Quantum Computers Won’t Out-Mine Bitcoin. Keys Are the Real Risk.

Bitcoin’s network hashrate sits at roughly 1.03 zettahashes per second in mid-October 2026, close to its all-time high and backed by more specialized silicon than at any point in the asset’s history (CoinWarz). Every few months a fresh quantum-computing headline lands, and the same worry resurfaces: that one of these machines will one day out-compute the entire mining network, rewrite the ledger, or mine every remaining coin in an afternoon. It is a reasonable thing to wonder about. It is also, once you look at the physics, aimed at the wrong layer of the system. The part of Bitcoin a quantum computer would struggle most to touch is precisely the hashrate. The part it could genuinely break, given a machine that does not yet exist, is the set of signatures guarding coins that have not moved in years.

This piece separates the two threats that usually get blended into one frightening sentence, because they are not the same threat, they do not target the same algorithm, and they are not remotely the same distance away. One concerns mining and the hash function SHA-256; the other concerns ownership and the signature scheme ECDSA. Knowing which is which is the difference between an informed risk and a recurring panic.

The Fear, and Why It Aims at the Wrong Layer

Quantum computers threaten classical cryptography through two different algorithms, and the gap between them is the whole story. Grover’s algorithm speeds up brute-force search. That is the tool relevant to mining, because mining is a brute-force search for a hash below a target, and because SHA-256 has no known structural weakness to exploit; you can only guess faster. Shor’s algorithm does something categorically more dangerous: it efficiently solves the factoring and discrete-logarithm problems that public-key cryptography is built on. That is the tool relevant to Bitcoin’s signatures, because the elliptic-curve scheme that proves you own your coins rests on the discrete-logarithm problem being hard.

The decisive difference is the size of the speedup. Grover offers a quadratic, or square-root, improvement: a search that would take N tries classically takes about the square root of N on a quantum machine. Shor offers an exponential improvement, which is the kind that turns a problem from impossible to merely expensive. A square-root dent in a 256-bit search still leaves an impossible search. An exponential dent in a 256-bit key turns it into a solvable one. That single asymmetry is why mining is the robust layer and signatures are the soft one.

What the Hashrate Actually Is, in One Minute

Hashrate is a count of guesses per second. Miners assemble an 80-byte block header, run it through SHA-256 twice, and check whether the resulting number falls below a target set by the network’s difficulty. If it does not, they change a nonce and try again. A single machine does this trillions of times a second; the whole network, at about 1.03 zettahashes per second, performs on the order of 10²¹ of these guesses every second. Nothing about the computation is clever. Its security comes from sheer volume, the fact that honest guessers vastly outnumber any single challenger.

The number that keeps the system honest is difficulty, currently about 132.72 trillion (CoinWarz). Every 2,016 blocks, roughly two weeks, the protocol retargets difficulty up or down to hold the average block interval near ten minutes. When more hashrate joins, blocks come faster, and the next retarget raises difficulty to slow them back down. When hashrate leaves, difficulty falls. That feedback loop, the difficulty thermostat, is the single most important fact for understanding why a quantum miner would be an anticlimax. The record hashrate of roughly 1.1 zettahashes per second was set in the autumn of 2025, alongside a difficulty peak near 156 trillion that October; the network has since drifted a little lower, by choice rather than by force, as operators divert power to artificial-intelligence workloads.

Grover’s Algorithm: A Square Root, Not a Skeleton Key

Here is what Grover’s algorithm would actually buy a quantum miner. Brute-forcing a 256-bit search space takes about 2²⁵⁶ operations classically. Grover reduces that to about 2¹²⁸ operations. That sounds like a catastrophe until you sit with the number. 2¹²⁸ is still a quantity so large that no imaginable machine, quantum or classical, finishes it inside the lifetime of the universe. Grover shaves the exponent in half; it does not make the problem small. For the kind of partial search miners really do (finding a hash below a target, not a full preimage), the same square-root logic applies to whatever work the target demands, and the target simply moves.

