Bitcoin and quantum computing for companies

Last checked 4 November 2026. This is a fast moving research area. We separate what is established from what is estimated or proposed, and we state no dates as fact. If anything here conflicts with the linked source, the source wins.

Quantum computing comes up in board discussions about bitcoin more and more. This page explains, calmly and with sources, what a large quantum computer could mean for bitcoin, which coins would be most exposed, what is known and what is not, which changes are being discussed, and what a small company can sensibly do now. Nothing here needs urgent action.

What could be affected
Exposed public keys
Known and not known
Proposals under discussion
Practical steps now

What a quantum computer could affect

Bitcoin signatures use elliptic curve cryptography (ECDSA, and Schnorr signatures since Taproot). Their security rests on the fact that a private key cannot practically be worked out from its public key. In 1994 Peter Shor described an algorithm that would let a large enough quantum computer solve this problem efficiently. Such a machine is often called a cryptographically relevant quantum computer.

Source: arXiv: Peter Shor: polynomial time algorithms for prime factorisation and discrete logarithms on a quantum computer, Bitcoin BIPs: BIP 340: Schnorr signatures for secp256k1, Bitcoin BIPs: BIP 341: Taproot, SegWit version 1 spending rules.

Researchers estimated in 2017 that breaking a 256 bit elliptic curve key would need about 2,330 logical qubits. Logical qubits are error corrected and each needs many physical qubits, so this is not the same as the qubit counts quoted for machines today. Estimates keep falling: in 2025 a Google researcher estimated that 2048 bit RSA (a different system) could be broken with under a million noisy qubits running for about a week.

Source: arXiv: Roetteler and others (2017): quantum resource estimates for computing elliptic curve discrete logarithms, arXiv: Gidney (2025): how to factor 2048 bit RSA integers with less than a million noisy qubits.

In our reading, most public discussion focuses on signatures rather than on mining or the hashes used in addresses. Bitcoin Optech keeps a running list of the research and proposals.

Source: Bitcoin Optech: Topic: quantum resistance (running list of proposals and discussion).

Exposed public keys and address reuse

The risk depends on whether a coin's public key is already visible on the public ledger. BIP 360 calls an attack on keys that stay visible for a long time a "long exposure" attack, and expects these to come first. A "short exposure" attack, on a key visible only while a transaction waits to be confirmed, would need a faster machine.

Source: Bitcoin BIPs: BIP 360: Pay to Merkle Root (P2MR), status Draft.

Situation	Public key visible?	Why
Coins on a hashed address never spent from (addresses starting 1, 3 or bc1q)	No, until spent	Only a hash of the key or script is on chain.
A hashed address that has already been spent from and then received more	Yes	Spending reveals the public keys, so reusing the address leaves new coins on a visible key.
Taproot outputs (addresses starting bc1p)	Yes	The output itself contains a public key.
Very old pay to public key outputs and bare multisig	Yes	The public key is written in the output.
Any transaction waiting in the mempool	Briefly	Spending reveals the key until the transaction confirms.

Source: the output type table in BIP 360.

Source: Bitcoin BIPs: BIP 360: Pay to Merkle Root (P2MR), status Draft.

A multisig descriptor or extended public key (xpub) contains public keys. Sharing it with an auditor or software provider exposes those keys off chain. Share it only where needed and keep a record of who has it.

Source: Bitcoin BIPs: BIP 380: Output script descriptors, general operation (wallet backups and exports), Bitcoin BIPs: BIP 32: Hierarchical deterministic wallets (extended keys).

What is known and what is not

Topic	Established	Uncertain or speculative
The maths	Shor's algorithm would break elliptic curve signatures on a large enough fault tolerant quantum computer.	Exactly how many qubits and how much time a real attack would need. Estimates have fallen and may keep changing.
Today	NIST finalised its first post quantum standards in August 2024, including the signature schemes ML-DSA (FIPS 204) and SLH-DSA (FIPS 205).	When, or whether, a machine able to break bitcoin keys will exist. BIP 360's authors write that it is unclear when or if one will be viable.
Bitcoin	No post quantum signature or output type is active on bitcoin today. Changes would need a soft fork with wide support.	Which proposal, if any, will be adopted, and how coins on exposed keys would be treated.
Governments	The NCSC asks organisations to plan their own migration to post quantum cryptography, with milestones in 2028, 2031 and 2035. NIST has a draft transition plan (IR 8547).	These are planning targets for organisations' own systems, not forecasts of when bitcoin keys could be broken.

