Which part of Bitcoin could a large quantum computer attack?
Why is this not only Bitcoin's problem?
What is the engineering answer to the quantum risk?
Quantum computers threaten which of these: (1) SHA-256 hashing, (2) elliptic-curve signatures, (3) both? Enter the number.
Then prove it: a 3-question quiz · a challenge. The lesson marks itself complete at 100%.
After this lesson you can: say what quantum computers threaten and what the upgrade path is.
The strongest version
Quantum computers running Shor's algorithm could derive private keys from public keys, letting an attacker spend anyone's coins. When that happens, Bitcoin is finished.
What is actually at risk
Signatures. Bitcoin's ECDSA and Schnorr signatures rely on math a sufficiently large quantum computer could break. The same math secures every bank, government and website on Earth.
Exposed public keys. A key is revealed when an address is spent from. Coins at reused addresses and in very old pay-to-public-key outputs (including Satoshi's) would be exposed first. Estimates put several million BTC in that category.
The confirmation window. A transaction reveals its public key when broadcast; a fast enough attacker could race it.
What is not
What is exposed, what is not.
Mining. Grover's algorithm offers only a modest speed-up on SHA-256; quantum mining is not a practical threat.
Unexposed keys, today. Addresses that have never been spent from show only a hash.
The engineering answer
Estimates of the qubits required range from millions to hundreds of millions of error-corrected qubits; today's machines are at a few thousand noisy ones. Post-quantum signature schemes exist and are standardised; proposals such as BIP 360 describe how Bitcoin could add a quantum-resistant address type by soft fork. Migration would take time and block space, which is why the work is being discussed now rather than later.
Today’s machines against the estimates for breaking a key. Log scale: each gridline is ten times the last.
What remains true
This is a real, long-term engineering question for Bitcoin and for all of cryptography. It is not an imminent threat, and Bitcoin is in a better position to coordinate an upgrade than most systems because the problem is public and the community is paying attention.
01Digital signatures, and so coins with exposed public keysShor's algorithm targets the signature math, not hashing.
02Banks, governments and the internet use the same signature mathIf quantum broke ECDSA, it would break far more than bitcoin, and everyone would need to upgrade.
03Signature schemes can be upgraded, and proposals for post-quantum address types already existThe risk is to signatures, and signatures can be replaced by soft fork.
