Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Bitcoin address types differ sharply in quantum-computing risk. P2PK and Taproot (P2TR) are the most exposed because their public keys are visible on-chain as soon as the output is created. Hash-based formats—P2PKH, P2WPKH, P2SH and P2WSH—normally hide the key until spending, although address reuse, mempool broadcasts or off-chain disclosure can remove that protection. P2MR is a proposed format intended to reduce Taproot’s long-exposure problem, not a complete, activated solution.
The issue is public-key visibility, not how old an address is or which prefix it starts with. A sufficiently capable quantum computer could use Shor’s algorithm to recover private keys from exposed elliptic-curve public keys. BIP 360 says when—or whether—cryptographically relevant quantum computers will become practical remains uncertain.
As an Amazon Associate I earn from qualifying purchases.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11At a glance
| Name | Best for | Key spec | Checked |
|---|---|---|---|
| P2PK | Legacy outputs already using a public key | Public key appears in the output; long-exposure risk from creation | November 2026 |
| P2TR (Taproot) | Modern script-tree and key-path spending | bc1p; output commits to a public key visible at receipt |
November 2026 |
| P2MS (bare multisig) | Legacy multisig scripts | Public keys are written directly into the script | November 2026 |
| P2PKH | Legacy hash-based payments | 1; key is normally revealed only when spent |
November 2026 |
| P2WPKH | SegWit single-key payments | bc1q; witness reveals the key on spend |
November 2026 |
| P2SH | Script-hash compatibility | 3; redeem script and any keys appear when spent |
November 2026 |
| P2WSH | SegWit script-hash spending | bc1q; witness script is revealed on spend |
November 2026 |
| P2MR (proposed) | Future long-exposure mitigation | Proposed bc1z; removes Taproot’s key path but not short-exposure attacks |
November 2026 |
The ranking describes exposure conditions, not a prediction that any particular wallet or coin will be stolen. A format that hides a key at output creation can still become exposed through reuse or another disclosure channel.
Why are some Bitcoin address types more vulnerable to quantum computing?
The decisive question is whether an attacker can obtain a Bitcoin public key long before the associated output is spent. Bitcoin’s signatures use elliptic-curve cryptography. A future cryptographically relevant quantum computer could apply Shor’s algorithm to derive a private key from a known public key, allowing an attacker to create a valid spend.
Popular on Amazon
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
There are two materially different attack windows:
- Long exposure: the public key is recorded in the blockchain while coins remain unspent. An attacker can collect keys now and attempt recovery later, with as much time as the key remains exposed.
- Short exposure: a normal spend broadcasts the public key before confirmation. An attacker must recover the key and get a conflicting transaction accepted during the mempool interval, which requires a much faster quantum computer.
Google Quantum AI’s analysis also identifies off-chain disclosure. A service, a reused key on another blockchain, or any public sharing can expose a key even when the Bitcoin output itself contains only a hash.
Which Bitcoin address types have the greatest long-exposure risk?
P2PK, P2TR and bare P2MS are the clearest high-exposure cases because public keys are present in the output script or output commitment from the start.
P2PK: public key visible at creation
Pay-to-public-key (P2PK) outputs place the full public key directly in the locking script. No hash hides it while the output waits to be spent, so the funds face the long-exposure window immediately. P2PK is a legacy construction and does not have a standard modern address prefix; an explorer or raw transaction is more reliable than an address-prefix guess.
P2TR: Taproot’s output key is exposed on receipt
Taproot addresses normally begin with bc1p. Under BIP 341, a version-1 witness program commits to a Taproot output key. That key supports the key-path spend and is visible in the output, so an unspent P2TR output has long-exposure risk from the moment it is received.
Taproot’s script-path option does not erase this issue: the output still commits to the public output key. Spending by script path changes which witness data is revealed, but it does not make an already visible output key private.
P2MS: bare multisig keys are written into the script
Bare pay-to-multisig (P2MS) scripts list their participating public keys directly. That means a quantum attacker can see those keys while the output remains unspent. Multisignature improves authorization policy, but it does not hide the keys in a bare P2MS output; quantum exposure and theft resistance are separate properties.
Free tools Windows power users keep installed
One-click scans. No signup required.
Also popular on Amazon
Do hashed address types protect coins from quantum attacks?
