In April 2026 a researcher named Giancarlo Lelli used a publicly accessible quantum computer to derive a private key from its matching public key. He won a bitcoin for it. The key was 15 bits long.
Bitcoin uses 256. That gap is the whole argument about quantum computing and cryptocurrency, and almost every account of it picks one side and stops. The alarmed version notes that 15 bits is 512 times the previous public record, set only seven months earlier. The dismissive version notes that going from 15 to 256 is not a matter of scaling up 17 times, and that the search space involved is larger than the number of atoms in the observable universe. Both are correct.
What has actually changed since this guide was first written is not the arrival of the threat. It is that the threat became measurable. In 2024 the honest answer to “when” was a shrug and a decade-wide range. Today there are finalised standards, published migration deadlines, and peer-reviewable resource estimates that have fallen by a factor of twenty twice in six years. The date is still unknown. The engineering is not.
| Area | Then | Now |
|---|---|---|
| Standards | NIST had just finalised FIPS 203, 204 and 205 in August 2024 | HQC added as a backup key mechanism, March 2025; draft transition guidance sets 2030 and 2035 milestones |
| Cost of breaking RSA-2048 | About 20 million noisy qubits, 8 hours (Gidney and Ekerå, 2019) | Fewer than 1 million noisy qubits, under a week (Gidney, May 2025) |
| Cost of breaking secp256k1 | Roughly 9 million qubits (Litinski, 2023) | Under 500,000 physical qubits (Google whitepaper, April 2026) |
| Largest key broken on real hardware | None publicly demonstrated | 15-bit elliptic curve key, April 2026, up from 6-bit in September 2025 |
| Bitcoin’s own response | No formal proposal | BIP-360, a proposed quantum-resistant address type, under discussion |
| The threat did not arrive in this window. What arrived was the ability to measure it. Every figure above is an estimate or a demonstration, not a deployed capability. | ||
What quantum computing actually does to encryption
A classical bit is one or zero. A qubit, through superposition, holds a weighted combination of both until it is measured, and through entanglement the state of one qubit can be correlated with another regardless of distance. Chain enough of them together and certain problems collapse from impossible to merely difficult, as MIT Technology Review set out in its primer on the field.
The relevant word is “certain”. Quantum computers are not generally faster. They are faster at a specific and short list of things, and two entries on that list matter here.
Shor’s algorithm, published in 1994, factors large integers and solves discrete logarithm problems in polynomial rather than exponential time. That breaks RSA and it breaks elliptic curve cryptography, which is what secures essentially every cryptocurrency wallet in existence. Grover’s algorithm offers a quadratic speed-up on unstructured search, which weakens hash functions without destroying them. Doubling a hash length restores the margin. Nothing restores a broken elliptic curve key except changing the curve.
That asymmetry is why the mining side of a blockchain is in far less danger than the wallet side. Proof-of-work is a hashing problem and Grover buys an attacker a square root, which a difficulty adjustment absorbs. Signatures are a discrete logarithm problem and Shor buys an attacker everything.
How much of the cryptocurrency market is actually exposed
An elliptic curve private key can only be derived from the corresponding public key, and a public key is not usually visible until its owner spends from the address. That single detail decides the scale of the problem.
Coins sitting in an address that has never been spent from are protected by a hash, not just a curve. Coins in an address that has been spent from, or in the earliest pay-to-public-key format used in Bitcoin’s first years, have their public key sitting in plain view on a permanent public ledger. Commonly cited chain analyses put the exposed total somewhere between 6.5 and 7 million BTC, which is roughly a quarter to a third of everything that will ever exist, and that figure includes the roughly one million coins attributed to Satoshi Nakamoto and never moved. At the price Bitcoin has been trading at through 2026, that is several hundred billion dollars sitting behind cryptography with a known expiry date.
| Situation | Is the public key visible? | Exposure |
|---|---|---|
| Address never spent from | No, only a hash of it | Protected until the first spend |
| Address spent from at least once | Yes, permanently on-chain | Vulnerable to a future Shor attack |
| Pay-to-public-key, used in Bitcoin’s earliest years | Yes, from the moment of creation | Vulnerable, and largely unmovable |
| Coins attributed to Satoshi Nakamoto | Yes, mostly pay-to-public-key | About 1 million BTC, never moved |
| Total in addresses with exposed keys | Commonly estimated at 6.5 to 7 million BTC, roughly a quarter to a third of the eventual supply | |
| Figures are chain analyses rather than an audited count, and estimates differ by several hundred thousand coins. Nobody but a key holder can move exposed coins to safety, and for much of this total there is no key holder left. | ||
Those coins cannot be moved to safety by anyone except whoever holds the keys, which in a great many cases is nobody at all. This is the part of the problem that no protocol upgrade solves, and it is the reason the Bitcoin developer conversation has turned toward proposals that would freeze quantum-vulnerable outputs rather than simply offer a safer address type alongside them.
The numbers that moved
The resource estimates are where the last two years have been genuinely dramatic, and they have moved in one direction.
In 2019 Craig Gidney and Martin Ekerå published the benchmark figure: factoring a 2048-bit RSA integer would need about 20 million noisy qubits running for eight hours. In May 2025 Gidney published a revised estimate of fewer than one million noisy qubits, running for under a week. The gain came from approximate residue arithmetic, yoked surface codes and cheaper magic-state production rather than from any new physics, and it cut the requirement twentyfold.
