Will Quantum Computing Kill Bitcoin? A New Cryptographic Arms Race
Will quantum computing kill Bitcoin?
Here is the direct answer: No.
But that “no” comes with conditions.
Imagine Bitcoin as a door secured by a mathematical puzzle. To open it, classical computers must “guess” a password roughly 78 digits long — even if every computer on Earth worked together, they would still be guessing long after the universe ends. That is the foundation of Bitcoin’s 17-year security track record.
Quantum computers do not “guess.” They use a shortcut called Shor’s algorithm that turns “guessing the password” into “running a single experiment” — once the experiment finishes, the password emerges.
The good news: a quantum computer capable of running that experiment does not yet exist. Google’s most advanced Willow chip has only 105 computational units, while breaking Bitcoin is estimated to require around 1,500 high-quality (error-corrected) logical qubits — roughly a 15× gap. Each of those logical qubits itself requires hundreds of physical qubits for error correction.
The bad news: the gap is closing faster than expected. Three years ago, scientists estimated that breaking Bitcoin would require 20 million quantum units; that figure has now been revised down to 500,000 — a 40× reduction. If the trend continues, the crossover point could arrive in the 2030s.
Bitcoin is not standing still. Developers are already designing “new locks” — post-quantum cryptographic signatures. The world’s largest asset manager, BlackRock, has joined nine other institutions in committing US$15 million to help Bitcoin change its locks. NIST (the U.S. National Institute of Standards and Technology) has already published new lock standards and plans to retire all legacy locks by 2035.
So what is the real answer? Bitcoin will not die from quantum computers — it may die from changing the locks too slowly. If the Bitcoin community completes its cryptographic upgrade before a quantum breakthrough, it will become the world’s first financial system to have passed a “quantum stress test.” If it is too late, the roughly 7 million BTC with exposed public keys will become targets for quantum attackers, and market confidence could evaporate within hours.
This EX.IO Research note aims to illuminate exactly that: how hard the lock-changing engineering really is, how much time remains on the clock, and who is positioned to survive this arms race.
I. Cryptographic First Principles: Why ECDSA Is a House of Cards Against Quantum Computers
Bitcoin’s security rests on the Elliptic Curve Digital Signature Algorithm (ECDSA), specifically the secp256k1 curve. Its security assumption is simple: given a public key Q = k·G (where G is the generator point and k is the private key), recovering k from Q classically requires approximately 2¹²⁸ operations — the discrete logarithm problem (DLP), the mathematical bedrock of Bitcoin’s security model.
The problem arises with quantum computing. In 1994, Peter Shor proposed a quantum algorithm that can break both integer factorization and the discrete logarithm problem in polynomial time. Specifically, at Bitcoin’s scale:
- Classical computing: breaking a secp256k1 private key requires ~2¹²⁸ elementary operations (completely infeasible).
- Shor’s algorithm: requires only ~128³ elementary quantum operations — roughly 2 million steps.
From 2¹²⁸ (≈ 3.4 × 10³⁸) down to ~2 million is not acceleration — it is a dimensional collapse.
Intuitive explanation of Shor’s algorithm (non-rigorous): Classical algorithms struggle with the discrete logarithm because they must search an enormous space. Shor’s algorithm uses the Quantum Fourier Transform (QFT) to fold that search space — it does not “try” private keys one by one; instead it encodes all possible periods simultaneously and uses quantum interference to cancel incorrect answers. Measurement then yields the correct period with high probability, from which the private key can be recovered.
The Bitcoin community has long placed its hopes on the assumption that “quantum computers are still a long way off.” That assumption is being revised by data:
| Time | Milestone | Key Data | Source |
| 2019 | Google Sycamore (53 qubit) achieves quantum supremacy | 200 seconds for a task that would take a supercomputer 10,000 years | Google Blog |
| 2020 | China’s Jiuzhang (76 photons) achieves photonic quantum supremacy | Gaussian boson sampling | Science (2020) |
| 2021 | China’s Zuchongzhi 2.0 (66 superconducting qubits) | Further validation of quantum supremacy | PRL (2021) |
| 2022–23 | IBM releases 433-qubit Osprey & 1,121-qubit Condor | Logical qubit quality still insufficient | IBM Blog |
| 2024.12 | Google Willow (105 qubits) achieves below-threshold error correction | 30-year quantum error-correction breakthrough — more qubits now lower error rates | Google Blog |
| 2025.05 | Google Gidney revises RSA-2048 qubit estimate | From 20 million down to <1 million (↓20×) | Forbes (2026.08.02) |
| 2026.04 | Google white paper: qubits needed to break BTC ECC | Pushed below 500,000 | Forbes (2026.08.02) |
| 2026.04 | Project Eleven “Q-Day” competition | Real hardware breaks 15-bit keys | Forbes (2026.08.02) |
| 2026.07 | Claude Fable 5 overturns 87-year Jacobian conjecture | Qualitative leap in AI-driven cryptanalysis | CoinDesk (2026.07.21) |
Key insight: While the number of available qubits is rising, estimates of the qubits required to break Bitcoin are falling. The two curves are moving toward each other; the intersection point keeps advancing.
