Quantum Computing and Your Coins: What Is Actually at Risk, on What Timeline, and What You Can Do Now

The target is the signature, not the blockchain

Most quantum headlines imply that a sufficiently powerful machine would somehow dissolve a blockchain. That is not the shape of the risk, and getting the shape right is what makes the rest of this tractable. A blockchain's integrity rests on hash functions, and hashing is comparatively resilient to quantum attack — the known quantum speedup against a hash function weakens it without breaking it, and the usual response is simply a longer output. Mining, block validation and the ledger's tamper-evidence are not where the problem sits.

The problem sits in the signature. Ownership of a coin is proved by producing a digital signature from a private key, and the mathematics linking a public key to its private key is exactly the kind of problem a large quantum computer is expected to solve efficiently. Break that link and you do not need to attack the network at all: you derive the private key from the public key and sign a perfectly valid transaction that every node accepts, because it is valid. This is why the standards world moved first and independently of crypto. NIST finalised its first three post-quantum standards on 13 August 2024 — FIPS 203 for general encryption, and FIPS 204 and FIPS 205 for digital signatures, the second intended as a backup should the first prove vulnerable — and urged administrators to begin integrating them immediately, because full integration will take time. The reason the migration starts before the threat materialises is that migration is slow, and that logic applies with unusual force to a system where the vulnerable material is published permanently on a public ledger.

Exposed keys: the number that actually sorts holders into risk groups

Here is the detail that turns an abstract debate into something you can act on. In Bitcoin's common address formats, what appears on-chain when you receive funds is not your public key but a hash of it. A hash does not hand an attacker the material they need. Your public key becomes visible at a specific moment: when you spend from that address, because the spending transaction publishes the key so the network can verify your signature. From that instant, the key is public forever, and every satoshi still sitting at that address is protected only by the difficulty of the underlying mathematics rather than by obscurity.

The scale is documented. BIP-361 states that as of 1 March 2026, over 34% of all bitcoin have revealed a public key on-chain, and that those UTXOs could be stolen by an attacker with a sufficiently powerful quantum computer. Roughly a third of the supply, in other words, is in a materially different risk category from the rest — and the difference is not the coin, the wallet brand, or the size of the holding. It is a history of address reuse. This recasts advice that has circulated for years as a privacy matter. Bitcoin.org's guidance is that you should use a new Bitcoin address each time you receive a new payment, and that addresses should only be used once. That was always sound for privacy; under a quantum threat model it becomes a security control, and it is one of the few in this entire subject that an individual can apply today, immediately, at no cost. Modern wallets generate a fresh receiving address automatically, so for most people compliance means not overriding the default — and specifically, not treating a single address as a permanent deposit box to be published, pinned in a profile, or handed out repeatedly.

Two attacks with very different timelines

BIP-360 draws a distinction that explains why the urgency is uneven, and it is worth carrying because it tells you which risk is yours. Long exposure attacks target public keys that have been visible for extended periods; as the proposal puts it, attackers will have ample time — as much time as vulnerable keys are exposed — to carry out quantum key recovery. If a key has been sitting in public since 2013, an attacker who eventually acquires the capability can work on it at leisure. Short exposure attacks are different in kind: they target the brief window while a transaction sits unconfirmed in the mempool with its public key revealed but its spend not yet final. That requires a quantum computer fast enough to derive a key and broadcast a competing transaction within minutes, which BIP-360 describes as requiring faster quantum computers and views as lower-risk than long exposure attacks in the nearer term.

The distinction matters because it maps onto ordinary behaviour. Long exposure is a stored, accumulating risk borne by dormant balances at reused addresses — coins nobody is watching, wallets belonging to people who have died or lost interest, and holdings deliberately left untouched for a decade. Short exposure is a transient risk borne during the act of transacting, and it is far further away. If you rotate addresses and do not leave balances behind at spent-from addresses, you are largely converting a long exposure position into a short exposure one, which is the direction the whole ecosystem is trying to move. On honest timing: no one credibly claims a machine capable of this exists today, and the responsible sources decline to name a date. What the evidence does support is that institutions are planning around a window rather than a certainty — BIP-360 notes that the US federal government plans to disallow elliptic curve cryptography after 2035, with the Commercial National Security Algorithm Suite 2.0 mandating post-quantum upgrades by 2030. Those are procurement deadlines, not predictions, but they indicate what serious planners consider a prudent margin.

