The curve, the window, the proposalsWallet
A bitcoin wallet does not use RSA. Its lock is a different hard problem on a curve, broken by the same quantum algorithm and, on paper, a little more cheaply. This page is the mechanics and the public record as of 2026-09-23: which coins show their key, what a ten-minute attack would need, and every draft proposal on the table. It is not advice.
The lock
Bitcoin's curve is y² = x³ + 7 over the integers mod a particular 256-bit prime, a curve called secp256k1 [68][66]. There is a fixed starting point G on it. Your private key is a random 256-bit number k. Your public key is the point you reach by adding G to itself k times, written k·G. Adding is fast, and there is a shortcut (double-and-add) so that 256 doublings get you anywhere. Going back — given k·G, find k — is the discrete logarithm, and the best classical methods need about 2128 steps [67]. Same shape as factoring: easy one way, no known way back.
Here is the same curve over the integers mod 97 instead, small enough to draw all 78 of its points and hop around on it.
Hop
G has order 79 here: 79 hops and you are back where you started. On secp256k1 the order is about 2256, and the landing spot after k hops tells you nothing about k that anyone knows how to read — classically.
A key, made here
The same arithmetic at full size, in your browser: a random 256-bit k, then k·G on secp256k1.
Which coins show their key
A Bitcoin address is usually not the public key. It is a hash of it — a one-way fingerprint — and the key itself appears on the chain only inside the transaction that spends from the address [69]. That one layer is most of the story. Hashes are not broken by Shor's algorithm; a quantum computer speeds up reversing a hash only by a square root, which a 256-bit hash absorbs. So what matters is which outputs put the key itself on the chain:
| output type | address looks like | key visible | note |
|---|---|---|---|
| P2PK 2009 | no address — the key itself | always | The original 2009–2010 output: the public key sits in the open on the chain. Satoshi-era mining rewards are here, about 1.7 million BTC across some 20,000 to 45,000 outputs, untouched since. [69][104] |
| P2PKH 2009 | 1… | only when spent, or if the address is reused | The output holds a hash of the key. The key is shown in the spending transaction — so a used address that receives coins again is exposed. [69] |
| P2SH 2012 | 3… | only when spent, or if reused | A hash of a script; the script and its keys appear at spend time. [104] |
| P2WPKH 2017 | bc1q… (42 characters) | only when spent, or if reused | SegWit's version of P2PKH; same hash-until-spend property. [69] |
| P2WSH 2017 | bc1q… (62 characters) | only when spent, or if reused | SegWit's version of P2SH. [104] |
| P2TR (Taproot) 2021 | bc1p… | always | The output is itself a (tweaked) public key, by design, so the key is on the chain from the moment coins arrive. About a third of all outputs by count in 2025, under one percent by value. [71][104] |
| P2MR (proposed, BIP 360) draft | bc1z… | no key path | Taproot's script tree with the key-path spend removed, so a hash-based or post-quantum script can sit in a leaf. A draft with no activation path. [72] |
The counts of how many coins sit in exposed outputs come from five sources and land in the same place: about a third of all bitcoin, once address reuse is counted, and about 1.6 to 1.7 million BTC in the oldest kind alone — coins mined in 2009–2010 and never moved.
| who counted | when | BTC | of supply | how |
|---|---|---|---|---|
| Deloitte | 2020-12 | 4.00M | 25% | about 2 million BTC in P2PK plus 2.5 million in reused P2PKH [73] |
| Chaincode Labs | 2025-05 | 6.26M | 30% | P2PK, raw multisig and Taproot, plus reused addresses; about 1.72 million BTC in P2PK alone [104] |
| CoinShares | 2026-02 | 1.60M | 8% | P2PK only, 32,000+ outputs averaging about 50 BTC [105] |
| Glassnode | 2026-05 | 6.04M | 30% | 1.92 million structural (P2PK, Taproot) plus 4.12 million by address reuse; 1.66 million of the reuse is exchanges [106] |
| Coinbase advisory board | 2026-06 | 7.00M | 33% | about 1.7 million in some 20,000 P2PK addresses plus about 5 million by reuse [107] |
The two attacks
Long-range
The public key is already on the chain. The attacker can take a month. Every P2PK output, every Taproot output, and every reused address of any type is in this class. [104][72]
Short-range (on-spend)
The key appears only in the spending transaction, so the attacker must compute the private key and broadcast a competing spend before the honest one is confirmed — about ten minutes, sometimes an hour. Every output type is in this class at the moment of spending. [104][91]
Harvest now, decrypt later
Does not apply to a wallet. There is no ciphertext to store; a key is either on the chain or it is not. [104]
The ten-minute window
For a never-reused hash address, the key is visible only between broadcast and confirmation. So the question people ask is whether a machine could take a public key, compute the private key, and get a competing transaction mined, in the ten minutes a block takes on average. The estimates:
| who | when | to break one key in ten minutes | in an hour | in a day | |
|---|---|---|---|---|---|
| Webber and others | 2022 | 1.9 billion physical qubits | 317 million | 13 million | [60] |
| Litinski | 2023 | about 6.9 million physical qubits (photonic model) | [61] | ||
| Babbush, Gidney, Boneh and others | 2026-03 | fewer than 500,000 superconducting qubits, 9–23 minutes | [91] | ||
| Caltech and Oratomic | 2026-03 | not possible on atoms — about 10 days per key on 10,000–26,000 atoms | [93] | ||
| IonQ | 2026-09 | not possible on ions — 25.7 days per key on 19,397 qubits | [100] |
The 2026 papers disagree with each other in an instructive way. Google's team says a fast superconducting machine of under half a million qubits could do it in minutes, inside the window [91]; the Caltech and IonQ blueprints, on atoms and ions, need ten to twenty-six days per key, because those qubits tick a thousand times slower [93][100]. Google withheld its circuits and published a proof they work, and advised: migrate, do not reuse addresses, decide what to do about abandoned coins [92]. None of these machines exists; see the gap chart.
