Can Quantum Computers Hack Bitcoin? The Quantum Threat Is Getting Closer

In March 2026, a team led by Google estimated that a future quantum computer might break the elliptic-curve cryptography protecting Bitcoin using fewer than 500,000 physical qubits. Seven months later, Alice & Bob estimated that a future quantum computer could recover a Bitcoin private key in about 62 minutes using no more than 29,588 specialized cat qubits. Neither team had performed the attack.

Yet the calculations raised a harder question: are the machines becoming capable of threatening Bitcoin faster than the network can prepare?

The apparent 17-fold difference is not a direct measure of progress. The two studies assume different hardware, error correction, and runtimes. But their findings sharpen an old theoretical concern into a specific engineering challenge, just as Bitcoin developers are debating what to do with coins that may never be moved to safer addresses.

Quantum threat to Bitcoin at a glance

• 29,588 physical cat qubits estimated by Alice & Bob in October 2026 to break a Bitcoin private key in roughly 62 minutes, down from 126,133 in 2023.
• Fewer than 500,000 physical qubits estimated by Google in March 2026 under a superconducting model, down from 317 million in a 2022 surface-code study.
• 120 programmable qubits demonstrated on IBM's Nighthawk r2 in 2026, illustrating the gap between lab hardware and cryptanalytic scale.
• 6.04 million BTC (30.2% of circulating supply) with public keys exposed at rest on-chain in May 2026, comprising 1.92 million structurally exposed and 4.12 million operationally exposed coins.
• 128 bits of effective security left on SHA-256 under Grover's algorithm, keeping Bitcoin mining and blockchain history safe while digital signatures face direct risk.
• 10% subjective probability estimated by Google co-author Justin Drake of a cryptographically relevant quantum computer arriving by 2032.

The Part of Bitcoin a Quantum Computer Could Break

Bitcoin ownership relies on digital signatures. A private key signs a transaction; a corresponding public key lets the network verify it. Older Bitcoin transactions commonly use ECDSA, while the Taproot upgrade uses Schnorr signatures. Both depend on the mathematical difficulty of deriving a private key from a public key.

Shor's algorithm could solve that mathematical problem on a sufficiently powerful, fault-tolerant quantum computer, allowing an attacker to derive the private key and authorize a competing transfer of those funds. Importantly, this threat is limited to digital signatures. Bitcoin mining and blockchain history rely on hashing (SHA-256), which is fundamentally different.

While Shor's algorithm attacks signature math directly, the primary quantum tool against hashing,known as Grover's algorithm,only speeds up brute-force guessing. Grover's algorithm merely cuts SHA-256's effective quantum security in half, to 128 bits. That still leaves an astronomically large number of combinations to search through, keeping the network secure and well within range of Bitcoin's routine proof-of-work difficulty adjustments. Because of this, Google and leading cryptographers agree that the realistic quantum risk is stolen private keys, not broken mining or rewritten transaction history.

How Researchers Cut the Estimated Cost of an Attack

The downward trend predates this year. In a 2017 study, researchers estimated circuit resources for elliptic-curve discrete logarithms; their bound for a 256-bit field was 2,330 algorithmic qubits, before the physical overhead of fault-tolerant error correction. That number must not be plotted alongside modern physical-qubit estimates as if it measured the same thing.

A 2022 hardware model estimated 317 million physical qubits to attack Bitcoin's 256-bit curve within one hour, or 13 million if the computation could run for a day, under specified surface-code conditions. A 2023 cat-qubit study proposed 126,133 physical cat qubits operating for nine hours. The stark variation already showed how strongly these estimates depend on the chosen technology and time limit.

Google's March 2026 work took a different step. The study was later published in the peer-reviewed journal PRX Quantum in August 2026. It described circuits needing fewer than 1,200 logical qubits with 90 million Toffoli gates, or fewer than 1,450 with 70 million gates.

Under its model for superconducting hardware, with physical error rates of 0.001, the authors estimated a minutes-long attack using fewer than half a million physical qubits. Physical qubits are the actual building blocks of a quantum computer, but they are highly sensitive to errors. Logical qubits use multiple physical qubits and error-correction techniques to protect information and make calculations more reliable.

This distinction matters because a quantum computer may need many physical qubits to operate a much smaller number of logical qubits. To understand why Alice & Bob’s October 2026 estimate dropped so steeply, it helps to look at how quantum calculations fail.

