Quantum computer vs bitcoin: a real threat or a delayed scenario?
The debate over whether quantum computing will spell the end for bitcoin has been raging in the industry for years. At the heart of these concerns lies Shor's algorithm—a mathematical method that radically changes the complexity of recovering a private key from a public one, transforming it from practically unsolvable to theoretically solvable in minutes given the right hardware.
In this analytical review, I will break down the mechanics of the threat, assess the realistic timeline for its materialization, and identify which specific categories of users are at risk.
Key takeaway: the threat is theoretical, but not hypothetical
Shor's algorithm is indeed capable of solving the discrete logarithm problem on the secp256k1 elliptic curve in polynomial time. This puts the cryptographic foundation of ECDSA and Schnorr signatures at risk. However, the current state of the quantum industry is far from the necessary threshold: the most powerful processors boast only about 1100–1200 physical qubits without full error correction, whereas attacking bitcoin would require millions.
The network's security rests on the impossibility of computing the private key k from the public point P = k ⋅ G. Classical algorithms require on the order of 2¹²⁸ operations—beyond the reach of any existing system. Shor's algorithm does not speed up brute force; it changes the very complexity class of the problem, which is fundamentally more significant.
Assessing the "cost" of an attack: from conservative to optimistic forecasts
Estimates of the required resources vary by orders of magnitude. According to conservative calculations, breaking the encryption would require about 2330 stable logical qubits, which, accounting for error correction, equates to 1–13 million physical qubits. Researchers at the University of Sussex estimate that ~13 million physical qubits would be needed to break it within a day. For comparison, in 2022, physicists calculated that compromising RSA-2048 within an hour would require about 317 million qubits.
However, a Google Quantum AI study published in March 2026 significantly revised these figures downward. According to their data, fewer than 500,000 physical qubits (~1200 logical) and about 70 million computational steps would suffice. In this scenario, a private key could be recovered in at most 9 minutes—faster than a new block is mined. This is a twenty-fold improvement over 2019 estimates, which cited 20 million qubits.
By 2029, IBM plans to build the fault-tolerant IBM Quantum Starling supercomputer with 200 logical qubits. IonQ is officially targeting a device with 2 million physical qubits by 2030. If these plans come to fruition, we could see a machine capable of a real attack in the second half of the 2030s.
That said, Blockstream CEO Adam Back is far more skeptical, estimating a 20–40 year horizon for such systems. A survey of 26 experts from the Institute for Global Risk puts the probability of a cryptographically significant quantum computer emerging at 28–49% within ten years and 51–70% within fifteen.
Who is at risk: not balance size, but digital hygiene
Asset vulnerability is determined not by the amount, but by the exposure of the public key. The high-risk group includes P2PK addresses from the Satoshi era, Taproot architecture, and wallets compromised by address reuse. In contrast, P2PKH, P2SH, and SegWit outputs remain protected until the first outgoing transaction, as they are hidden behind a cryptographic hash.
According to Glassnode estimates, keys for 6.04 million BTC (30.2% of the total supply, or ~$469 billion) have been exposed on the blockchain. Of these, structural vulnerability (P2PK) affects 1.92 million BTC, while operational vulnerability (address reuse) affects 4.12 million BTC.
This gives rise to the main practical risk—the "harvest now, decrypt later" (HNDL) strategy. An attacker does not need a quantum computer today. It is enough to store all exposed public keys and wait for the emergence of a CRQC. A study by the U.S. Federal Reserve explicitly cites bitcoin as an example of the limitations of post-quantum migration: new algorithms will protect future transactions but will not conceal already published data or automatically transfer funds from old outputs.
Practical takeaways for holders and investors
For holders, this is a reason not for panic, but for an audit. It is necessary to check whether funds are held in P2PK outputs or reused addresses. Keys under one's control can be transferred, but "dormant" wallets from the early years have no one to migrate them—these will be the first targets.
For investors, another aspect matters: the market may react before the technology does. A single high-profile publication about reduced qubit requirements could cause prices to price in risks long before a real attack. Two horizons are at play here: the technological one (ten years or more) and the narrative one (any upcoming quarter). Regulators—the NSA and NCSC—are already preparing the transition to post-quantum cryptography. Bitcoin, however, will have to coordinate migration through consensus, and that process is always slower than the roadmap updates of commercial vendors.
Q-check: brief summary
Is the threat real?
For now, in data collection mode (HNDL).
Is the hardware there?
No: about 1500 noisy qubits versus the required hundreds of thousands.
Who is at risk?
Approximately 6 million BTC with exposed public keys, of which 1.92 million are P2PK.
What can be done now?
Check output types, avoid address reuse, and monitor work on post-quantum migration.
My comment as an analyst: The quantum threat is not a question of "if," but of "when." However, the real risk to the market today comes not from the quantum machines themselves, but from information panic. Investors should prepare for volatility on news of breakthroughs in this area, and holders should audit their digital hygiene right now, without waiting for the first attacks.