When quantum computers finally break modern encryption — and experts now say that day may arrive as early as 2029 — the first victim will likely be Bitcoin. Not because its cryptography is uniquely flawed. Because getting tens of millions of pseudonymous participants to agree on anything fast enough to matter is a problem that no amount of code can fix.
That framing comes from Eddy Zervigon, CEO of quantum security firm Quantum Xchange, who delivered a pointed assessment to CoinDesk on Monday. “Cryptocurrencies are the canary in the coal mine,” Zervigon said. “That’s the first place of attack because of the decentralized nature.” He added: once you see it happening there, “you know that someone somewhere has a cryptographically relevant quantum computer” — making Bitcoin not just a target, but a global early-warning system for every bank, government agency, and enterprise network that runs on the same underlying cryptography.
The stakes are visible in the on-chain data. As of March 1, 2026, over 34% of all Bitcoin in circulation had revealed a public key permanently on-chain — a figure documented in the BIP-361 proposal — leaving holdings that, by current market valuations, amount to more than $700 billion susceptible to a quantum attack the moment a sufficiently powerful machine exists.
Shor’s Algorithm Is the Threat — and It Targets Signatures, Not Mining
To understand why Bitcoin is exposed, it helps to understand exactly what quantum computers threaten. The answer is not Bitcoin mining — the SHA-256 hash functions that secure the mining process face only a modest, manageable risk from Grover’s algorithm, which provides a quadratic speedup at most. What is vulnerable is the transaction signing process.
Every time a Bitcoin holder sends funds, the network requires a digital signature proving ownership. That signature is produced using the Elliptic Curve Digital Signature Algorithm, or ECDSA, operating on a mathematical structure called secp256k1. Proving you own Bitcoin without revealing your private key depends on the hardness of the Elliptic Curve Discrete Logarithm Problem, or ECDLP — a mathematical relationship that classical computers would need an estimated 2^128 operations to break. Peter Shor’s 1997 quantum algorithm solves ECDLP in polynomial time, theoretically reducing that impossibly large computation to something a sufficiently powerful quantum machine could run in minutes.
The critical word until now was “sufficiently powerful.” In March 2026, the definition of that phrase changed.
A landmark white paper from Google Quantum AI, co-authored with researchers from the Ethereum Foundation and Stanford University, found that breaking Bitcoin’s ECDSA signatures would require fewer than 500,000 physical qubits on a superconducting quantum architecture — a roughly 20-fold reduction from the prior best estimate of approximately 9 million qubits. More precisely, the team designed two optimized circuits for ECDLP-256: one requiring approximately 1,200 logical qubits and 90 million Toffoli gates, the other approximately 1,450 logical qubits and 70 million Toffoli gates. Under standard error-correction assumptions for Google’s superconducting processors, both circuits fit inside the 500,000 physical qubit bound and complete in minutes — fast enough that an attacker could, in theory, intercept a pending Bitcoin transaction, compute the private key, and submit a fraudulent transaction before the original clears the network.
Google did not publish the actual attack circuits. Instead, the team used a zero-knowledge proof to validate that the circuits perform as claimed on 9,000 random test inputs without revealing the circuits themselves — a responsible disclosure approach that confirms the result without handing attackers a blueprint.
The gap between that threshold and current hardware remains enormous. The best quantum processors in operation today run at roughly 1,000 to 2,000 physical qubits, without meaningful fault tolerance. Microsoft and Quantinuum’s error-correction breakthrough, independently peer-reviewed in Nature in June 2026, confirmed an 800-fold reduction in logical error rates on trapped-ion hardware — a milestone that still leaves those systems well under 100 high-quality logical qubits, compared with the approximately 1,200 the Google paper requires. IBM’s published roadmap targets roughly 200 logical qubits by 2029. Quantinuum is aiming for hundreds by the end of the decade. Neither meets the threshold.
But “not yet feasible” is no longer the same as “far away.” Zervigon cited statements from executives at IBM, Microsoft, and other firms investing billions in quantum hardware, including IBM’s Arvind Krishna, to ground his assessment: “generally believe there will be a commercially relevant, cryptographically relevant quantum computer in the 2029 timeframe.” Justin Drake of the Ethereum Foundation, a co-author of the Google paper, put his personal estimate at a 10% probability of a quantum computer recovering a Bitcoin private key by 2032 — a probability he said “shot up significantly” after the paper was published, as reported by TechTimes in July.
Q-Day Is Not a Switch — It Is a Gradient
A common framing in market commentary treats the quantum threat as a binary event: either encryption holds, or it doesn’t, and the difference is a single date. Experts reject that model entirely, and for specific mathematical reasons.
“Everybody talks about the moment you can break an algorithm,” Zervigon said. “You don’t necessarily need to do it in one moment to be effective. If it takes me three months or six months to decrypt data that still has value, I’ve achieved the same goal.”