Qubits are extraordinarily fragile and suffer from two main types of physical noise: "bit-flips" (where a 0 accidentally flips to a 1) and "phase-flips" (a disruption in the quantum wave's timing).

Standard quantum designs must deploy hundreds of extra physical qubits just to babysit each calculation and catch both types of errors simultaneously. Cat qubits are engineered to mechanically prevent bit-flips directly at the hardware level. Because the chip itself takes care of half the error problem, the system can use a far leaner error-correction scheme (low-density parity-check, or LDPC codes) to handle the remaining phase-flips.

Alice & Bob calculated that just 29,588 of these specialized physical qubits could yield 1,462 error-corrected logical qubits,enough to recover a Bitcoin private key in roughly 61.8 minutes. The researchers developed this architecture primarily for an attack on RSA encryption, then adapted parts of that model to estimate the Bitcoin attack. Their findings were published as a preprint, and neither attack has been demonstrated on physical hardware.

Crucially, the 29,588-qubit estimate relies on demanding theoretical assumptions: a one-microsecond error-correction cycle, a ten-microsecond classical reaction time, and the complete hardware suppression of bit-flips. Alice & Bob acknowledged that turning these assumptions into physical machines presents steep engineering hurdles.

2026 studiesEarlier studies

Webber et al. (2022)1 hour · surface code317 million

Webber et al. (2022)24 hours · surface code13 million

Gouzien et al. (2023)9 hours · repetition cat code126,133

Google (March 2026)Minutes · superconductingUnder 500,000

Alice & Bob (October 2026)61.8 minutes · LDPC cat code29,588

10K100K1M10M100M

Show the numbers

Study	Physical qubits	Attack time	Architecture
Webber et al. (2022)	317 million	1 hour	Surface code
Webber et al. (2022)	13 million	24 hours	Surface code
Gouzien et al. (2023)	126,133	9 hours	Repetition cat code
Google (March 2026)	Under 500,000	Minutes	Superconducting
Alice & Bob (October 2026)	29,588	61.8 minutes	Ldpc cat code

The studies use different architectures, error-correction assumptions and attack durations, so the values are not a like-for-like improvement series. The 2017 estimate of 2,330 algorithmic qubits from Roetteler et al. counts logical qubits and is left off for that reason. Data: Webber et al. (2022) · Gouzien et al. (2023) · Google Quantum AI (2026) · Alice & Bob (2026)

How Far Today's Quantum Computers Are From Breaking Bitcoin

Even the smaller October estimate describes a machine far beyond demonstrated systems. IBM's Nighthawk r2 has 120 programmable superconducting qubits and demonstrated accurate computational estimations on circuits containing over 7,500 gates without error accumulation crashing the calculation. Quantinuum's Helios uses 98 trapped-ion qubits and has reported high-fidelity gate operations in a peer-reviewed study. Neither achievement is a demonstration of millions of fault-tolerant cryptanalytic operations.

Other experiments have reached much larger numbers. In 2025, researchers demonstrated an array containing more than 6,100 neutral-atom qubits. But that experiment did not show a machine capable of running the long, reliable calculations needed to break Bitcoin. Having more qubits does not automatically mean a computer is closer to carrying out an attack.

The most revealing comparison comes from Alice & Bob itself. On October 20, the company reported three separate demonstrators: two six-qubit chips and one twelve-qubit chip. They tested important components of its cat-qubit error-correction scheme, but the measured logical error rate had not yet fallen below the required threshold. Nine days later, the company published a design for a Bitcoin-related attack using nearly 30,000 cat qubits.

The chasm between today's hardware and a Bitcoin attack is one of scale and stamina. Running a cryptanalytic attack requires executing tens of millions of continuous, error-corrected operations across thousands of synchronized qubits. Today's commercial processors can execute several thousand operations before physical noise crashes the calculation. Bridging that gap requires scaling up physical qubit counts by orders of magnitude while simultaneously driving physical error rates low enough for error correction to take hold.

Modeled attack designsNot built

Google, March 2026

Under 500,000 physical qubits

Superconducting design; attack in minutes at assumed error rates.

Alice & Bob, October 2026

29,588 physical cat qubits

Attack in 61.8 minutes, relying on specialized error correction and strong hardware assumptions.