II. Attack Surface Deep Dive: How Exposed Is Your Bitcoin?
Not all Bitcoin addresses face equal risk. Quantum exposure depends on whether the public key has already been revealed on-chain and for how long.
Quantum Exposure Spectrum by Address Type
| Address Type | Example | When Public Key Is Exposed | Quantum Risk |
| P2PK | Satoshi’s early mining addresses | Exposed immediately upon receipt (pubkey in output script) | 🔴 Highest — exposed for years |
| P2PKH | Traditional 1… addresses | Exposed only when spent (pubkey in input script) | 🟡 Medium — unspent = safer |
| P2SH | 3… multisig addresses | Exposed only when spent (redeem script + pubkey) | 🟡 Medium |
| Bech32 P2WPKH | Native SegWit bc1q… | Exposed only when spent | 🟡 Medium |
| P2TR (Taproot) | bc1p… addresses | Key-path spend exposes pubkey; script-path does not | 🟢 Lower — but exposure paths remain |
BIP-360 (proposed by Hunter Beast, Ethan Heilman, and Isabel Foxen Duke) is built precisely around this granularity. It introduces two key concepts:
- Long Exposure Attack: Public keys exposed for days, months, or years — attackers have ample time to run a quantum computer. P2PK addresses and any previously spent address fall into this category.
- Short Exposure Attack: Public keys exposed only for the minutes between transaction broadcast and confirmation — an extremely narrow window.
BIP-360’s P2MR (Pay-to-Merkle-Root) scheme removes the key-path spend option from P2TR and retains only the script path. This effectively eliminates the long-exposure attack surface, though BIP-360 itself acknowledges it cannot defend against short-exposure attacks. True post-quantum signature schemes (such as SPHINCS+) are the ultimate defense against the short-exposure threat.
Quantifying Exposure
Three independent 2026 data points:
- Galaxy Digital (March 2026, cited by Forbes): 7 million BTC with exposed public keys, valued at ~US$470 billion
- Glassnode (cited by Forbes): 6.04 million BTC (30.2% of supply)
- CryptoQuant (cited by CoinDesk, 23 July 2026): ~6.9 million BTC potentially exposed
Among these, P2PK addresses alone contain a large volume of early-mined Bitcoin attributed to Satoshi (estimates exceed 1 million BTC that have never moved). The irony is sharp: Satoshi’s “one address per transaction” practice is inherently quantum-resistant — yet the early P2PK mining addresses themselves are the exception that proves the rule.
III. Post-Quantum Cryptography: The Materials Science of the Next Generation of Locks
In 2016, NIST launched a global Post-Quantum Cryptography (PQC) standardization competition. In August 2024, the first three standards (FIPS 203/204/205) were published. In 2025, HQC was selected as a fourth-round complementary standard.
A current Bitcoin ECDSA signature is approximately 71–73 bytes (DER-encoded). Replacing it directly with a small-parameter SPHINCS+ variant (SLH-DSA-SHA2-128s) inflates the signature to roughly 7,856 bytes (NIST FIPS 205 standard parameters) — about 110× larger. A typical 1-in-2-out transaction would swell from ~250 bytes to ~16 KB (two inputs each carrying a SPHINCS+ signature).
This is not merely a “transactions get bigger” problem — it triggers:
- Block-space competition intensifies: the same 1 MB block can hold only ~60 transactions (versus 2,000+ today).
- UTXO-set bloat: signatures also become a storage burden for nodes.
- Fee-market restructuring: under a per-byte fee model, post-quantum transactions will cost far more than traditional ones.
- SegWit discount may be insufficient: the current 75% witness discount still leaves SPHINCS+ signatures large.
This is why Lamport signatures have long been discussed in the Bitcoin community — they are extremely fast and simple, but each key pair can sign only once. Bitcoin Wiki estimates their signature size at 40–170× that of current ECDSA signatures (roughly 3–12 KB). For Bitcoin’s natural “one address, one use” pattern this is a natural fit — yet key-management complexity (pre-generating and storing all possible signing keys) remains an engineering challenge.
BIP-360 chooses a middle path: it does not introduce post-quantum signatures directly; instead it removes the key-path spend option to eliminate the long-exposure attack surface. This gives Bitcoin an immediate “reinforce the door frame without changing the lock cylinder” upgrade, buying time for true post-quantum signature schemes.
IV. Real Progress in Quantum Hardware: Superconducting vs Photonic vs Trapped-Ion
Google Willow’s 105 qubits (December 2024) remain the most advanced publicly known general-purpose quantum processor on the superconducting track, yet it is still orders of magnitude away from breaking secp256k1.