The proposals
Every one is a draft. None has an activation path. Bitcoin has, as of 2026-09-23, no agreed roadmap, funding or timeline for a post-quantum move [121].
| proposal | when | what it does |
|---|---|---|
| BIP 360 — P2MR Hunter Beast, Ethan Heilman, Isabel Foxen Duke | 2024-12 onward | A new output type, SegWit version 2, addresses bc1z: Taproot's script tree without the key path. Renamed twice (P2QRH, P2TSH, P2MR). Status: draft. [72] |
| BIP 361 — legacy signature sunset Jameson Lopp and others | 2025-07 list post; 2026-04 merged as draft | Phase A, about three years after activation: legacy scripts may only send to post-quantum scripts. Phase B, two years later: old signatures no longer verify, with 'rescue' paths for coins provably from a seed phrase. Status: draft. [109][110] |
| Hourglass Hunter Beast | 2025-04 | Rate-limit spends from P2PK outputs to one per block, so a thief could not dump 1.7 million BTC at once. [111] |
| Commit, delay, reveal Tim Ruffing; Tadge Dryja's variant | 2025-05 | Publish a hash of your transaction first, wait, then reveal it, so an attacker who learns your key at reveal time cannot front-run a transaction committed earlier. Would let exposed keys spend safely after the curve breaks. [112] |
| Quantum canary BitMEX Research | 2026-04 | Coins in an address only a quantum machine could open; a spend from it triggers restrictions automatically instead of on a fixed date. [113] |
| Provable address-control timestamps Dan Robinson, Paradigm | 2026-05 | Privately timestamp a proof that you control an address now, without moving coins; redeem frozen coins later with a STARK proof. [124] |
| SHRINCS Jonas Nick and Mikhail Kudinov, Blockstream | 2026-08 | A SHA-256-based signature of about 324 bytes, so post-quantum signatures do not cut throughput to a third of a transaction a second. [114] |
| Quantum-safe transactions without a fork Avihu Levy, StarkWare | 2026-04 | Hash-based proofs under today's rules, at $75–$200 of GPU time per transaction; a last resort, its author says. [123] |
| P2Q Casey Rodarmor | draft | A SegWit version 3 output identical to Taproot, so its key path can be switched off later without touching existing Taproot coins. [122] |
The hard part is not the new signature; NIST has three of those already [63]. It is the old coins. A post-quantum output type only protects coins that move to it, and the question of what happens to coins whose owners never move them — including the 1.7 million BTC from 2009 — is a question about freezing other people's property, which is why BIP 361's sunset schedule is the contested one [109]. Migrating every output would take about 76 days of full blocks at best [104].
Elsewhere:
- Ethereum — A roadmap: hash-based validator signatures, signature agility for accounts (EIP-8141, expected in the Hegotá fork), core post-quantum infrastructure around 2029. [117]
- Algorand — First post-quantum transaction on mainnet in November 2025, Falcon-1024 signatures in a stateless contract; consensus itself not yet post-quantum. [118]
The timelines people sign their names to
| who | when | what they said |
|---|---|---|
| Global Risk Institute expert survey | 2026-03 | 28–49% chance of a 24-hour RSA-2048 break within ten years; 92% of experts give even odds within twenty. [119] |
| NIST | 2024-11 | RSA-2048 and 256-bit curves deprecated after 2030, disallowed after 2035 (draft). [64] |
| 2026-03 | Its own migration done by 2029. [90] | |
| Coinbase advisory board | 2026-04 | 'Clearly on the horizon', a few years to a decade or more; blockchains safe today; start preparing now. [108] |
| CoinShares | 2026-02 | At least a decade away. [105] |
Nobody has a date. What exists is a policy calendar (NIST's 2030 and 2035), a corporate one (Google's 2029), an expert survey with odds per decade, and a set of resource estimates that have fallen twentyfold twice in seven years while the machines grew tenfold once. The ledger is where each new number lands.