Source: arXiv: Peter Shor: polynomial time algorithms for prime factorisation and discrete logarithms on a quantum computer, NIST: NIST releases first three finalised post quantum encryption standards (August 2024), NIST: FIPS 204: Module lattice based digital signature standard (ML-DSA), NIST: FIPS 205: Stateless hash based digital signature standard (SLH-DSA), Bitcoin BIPs: BIP 360: Pay to Merkle Root (P2MR), status Draft, NCSC: Timelines for migration to post quantum cryptography, NIST: IR 8547 (initial public draft): transition to post quantum cryptography standards.

Some sources give dates for when such a machine might arrive. We do not repeat them as fact, because they are estimates and they differ widely.

Proposals under discussion

Bitcoin changes start as BIPs (Bitcoin Improvement Proposals). A BIP number and a "Draft" status mean a proposal is written up for discussion. It does not mean it has been accepted or will activate. Status below is as shown in the BIP index on 4 November 2026.

Source: Bitcoin BIPs: BIP index with the current status of each proposal.

Proposal	Status	What it would do
BIP 360: Pay to Merkle Root (P2MR)	Draft	A new output type like Taproot but with the key path spend removed, so coins are not left on a visible public key. Its authors say it protects only against long exposure attacks, and that post quantum signatures may be needed later for full protection.
BIP 361: Post quantum migration and legacy signature sunset	Draft (informational)	Assumes a post quantum output type exists first. Phase A would stop new payments to quantum vulnerable addresses. Phase B would later restrict old style signatures, subject to a rescue process. It depends on a post quantum signature BIP that does not exist yet.
Post quantum signature schemes	Research	Schemes such as those standardised by NIST are being discussed for bitcoin. Their signatures are much larger than today's, which affects fees and block space.

Source: Bitcoin BIPs: BIP 360: Pay to Merkle Root (P2MR), status Draft, Bitcoin BIPs: BIP 361: Post quantum migration and legacy signature sunset, status Draft, NIST: FIPS 204: Module lattice based digital signature standard (ML-DSA), NIST: FIPS 205: Stateless hash based digital signature standard (SLH-DSA), Bitcoin Optech: Topic: quantum resistance (running list of proposals and discussion).

BIP 361 would restrict coins whose owners do not move them, so it raises questions beyond the technical ones. Follow the discussion through Bitcoin Optech rather than headlines.

Practical steps for a small company now

Do not reuse addresses. Use a fresh receiving address for every payment, which wallets do by default from one seed. This is good privacy practice anyway.
Do not leave coins on an address that has already been spent from. Change from a spend goes to a new address in normal wallets. Check yours does.
Share the descriptor and xpubs only where needed. Keep a list of who has a copy.
Keep the 2 of 3 multisig. Quantum risk is not a reason to change custody model, and we do not recommend a single signature wallet for a company treasury.
Keep software and firmware current from each maker's official source, so the wallet can support a new output type if one is adopted.
Add it to the risk register. Note it, name an owner and review it yearly, for example at the board meeting.
Be wary of "quantum safe" offers. Unsolicited requests to move funds to a new "quantum safe" wallet are a scam pattern. See scams aimed at companies.

Source: Bitcoin.org: Protect your privacy: use a new address for each payment, Bitcoin BIPs: BIP 32: Hierarchical deterministic wallets (extended keys), Bitcoin BIPs: BIP 360: Pay to Merkle Root (P2MR), status Draft.

Our judgement, not a rule: for a small company the sensible response today is good housekeeping, not a rush to act. Avoiding address reuse, keeping the descriptor private and reviewing the topic once a year costs little and helps whatever happens.

Sources

Primary sources only. Each link was checked on 4 November 2026. Rules change, so confirm the current version with your adviser.

Education, not advice.

This is general information and education only. It is not financial, investment, tax, accounting, legal or regulatory advice, and it is not a recommendation to buy, sell or hold bitcoin or any other asset. It does not take account of your circumstances or those of your company. You must obtain your own official professional advice to confirm this information is correct before acting on it.

Rules change. This information is correct to our understanding at the last-reviewed date, but it may be incomplete or out of date, and official sources take precedence. Bitcoin is volatile. A company that buys it could lose some or all of the money it puts in.

Using this site does not create an adviser or client relationship. IoT Financial is not authorised or regulated by the Financial Conduct Authority (FCA) and is not registered with the US Securities and Exchange Commission (SEC) as an investment adviser. Read the full disclaimer.