Market eyes quantum Bitcoin risk as researchers plan staged

Institutional investors are increasingly asking how the quantum Bitcoin narrative affects long-term security assumptions, even though the practical threat still appears distant.

The real scope of the quantum threat

Public discussion often suggests that quantum computing could imminently break Bitcoin. However, machines powerful enough to do so using Shor’s algorithm are likely still decades away, and the real exposure is narrower than dramatic headlines imply.

Bitcoin relies on digital signatures to secure ownership, historically ECDSA and, since Taproot, also Schnorr signatures under BIP340. Both schemes use the same elliptic curve, secp256k1, to derive public keys from private keys in a way that is currently infeasible to reverse with classical hardware.

A fault-tolerant quantum computer able to run Shor’s algorithm at cryptographically relevant scale could, in theory, solve the elliptic-curve discrete logarithm problem. That would allow an attacker to forge valid signatures and directly steal funds, which is why this attack vector attracts the most attention.

Of secondary concern is Grover’s algorithm, which offers a quadratic speed-up for brute-force search problems. It would not outright break SHA-256, but it could reduce the work required to find a valid proof-of-work hash, potentially shifting mining economics and centralisation risks if a quantum miner could outpace today’s ASIC fleets.

Moreover, any such proof-of-work advantage would still depend on real-world engineering: designing and operating a quantum miner superior to specialised ASICs is a separate, enormous challenge, over and above simply running Grover’s algorithm in a lab.

Where Bitcoin is actually exposed

Shor-based attacks only become relevant once a public key is visible on-chain. That exposure profile varies significantly across output types and wallet practices, which is why the quantum risk for Bitcoin is not uniform.

Coins with long-term exposure are those where the public key is revealed when the UTXO is created or remains visible for extended periods. This group includes early P2PK outputs, reused addresses whose funds are tied to keys revealed in earlier spends, and Taproot P2TR outputs, which commit to a tweaked key directly in the UTXO.

In those cases, public keys can be harvested long before any spend occurs. That creates a potential “harvest now, attack later” scenario: if powerful quantum machines existed in the future, they could target long-exposed keys en masse.

By contrast, modern wallet types such as P2PKH (legacy) and P2WPKH (SegWit) use hashed public keys, only revealing the actual key at spend time. However, this sharply limits the window for an attacker, who would need to derive the private key and broadcast a conflicting transaction within the few blocks before the legitimate spend confirms.

Estimates of how many coins are exposed vary. Some analyses suggest that 20–50% of total supply could be vulnerable under broad assumptions. Others argue this overstates practical exploitability, especially when many exposed coins are fragmented across small UTXOs or only briefly visible during mempool races.

One widely cited report narrows the materially exposed, concentrated subset to around 10,200 BTC, which is significant but far from a systemic wipe-out scenario. Moreover, this distinction between theoretical and practical attack surface is critical for credible risk assessment.

The fault-tolerant quantum bottleneck

All of these scenarios assume the existence of large, fault-tolerant quantum computers operating at scales far beyond current devices. Today, publicly known systems are still noisy, small, and incapable of cryptographically meaningful attacks.

Breaking Bitcoin’s elliptic-curve signatures would likely require millions of physical qubits with strong error correction to produce enough stable logical qubits. One recent study estimates that machines may need to be roughly 100,000× more powerful than any quantum processor available today.

Opinions differ on whether such hardware will arrive in time to matter for Bitcoin. That said, many serious forecasts cluster around the mid-2030s to mid-2040s as the earliest plausible window, which gives the ecosystem time but not an excuse for complacency.

Crucially, if meaningful capability ever emerges, the response will need to have been planned, tested, and coordinated years in advance. That is why the discussion has shifted from science fiction to an engineering and governance problem.

Post-quantum standards and migration paths

The core challenge is how Bitcoin could migrate to quantum-resilient cryptography under strict throughput limits, conservative governance, and uneven incentives among holders and service providers.

In 2024, NIST finalised its first set of post-quantum cryptography standards, including lattice-based ML-DSA (Dilithium) and SLH-DSA (SPHINCS+). These schemes are becoming the default candidates for large systems that need to prepare for quantum-safe operations.

