Quantum computers have not yet cracked Bitcoin, but 7.1 million BTC already face potential risks: how to defend?

Author: Bitcoin Security Consortium

Compiled by: TechFlow

Editor's Summary:In recent years, with the emergence of Google's Willow chip and the publication of multiple optimization studies on Shor's algorithm, the question of whether quantum computing threatens Bitcoin security has once again sparked discussion. The Bitcoin Security Consortium, in collaboration with Presidio Bitcoin, released this report to systematically review technological advancements and risk boundaries.

The report points out that there remains a massive hardware gap between current systems and truly cryptographically capable quantum computers. However, Bitcoin's signature mechanism indeed faces two major attack vectors: "static exposure" and "in-transit" transactions. Addressing common misconceptions regarding overestimation and underestimation of threats, the article further breaks down routes for address migration, SHRINCS post-quantum signatures, and the disposal route for legacy early P2PK coins.

This article is a joint report released by the Bitcoin Security Consortium and Presidio Bitcoin.

Key Takeaways (TL;DR)

· Recent quantum computing progress is real, but remains incremental: Google's Willow chip and recent Shor's algorithm optimizations have sparked market concerns, yet no cryptographically relevant quantum computer (CRQC) has emerged thus far.

· Quantum risks to Bitcoin are limited to its signature mechanism, manifesting as two specific attack vectors: static attacks (at-rest) against vulnerable legacy coins, and in-transit attacks (in-flight) against mempool transactions.

· Mitigation strategies are clear, and the community is actively advancing implementation: including migrating funds from reused addresses, developing post-quantum signature schemes, and establishing network consensus on handling Bitcoin locked in likely lost P2PK addresses.

Is Quantum Computing Experiencing a Renaissance?

After years that seemed stagnant, the quantum computing field has recently seen an increasing number of academic papers and media reports claiming technological breakthroughs, sparking concerns among investors about Bitcoin's security. These representative advancements include:

· Google Willow Chip (December 2024): The first experimental demonstration showing that increasing the number of physical qubits used to protect a single fault-tolerant "logical" qubit improves that logical qubit's reliability rather than degrading it.

· Shor's Algorithm Optimizations by Google Quantum AI, Oratomic/Caltech, and ECDSA.fail (2026): Google Quantum AI, in partnership with the Ethereum Foundation and Stanford University, reduced the circuit size required for Shor's algorithm to break Bitcoin's elliptic curve by approximately 20 times.

The Oratomic and Caltech team also proposed that their optimized Shor's algorithm could potentially crack a single Bitcoin private key within days. In the following months, Eigen Labs launched the leaderboard project ECDSA.fail, which brought together researchers and AI agents to further compress Google's circuit size by nearly 70%.

· IonQ's End-to-End Shor's Algorithm Optimization (September 2026): Released a complete, compilable runtime blueprint accounting for both software and hardware estimates. Theoretically, each attempt would take approximately 26 days to solve a single private key, with a per-attempt success rate of 63.3%.

· Google's "Magic State" Distillation Technology (October 2026): Quantum computing relies on "magic states," resource states consumed upon each use and expensive to prepare. Google demonstrated on Willow that its distillation protocol can reduce error rates in these states by approximately 40-fold, achieving 99.99% logical fidelity.

· Quantinuum's "Five-Nines" Logical Fidelity (October 2026): Its Helios computer experiences only 5 errors per million operations (achieving 99.9995% logical fidelity), with an error rate roughly 100 times lower than Google's demonstration, and error rates dropping 12-fold per scaling step of the error-correcting code (λ = 12).

Although a cryptographically relevant quantum computer (CRQC) does not yet exist, and the technology still faces numerous engineering challenges such as physically scaling fault-tolerant qubits, why do these developments keep the Bitcoin community highly alert? What exactly is the connection between Bitcoin and quantum computing? The following section breaks it down.

A Brief Overview of Quantum Computing Principles

The core of quantum computing lies in the qubit. Unlike traditional classical bits that can only store one of two states, 0 or 1, qubits possess two unique properties found in the quantum mechanical world:

· Superposition: A qubit can simultaneously exist in a combined state of both 0 and 1, collapsing into a single definite value upon observation/measurement according to weighted probabilities.

· Quantum Entanglement: Two or more qubits can share the same joint state. Regardless of the distance between them, measuring one immediately determines the state of the other.

