Quantum Apocalypse for Bitcoin: A Real Threat or a Distant Scenario?
The question of whether a quantum computer will become the "gravedigger" of bitcoin has long moved beyond theoretical discussions in the crypto community. At the heart of these concerns lies Shor's algorithm, which radically changes the very mathematical nature of the task of recovering a private key from a public one. If classical computing makes this operation practically impossible, quantum computing moves it into the realm of solvable within minutes, provided the appropriate hardware is available.
The Real Mathematics of the Threat
The essence of the problem is not in speeding up brute force, but in changing the complexity class. Network security is based on the irreversibility of the operation P = k ⋅ G on the secp256k1 curve, where the best classical algorithms require about 2¹²⁸ operations. Shor's algorithm solves the discrete logarithm problem in polynomial time, making it theoretically capable of compromising both ECDSA and Schnorr signatures.
However, between theory and practice lies a chasm measured in qubits. Modern processors have about 1100–1200 physical qubits without error correction. For a real attack, estimates range from 500,000 to 13 million physical qubits. Notably, a Google Quantum AI study published in March 2026 significantly lowered this bar: it speaks of fewer than 500,000 physical qubits (approximately 1,200 logical) and 70 million computational steps. Under such conditions, a private key can be recovered in less than 9 minutes—faster than a block is mined.
Who Is in the Strike Zone
The key vulnerability factor is not the size of the balance, but the digital hygiene of the owner. Addresses with already exposed public keys are at the greatest risk: these include P2PK outputs from the Satoshi era, the Taproot architecture, and wallets compromised by address reuse. According to Glassnode estimates, keys for 6.04 million BTC (30.2% of the total supply) have been exposed in the blockchain, of which 1.92 million BTC are structurally vulnerable P2PK, and 4.12 million BTC are operationally vulnerable due to reuse.
In contrast, P2PKH, P2SH, and SegWit outputs remain protected until the first outgoing transaction, as they are hidden behind a cryptographic hash. This creates a paradoxical situation: the "dormant" wallets from bitcoin's early years become the first target, and no one will help their owners anymore.
The HNDL Strategy: A Threat Without Haste
The main practical risk is not in tomorrow's attack, but in the "harvest now, decrypt later" (HNDL) strategy. Attackers do not need to wait for the emergence of a cryptographically relevant quantum computer (CRQC). It is enough to save all exposed public keys right now and decrypt them later, once the technology matures. This is also confirmed by a study from the U.S. Federal Reserve, which cites bitcoin as an example of the limitations of post-quantum migration: new algorithms will protect future transactions but will not hide already published data.
Timing: Technology vs. Narrative
Here it is important to distinguish between two horizons. The technological one is 10–20 years, even if IBM implements its plans to create a fault-tolerant IBM Quantum Starling by 2029, and IonQ—a device with 2 million qubits by 2030. However, the narrative horizon could trigger much earlier: it takes just one high-profile publication about reduced qubit requirements for the market to price in risks long before a real threat. A survey of 26 experts from the Institute for Global Risks shows the probability of a CRQC emerging within 10 years at 28–49%, and within 15 years at 51–70%.
My expert conclusion: it is too early to panic, but an audit is mandatory. For holders, this is a reason to check output types and abandon address reuse. For investors, it is worth remembering that the market may react to headlines sooner than to actual quantum capabilities. Bitcoin faces a complex consensus process of post-quantum migration, and it will proceed more slowly than the updating of commercial vendors' roadmaps.