What quantum computers mean for Bitcoin and Ethereum a Q-Day guide for crypto holders

[Cyborg77]

TL;DR

• Bitcoin and Ethereum rely on elliptic curve signatures (secp256k1), which Shor's algorithm on a large fault tolerant quantum computer could break
• A March 2026 paper by Google researchers and collaborators including Dan Boneh and Justin Drake estimated that breaking 256 bit elliptic curve keys would need roughly 1,200 to 1,450 logical qubits, or fewer than half a million physical qubits on suitable hardware, running for minutes
• Coins are most exposed where the public key is already visible on chain, such as early pay to public key outputs, reused addresses and some Taproot outputs; estimates of exposed bitcoin range from a few million BTC to around a third of supply
• Bitcoin developers have proposed BIP-360, a new output type designed to avoid exposing public keys, and the Ethereum Foundation set out a post quantum roadmap in March 2026 targeting 2029
• No quantum computer can break these keys today, so the sensible response is informed preparation, not panic: avoid address reuse, follow wallet guidance and watch the upgrade proposals

Why crypto holders should care about Q-Day

Cryptocurrencies are built on public key cryptography. Owning bitcoin or ether means controlling a private key that can produce valid signatures for transactions. Anyone who could derive that private key from its public key could spend the funds. That is exactly the capability a large quantum computer running Shor's algorithm would provide against elliptic curve cryptography

This makes cryptocurrencies one of the clearest real world examples of quantum risk. Unlike most systems, blockchains publish data permanently and openly, so exposed public keys stay visible forever. Funds can be moved irreversibly, and there is no bank to reverse a theft. The stakes for preparation are therefore unusually high

This thread explains how the risk works, what recent research says, which coins are most exposed and what the Bitcoin and Ethereum communities are doing. It is not financial advice, and nothing here suggests buying or selling any asset. The goal is to help holders understand the technology and make informed decisions. As always on this forum, claims are linked to named sources where possible

How signatures protect your coins

Bitcoin uses the secp256k1 elliptic curve for both ECDSA signatures and, since the Taproot upgrade activated in November 2021, Schnorr signatures. Ethereum also uses ECDSA on secp256k1 for ordinary accounts, while its proof of stake validators use BLS signatures on a different curve. In every case, security depends on the difficulty of the elliptic curve discrete logarithm problem. Classical computers cannot solve it for these key sizes, but Shor's algorithm could on a sufficiently powerful quantum machine

Hash functions add a layer of protection in many cases. Most modern bitcoin addresses are derived from a hash of the public key rather than the key itself. While coins sit unspent at such an address, an attacker sees only the hash, which quantum computers cannot easily reverse. The public key is revealed only when the owner spends from the address

That reveal creates a window. When you broadcast a transaction, your public key becomes visible in the mempool before the transaction is confirmed in a block. In principle, an attacker with a fast enough quantum computer could derive the private key and broadcast a competing transaction during that window. Whether such short range attacks are feasible depends on how fast future quantum computers run, which is why runtime estimates matter

What recent research says

Estimates of the quantum resources needed have fallen sharply. In May 2025, Craig Gidney of Google Quantum AI estimated that RSA-2048 could be factored with fewer than one million noisy qubits in under a week. In March 2026, a paper posted to the IACR ePrint archive by Ryan Babbush, Adam Zalcman, Craig Gidney and colleagues at Google, together with Dan Boneh of Stanford and Justin Drake of the Ethereum Foundation, focused specifically on elliptic curve cryptocurrencies. It estimated that breaking 256 bit elliptic curve keys on secp256k1 would require either about 1,200 logical qubits and 90 million Toffoli gates or about 1,450 logical qubits and 70 million Toffoli gates

Translated into hardware, the authors estimated fewer than half a million physical qubits on superconducting hardware with physical error rates around one in a thousand, with the circuits running in minutes. That runtime is significant because it brings short range attacks on transactions in the mempool into the realm of theoretical possibility once such machines exist. The authors also discussed mitigations for cryptocurrencies. The paper is one of the most important reference points for anyone assessing crypto quantum risk

It is vital to keep this in perspective. No quantum computer today has anything close to a thousand high quality logical qubits capable of running such circuits. Leading systems in 2026 demonstrate dozens of logical qubits with error rates still far above what these attacks require. Hardware roadmaps from companies such as IBM and Quantinuum target fault tolerant systems around 2029, but those systems would still need to scale considerably to threaten elliptic curve keys

Which coins are most exposed

Risk is not evenly distributed. The most exposed bitcoin sits in pay to public key outputs from the network's earliest years, which place the public key directly on chain. These include a large holding commonly attributed to Bitcoin's pseudonymous creator, often estimated at around one million BTC. Because those coins have not moved, their public keys have been visible for over fifteen years

Address reuse creates further exposure. If you spend from an address and then receive more funds to the same address, the public key is already public. Coins held by exchanges and custodians in reused addresses can fall into this category. Taproot outputs spent through the key path also expose a form of the public key on chain

Estimates of how much bitcoin is exposed vary widely depending on methodology, ranging from a few million BTC to around a third of total supply in some analyses, such as one widely cited estimate from the research firm Project Eleven. The differences arise from how analysts treat reused addresses, Taproot outputs and coins likely lost. What is clear is that a substantial amount of value would be at risk from a capable quantum computer. That is why developers are discussing migration seriously

Ethereum's exposure differs. Any Ethereum account that has sent a transaction has revealed its public key, because Ethereum's account model reuses the same key. That means most active accounts are exposed in the quantum sense. Ethereum's flexibility, however, gives it more options for upgrading account authentication