Notably, in December 2024 Google Willow achieved “below-threshold” quantum error correction for the first time — historically the first instance in which adding logical qubits actually reduced error rates. For the previous 30 years, the epitaph of quantum computing read: “more qubits, more errors.”
Willow’s physical qubit lifetime (T1) reaches nearly 100 microseconds — about 5× better than the previous Sycamore generation. According to the 2018 academic paper by Aggarwal et al. published in Ledger (as compiled on Bitcoin Wiki), breaking a Bitcoin secp256k1 private key requires approximately 1,500 logical qubits. At current superconducting error rates, each logical qubit still needs hundreds to thousands of physical qubits for error correction.
In other words: even holding Google Willow’s quality constant, assembling 1,500 logical qubits would require scaling today’s 105 physical qubits by roughly 100–1,000×. From all viable roadmaps, a quantum computer capable of threatening Bitcoin is unlikely to appear before 2030 — but the 2030s remain the critical window.
China’s Dual-Track Position
China is pursuing a dual-track approach:
- Superconducting quantum computing: USTC’s Pan Jianwei team with the “Zuchongzhi” series (Zuchongzhi 2.0 with 66 qubits in 2021, later Zuchongzhi 3.0) parallels Google’s roadmap.
- Photonic quantum computing: the Jiuzhang series leads in Gaussian boson sampling, but photonic systems currently cannot run Shor’s algorithm.
China is essentially neck-and-neck with Google in demonstrating quantum supremacy, yet on the cryptographically relevant superconducting application path Google and IBM still lead. Given the scale of China’s national investment in quantum computing (“14th Five-Year Plan” quantum special projects and the National Laboratory for Quantum Information), this landscape could shift in the coming years.
V. Real Progress on the Defensive Front: Who Is Funding, Who Is Delaying?
Capital Side: US$20 Million Already Committed
Bitcoin Security Consortium (23 July 2026) — nine institutions, US$15 million over three years:
- BlackRock, Coinbase, Strategy, Fidelity Digital Assets, Galaxy, Anchorage Digital, ARK Invest, Block (Jack Dorsey), Blockstream
- Funds are not pooled; each member chooses its own funding priorities. Mike Schmidt (Executive Director of Brink) coordinates voluntarily.
In the same week, Galaxy independently established a US$5 million quantum special fund (anti-quantum signatures / wallet migration tools / security audits).
Regulatory Side: Global Central Banks Are Running on Their Own Clocks
- NIST: plans to deprecate ECDSA in federal systems starting 2030 (earlier for high-risk systems) and fully remove it by 2035 (NIST IR 8547 transition timeline).
- U.S. CNSA 2.0: requires software and network equipment to upgrade to post-quantum schemes by 2030; browsers and operating systems by 2033.
- Hong Kong HKMA (27 July 2026): published the first banking Quantum Preparedness Index (QPI). Current score 2.3/10; target full marks by 2030. About 68% of banks have awareness or have entered planning; 32% have not started; roughly half of banks have no formal PQC plan.
- European Union: EuroQCI quantum communication infrastructure is being deployed; post-quantum migration recommendations are already in the ENISA framework.
The core tension: NIST’s timeline (deprecate ECC by 2035) gives traditional banking systems a 10-year window. But if the Bitcoin community waits until a quantum breakthrough is “certain” before deploying, it may discover that soft-fork consensus takes 2–3 years + full ecosystem wallet/exchange/mining-pool synchronization takes another 2–3 years + actual user migration may take 5–10 years — a total chain that could exceed the remaining quantum-breakthrough window. Bitcoin’s decentralized governance is both a moat and a critical vulnerability when facing this clock.
VI. The Terminator’s Dilemma: The Market Is Ignoring Systemic Tail Risk
As of publication (5 August 2026), BTC was trading in the US$63,000–64,000 range. The market is pricing in:
- Coldcard hardware-wallet vulnerability (self-custody trust crisis)
- Slowing BTC ETF inflows
- CLARITY Act legislative deadlock
- Yen-carry-trade unwind / macro uncertainty
What is completely unpriced is the risk of a non-linear quantum breakthrough. This is a classic case of long-tail risk mispricing: the timeline is too uncertain and the probability too low (but non-zero) for the market to bother.
Yet smart money is already moving:
- BlackRock is not only issuing ETFs — it is protecting the security assumptions underlying ETF assets. The manager of the world’s largest Bitcoin ETF joining a quantum-defense consortium is itself a signal.
- Galaxy’s US$5 million special fund — CIO-level cryptographic risk-management awareness.
- HKMA’s QPI moving from 0 to 2.3 — the step of “starting to measure from complete unawareness” has already been taken.