For Bitcoin, any realistic migration would likely roll out in stages. New output types and wallet defaults would be introduced, possibly alongside hybrid transactions that require both classical and post-quantum proofs during a long transition period.

However, post-quantum signatures generally come with trade-offs: they are often larger and more computationally heavy to verify, increasing blockspace usage, bandwidth requirements, and validation costs for full nodes. Careful design is needed to avoid stressing network scalability and decentralisation.

There are several plausible directions beyond any single blueprint. Options include quantum-capable output types, hybrid policies for a defined transition window, and wallet defaults that gradually reduce long-lived public-key exposure. A soft fork is the most plausible mechanism to introduce new script types, while a hard fork remains a high-risk last resort because of potential chain splits.

BIP 360 and P2MR as incremental hardening

BIP 360, recently merged into the official BIPs repository, is the most concrete attempt so far to translate high-level concern into an incremental, Bitcoin-native mitigation focused on long exposure patterns.

The proposal introduces a new output type called Pay-to-Merkle-Root (P2MR), designed to be functionally similar to Taproot’s script trees but deliberately removes key-path spending. Instead, all spends must reveal a script path and a Merkle proof.

Conceptually, P2MR is “Taproot-like script trees, but no key-path.” This design directly targets long-lived embedded public keys that are most vulnerable to “harvest now, attack later” scenarios linked to Shor’s algorithm, without immediately committing Bitcoin to heavyweight post-quantum signature schemes.

The main trade-off is size: P2MR spends carry larger witnesses compared with compact Taproot key-path spends. However, proponents argue that accepting slightly larger scripts is justified if it significantly reduces long-duration public-key exposure.

BIP 360 presents P2MR as a foundational building block rather than a final answer. It addresses part of the problem — long-exposure outputs — while short-lived mempool race risks and the shift to full post-quantum signatures would require additional proposals and consensus.

Legacy UTXOs and governance dilemmas

The proposal also underscores a more uncomfortable reality: even with new output types and better wallet defaults, a non-trivial share of the UTXO set will probably remain on legacy scripts indefinitely, creating pockets of structural vulnerability.

Some holdings are simply dormant or lost, with owners who will never sign a new transaction. Others sit in institutional custody arrangements or bespoke setups that move slowly. Moreover, simple human inertia means some users will not voluntarily migrate until a threat feels immediate.

If cryptographically relevant quantum capability ever appears, some long-exposed coins whose owners are unreachable could, in principle, be swept by whoever can derive their private keys first. Even if this is treated as theft rather than protocol failure, the market impact could be severe.

Sudden liquidation of large dormant clusters might shatter confidence, trigger emergency policy debates, and fuel fears about hidden supply overhang. However, proposals to freeze, claw back, or otherwise treat unmigrated coins differently raise explosive questions around immutability, neutrality, and property rights that cut to the core of Bitcoin’s social contract.

The possibility of governance deadlock is one reason why early, measured planning is so important. Once a credible quantum attack is underway, there may be little time or consensus left to improvise radical fixes.

Risks, timelines and realistic readiness

Within the broader debate on bitcoin quantum risk, most serious analysts now agree on a few points: the challenge is real, the timelines are uncertain, and the attack surface is highly uneven across different types of outputs and wallet practices.

Importantly, the ecosystem is not starting from zero. Developers are already exploring soft-forkable enhancements, new output designs like P2MR, and migration strategies informed by emerging standards in other industries. This is precisely the sort of work long-horizon institutional holders want to see.

The most difficult part is coordination. Any significant transition could take years, be politically contentious, and be complicated by coins that never move. That said, Bitcoin’s conservative upgrade culture is also a strength, enabling opt-in, staged change without forcing the entire network onto a rushed, hard-fork deadline.

In that context, the quantum bitcoin risk profile looks less like an imminent existential cliff and more like a long-duration engineering challenge. With ongoing research, prudent wallet design, and incremental protocol hardening, the network still has time to prepare.

Ultimately, the rational posture is clear: preparation beats panic. By treating quantum as a serious but manageable threat, Bitcoin can continue evolving its security model without sacrificing the properties that made it valuable in the first place.