The elliptic curve numbers followed the same curve. A 2023 analysis by Daniel Litinski put a full attack on secp256k1, the curve Bitcoin uses, at roughly nine million qubits. A Google whitepaper in April 2026 put it under five hundred thousand.
| Target | Estimate | Source and date |
|---|---|---|
| RSA-2048 | 20 million noisy qubits, 8 hours | Gidney and Ekerå, 2019 |
| RSA-2048 | Under 1 million noisy qubits, under a week | Gidney, May 2025 |
| secp256k1 (256-bit elliptic curve) | About 9 million qubits | Litinski, 2023 |
| secp256k1 (256-bit elliptic curve) | Under 500,000 physical qubits | Google whitepaper, April 2026 |
| 6-bit elliptic curve key | Broken on real quantum hardware, September 2025 | |
| 15-bit elliptic curve key | Broken on real quantum hardware, April 2026 | |
| The first four rows are theoretical resource estimates. The last two are demonstrations on existing machines. They are not points on the same line and should not be read as one. | ||
Against that, the largest key anyone has actually broken on real hardware went from six bits in September 2025 to fifteen bits in April 2026. The machines are nowhere near the paper estimates. The paper estimates keep falling toward the machines.
What has been built in response
The defensive side is further along than the coverage usually suggests.
In August 2024 the United States National Institute of Standards and Technology finalised its first three post-quantum encryption standards: FIPS 203, a lattice-based key encapsulation mechanism now called ML-KEM; FIPS 204, the ML-DSA signature scheme; and FIPS 205, SLH-DSA, a hash-based signature scheme deliberately built on different mathematics so that a break in lattices does not take everything with it. NIST added HQC as a backup key mechanism in March 2025.
These are not drafts. They are the algorithms federal systems are required to migrate to, and the draft transition guidance deprecates RSA-2048 and 256-bit elliptic curve by 2030 and removes them entirely by 2035. Vendors have followed, and the first nationally recognised quantum-safe algorithms are now emerging outside the United States too.
Cryptocurrency is behind that curve, for a structural reason: nobody can force an upgrade. Bitcoin’s response is BIP-360, a proposed quantum-resistant address type that keeps the public key off-chain until a spend and even then reveals only the branch being used. It is a proposal, not a deployed consensus rule, and getting from one to the other on a network with no central authority is the slow part.
What to do about it, in order of usefulness
Stop reusing addresses. Every spend from an address publishes its public key permanently, and an address used once and abandoned exposes far less than one used as a standing deposit account.
Prefer wallets and custodians that have published a post-quantum migration plan rather than a post-quantum press release. The distinction is whether they name the algorithms and the timeline.
Understand that cold storage helps with theft and does not help with this. An offline device protects a key from being copied. It does nothing about a public key already written into a block in 2011.
For anything that is not cryptocurrency, the priority is different and more urgent, and it has a name: harvest now, decrypt later. Encrypted traffic captured today can be stored and opened whenever the hardware arrives. Any data that must stay confidential into the 2040s is already at risk, and that risk does not wait for the first working attack.
What this does not settle
The forecasting problem is unresolved and the people closest to it disagree sharply. Resource estimates have fallen twentyfold twice, which could mean the trend continues or could mean the obvious optimisations have now been found and the curve flattens. Neither reading has been demonstrated.
The harder gap is that public demonstrations and paper estimates measure different things and get compared as though they do not. A 15-bit break on real hardware and a 500,000-qubit estimate for 256 bits are not two points on one line. The first is bounded by what exists; the second by what would have to be built. Nobody has shown that the second follows from the first at any particular rate, and the honest position is that the date remains genuinely unknown while the direction does not.
Quantum computing and cryptocurrency: frequently asked questions
Can a quantum computer steal bitcoin today?
No. The largest elliptic curve key broken on real quantum hardware is 15 bits, in April 2026. Bitcoin uses 256-bit keys, and no existing machine is close to that.
How much bitcoin is vulnerable to a future quantum attack?
Analyses commonly put between 6.5 and 7 million BTC in addresses whose public keys are already visible on-chain, roughly a quarter to a third of the supply. That includes about a million coins attributed to Satoshi Nakamoto.
Which is at risk, mining or wallets?
Wallets. Signatures rely on the discrete logarithm problem, which Shor’s algorithm solves outright. Mining relies on hashing, where Grover’s algorithm gives only a quadratic speed-up that a difficulty adjustment can absorb.
What are the NIST post-quantum standards?
FIPS 203 (ML-KEM) for key encapsulation, FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for digital signatures, all finalised in August 2024, with HQC added as a backup key mechanism in March 2025.
What is BIP-360?
A proposed Bitcoin address type designed to resist quantum attack by keeping public keys off-chain until they are spent. It is a proposal under discussion, not an active consensus rule.
What does harvest now, decrypt later mean?
Capturing encrypted data today and storing it until a quantum computer can decrypt it. It makes the threat present-tense for any information that must stay secret for decades, regardless of when the hardware arrives.
Does moving my coins to cold storage protect them?
Not from this. Cold storage protects a private key from being copied. If the matching public key has already appeared on-chain from an earlier spend, it is exposed wherever the private key is kept.
Related Posts