Two further properties gut the threat. First, Grover’s search is stubbornly sequential: it does not parallelize well. Split the job across many quantum processors and the combined speedup grows only with the square root of the number of machines, so a thousand quantum computers working together deliver roughly a thirty-fold improvement rather than a thousand-fold one. Mining, by contrast, is embarrassingly parallel for classical ASICs, which is exactly why the network can run millions of chips at once. Grover throws away that advantage. Second, the error-correction overhead of running Grover on real fault-tolerant hardware is enormous, inflating the practical cost far above the textbook 2¹²⁸. Analysts at Bernstein, summarizing the state of the research, concluded that Bitcoin mining faces no realistic risk from quantum machines because the SHA hashing used in mining is, in their words, quantum safe, taking millions of years to brute-force even after recent algorithmic improvements including Grover’s (Decrypt).

The Energy of a Star

If the abstract math is not convincing, the thermodynamics is. In a paper published in March 2026, Pierre-Luc Dallaire-Demers and colleagues at BTQ Technologies modeled what it would take for a quantum computer to launch a 51% attack on Bitcoin mining, meaning out-hashing the honest network and finding blocks fast enough to seize control. Their estimate, reported by CoinDesk, is that the machine would need to draw roughly 10²⁵ watts of power, about 3% of the total energy output of the Sun, and marshal on the order of 10²³ qubits to find a block inside Bitcoin’s ten-minute window. For scale, the entire Bitcoin network currently consumes something like 15 gigawatts.

Numbers at that magnitude stop being an engineering roadmap and start being a statement about physics. You cannot out-build a gap of twenty-plus orders of magnitude with better chips and a bigger budget; it is closer to asking for a Dyson sphere than a data center. The same research program has a useful side note for the hype cycle: a separate 2025 study by Peter Gutmann of the University of Auckland and Stephan Neuhaus of the Zurich University of Applied Sciences reproduced essentially every headline quantum-factoring breakthrough of the past two decades using 1981-era computing equipment, showing that many of the celebrated demonstrations relied on pre-simplified problems rather than genuine cryptographic progress. The lesson is not that quantum computing is fake; it is that the distance between a press release and a cryptographic break is routinely understated.

Even a Perfect Quantum Miner Just Trips the Thermostat

Suppose we grant the impossible and imagine a quantum computer that somehow obtained a real Grover edge on SHA-256. What would happen to Bitcoin? The honest answer is almost nothing dramatic. The machine would mine faster, find more blocks than its share of classical hashrate would predict, and the network would respond the way it responds to any surge in mining power: the next difficulty retarget would raise the target until block times settled back near ten minutes. A quantum miner is, from the protocol’s point of view, just more hashrate to absorb. It is treated exactly like the arrival of a new ASIC generation, and the thermostat re-levels the field within a fortnight.

Crucially, winning the hashrate race does not hand an attacker the things people fear most. A 51% majority lets you reorder or censor recent transactions and attempt double-spends of your own coins; it does not let you forge old blocks cheaply, invent coins out of nothing, or spend Bitcoin for which you do not hold the private keys. The ledger’s history is protected by the accumulated proof-of-work behind it, and balances are protected by signatures, which Grover does not touch. So the most catastrophic-sounding version of the quantum story, a machine that mines its way to control, is both the least physically plausible and, even if it happened, the least financially rewarding. The attacker would spend a star’s worth of energy to win the right to censor a few blocks the network would quickly route around.

This is the deep reason the hashrate is the wrong thing to worry about: it defends itself. The same self-correcting loop that has absorbed the move from CPUs to GPUs to FPGAs to purpose-built ASICs, and the hundredfold efficiency gains across ASIC generations, would absorb a quantum entrant too. At today’s roughly $39.70 per petahash per day of mining revenue (Hashrate Index via NewHedge), the network pays out something on the order of $14 billion a year to the miners defending it, and that economic wall rises and falls with price, not with the type of silicon doing the work.

Where the Risk Actually Lives: Shor and Your Signatures

Now flip to the layer that should get the attention. Bitcoin proves ownership with the Elliptic Curve Digital Signature Algorithm, ECDSA, on the secp256k1 curve. The security of that scheme rests on the elliptic-curve discrete-logarithm problem: given a public key, recovering the matching private key is believed to be computationally infeasible for classical machines. Shor’s algorithm breaks that assumption. A large, fault-tolerant quantum computer running Shor could, in principle, derive a private key from its public key and then sign transactions as if it were the owner, moving the coins.