Leveraging these properties, quantum computers can explore vast numbers of candidate solutions simultaneously while canceling out incorrect options. However, physical qubits are highly fragile and prone to decoherence, which is the loss of quantum information.

For this reason, many quantum computing companies today have set roadmap targets around reaching the minimum threshold of logical qubits. These qubits are constructed from multiple redundant physical qubits through error correction, enabling the detection and repair of errors to ensure computational and data reliability.

To achieve the most efficient physical-to-logical qubit ratio, various quantum labs are researching the most effective hardware architectures, primarily centered around these four routes:

· Superconducting Circuits (Google, IBM): Cooling microscopic wire loops to near absolute zero, causing electrical currents to behave like a qubit. This technology offers faster computation speeds, but scales relatively slowly.

· Neutral Atoms (Oratomic): Using laser arrays known as "optical tweezers" to trap electrically neutral atoms, utilizing their electrons as qubits. This route scales quickly, but theoretically requires longer computation times.

· Ionic Traps (Quantinuum, IonQ): Manipulating charged atoms (ions) with lasers in electromagnetic fields, using their ground or excited energy states as qubits. This route has comparatively slower computation speeds and medium scaling capabilities.

· Photonic (PsiQuantum, Xanadu): Passing photons through chips and optical components, using each photon's physical attributes as qubits. This route features very fast computation but currently has a longer overall R&D and deployment timeline.

Bitcoin's Quantum Attack Surface

Theoretically, a cryptographically scaled quantum computer running Shor's algorithm could break Bitcoin's Elliptic Curve Digital Signature Algorithm (ECDSA). This signature mechanism upholds ownership and property rights within the network, allowing parties to prove private key possession without exposing it to counterparties.

It is crucial to note that the vast majority of Bitcoin's core game-theoretic and economic rules fall outside this attack surface. Factors such as transaction consensus mechanisms, issuance schedules, and the total supply cap remain unaffected.

Quantum attacks targeting Bitcoin private keys present the network with the following two attack surfaces:

· Prolonged Exposure (Static Attacks): Bitcoins stored in reused addresses or early, less secure addresses (such as P2PK public key payment addresses) have exposed public keys, which quantum computers could exploit to derive corresponding private keys.

Most active addresses today utilize modern output types that hide public keys until funds are spent, rendering them immune to this specific attack vector. However, Project Eleven estimates that if a computationally sufficient quantum computer emerged today, approximately 7.1 million BTC (about 35% of the total supply) would be at risk of theft.

Approximately three-quarters of these are held in reused addresses, predominantly concentrated in large exchanges; risk can be significantly mitigated simply by exchanges migrating funds to one-time-use addresses and adopting stricter custody protocols. Another ~1.8 million BTC lie dormant in P2PK addresses, likely already lost and difficult to proactively migrate to secure addresses.

Whether faster or slower, quantum computers could exploit these exposed public keys to iteratively reverse-engineer the private keys controlling investor funds.

· Short-Term Exposure (In-Transit Attacks): Funds on the Bitcoin network typically only reveal public keys when being spent, creating a vulnerability window of approximately 10 minutes (more precisely, the interval between transaction submission and block inclusion).

A sufficiently fast quantum computer could exploit this window to intercept funds mid-transaction. Google previously estimated that a prepared, high-clock-speed quantum device could calculate a private key in as little as 9 minutes, meaning even Bitcoin stored in secure addresses could face front-running and theft risks during routine transfers.

Common Misconceptions: Overestimating the Threat

· "Quantum hardware has already achieved scalability and is ready for deployment." The most advanced publicly demonstrated system to date comes from Quantinuum, producing only 48 fault-tolerant logical qubits, whereas breaking Bitcoin's elliptic curve requires at least ~1,200.

· "Recent quantum demonstrations have proven cryptographic-scale computing capability." This is not the case. The Willow chip validated fault-tolerant quantum memory, not large-scale fault-tolerant computation.

The 2026 papers released by Google, Oratomic, and IonQ are theoretical design blueprints, not functioning physical machines. Achieving low-error-rate computations across large quantities of logical qubits remains an unmet bottleneck.

· "All Bitcoin will be stolen instantaneously." Most Bitcoin is not vulnerable when stored statically, as public keys remain hidden behind hashes until spending occurs; the primary risk source, "address reuse," can now be mitigated simply by rotating to fresh, unused addresses.