Hardware demonstrated in 2026Built

Alice & Bob test chips, October 20

6, 6 and 12 qubits, on three separate chips

Tested error-correction parts; logical errors not yet below the required threshold.

IBM Nighthawk r2

120 programmable qubits

Accurate observable estimation on circuits with more than 7,500 gates.

Quantinuum Helios

98 physical qubits

Trapped-ion processor with high-fidelity gate operations.

Researchers have cut the estimated resources needed to attack Bitcoin. No existing quantum computer has shown the scale and reliability those attacks need.

Data: Google Quantum AI · Alice & Bob attack research · Alice & Bob hardware results · IBM Nighthawk r2 · Quantinuum Helios

Experts disagree about when quantum computers could become a practical threat to Bitcoin. In an April 2026 Bloomberg interview, Blockstream CEO Adam Back argued that the threat was not imminent. Google research co-author Justin Drake offered a more urgent assessment, giving a subjective 10% probability of a cryptographically relevant quantum computer arriving by 2032 during an April 26 interview with Blockspace. Alice & Bob has also suggested an early-2030s convergence between improving hardware and declining resource requirements. These remain predictions rather than established timelines.

Which Bitcoin Holdings Would Be Exposed First?

The vulnerability of a Bitcoin wallet comes down to whether its public key is visible on the ledger. Think of a public key like a keyhole, and a private key like the physical key that opens it.

Standard addresses (like legacy P2PKH and native SegWit) don't display the keyhole in public; they hide it behind a cryptographic hash,essentially placing a protective metal faceplate over the keyhole. A quantum computer cannot attack what it cannot see.

Modern Taproot addresses, however, expose that keyhole on the blockchain the moment funds arrive to enable greater script flexibility. Similarly, when someone spends from a standard hashed address, they must reveal the public key to authorize the transfer. If that address is ever reused to receive more funds, the protective cover is permanently gone, leaving the remaining balance directly exposed. This structural versus operational exposure is formalized in the BIP 360 draft.

Glassnode's May 20, 2026 analysis estimated that 6.04 million BTC, 30.2% of the then-issued supply, had public keys exposed while the coins were at rest. Of that total, 1.92 million BTC was structurally exposed and 4.12 million operationally exposed, primarily through reuse and custody practices. Another 13.99 million BTC had no public-key exposure at rest under Glassnode's definitions. That did not make those coins immune to an attack when spending.

6.04 million BTC potentially exposed at rest, about 30.2% of issued supply

• Not exposed at rest 13.99 million BTC · 69.8%

  Public keys not exposed while the coins sit unspent. They can still be exposed when spent.

• Operationally exposed 4.12 million BTC · 20.6%

  Exposed through spending patterns, address reuse, and wallet or custody practices.

• Structurally exposed 1.92 million BTC · 9.6%

  Exposed by the output type itself, including some early outputs and Taproot outputs.

The 6.04 million BTC total is the operational and structural segments added together, not a fourth segment. Data: Glassnode, Measuring Bitcoin's Quantum-Exposed Supply (May 20, 2026)

Why do other figures differ? Google's study discusses roughly 6.7 million BTC in exposed-key categories, while Coin Metrics reports roughly 6.9 million. They use different snapshots, categories and underlying research, so they should not be presented as three measurements taken on the same day. None is a count of coins currently stealable by a working quantum computer.

Early Bitcoin holdings create another potential target. Many coins from Bitcoin's earliest years use P2PK outputs that permanently reveal their public keys. Some have been statistically attributed to Satoshi Nakamoto, although their exact ownership remains unproven. If the original owners have lost access to their keys, they cannot voluntarily migrate those funds to safer addresses.

The timing of an attack matters. An attacker targeting an already-exposed public key could spend hours recovering its private key while the coins remain untouched. By contrast, an attacker targeting a newly broadcast transaction would need to recover the key and get a conflicting transaction confirmed before the legitimate payment settles. Alice & Bob's modeled 61.8-minute attack would generally be too slow for a typical ten-minute confirmation window, although Bitcoin's block intervals vary and ten minutes is not a guaranteed deadline. These scenarios represent different levels of risk, not a single pool of Bitcoin that could automatically be stolen.