The saving grace, and the key to every mitigation that follows, is that your public key is not always visible. Modern Bitcoin address types (pay-to-public-key-hash, pay-to-witness-public-key-hash, and Taproot) commit to a hash of the public key, not the key itself. The raw public key only appears on-chain at the moment you spend from that address. If you receive coins to a fresh address and never move them, a quantum adversary has nothing to attack but a hash, and SHA-256 and RIPEMD-160 hashes are, as we have seen, quantum robust. The exposure problem is therefore narrower than it first sounds: it concerns coins whose public keys are already revealed, not every coin in existence. Where it does apply, though, it applies to real money, and the amounts are not small.

How Many Qubits, and How Far Away

The signature threat is real, but the hardware to realize it does not exist, and the honest debate is about when it might. The most important recent data point came from Google Quantum AI. In a whitepaper dated 31 March 2026, researcher Craig Gidney estimated that breaking Bitcoin’s 256-bit elliptic-curve cryptography could take fewer than 500,000 physical qubits, using roughly 1,200 to 1,450 logical qubits and 70 to 90 million Toffoli gates, with a running attack finishing in about 9 to 18 minutes (Google Quantum AI). That is roughly a twentyfold reduction from the prior best estimate, Litinski’s 2023 figure of about 9 million physical qubits on a photonic design.

A twentyfold cut in the resource estimate is genuinely notable, and it is why the topic keeps resurfacing. But two cautions matter. First, these are resource estimates for a fault-tolerant machine, not a demonstration; they describe hardware nobody has built. Second, the trend they belong to is an algorithmic one, not a hardware one. Blockstream chief executive Adam Back made exactly that distinction, noting that the Google paper is about algorithmic improvements and “doesn’t bring with it any hardware improvements,” and pointing out that the biggest number a real quantum computer has so far factored with Shor’s algorithm is 21, into seven times three (Decrypt). Back has publicly estimated that Bitcoin is unlikely to face a meaningful quantum threat for two to four decades (Cryptonews). The gap between 500,000 fault-tolerant qubits and the roughly 100 physical qubits on Google’s Willow chip from late 2024 is not a detail; it is the entire distance that has to be crossed.

The Honeypot: Millions of Coins With Their Keys Showing

Because the exposure only affects coins whose public keys are already visible, the practical question is how many such coins exist. The answer is uncomfortably large. Estimates cluster around 6 to 7 million BTC, somewhere between a quarter and a third of the circulating supply, sitting in outputs with revealed public keys. These split into two groups: legacy pay-to-public-key outputs, the original 2009-era format that put the raw public key directly on-chain and holds much of the coinbase reward attributed to Satoshi and the earliest miners, and coins in addresses that have been reused after a spend, which exposes the key in the process. The CoinDesk reporting on the issue cites roughly 6.9 million BTC in wallets with visible keys and over 10 million addresses at some risk (CoinDesk); Bernstein’s analysts flag about 1.7 million BTC in the highest-risk legacy wallets (Decrypt), worth well over $100 billion at current prices.

This is what cryptographers call a “harvest now, decrypt later” problem. An adversary does not need a working quantum computer today to benefit from one tomorrow; they can record every exposed public key now and crack the keys whenever the hardware finally arrives. The coins most at risk are, ironically, the oldest and most storied ones, the never-moved early rewards that also happen to be the most collectible fragments of Bitcoin’s history, including many of the rare sats prized by early-UTXO hunters. A quantum raid on those wallets would be the largest theft in history and, simultaneously, a profound philosophical event for a network whose origin coins have always been treated as untouchable. The user-level defense is unglamorous but effective: never reuse addresses, and keep coins in modern hashed-key address types where the public key stays hidden until the moment you spend. For anyone holding meaningful amounts, that is reason enough to understand exactly where your keys live and how you would move them.

The Raid Still Has to Go Through the Miners

Here is the part the scary headlines leave out: even the signature attack runs through the hashrate. To steal an exposed coin, a quantum adversary cannot simply rewrite the ledger. They have to construct a valid transaction signed with the derived private key and broadcast it, after which it sits in the public mempool until a miner chooses to include it in a block. That detail matters more than it looks. It means the theft is visible before it is final, and it means the same proof-of-work layer the attacker cannot out-mine is also the gate every stolen coin has to pass through. A quantum thief does not get to bypass miners; they have to line up behind everyone else and wait for confirmation.