This collapses the conventional risk timeline. An attacker with a partial quantum capability — one that can break a signature over the course of weeks rather than minutes — still poses a credible threat to any exposed Bitcoin wallet, because those wallets are permanent. The public keys etched into the blockchain in 2010, 2015, or 2020 will still be there when a viable attacker arrives. They are not time-limited.
The same logic governs “harvest now, decrypt later” attacks, where adversaries collect and store encrypted data today with the intention of decrypting it once quantum hardware matures — a threat model well documented in post-quantum cryptography literature. This practice — already suspected in the classified communications sector — is particularly concerning for Bitcoin because every exposed public key on the blockchain is, in effect, already harvested. An attacker with a future cryptographically relevant quantum computer does not need to intercept anything in real time. The data has been sitting on a public ledger for years.
Governance Is Where Bitcoin’s Exposure Diverges From Every Other System
The natural response to all of this is: if the threat is real and the timeline is compressing, why haven’t institutions prepared? The answer, for most centralized systems, is that they have.
JPMorgan does not need to convene a public debate with millions of pseudonymous stakeholders before upgrading its cryptographic infrastructure. It needs a board resolution, a budget, and a vendor. The White House announced it aims to develop a powerful quantum computer by 2028 and transition high-value federal assets and data to post-quantum cryptography by 2030, with key-establishment systems required to comply by late 2030 and digital signatures by 2031. President Trump reinforced that timeline in June with executive orders accelerating both US quantum development and the federal migration deadline. Apple completed a hybrid post-quantum migration for iMessage in 2024. Signal implemented quantum-resistant key exchange in 2023.
Bitcoin cannot do any of that. Any upgrade to Bitcoin’s consensus rules requires agreement from a supermajority of the network’s miners, node operators, developers, and economic stakeholders. Bitcoin has historically set that bar at 90% miner consensus, as documented in the arXiv paper “Downtime Required for Bitcoin Quantum-Safety”. The last time Bitcoin attempted a major protocol upgrade at that scale — the SegWit change in 2017 — the fight lasted years, involved legal threats between developer factions, and ultimately split the network into multiple competing chains, including Bitcoin Cash and Bitcoin Gold.
A post-quantum migration is considerably more disruptive than SegWit. It would require retiring the signature schemes that underpin every existing Bitcoin address and transaction, migrating hundreds of millions of UTXOs, and arriving at a clear consensus on what to do about coins that cannot migrate themselves.
Deutsche Digital Assets framed the problem precisely in a note published July 23: “Large financial institutions can and will migrate to post-quantum standards faster, more quietly, and more predictably than a decentralised public blockchain. That is not an argument against Bitcoin. It is an argument for taking its governance process seriously.”
The academic literature reinforces the point with a specific risk framework: Mosca’s theorem, named for cryptographer Michele Mosca, states that migration is urgent when X + Y > Z — where X is the number of years needed to migrate, Y is the number of years the protected data must remain secure, and Z is the estimated years until a cryptographically relevant quantum computer arrives — as outlined in post-quantum cryptography documentation. For Bitcoin, X may be five to seven or more years based on the SegWit precedent. Y is effectively permanent — on-chain data does not expire. Z is now estimated at three to six years. The theorem suggests Bitcoin’s migration window may have already closed.
BIP-360 and BIP-361: Bitcoin’s Defense in Progress
Bitcoin’s developer community has not been passive. Two significant proposals are under active debate, and one has already been formally merged.
BIP-360, published February 11, 2026 and merged into Bitcoin’s official improvement proposal repository, introduces the network’s first quantum-resistant address type. The proposal adds a new output format called Pay-to-Merkle-Root, or P2MR, which uses NIST-approved ML-DSA lattice-based signatures and — critically — never exposes the public key on-chain during a transaction. For newly created wallets using P2MR addresses, the quantum vulnerability that affects 34% of current supply would not apply.
The harder problem is what to do about the coins already exposed. BIP-361, formally titled “Post Quantum Migration and Legacy Signature Sunset” and published April 14, 2026 by developer Jameson Lopp and five co-authors, proposes an answer — and it is a deeply controversial one.
BIP-361 outlines a two-phase sunset of Bitcoin’s existing signature schemes. Phase A, taking effect approximately three years after activation, would stop the network from accepting new outputs sent to quantum-vulnerable address types. Phase B would disable legacy ECDSA and Schnorr signature verification entirely at the consensus layer, effectively rendering unspendable any Bitcoin that had not been migrated before the deadline.
That includes approximately 1.7 million BTC locked in early Pay-to-Public-Key addresses — coins from Bitcoin’s founding years that expose public keys by design, including an estimated 1.1 million BTC widely attributed to Satoshi Nakamoto and now worth roughly $70 billion at current valuations. Those coins are almost certainly permanently inaccessible — their holder is unknown, absent, or deceased. Under BIP-361’s logic, they would be frozen before a quantum attacker could claim them. Critics counter that freezing coins no one has stolen is still confiscation by protocol — a violation of Bitcoin’s foundational principle that possession of a private key equals unconditional ownership.