Bitcoin Has Potential Defenses, but No Settled Migration

Bitcoin already has candidates for improving protection, yet the central proposals were still drafts in November 2026. BIP 360 proposes a new Bitcoin output type called Pay-to-Merkle-Root (P2MR). It removes a Taproot feature that exposes a public key before coins are spent. This could help protect coins whose public keys have not been revealed elsewhere. However, it would not protect against a quantum attack while a transaction is waiting for confirmation. Stronger protection would still require quantum-resistant signatures.

BIP 361 proposes a phased transition away from quantum-vulnerable signatures once a suitable post-quantum system has been implemented. Under the proposal, new payments to vulnerable address types would eventually be restricted, followed by additional spending requirements for older coins. Its proposed three- and five-year milestones would begin after a future activation, not from an already established deadline.

The central governance dilemma is what happens to Bitcoin that never migrates. In a September 2026 analysis, BIP 361 co-author Jameson Lopp examined the tension between protecting the network from quantum theft and preserving the property rights of existing holders. While researchers are exploring zero-knowledge methods for owners to prove coin control without revealing vulnerable keys, these tools may not work for early Satoshi-era outputs whose owners have lost access.

Freezing or restricting legacy signatures after a sunset period would stop quantum attackers from raiding dormant treasuries, but it would also permanently confiscate funds from legitimate, inactive holders. No consensus exists among developers on this trade-off. Technical hurdles also complicate the transition. While NIST finalized post-quantum standards like ML-DSA and SLH-DSA in 2024, these algorithms produce signatures hundreds of times larger than ECDSA or Schnorr. On-chain, larger signatures consume scarce block space, bloating validation requirements and sending transaction fees soaring during a mass migration.

Alternative proposals, such as Blockstream Research's hash-based SHRINCS opcode, offer more compact signatures but introduce new operational challenges, like securing signing-device states during wallet backups. Discussions across the Bitcoin Development Mailing List reflect broad agreement that an upgrade must happen eventually, but deep division over which signature scheme balances cryptographic safety, transaction costs, and backward compatibility.

What Holders, Exchanges and Crypto Casinos Can Do Now

For Bitcoin holders, today's primary defense lies in understanding the limits of existing security setups. While hardware wallets and cold storage protect against malware, remote key extraction, and phishing, they cannot conceal a public key that has already been published to the blockchain ledger. Keeping coins offline reduces conventional operational risks, but it provides zero added protection against a quantum computer once the corresponding public key is visible.

For crypto casinos, high-volume betting platforms, and their players, this creates a clear operational vulnerability: automated address reuse. Online casinos process thousands of transactions daily. To simplify accounting, platforms often assign players static deposit addresses or sweep incoming funds into central "hot wallets" over and over again. The moment an automated sweep sends coins out of an address, that address's public key is published to the blockchain forever. If the casino continues using that same address to hold player balances or house reserves, those funds sit completely unshielded.

A future quantum attacker wouldn't need to intercept transactions in real time; they could simply scan the blockchain for wealthy casino cold-storage or reserve addresses that were previously spent from, derive the private keys at their convenience, and drain the funds. Players who repeatedly withdraw winnings back to the same legacy address face the exact same risk.

This is not a reason for immediate panic,no quantum machine today can execute this attack. Casinos face far more pressing threats from server hacks, phishing, and hot-wallet credential leaks. But the defense against future quantum theft starts with basic operational habits today: casinos should use automated wallet architectures that generate fresh addresses for every deposit, and players should ensure they withdraw to a newly generated address every time.

Our Crypto Gambling Statistics 2026 provides context on cryptocurrency activity in the gambling industry, but does not measure quantum-exposed casino holdings. Other cryptocurrencies, including Ethereum, also use elliptic-curve signatures, meaning they face related quantum threats, although their account systems and migration challenges differ from Bitcoin's.

A Shrinking Model Is Not an Imminent Hack

The strongest finding of 2026 is that researchers have made the hypothetical quantum attack on Bitcoin materially less resource-intensive on paper. Real computers have not demonstrated the fault-tolerant capability required to carry it out. Meanwhile, protecting exposed coins and coordinating a network-wide migration could take considerable time.

That leaves an important but unresolved risk: algorithmic progress and hardware advances may outpace Bitcoin's ability to agree on and deploy defenses. The evidence does not support a countdown to a quantum theft. It does support taking the transition seriously before the necessary machine exists.