That visibility opens a defensive race and a menu of emergency options. The rightful owner, or wallet software watching on their behalf, could try to sweep funds to a fresh quantum-safe address the moment a key looks threatened, and a network that had already shipped BIP-360-style addresses would give most users somewhere safe to land. In an acute crisis the community has blunt instruments too, from fee markets that make large thefts expensive to confirm, to the kind of coordinated emergency fork that developers have floated for quarantining obviously compromised outputs. None of this is a clean guarantee; a determined attacker could pay enormous fees or try to collude with miners, and a sudden rush to migrate millions of coins at once would be chaotic. But it reframes the hashrate one last time. It is not only the layer a quantum computer cannot out-compute; it is also the chokepoint, and potentially the defense, through which any quantum theft would have to travel. On both the mining side and the ownership side, the honest hashrate ends up on the right side of the problem.

A 15-Bit Key Against a 256-Bit Wall

Nothing frames the current distance better than the one real-world contest built to measure it. In April 2025, the quantum-research firm Project Eleven launched its Q-Day Prize, offering 1 BTC to the first team to break an elliptic-curve cryptographic key of any size using a quantum computer, deriving the private key from the public one (CoinDesk). The bounty functioned as a public thermometer for the threat, a cash incentive to show how far the hardware had actually come rather than how far a slide deck claimed it might.

A year later, in April 2026, Project Eleven awarded the prize to independent researcher Giancarlo Lelli, who broke a 15-bit elliptic-curve key on publicly accessible quantum hardware, a 512-fold jump over the previous public demonstration of a 6-bit key (CoinDesk). That is the largest quantum attack on elliptic-curve cryptography achieved to date. Bitcoin uses 256-bit keys. Every added bit doubles the work, so the leap from 15 bits to 256 is not a few more steps along the same road; it is a different order of reality, and the resource estimates above assume error-corrected machines that dwarf anything yet shown. Crypto’s habit of putting real money behind adversarial testing, visible in everything from these quantum bounties to the eight-figure bug-bounty payouts that dwarf big tech’s, is one reason the threat is being measured honestly rather than guessed at.

Bitcoin’s Own Answer: BIP-360, BIP-361, and a Migration Fight

The protocol is not standing still, though it is moving at Bitcoin’s characteristic pace of caution and argument. The first formal step is BIP-360, originally titled Pay to Quantum Resistant Hash and since iterated toward a Pay to Merkle Root design, authored by the developer known as Hunter Beast. It defines a new address type that keeps the public key off-chain and commits to post-quantum signature schemes, eliminating the long-exposure problem using cryptography that exists today. In February 2026 it was merged into the official Bitcoin Improvement Proposals repository (TFTC). A merge signals that a proposal meets the documentation bar for serious discussion; it is emphatically not activation or endorsement.

The cryptographic building blocks are ready. In August 2024, the US National Institute of Standards and Technology finalized its first three post-quantum standards, FIPS 203 (ML-KEM) for key exchange and FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for digital signatures, giving developers vetted lattice-based and hash-based options to build on (NIST). The hard part is not the math; it is the politics of migration. Jameson Lopp’s BIP-361, titled Post-Quantum Migration and Legacy Signature Sunset, would phase out vulnerable outputs and, five years after activation, render old ECDSA and Schnorr signatures invalid, freezing any coins that had not migrated, a step Lopp frames as necessary to prevent what he calls intergenerational theft by a future quantum adversary (crypto.news). Adam Back and others push back hard, preferring optional, opt-in migration over any forced freeze, and Blockstream has been testing hash-based signatures on its Liquid sidechain as a lower-stakes proving ground. Whichever path wins, wallet makers will have to support the new address types, which means the companies behind the devices most people trust, from Ledger and Trezor to Tangem, are quietly part of the timeline too.

What It Means for Miners: Almost Nothing, For Now

For the people actually running hashrate, quantum computing is a reading-list item, not an operational one. The forces shaping mining in October 2026 are entirely prosaic. Hashprice is hovering near $39.70 per petahash per day, and a difficulty retarget due around 16 October is projected to rise about 5.68%, toward roughly 140 trillion, which would trim hashprice to the high $37 range and squeeze the least efficient rigs (CryptoSlate). The structural story is the pull of artificial-intelligence and high-performance-computing contracts on the same megawatts that once went only to hashing. None of that has anything to do with Shor or Grover.

