Hadamard Get the app

Which Bitcoin Addresses Are Vulnerable to Quantum Computers?

Which Bitcoin Addresses Are Vulnerable to Quantum Computers? — Hadamard

A Bitcoin address is vulnerable to a future quantum computer when its public key is visible on-chain. That covers P2PK outputs, Taproot (bc1p) outputs, and any hashed address that has already spent and still holds coins. Hashed addresses (starting with 1, 3 or bc1q) that have never spent show only a hash, so their public key is not exposed while the coins sit still.

This guide explains which Bitcoin addresses are vulnerable to quantum computers and why. It covers how many coins are affected, how far away the hardware is, and what Bitcoin developers have proposed. It reflects the state of research and proposals as of October 2026.

The short answer: quantum attacks target exposed public keys, not the blockchain

Bitcoin uses two kinds of cryptography. Mining and the chain’s history rely on hash functions such as SHA-256. Ownership relies on elliptic-curve signatures (ECDSA and Schnorr over secp256k1). A large, fault-tolerant quantum computer running Shor’s algorithm could derive a private key from a public key. It cannot meaningfully reverse a hash.

Europol made the same distinction in an October 7 warning reported by CoinDesk. It said the hash functions behind mining and chain history are far more resistant to quantum attacks than wallet signatures. It also said that keys already exposed cannot be made safe after the fact. For more on why hashing holds up, see our explainer on whether quantum computers can break SHA-256.

So the practical question is simple: is the public key that controls your coins visible to anyone reading the blockchain?

Which Bitcoin addresses are vulnerable to quantum computers? A risk ranking

Exposure depends on the output type and on whether the address has spent before. Based on 24/7 Wall St.’s September 2026 breakdown and CoinDesk’s reporting, the picture looks like this:

Output type Typical prefix Public key on-chain? Quantum exposure at rest
P2PK (pay-to-public-key) No standard address format Yes, in the locking script from the start Always exposed
Taproot (P2TR) bc1p Yes, by design (key-path spend) Exposed
P2PKH, P2WPKH, P2SH, P2WSH that have already spent and still hold funds 1, bc1q, 3 Yes, revealed at first spend and visible permanently Exposed
P2PKH, P2WPKH, P2SH, P2WSH that have never spent 1, bc1q, 3 No, only a hash Not exposed until spent

P2PK outputs date largely from Bitcoin’s earliest years, which is why they dominate discussions of early-miner and Satoshi-era coins. Taproot is the less obvious case. It is a modern format, but its key-path spend places a public key directly in the output, so a bc1p address is exposed from the moment it receives funds.

Address reuse is the most common way modern users create exposure. Spending from a hashed address reveals its public key. Any coins later sent to, or left on, that address are protected only by that now-public key. EU financial watchdogs warned on September 24 that older and reused addresses are especially vulnerable.

How many BTC have exposed public keys?

Estimates range from about 6.0 to 6.9 million BTC, depending on who is counting and how:

  • Google Quantum AI paper (as reported by CoinDesk): about 6.9 million BTC, roughly one-third of supply.
  • Quantum Alliance: 6.04–6.4 million BTC (30.2% of supply), including about 1.1 million attributed to Satoshi.
  • Chaincode Labs: about 6.26 million BTC.
  • Glassnode: about 6 million BTC.

These figures are summarized in CoinDesk’s October 16 coverage. The gap comes mainly from methodology, such as whether Taproot outputs or conditionally exposed keys are included. Treat any single number as one estimate within that range.

At-rest attacks vs. the 9-minute in-transit attack

There are two distinct threat models.

An at-rest attack targets coins whose public key is already on-chain. An attacker can work on those keys at leisure, with no time pressure. This is the risk that applies to P2PK, Taproot and reused addresses.

An in-transit attack targets a transaction while it waits to be confirmed. Spending from any address broadcasts the public key, even from a never-used bc1q address. Google’s March 2026 paper estimated that a key could be cracked in about 9 minutes once revealed. According to CoinDesk, that would give an attacker about a 41% chance of producing a competing transaction before Bitcoin’s average 10-minute block.

Good address hygiene removes at-rest exposure. It does nothing against the in-transit attack, though. Only a change to Bitcoin’s signature scheme addresses that.

How far away is a quantum computer that can break Bitcoin’s keys?

Nobody knows, and this article does not predict a date. What has changed is the size of the required machine.

In a whitepaper published March 30–31, 2026, Google Quantum AI estimated the resources needed to break 256-bit elliptic-curve keys like Bitcoin’s. Co-authors included researchers from the Ethereum Foundation and Stanford. The paper gives two configurations:

  • 1,200 or fewer logical qubits and 90 million or fewer Toffoli gates, or
  • 1,450 or fewer logical qubits and 70 million or fewer Toffoli gates.

On superconducting hardware, that translates to fewer than 500,000 physical qubits and a few minutes of runtime. CoinDesk described this as roughly a 20x reduction from earlier estimates in the millions. Google did not publish the circuits. Instead, it released a zero-knowledge proof that they exist. The Block reported that Google has set 2029 as its own internal deadline for moving to post-quantum cryptography.

Other estimates point in a similar direction. IonQ has published a resource estimate for a trapped-ion machine: 1,457 logical qubits, 19,397 physical qubits, about 25.7 days per attempt and a 63% heuristic success rate. That is according to PostQuantum.com’s summary; we have not verified the primary IonQ paper. A June 2026 preprint, “Quantum Horizon”, traces logical-qubit estimates falling from about 2,330 (Roetteler et al., 2017) to 1,200–1,450 in 2026.