Lopp himself acknowledged the difficulty, writing on X and confirmed by KuCoin reporting: “I know people don’t like this proposal. I don’t like it either. But I wrote it because I dislike the alternative even more.” The market appears to be processing BIP-361 as a governance discussion rather than an emergency, with Polymarket odds on Satoshi moving funds in 2026 rising to approximately 9% — elevated but not alarming.
No major distributed ledger technology platform has completed a full post-quantum cryptography migration as of 2026.
Galaxy Digital’s $5 Million Bet on Collective Action
On July 21, 2026, Galaxy Digital announced the Bitcoin Quantum Readiness Initiative, a program committing up to $5 million in developer grants, research funding, and an advisory council of cryptography and quantum computing experts. The initiative explicitly frames quantum readiness as a collective problem — one that no single developer team or company can solve — and signals that institutional capital is beginning to treat the governance challenge as something that requires active investment, not passive monitoring.
Galaxy advisory council member Barry Sanders noted that governments and major industries are already mobilizing. The Bitcoin ecosystem, Sanders implied, cannot afford to rely on others setting the pace.
The irony that looms over all of this is structural. Bitcoin’s defining architectural achievement — its resistance to any centralized authority, its requirement that changes earn near-universal consensus — is precisely what makes it the most likely first casualty of a cryptographic threat that requires only one actor to move without announcement. A quantum attacker does not need a board resolution. They do not need to notify a regulator. They simply wait for a transaction that exposes a public key, then move.
How to Know If Your Bitcoin Is Exposed
Not all Bitcoin is equally at risk. Whether a given wallet is vulnerable depends on the address format and transaction history.
Pay-to-Public-Key addresses — recognizable by their 65-byte or 33-byte compressed format — expose the full public key by design, even without any outgoing transactions. These include most coins mined in Bitcoin’s first two years and are the most immediately vulnerable category.
Pay-to-Public-Key-Hash and SegWit addresses keep the public key hidden behind a hash until funds are spent. Once you have sent Bitcoin from such an address, the public key is revealed on-chain permanently. If you have ever used a wallet address to send funds, that address’s public key is now public.
Newer Taproot addresses have a key path spend that reveals the public key, but internal key path spends used in certain configurations can obscure it. Whether any specific Taproot output is quantum-vulnerable depends on how it was constructed and spent.
The simplest practical guidance is: if you have ever sent Bitcoin from an address, that address’s public key is on-chain and theoretically at risk in a post-cryptographically-relevant-quantum-computer world. Migrating funds to a P2MR address once BIP-360 is activated and wallet software supports it would eliminate that exposure going forward.
Frequently Asked Questions
Can quantum computers break Bitcoin right now?
No. Current quantum hardware tops out at roughly 1,000 to 2,000 physical qubits without meaningful fault tolerance. Breaking Bitcoin’s elliptic curve cryptography would require an estimated 500,000 physical qubits under the most optimistic engineering assumptions, a scale at least one to two orders of magnitude beyond what exists today. The meaningful risk window is 2029 to 2032, based on the consensus estimates from experts at Google, IBM, and the Ethereum Foundation — not zero, but not tomorrow.
What makes Bitcoin more vulnerable than a bank’s encryption?
Both rely on the same underlying mathematics — elliptic curve cryptography — and both face the same quantum threat. The difference is response time. A bank can instruct its IT department to implement new standards next quarter. Bitcoin requires something closer to a constitutional amendment: a multi-year process of community debate, developer proposals, and miner coordination historically requiring 90% consensus, in a network with no board, no CEO, and no shutdown switch. The 2017 SegWit upgrade triggered a community schism that split Bitcoin into multiple competing chains — and that was a far less disruptive change than retiring all existing signature schemes.
What is BIP-360, and what should Bitcoin holders do now?
BIP-360 introduces a new, quantum-resistant Bitcoin address type called Pay-to-Merkle-Root, using NIST-approved lattice-based signatures that do not expose your public key on-chain. It was merged into Bitcoin’s proposal repository in February 2026 but has not yet been activated on the network. Holders cannot yet create BIP-360 addresses in mainstream wallets. The practical action today is to avoid reusing addresses, to limit the number of addresses from which you have already spent, and to monitor BIP-360 activation milestones as wallet software begins to implement support. The deeper implication — named by Mosca’s theorem — is that the governance process to activate and roll out quantum-resistant addresses needs to begin in earnest now, because the historical timeline for Bitcoin protocol changes suggests it will take years even after the community agrees.
If Bitcoin is the “canary,” what happens to other systems when the canary falls?
A confirmed quantum attack on any Bitcoin wallet would serve as definitive proof that someone, somewhere, has built a cryptographically relevant quantum computer. That signal would trigger emergency responses across the global financial system — bank communications, TLS-encrypted internet traffic, government authentication systems, and enterprise security infrastructure all rely on the same elliptic curve and RSA foundations. The difference is that centralized institutions can migrate in months once the signal is given. Bitcoin’s governance process cannot respond that fast. The canary’s role is to provide the warning; whether the rest of the system can act on it before the same threat reaches them is a separate question that those institutions are actively preparing for now.