← Back to Blog Research

Will Quantum Computers Break Bitcoin? Blockchain Post Quantum Cryptography Status in 2026

15 min read

The Question Every Crypto Holder Is Asking

Will a large quantum computer drain every Bitcoin wallet? The honest answer is that it depends on how the wallet was used, how much time the community has to migrate, and whether the industry actually follows through on the proposals now sitting in BIPs and EIPs. What is no longer in question: Bitcoin and Ethereum as deployed today use ECDSA and related elliptic-curve primitives that Shor's algorithm breaks in polynomial time. If a cryptographically relevant quantum computer (CRQC) arrives, the blockchain world has an urgent, unavoidable migration problem.

This research post walks through the current state of blockchain Post Quantum Cryptography as of April 2026, including BIP-360 (quantum-resistant addresses), BIP-361 (the legacy signature sunset), Vitalik Buterin's Ethereum quantum roadmap, and the live proposals like EIP-8141.

Why Bitcoin Is Vulnerable

Bitcoin addresses fall into broadly two classes from a quantum perspective:

Addresses where a public key has never been revealed. These are pay-to-public-key-hash (P2PKH) and similar addresses that have never spent outputs. The public key is hashed but not revealed. Shor cannot attack what it cannot see. A CRQC would have to wait for a spend transaction to get the public key.
Addresses where the public key has been revealed. Pay-to-public-key (P2PK, early Bitcoin including Satoshi's coins), reused P2PKH addresses after a spend, and any output that publishes the pubkey on chain. These are directly vulnerable once a CRQC exists.

Estimates of the total Bitcoin exposed in vulnerable address types vary. Reused addresses and early Satoshi-era coins represent a non-trivial fraction. The migration problem is the entire user base, not just the miners.

BIP-360 and BIP-361

BIP-360, known as P2MR (Pay-to-Merkle-Root), defines a quantum-resistant address type for Bitcoin. The proposal uses a Merkle tree of post-quantum public keys so a spending transaction reveals only the necessary PQC key. The proposal has been under discussion for several years. A public reference is bip360.org.

BIP-361, Post Quantum Migration and Legacy Signature Sunset, was formally assigned on February 11, 2026. Co-author Jameson Lopp is one of the most widely respected Bitcoin engineers. BIP-361 proposes a coordinated migration path and, critically, a deadline after which legacy ECDSA signatures would no longer be accepted. The sunset is the hard part. It is a social coordination problem on a scale the community has never attempted. Expect years of debate before activation.

Ethereum: EIP-8141 and Vitalik's Roadmap

In February 2026, Vitalik Buterin published a four-year Ethereum quantum roadmap. The plan covers:

Transition from BLS signatures to hash-based signatures for validator consensus.
Account abstraction extensions that let wallets use ML-DSA or SLH-DSA signatures at the application layer.
EIP-8141 as one of the concrete proposals implementing post-quantum primitives at the protocol level.

Ethereum has two advantages over Bitcoin for this migration. The account abstraction system allows wallet-level crypto changes without a hard fork. And the validator set is smaller and more coordinated than Bitcoin's mining population, making consensus-level changes more tractable.

What About Proof of Work Itself?

Bitcoin's SHA-256 proof of work is symmetric. Grover's algorithm provides only a quadratic speedup, reducing effective work to roughly 128 bits. This halves mining difficulty from a quantum attacker's perspective but does not break PoW. The real quantum threat is to signatures, not mining.

Layer 2 and Sidechain Implications

Lightning Network, Liquid, Polygon, Optimism, Arbitrum, Solana, and every other L1/L2 uses elliptic-curve cryptography somewhere. Each chain's PQC roadmap is independent. Solana's Ed25519-based validator signatures would also need migration. The PQC-for-blockchain story is not a single migration, it is a thousand parallel ones.

Zero-Knowledge Proofs and Rollups

ZK rollups use elliptic curve pairings for their proof systems. Some pairing-based primitives have no known efficient quantum attacks (yet), but hash-based STARKs are often preferred for post-quantum resistance. Expect rollup teams to move toward STARK-based systems more aggressively as Q-Day estimates tighten.

Wallet Security Today

If you hold cryptocurrency today, practical advice for the quantum era:

Do not reuse addresses. Use a new address for every receipt. This limits public-key exposure.
Prefer P2WPKH, P2TR, and similar address types that hash the public key.
Monitor BIP-360 and BIP-361 activation. When a P2MR address type is live, migrate holdings.
On Ethereum, track account abstraction upgrades that add PQC signature support.
For large holdings, consider multi-signature schemes that combine classical and post-quantum primitives as a belt-and-braces approach.

What Can Still Go Wrong

Even with BIP-360 and EIP-8141 successfully deployed, the migration is a race. If a CRQC arrives before the broad community migrates holdings, tens of billions of dollars of cryptocurrency is exposed. This is not a hypothetical. The Global Risk Institute 2025 survey raised the pessimistic 10-year probability floor to 28 percent. The window is shrinking.

QNSQY and Crypto Custody

QNSQY is a Post Quantum Cryptography data encryption platform. It is used by crypto exchanges, custody providers, and individual holders to protect off-chain data: seed backups, hardware wallet firmware builds, KYC archives, and wallet infrastructure configuration. The on-chain migration is up to the chain. The off-chain security posture is under your control today.

Bottom line. Bitcoin and Ethereum are quantum-vulnerable as deployed. Migration paths exist (BIP-360, BIP-361, EIP-8141). The question is whether the community migrates faster than quantum computing scales.

Frequently Asked Questions

Can quantum computers break Bitcoin today?

No. Current quantum hardware (IBM Condor at 1,121 qubits, Google Willow at 105 qubits) cannot run Shor's algorithm against 256-bit elliptic curves. But Bitcoin's ECDSA scheme would be broken by a sufficiently large fault-tolerant quantum computer.

What is BIP-360?

BIP-360 is a Bitcoin Improvement Proposal defining P2MR (Pay-to-Merkle-Root), a quantum-resistant address type that uses a Merkle tree of post-quantum public keys.

What is BIP-361?

BIP-361, Post Quantum Migration and Legacy Signature Sunset, was formally assigned on February 11, 2026, with Jameson Lopp as co-author. It proposes a coordinated migration and an eventual deadline after which legacy ECDSA signatures would no longer be accepted.

What is Ethereum's quantum plan?

In February 2026 Vitalik Buterin published a four-year Ethereum quantum roadmap that includes moving from BLS to hash-based validator signatures, extending account abstraction for PQC wallet signatures, and concrete proposals like EIP-8141.

Does Bitcoin mining itself become insecure?

No. SHA-256 proof of work is symmetric. Grover's algorithm gives only a quadratic speedup, reducing effective work to about 128 bits. The real quantum threat is to signatures, not mining.

Sources

Protect Your Data Before Q-Day Arrives

QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.

Try QNSQY

Originally published at quantumsequrity.com/blog/pqc-blockchain-bitcoin-ethereum.