Even if a quantum attack occurred today, each attempt by an attacker could only target a single private key, making it impossible to simultaneously plunder all vulnerable supplies in one go.

Common Misconceptions: Underestimating the Threat

· "Shor's algorithm optimizations are merely insignificant hype." This March, Google compressed the theoretical number of logical qubits required to break Bitcoin's ECDSA by ~20 times, noting that elliptic curve algorithms historically received far less optimization attention than the RSA (Rivest-Shamir-Adleman) cryptosystem, leaving considerable room for further compression.

Events have since corroborated this: the ECDSA.fail project subsequently optimized Google's circuit size by another ~70%.

· "The quantum threat won't arrive for decades, so why worry prematurely?" Recent expert surveys indicate a ~50% probability that cracking-capable quantum machines will emerge between 2030 and 2035; governments worldwide have also set post-quantum migration targets for the early-to-mid 2030s, while Google and Cloudflare have set internal deadlines prior to 2029.

It is worth noting that governments and enterprises establish these timelines primarily to guard against "harvest now, decrypt later" attacks, protecting privacy data that retains sensitive value into the future.

Since Bitcoin network participants can self-defend by migrating to new addresses that hide public keys, these timelines should instead be viewed as references for network "best practices," rather than inevitable crisis triggers.

· "We will definitely detect quantum breakthroughs well in advance." Technological breakthroughs may be classified or kept secret by sovereign states; early instances of quantum theft could also occur sporadically, appearing virtually indistinguishable from standard custodial fund management or ordinary payment transfers.

What Actions Is the Industry Taking Currently?

Today, Bitcoin ecosystem participants, including exchanges, institutions, and investors, have begun proactively preparing for quantum threats and are actively discussing and advancing solutions roughly following these priorities:

· Migrate vulnerable funds from reused addresses to fresh ones: This represents the lowest-hanging fruit, requiring no network-wide consensus or soft fork.

This measure entirely depends on large exchanges, custodial institutions, and self-custody investors implementing modern security practices, such as change output rotation and striving to avoid reusing the same address.

· Develop post-quantum signature schemes: The most prominent Bitcoin post-quantum payment scheme to date is Blockstream's SHRINCS (short for "Shrunken SPHINCS"), built on top of SHA-256.

SHRINCS can process up to 3 transactions per second, compared to the U.S. National Institute of Standards and Technology (NIST) SPHINCS+ standard at merely 0.36 transactions per second. Blockstream tested this scheme on the Liquid network in March 2026 and, alongside contributors, released a Bitcoin Improvement Proposal (BIP) in August.

Formal security proofs for this scheme are still ongoing, and network-wide deployment would require implementation via a soft fork.

· Reach consensus on disposing of Bitcoin locked in vulnerable, likely-lost P2PK addresses: This is arguably the most contentious issue for Bitcoin facing quantum threats over the coming years. Approximately 1.7 million BTC are currently held across ~20,000 P2PK addresses, with an estimated 1.1 million attributed to Satoshi Nakamoto.

According to Presidio Bitcoin's research, three mainstream proposals are currently under discussion: (1) retain validity of legacy transaction spends (i.e., allow quantum attackers to "steal"); (2) restrict the withdrawal rate from legacy addresses (i.e., "throttle" vulnerable funds).

(3) Freeze with a recovery path, i.e., disable all legacy spends but allow original owners to reclaim funds using mnemonic-based zero-knowledge proofs (i.e., "soft freeze").

For those wishing to delve deeper into this critical topic, refer to Presidio Bitcoin's continuously updated foundational guide (click here for source materials).

Disclaimer: This material is for informational and educational purposes only and should not be used as the basis for any investment decisions. Statements involving companies, securities, or cryptocurrencies reflect the author's views alone and do not constitute endorsements or recommendations to buy, sell, or hold.

Certain portions of this material may constitute forward-looking statements or expectations based on the author's current views and assumptions. Subject to known and unknown risks and uncertainties, actual results may differ materially from those expressed.

Information is sourced from believed reliable channels, but no guarantees are made regarding the accuracy or completeness of any third-party derived information.

Beyond the risks outlined herein, Bitcoin is also subject to severe price volatility, market manipulation, theft, and potential liquidity constraints during market stress.

While institutional adoption and regulatory maturation have driven the evolution of the Bitcoin market, its value remains influenced by market conditions, supply and demand shifts, and regulatory developments, with no guarantee of long-term preservation of value.