Usually, but only conditionally. P2PKH, P2WPKH, P2SH and P2WSH commit to a hash, so the public key or spending script is normally revealed only when the output is spent. This delays the long-exposure window, but it does not make the key quantum-proof.
P2PKH
Pay-to-public-key-hash addresses commonly start with 1. The output contains a hash of the public key. When you spend, the unlocking data supplies the public key and signature, making the key visible from that transaction onward. If the same key or address has a remaining balance, that remainder may become vulnerable to a long-exposure attack.
P2WPKH
Pay-to-witness-public-key-hash is a SegWit form commonly displayed with a bc1q address. BIP 141 specifies that the witness supplies the public key and signature when spending. A fresh, never-spent P2WPKH output therefore keeps its key hidden until that spend; reusing the address after spending defeats the practical benefit for any coins left there.
P2SH
Pay-to-script-hash addresses commonly begin with 3. The output commits only to a hash of a redeem script. On spending, the redeem script is provided, and any public keys embedded in it become visible. Quantum exposure depends on that revealed script and on whether the same script-hash address is reused.
P2WSH
Pay-to-witness-script-hash also commonly uses the bc1q prefix, despite being different from P2WPKH. Its witness reveals the witness script when spent. A script can contain one or more public keys, so the key exposure and quantum risk depend on the script design and reuse pattern.
Because P2WPKH and P2WSH share the same human-readable prefix, bc1q alone cannot tell you which script type you are looking at. Transaction data and wallet metadata are needed for a dependable classification.
Also popular on Amazon
Are Taproot addresses vulnerable to quantum computing?
Yes. Taproot (P2TR) outputs are vulnerable to the long-exposure form of a future quantum key-recovery attack because their output public key is visible when the coins are received. The risk is not evidence that a Bitcoin-breaking quantum computer exists today; it is a consequence of how the output is constructed.
Taproot can still provide important non-quantum benefits, including flexible spending policies and script privacy, but those benefits should not be described as protection against recovery of an exposed elliptic-curve key. The distinction matters when deciding whether a wallet’s default address type is appropriate for long-term storage.
How do address reuse and spending change the risk?
Address reuse converts a conditional, short-lived shield into a durable exposure problem. Once a hash-based output is spent, its public key or script is on-chain. Any additional coins sent to the same address or key can then be targeted without waiting for another spend.
- Receive to a fresh hash-based output. Before spending, the public key is normally hidden behind a hash.
- Spend only the intended output. The transaction reveals the key or script needed to authorize the spend.
- Move change to a new output. Do not send change back to the already revealed address.
- Avoid consolidating exposed and unexposed coins unnecessarily. A transaction can reveal relationships and keys that were previously kept separate.
These are exposure-reduction practices, not a guarantee against a future quantum attack. Off-chain publication of a public key, use of the same key on another chain, or a service receiving the key can have the same effect as an on-chain spend.
What is the difference between long-exposure and short-exposure attacks?
Long-exposure attacks target keys that have been visible for months or years; short-exposure attacks target a key revealed in a transaction that is waiting for confirmation. The first gives an attacker time to acquire quantum capability, while the second demands rapid key recovery and transaction propagation.
| Exposure window | When the key appears | Attacker’s timing problem | Most relevant outputs |
|---|---|---|---|
| Long exposure | At output creation, or after a prior spend/reuse | Can collect the public key and attack later | P2PK, P2TR, P2MS; reused hash-based outputs |
| Short exposure | When a spend is broadcast but before confirmation | Must recover the key and get a conflicting spend confirmed quickly | Most ordinary signature-based spends |
| Off-chain exposure | Outside the Bitcoin output, such as another chain or a service | Timing depends on where and when the key was published | Any format whose key is disclosed elsewhere |
BIP 360 characterizes long exposure as the likely earlier quantum threat because an attacker has the entire period during which the key is public. It also notes that a format designed only for long exposure does not automatically solve the mempool problem.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Also popular on Amazon
What is P2MR, and does it make Bitcoin quantum-safe?
Pay-to-Merkle-Root (P2MR) is a proposal in BIP 360, not a generally activated mainnet address type. It commits to a script-tree root without Taproot’s internal key and key-path spend, with the goal of reducing long-exposure risk. The proposal describes a possible bc1z representation.