Lost coins complicate every estimate. Some early bitcoin is believed to be permanently inaccessible because owners lost their keys. Those coins cannot be migrated by anyone, which matters for any plan that requires owners to move funds. They are also the coins most likely to sit in exposed outputs

What Bitcoin developers are proposing

Bitcoin changes slowly and conservatively by design, through Bitcoin Improvement Proposals and soft forks that require broad consensus. In 2026, a proposal known as BIP-360 was reported to have been merged into the BIP repository, describing a new output type called pay to Merkle root that commits to a script tree without exposing a public key until a specific branch is spent. It is intended as a foundation for adding post quantum signature schemes. Merging into the repository does not mean activation, which would require a soft fork and wide adoption

Other ideas under discussion include adding post quantum signature opcodes, encouraging users to migrate funds to quantum resistant outputs over a period of years and, more controversially, phasing out spending from vulnerable legacy outputs after a deadline. The last idea raises difficult questions about property rights and coins whose owners have lost their keys. Developers and the wider community have debated these trade offs openly. Any such change would be one of the most significant in Bitcoin's history

Signature size is a practical challenge. Post quantum signatures such as ML-DSA and SLH-DSA are much larger than Schnorr or ECDSA signatures, which affects block space and fees. Hash based schemes are attractive for their conservative security but are especially large. Designers must balance security, efficiency and decentralisation

Timelines are a further consideration. Bitcoin soft forks have historically taken years from proposal to activation, as Taproot did. If migration requires users to move coins voluntarily, it could take years more for most holders to act. Starting early gives the network room to deliberate carefully

What Ethereum is planning

On 24 March 2026, the Ethereum Foundation published a post quantum security roadmap aiming to complete major protocol changes by 2029, with full migration continuing for several years afterwards. The roadmap describes a series of planned upgrades, including steps to prepare validators for an emergency switch, reduce the cost of verifying post quantum signatures, compress state proofs and protect layer two networks. For validator consensus, it proposes replacing BLS signatures with hash based schemes, using succinct proofs to handle aggregation. For user accounts, it relies on account abstraction so that wallets can adopt quantum safe authentication without forcing everyone to change at once

Ethereum's co founder Vitalik Buterin has long discussed contingency plans, including how the network could respond if a quantum threat emerged suddenly, for example by rolling back to a point before an attack and requiring users to prove ownership with quantum safe methods. These remain ideas and proposals rather than settled policy. Ethereum's more frequent upgrade cadence may make migration somewhat easier than Bitcoin's. Execution will still be a major undertaking

Other blockchains

Many other cryptocurrencies use elliptic curve signatures and face similar issues, including chains using Ed25519 such as Solana and others. Some newer projects market themselves as quantum resistant from the start, using hash based or lattice based signatures. Claims of quantum resistance deserve the same scrutiny as any marketing, including which algorithms are used and whether implementations have been audited. Standardised algorithms such as NIST's ML-DSA and SLH-DSA are generally a better sign than proprietary schemes

Custodians and exchanges hold a large share of many cryptocurrencies on behalf of customers. Their preparation matters greatly, because a single custodian may control keys for millions of users. Financial regulators already expect banks to plan post quantum migration, and similar expectations may extend to crypto custodians. Holders can ask their providers directly about their plans

Practical steps for holders

• Avoid address reuse: use a fresh receiving address for each transaction, which most modern wallets do automatically
• Prefer wallets and custodians that publish their post quantum plans and follow standards
• Be cautious with self described quantum proof coins and products, and check what they implement
• Follow BIP-360, Ethereum Foundation roadmap updates and announcements from your wallet provider
• Keep long term holdings in addresses whose public keys have not been exposed, following your wallet's guidance
• Ignore panic headlines claiming bitcoin has been broken by a quantum computer; check for peer reviewed evidence

Separating hype from reality

Quantum and crypto together attract dramatic headlines. Some claim bitcoin will be broken within months, while others dismiss the threat entirely. The evidence supports neither extreme. Resource estimates have fallen sharply and hardware is improving, but machines capable of breaking secp256k1 do not yet exist and would need substantial further scaling

Mining is a separate issue often confused with signature security. Bitcoin's proof of work uses SHA-256, and Grover's algorithm offers at most a quadratic speedup for searching hashes. Experts generally consider quantum mining advantages modest compared with specialised classical mining hardware, at least for the foreseeable future. The signature threat is the one that matters most

Closing thoughts

Cryptocurrencies face one of the most visible tests of Q-Day preparedness. Their open, permanent ledgers make exposed public keys easy to identify, and irreversible transactions raise the stakes. The good news is that researchers, developers and foundations are taking the issue seriously, with concrete proposals and timelines emerging in 2026. Holders who stay informed and follow sound wallet practices are well positioned

Please share updates on BIP-360, Ethereum's roadmap and wallet provider announcements in the replies, with links to primary sources. Disagreement about migration strategies is welcome, as long as it stays respectful. Remember that nothing here is financial advice


Key references for citation

• Babbush, Zalcman, Gidney and colleagues, Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations, IACR ePrint 2026/625, March 2026
• Craig Gidney, How to factor 2048 bit RSA integers with less than a million noisy qubits, May 2025
• BIP-360, pay to Merkle root proposal, Bitcoin Improvement Proposals repository
• Ethereum Foundation, post quantum security roadmap, 24 March 2026
• ethereum.org, Quantum resistance roadmap page

[StormForge62]

Clear and calm, which is rare for this topic. Most crypto quantum articles are either doom or denial. I will be sharing it with my local meetup group

The point about hashed addresses protecting unspent coins is something many holders do not know. It changes how worried people should be about their own wallets. I had assumed every coin was equally exposed. Learning otherwise was a relief. It also made me check my own habits

Address reuse is the real habit to break. Most modern wallets handle it automatically anyway