and backup mistakes;
- decide how to handle already exposed keys and abandoned coins;
- provide enough transition time for global adoption; and
- test interoperability, recovery and chain-split contingencies.
Risk matrix
| Scenario | Likely result |
|---|---|
| No cryptographically relevant quantum computer for decades | Bitcoin has time for a planned migration. |
| Quantum progress accelerates while migration begins early | Significant engineering and cost, but a survivable transition. |
| A capable machine appears while exposed coins remain unmigrated | Theft, market panic and emergency governance decisions. |
| An attacker targets old or dormant exposed outputs | Redistribution of coins and a legitimacy crisis. |
| The community cannot agree on migration rules | Potential chain split, censorship disputes or loss of confidence. |
| Robust post-quantum signatures are adopted in time | Quantum computing need not destroy Bitcoin. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