EX.IO Research Core Views: The Quantum Threat Is Not a “Whether” Question — It Is a “How Wide Is the Window” Question
- Two deaths, one immortality. Bitcoin will not die from “a quantum computer suddenly appearing.” It may die from: (a) the collective-action problem of cryptographic migration — no one wants to be first to bear the migration cost; or (b) a market-confidence collapse after early-mined coins with exposed public keys are successfully attacked and dumped at scale. Both are governance problems, not technical ones.
- Post-quantum signature size is not a technical problem — it is an economic problem. Migrating from 73-byte signatures to multi-kilobyte signatures essentially transfers cryptographic cost from “hash power” onto “block space.” This will reduce Bitcoin’s transaction throughput by an order of magnitude — but it is also a structural force that can push more load onto Layer 2 / Lightning / sidechains.
- Licensed custodians gain a triple dividend. Under the dual pressure of physical vulnerabilities in self-custody cold wallets and mathematical vulnerabilities (quantum threat), the narrative of “you do not need to become a cryptography expert” continues to appreciate for licensed custodians.
- Hong Kong’s QPI is a defensive asset. HKMA is one of the few central banks globally to publish a quantitative quantum-preparedness index. When global financial institutions begin treating “QPI compliance” as an evaluation criterion for custody service providers, the first-mover advantage of Hong Kong-licensed institutions will convert into pricing power.
- AI is the most under-appreciated variable — in both directions. Claude Fable 5 overturned an 87-year mathematical conjecture. The same AI capabilities can accelerate cryptanalysis (shortening the quantum-threat timeline) and accelerate post-quantum cryptography design (strengthening defenses). The current net effect favors the attack side — because research funding for post-quantum cryptography is far smaller than for AI-driven cryptanalysis.
- A pragmatic investor strategy. If you are a long-term holder (>10 years), watch BIP deployment progress more closely than quantum-chip progress. Before a post-quantum signature BIP is activated, BTC held in previously spent addresses faces the greatest tail risk. After a post-quantum signature BIP is activated, migrating to the new address type is the most direct technical path to reducing quantum exposure.
References
- Forbes: “That Is The End of Bitcoin? The Quantum Race for $470 Billion” (2 Aug 2026) — Galaxy/Glassnode exposure estimates, Google Gidney qubit revision, Justin Drake 10%/2032 probability, Project Eleven Q-Day.
- Bitcoin Wiki: “Quantum computing and Bitcoin” — 2¹²⁸ vs 128³ operation counts, Aggarwal et al. (2018) academic paper, Lamport signatures, BTQ quantum risk calculator.
- GitHub / BIP-360: “Pay-to-Merkle-Root (P2MR)” — Hunter Beast, Ethan Heilman, Isabel Foxen Duke. Draft (18 Dec 2024). Long/short exposure attack definitions, P2MR script-path design.
- NIST CSRC: “Post-Quantum Cryptography Standards” — FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA), Falcon/HQC/FN-DSA standardization, NIST IR 8547 transition timeline (deprecate ECC by 2035).
- Google Quantum AI Blog: “Meet Willow, our state-of-the-art quantum chip” (Dec 2024, updated Jun 2025) — 105 qubits, below-threshold error correction, T1 ≈ 100 µs, 10²⁵-year RCS benchmark.
- CoinDesk: “BlackRock, Coinbase, Strategy Pledge $15M to Prepare Bitcoin for Quantum Threats” (23 Jul 2026) — nine institutions, US$15 million / 3 years, CryptoQuant 6.9M BTC exposure.
- HKMA: “HKMA Launches Quantum Preparedness Whitepaper and Index” (27 Jul 2026) — QPI 2.3/10, 68% awareness, 32% not started, ~50% without formal PQC plan, 2030 target, HKUST PQC toolkit.
Disclaimer
This content is provided for general market information and educational reference only. It does not constitute investment advice, legal opinion, compliance advice, trading recommendation, solicitation, or endorsement. Digital asset prices are highly volatile; past data is not indicative of future performance. Price references “as of publication” are contemporaneous snapshots and do not represent subsequent market conditions. Quantum-computing timeline estimates are based on publicly available academic research and third-party analysis as of the publication date and are subject to material uncertainty.
Forward-looking statements in this report are based on current expectations, assumptions, and publicly available information as of the publication date. They involve known and unknown risks, uncertainties, and other factors that may cause actual results, market conditions, or technological developments to differ materially from those described herein. The pace of development in quantum computing, cryptography, and related fields may substantially exceed or fall short of current estimates. Readers should not treat any timeline estimates in this document as deterministic forecasts.
EX.IO and/or its affiliates may hold positions in the digital assets or related financial products discussed in this report in the ordinary course of business. Readers should not make trading, product, licensing, or other commercial decisions solely on the basis of this content. For legal, compliance, tax, or investment judgments, consult a qualified professional adviser.