P2MR is not a complete quantum solution. A spend still needs an authorization mechanism, and a public key broadcast in the mempool can remain exposed to a short-exposure attack. BIP 360 says post-quantum signature schemes may be required for that window. Its authors summarize the status carefully: “While it is unclear when or if CRQCs will become viable in the future, we propose the addition of a quantum-resistant, script tree output type for those interested in this level of protection.”
Because P2MR is a proposal, users should not assume that a wallet can send to it, that miners enforce it, or that an address beginning with a proposed prefix is spendable on today’s network. Activation and implementation status must be verified separately before treating it as a practical option.
Can an address prefix tell me whether my coins are quantum-exposed?
A prefix is a useful first clue, not a complete risk audit. In broad terms, bc1p indicates P2TR, 1 indicates P2PKH, 3 indicates P2SH, and bc1q can indicate either P2WPKH or P2WSH. P2PK and bare P2MS have no standard address prefix.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →To assess a real output, inspect its script type, whether the output key is already visible, the spending history, address reuse, and any off-chain publication. Two addresses with similar-looking prefixes can have materially different exposure, and an old address is not automatically more vulnerable than a new one.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should Bitcoin holders do about quantum exposure now?
There is no sourced basis for claiming that quantum computers are currently recovering Bitcoin keys. The 2026 PRX Quantum research discusses resource estimates and mitigations; it does not demonstrate a currently available machine that can break Bitcoin.
Also popular on Amazon
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
Practical risk reduction is therefore about key-hygiene and migration readiness:
- Prefer fresh, non-reused hash-based outputs when your wallet supports them and long-term quantum exposure is a concern.
- Avoid leaving large balances in P2PK or P2TR outputs for unnecessarily long periods if a compatible alternative is available.
- Never reuse a spent P2PKH, P2WPKH, P2SH or P2WSH address for change or new deposits.
- Track which outputs have had their public keys revealed, including through multisignature scripts and external services.
- Keep wallet software and recovery procedures current so you can migrate if Bitcoin adopts post-quantum signature or output changes.
- Do not treat a hardware wallet as a cure for an already exposed public key. It can protect private-key handling, but the cited protocol sources do not show that it changes the mathematics of quantum key recovery.
These steps reduce present-day operational mistakes and preserve options for a future protocol transition; they do not predict when a cryptographically relevant quantum computer will exist.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →How should you rank the address types?
For long-exposure risk alone, the practical order is:
- P2PK and P2TR: public keys are visible at output creation.
- Bare P2MS: participating public keys are also visible directly in the script.
- Reused or previously spent P2PKH, P2WPKH, P2SH and P2WSH: their keys or scripts have become visible, so remaining funds lose the hash-based delay.
- Fresh, never-spent P2PKH, P2WPKH, P2SH and P2WSH: keys are normally hidden until spending, offering conditional protection against long exposure.
- P2MR (proposed): designed to improve long-exposure resistance, but not activated universally and not sufficient for short-exposure attacks by itself.
This is not a permanent “safe versus unsafe” list. A fresh hash-based output can become exposed in one transaction, while a future post-quantum output type could change the ranking. The durable rule is to minimize how long a classical public key remains available and avoid reuse.
How we classified the exposure
The comparison uses four criteria from the protocol specifications and cited analyses: whether the public key is visible when the output is created; what spending reveals; whether reuse leaves other funds exposed; and whether the design addresses long exposure, short exposure, or neither. Prefixes are included only as identification clues, not as a substitute for reading the output script.
Frequently Asked Questions
Can a quantum computer steal Bitcoin from an address that has never been spent?
It depends on the output type. A never-spent P2PK or P2TR output already exposes a public key, while a never-spent hash-based output normally does not; a future attacker would first need the capability to recover a key from whatever has been disclosed.
Does moving Bitcoin to a new address hide a public key forever?
No. It hides the key only until that output is spent or the key is disclosed elsewhere. After spending, send change to a fresh output rather than returning it to the revealed address.
Are multisignature Bitcoin wallets immune to quantum attacks?
Multisignature changes how many signatures are required, not the underlying public-key mathematics. Bare multisig exposes keys in the output, while hashed multisig delays disclosure until the redeem or witness script is revealed.
When will Bitcoin need post-quantum signatures?
No reliable date is established. The cited standards describe quantum computing as a future conditional risk, and any migration timeline would depend on advances in quantum hardware, Bitcoin governance and deployment of compatible signature schemes.