A quantum computer does not make an ASIC obsolete. SHA-256 silicon stays SHA-256 silicon, and the hash function it computes is the robust part of the system. If the migration debate ever forces a change, it will land on the signature layer and on wallet software, not on the mining rigs humming in Texas and Paraguay. The one indirect link worth keeping in mind is the security budget: because miner revenue, and therefore the cost of attacking the chain, scales with price, the same price models that drive the 2026 targets also set the dollar height of Bitcoin’s defensive wall. A higher price funds a larger security budget, which is the opposite of the fragility the quantum headlines imply.

The Regulator’s View

Quantum computing does not change how mining is regulated in the United States. In March 2025, the SEC’s Division of Corporation Finance stated that proof-of-work mining, whether solo or through a pool, does not involve the offer or sale of securities, because miners are compensated for providing computational effort rather than investing in a common enterprise reliant on others (SEC). A faster or quantum-powered miner would still be mining under that logic; the activity’s legal character does not hinge on the kind of chip.

The quantum question sits in a different box: custody and consumer protection. If a future machine could sweep coins from exposed keys, the pressing policy issues are who bears that loss, how custodians and exchanges harden their holdings, and how quickly migration standards propagate, which is much closer to the SEC’s and banking regulators’ concerns about safeguarding client assets than to how mining is classified. Those are not crypto-only questions, either. The same NIST standards driving Bitcoin’s migration debate are being adopted across banking, government, and the broader internet, because harvest-now-decrypt-later threatens every long-lived secret, not just private keys on a blockchain.

Timelines: 2032, Two Decades, or Never in a Useful Form

So when does any of this actually matter? Pull the credible estimates together and a shape emerges. Google’s own researchers frame their resource estimate against the possibility of capable hardware around the early 2030s if, and it is a large if, qubit counts and error correction keep improving on schedule. Adam Back puts the meaningful-threat horizon at two to four decades. Bernstein calls the risk neither existential nor novel nor unique to crypto. The honest synthesis is wide uncertainty on the signature side, with a lower bound that is not imminent and an upper bound that may never arrive in a practically useful form, and effectively no threat at all on the mining side across any of these timelines.

Ryan Gentry, reflecting the view of many longtime Bitcoin builders, put the bottom line simply: “I do not think quantum computers are going to take bitcoin to zero” (TFTC). The practical instruction that follows is the opposite of panic. Watch the signature-migration debate, because that is where a real decision will eventually be forced. Move old coins into modern single-use addresses, because that is the exposure you personally control. And stop losing sleep over the hashrate, because it will keep doing what it has always done: absorbing every new kind of machine thrown at it through the quiet arithmetic of the difficulty thermostat, including, if it ever shows up, a quantum one.

Frequently Asked Questions

Can a quantum computer mine all the remaining Bitcoin?

No. Grover’s algorithm gives only a square-root speedup on SHA-256 and barely parallelizes, so the advantage shrinks as you add machines. The difficulty adjustment would also raise the target to keep blocks near ten minutes, treating a quantum miner like any other new hardware. Researchers estimate a quantum 51% attack on mining would need roughly 3% of the Sun’s energy output.

What is the real quantum threat to Bitcoin?

Shor’s algorithm, which could derive private keys from exposed public keys and then spend the coins. It targets the ECDSA signature scheme that proves ownership, not the hashrate. Roughly 6 to 7 million BTC sit in addresses whose public keys are already visible on-chain.

How many qubits would it take to break Bitcoin’s keys?

Google Quantum AI estimated in March 2026 that breaking Bitcoin’s 256-bit elliptic-curve cryptography could take fewer than 500,000 physical qubits, about a twentyfold drop from earlier estimates. The largest public quantum chips today hold around 100 qubits, so the hardware does not yet exist.

Is Bitcoin doing anything to prepare for quantum computers?

Yes. BIP-360 defines a quantum-resistant address type and was merged into the Bitcoin Improvement Proposals repository in February 2026, while BIP-361 proposes migrating and eventually sunsetting legacy signatures. NIST finalized post-quantum signature standards in August 2024. Activation on Bitcoin is still being debated.

Should I move my Bitcoin now?

Your coins are exposed only once a public key is revealed, which happens with legacy pay-to-public-key outputs and with reused addresses. Keeping funds in modern single-use addresses and in a secure wallet limits exposure, so there is no need to panic, but address hygiene matters.

Marcus Okafor covers Bitcoin mining, protocol security, and the economics of proof-of-work for HOGE Wire.