What Bitcoin is proposing, and the deadline nobody mentions to ordinary holders

Two draft proposals are worth knowing about, not because you need to follow the engineering but because one of them has a direct consequence for anyone holding long-term. BIP-360, authored by Hunter Beast, Ethan Heilman and Isabel Foxen Duke, proposes Pay-to-Merkle-Root: a new output type that behaves like Pay-to-Taproot but removes the quantum-vulnerable key path spend, committing only to a script tree's Merkle root. It is a foundation — somewhere quantum-safe to move to.

BIP-361, authored by Jameson Lopp, Christian Papathanasiou, Ian Smith, Joe Ross, Steve Vaile and Pierre-Luc Dallaire-Demers, is the one with teeth. Titled Post Quantum Migration and Legacy Signature Sunset, it proposes a phased schedule: Phase A, roughly three years after activation, would disallow sending funds to quantum-vulnerable addresses, requiring new transactions to use post-quantum script types; Phase B, two years after that, would restrict ECDSA and Schnorr spends by applying quantum-safe rescue protocols designed to let authentic coin-holders spend while blocking quantum attackers, leveraging knowledge asymmetries such as BIP-32 hardened key derivation that a quantum attacker would lack. Both are drafts, neither is activated, and Bitcoin's consensus process is deliberately slow and contested — a draft BIP is a proposal, not a schedule. But the shape of the debate is now visible, and it has an implication rarely stated to ordinary holders: any sunset design creates a class of coins whose owners did not act in time. That class is not made up of careless people so much as absent ones — inherited keys nobody knew about, wallets set aside for a decade, holders who died without a handover plan. If you hold long-term, the practical takeaway is not to migrate today, because there is nothing to migrate to yet. It is to remain migratable: know where your keys are, keep a record of which addresses hold what, make sure someone you trust can act if you cannot, and stay reachable by the information channels that would tell you when a real migration path activates.

The scam wave this subject reliably attracts

Every genuine security transition produces a parallel industry of people monetising the confusion, and this one has unusually fertile ground: a real, technical, widely-reported threat that most people cannot evaluate, plus a genuine future migration that will one day require holders to move funds. That combination is close to ideal for fraud, and the pattern is predictable enough to inoculate against now. Expect quantum-safe wallets sold with urgency and no verifiable engineering behind them; expect migration assistants offering to move your coins to a post-quantum address; expect scanners that will check whether your keys are quantum-vulnerable if you connect a wallet or paste a phrase; expect support staff contacting you first about an upgrade deadline.

The defences are the ordinary ones, and they hold here without modification. Nobody legitimate ever needs your recovery phrase, for any reason, including a security migration — a real migration is something you perform in your own wallet with your own keys, and the entire point of a self-custody system is that no third party can or should do it for you. Direction of contact remains the sharpest single test: the FBI's Internet Crime Complaint Center has repeatedly documented tech-support and organisation impersonation as a major fraud category, and the structural rule that follows is that genuine support answers channels you opened rather than opening them. Urgency is the other reliable tell. A real protocol migration measured in years does not require you to act within the hour, and any message compressing a multi-year engineering timeline into a same-day deadline is telling you what it is. Finally, apply a healthy scepticism to the sales pitch itself: at the time of writing there is no activated post-quantum address type on Bitcoin to migrate to, which means anything marketed today as a completed quantum migration for your bitcoin is describing something that does not yet exist.

Authority sources used

Outbound links are included for verification and entity authority, not decoration.

• BIP-361: Post Quantum Migration and Legacy Signature SunsetBitcoin Improvement Proposals
• BIP-360: Pay to Merkle Root (P2MR)Bitcoin Improvement Proposals
• NIST Releases First 3 Finalized Post-Quantum Encryption StandardsNational Institute of Standards and Technology
• Protect your privacyBitcoin.org
• Tech/Customer Support and Government ImpersonationFBI Internet Crime Complaint Center (IC3)

FAQ