Today’s hardware is far from those requirements. The same preprint puts 2026 machines at about 1,000–1,200 physical qubits, such as IBM Condor (1,121) and Atom Computing (1,180). None is fault-tolerant at the scale required. Error correction is improving, as Google’s recent result on Willow shows; we cover that in Magic State Cultivation: what Google’s 40x Willow result means. Timelines from industry figures still vary widely. Casa’s Jameson Lopp, for example, has said it will be at least a decade, as reported by Benzinga.

Bitcoin’s proposed fixes: BIP-360 (P2MR), BIP-361 and hybrid wallets

A note on sourcing: the details below come from established press coverage. We were not able to check them directly against the BIP texts or Coinbase’s paper. Readers should consult the bitcoin/bips repository for the authoritative specifications.

BIP-360: Pay-to-Merkle-Root

BIP-360, or Pay-to-Merkle-Root (P2MR), was merged into the bitcoin/bips repository around February 10–11, 2026, according to Bitcoin Magazine. Its authors are Hunter Beast, Ethan Heilman and Isabel Foxen Duke. It is a draft soft fork, and being merged into the repository is not the same as activation.

P2MR keeps Taproot-style script trees but removes the key-path spend, which is the part that exposes a public key. It would use a SegWit version 2 output with a “bc1z” prefix. BTQ Technologies released a Bitcoin Quantum testnet (v0.3.0) in March 2026 that creates, signs and verifies P2MR transactions, per Analytics Insight. That is a third-party testnet, not Bitcoin Core.

BIP-361 and the Satoshi-coins question

BIP-361, also a draft, takes a harder line. As described by CryptoDaily, it would first ban new payments to vulnerable address types and later retire legacy ECDSA and Schnorr signatures. Coins that are never migrated, including the roughly 1.1 million BTC attributed to Satoshi, could end up frozen.

This is the most contested question in the debate. Freezing coins breaks a long-standing norm that valid keys always control their coins. Leaving them alone risks a large sum becoming available to whoever builds a capable machine first. Experts broadly agree the coins could be at risk, but CoinDesk reports they do not agree on what to do.

Coinbase’s paper and the Quantum Alliance

On October 13, Coinbase published a technical paper. According to The Block and Blockonomi, it makes these points:

  • It backs flexible designs such as BIP-360/P2MR and P2TRv2.
  • It proposes a 1-of-2 hybrid wallet that accepts either a current signature or a post-quantum one.
  • It suggests evaluating ML-DSA, SLH-DSA, FN-DSA and SHRINCS.
  • It argues the lost-coins debate should be kept separate from the technical work.
  • It estimates a signature migration could take up to seven years.
  • It notes that today’s most advanced machines have fewer than 1,000 qubits.

Two days later, nine organizations launched the Quantum Alliance in Lisbon. Members include Hacken, Midnight Foundation, Quantus and Postquant Labs. The group plans shared security tests and migration guidance. TFTC noted that no founding member is publicly identified as a Bitcoin Core contributor.

Ethereum faces a parallel problem with its own account model; see Can Quantum Computers Break Ethereum? for that side. At Hadamard, we build BB84, an Ethereum Layer 2 that avoids ECDSA entirely. It uses one-time addresses based on hash commitments, the same principle that keeps unspent hashed Bitcoin addresses unexposed.

How to check if your Bitcoin is exposed and protect it today

You cannot fix the in-transit risk yourself, but you can avoid at-rest exposure. A practical checklist:

  1. Identify your address type. Addresses starting with bc1p are Taproot and expose a public key by design. Those starting with 1, 3 or bc1q are hashed.
  2. Look up each address in a block explorer. If a hashed address shows any outgoing transaction and still holds a balance, its public key is public.
  3. Stop reusing addresses. Use a fresh receive address every time. Do not leave funds on an address you have already spent from.
  4. Consider moving exposed funds. Coins on a spent-from or P2PK output can be moved to a new, never-used hashed address. Weigh fees and privacy, and remember the move itself briefly exposes the key while it waits to confirm.
  5. Ask your custodian direct questions. Do they reuse deposit addresses? Which output types do they hold coins in? Do they have a migration plan for when a post-quantum output type is activated?
  6. Follow the BIP process. When a post-quantum output type is activated, migrating early avoids a rush. Coinbase’s estimate suggests a migration could take years.

For wider context on deadlines across chains and standards, our Post-Quantum Migration Tracker follows the status of each.

FAQ

Is my Bitcoin safe from quantum computers if I’ve never sent from my address?

If it’s a hashed address (1, 3 or bc1q) that has never spent, the public key is not on-chain, so it is not exposed at rest. It will be briefly exposed when you eventually spend from it.

Is Taproot (bc1p) less quantum-safe than SegWit (bc1q)?

At rest, yes. Taproot exposes a public key by design, while an unspent bc1q address shows only a hash. BIP-360’s P2MR proposal keeps Taproot-style script trees but removes the key-path spend that causes this exposure.

Could a quantum computer steal Bitcoin while a transaction is waiting in the mempool?

In principle. Google’s paper estimated about 9 minutes to crack a revealed key, which works out to about a 41% chance of beating the 10-minute block. No machine capable of this exists today.

Will Satoshi’s coins be frozen or stolen, and what would BIP-361 do?

That is undecided. BIP-361, a draft, would restrict and then retire legacy signatures, which could freeze coins that are never migrated, including Satoshi’s. There is no consensus on whether to freeze them, protect them or leave them alone.

Sources