Q-Day for BTC: What happens if a quantum computer breaks Bitcoin?

​The public keys of more than 6 million BTC have already been exposed, making these coins potentially vulnerable. A sufficiently powerful quantum computer could theoretically derive the corresponding private keys, putting hundreds of billions of dollars at risk. What would happen to Bitcoin if such technology emerged before the network could transition to quantum-resistant cryptography?

This is not a scenario in which the blockchain suddenly stops producing blocks or someone breaks the SHA-256 cryptographic hash function. The main threat in this case concerns digital signatures.

Today, only the holder of a private key can validly sign a BTC transaction, while the network verifies the signature using the public key. Shor's algorithm theoretically allows a sufficiently powerful quantum computer to derive a private key from its corresponding public key, enabling an attacker to spend someone else's coins.

Bitcoin could therefore continue operating even after the "attack of the century" begins.

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

Miners would continue producing blocks and nodes would keep validating transactions, but digital signatures would no longer reliably prove ownership of certain coins. The problem would then extend far beyond individual wallets: Bitcoin is already held in ETFs, corporate reserves and other traditional financial products.

How could Bitcoin be hacked?

Today, guessing a private key using a conventional computer is practically impossible. This computational difficulty underpins the security of ECDSA and Schnorr, the two digital signature schemes used in Bitcoin, both based on secp256k1 elliptic-curve cryptography.

Quantum computers change that equation. Shor's algorithm can solve the mathematical problem underlying this cryptography fundamentally faster. If a quantum computer becomes powerful enough, an attacker would only need to obtain a public key, derive the corresponding private key and sign a transaction transferring someone else's BTC.

To the network, such a transaction would appear valid. The blockchain does not know who originally controlled the key; it only verifies the mathematical signature.

After a successful quantum attack, the current protocol would therefore have no way to distinguish the legitimate owner from an attacker.

However, not all wallets are equally vulnerable. According to Glassnode, by May 2026, public keys had been permanently exposed for approximately 6.04 million BTC, or 30.2% of the issued supply. The BIP-361 proposal provides a higher estimate of more than 34%, but the methodologies differ, so the figures should not be treated as directly comparable.

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

Particularly vulnerable are older P2PK outputs, which represent records of spendable balances, and Taproot P2TR outputs, where the public key is directly available in the output structure. Coins associated with addresses whose public keys were exposed during previous transactions are also at risk.

Such a wallet could be attacked in advance, without having to act within the few minutes between broadcasting a transaction and its confirmation. For outputs whose public keys remain hidden behind a hash, the attack window opens only when the coins are spent. Once the transaction is published, an attacker must derive the private key and create a competing transaction before the original is confirmed.

Developers refer to these scenarios as long exposure and short exposure. In the first case, the public key is known in advance, giving an attacker considerably more time. In the second, the limited window dramatically increases the computing power required.

The oldest coins present another problem. A significant portion of the BTC attributed to Satoshi Nakamoto is held in early outputs with already exposed public keys.

If these coins begin moving for the first time in decades after the emergence of a cryptographically relevant quantum computer, the market would not immediately know whether their rightful owner had returned or someone had derived the private keys.

The first hours: From wallets to Wall Street

The blockchain itself could continue producing blocks. The crisis would begin not with a network shutdown, but with a loss of confidence that a digital signature genuinely belongs to a particular user.

One of the first responses from major trading platforms would likely be restrictions on Bitcoin transactions. Exchanges and custodians would need to determine which outputs had already been compromised, whether reserves could be moved safely and whether broadcasting a transaction would expose coins to additional risks.

At the same time, holders would begin migrating funds away from vulnerable addresses. If millions of users attempted to move BTC simultaneously, the mempool could become severely congested, driving transaction fees sharply higher.

With a sufficiently powerful quantum computer, some of these transfers would themselves create a brief attack window immediately after the public key was revealed.

A loss of confidence in Bitcoin ownership would quickly affect financial products holding the asset on behalf of investors. U.S. spot Bitcoin ETFs hold approximately 1.5 million BTC. Legally, shares in these funds would not disappear, but their operations depend on custodians being able to store and transfer the underlying asset securely.

A quantum attack could disrupt the creation and redemption of ETF shares. If a custodian cannot safely move reserves or guarantee control over them, the arbitrage mechanism linking Bitcoin's value to ETF prices could break down.

Funds would likely have to restrict operations until they could verify the security of their assets.

Public companies would face similar problems. Strategy holds more than 848,000 BTC, meaning a sharp price decline or the compromise of part of its reserves would affect more than just its balance sheet.

Its common shares, preferred securities, debt obligations and other instruments through which investors gain indirect exposure to Bitcoin would also come under pressure.

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

Derivatives would also continue to exist. A CME futures contract would not disappear simply because confidence in digital signatures had collapsed. However, the reliability of the underlying asset's reference price would come under pressure if different trading platforms began restricting BTC transactions.

Mining would not necessarily stop either. A quantum computer capable of attacking digital signatures would not gain the same advantage against SHA-256. But if Bitcoin's price collapsed, some mining equipment would become unprofitable, the hash rate would decline, and pressure on network security would emerge through the economics of mining.

Saving Bitcoin means deciding the fate of old coins

Tools for preparing for this scenario already exist. NIST experts have standardized post-quantum digital signature schemes, while Bitcoin developers are discussing ways to prepare the protocol for a transition to new cryptography.

For example, BIP-360 proposes an intermediate step: a new P2MR output type without the Taproot key path vulnerable to quantum attacks. It would allow the creation of outputs resistant to long-exposure attacks and prepare the infrastructure for the possible introduction of post-quantum signatures. However, this approach alone would not protect against rapid private-key recovery after a transaction is broadcast.

Moreover, introducing a new output format would not be enough. Millions of existing coins would remain in older outputs, and this is where the most controversial issue begins.

The draft BIP-361 proposes a two-stage migration. Approximately three years after activation, funds from legacy outputs would be allowed to move only to post-quantum outputs. Another two years later, the rules for spending remaining ECDSA- and Schnorr-protected coins would become significantly stricter.

For some wallets, the authors propose special recovery mechanisms that would allow legitimate owners to prove ownership without relying on the existing vulnerable signatures.

This approach would protect the network against attackers but create another problem. If an owner failed to migrate in time, lost access to backup information or held a wallet too old to support recovery, their BTC could effectively become frozen under the protocol's own rules.

The alternative is even more drastic: leave the rules unchanged and allow whoever first obtains a sufficiently powerful quantum computer to take vulnerable coins. For lost Bitcoin or Satoshi's early outputs, the network would have no automatic way to determine who is the rightful owner and who derived the key decades later.

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

Developers are actively debating this choice. Some argue that quantum-resistant features should be introduced early while avoiding mandatory freezes. Others support a strict migration deadline, reasoning that once a genuinely capable quantum computer emerges, there will no longer be time for an orderly upgrade.

More complex recovery proposals are also being explored.

In 2026, Project Eleven demonstrated a prototype that uses zero-knowledge proofs to establish ownership of an old wallet without relying on its existing signature scheme. However, the approach remains experimental and does not solve the problem for all early addresses, particularly those created before modern seed phrases and standardized backup recovery methods.

A quantum computer, therefore, would not necessarily have to shut Bitcoin down. A far more dangerous scenario is one in which blocks continue to be produced, but existing digital signatures can no longer guarantee that coins are being spent by their rightful owners.

If the transition to post-quantum cryptography begins early, the network will have time for a gradual migration. If the first major theft occurs before that transition, a technical problem will instantly become a financial and political one: Bitcoin will have to decide not only how to protect new transactions, but also who has the right to millions of old BTC.