chain · quantum risk

Is Bitcoin Quantum Proof?

Risk: high · Confidence: high · Reviewed: 2026-07-19

Verdict

Bitcoin is not quantum-proof. Shor’s algorithm threatens spendable keys once public keys are known. Hash-locked addresses that never spent are better until first spend—but the ecosystem still needs a long-term PQC path.

Overview

When people ask “is Bitcoin quantum proof?” they usually mean one of two things: can a quantum computer steal coins, or can it break mining? Those are different cryptographic stories. Theft risk centers on classical digital signatures (ECDSA and Taproot Schnorr). Mining risk centers on hash-based proof-of-work and Grover-style search—not the same as Shor breaking secp256k1.

A cryptographically relevant quantum computer (CRQC) that runs Shor’s algorithm could derive private keys from known public keys. On Bitcoin, public keys often appear when coins are spent. Until then, many address formats only publish a hash of the key—so an attacker cannot target what they cannot see. That nuance matters, and it collapses the moment addresses are reused.

This hub is the canonical starting point on isquantumproof.com. Deep dives cover address reuse, early P2PK coins, mining versus signatures, and custody practice. Related long-form briefing and the older system hub remain linked for readers who want more narrative detail.

Cryptographic profile

Signatures: ECDSA-secp256k1, Schnorr (Taproot)
Hash: SHA-256, RIPEMD-160
Public-key exposure: Typically revealed on spend; early P2PK and reused addresses expose keys earlier or permanently.

What breaks

ECDSA spend paths when the public key is on-chain or revealed
Schnorr/Taproot keys under discrete-log assumptions once exposed
Reused addresses that keep public keys permanently public
Legacy P2PK outputs with naked public keys

Mitigations

Never reuse addresses; prefer modern hashed outputs
Inventory UTXOs that already exposed public keys (especially early coins)
Separate mining (Grover) planning from signature (Shor) theft planning
Institutions: key ceremonies, cold storage policy, and migration research now

FAQ

Is Bitcoin quantum-proof in one word?

No. Signature schemes used to authorize spends are not quantum-safe. Practical risk depends on whether public keys are already known for a given UTXO.

Are unused hashed addresses safe forever?

They are safer until first spend because the raw public key may not be public yet. After spend—or with reuse—they inherit the same Shor-class exposure as any revealed key.

Is this investment advice?

No. This site provides educational cryptography and risk framing only.

Key concepts (technical dictionary)

Terms used on this page — open a definition:

Full technical dictionary →