Quantum Computing and Bitcoin: What It Threatens, and Why It Is Not Your Miner

Quantum computing is a threat to Bitcoin’s signatures. It is not a threat to Bitcoin mining. Those are two different pieces of cryptography doing two different jobs, and almost every article on this subject blurs them together. If you are buying an ASIC, the short version is that your machine is in the resistant half — and it will be retired by ordinary efficiency competition long before any of this is relevant to it.

We sell mining hardware, so we have an obvious interest in that being true. It is worth saying that the strongest statement of it comes from the academic paper this page has always linked, not from us.

The part that is genuinely at risk: signatures

Every bitcoin is controlled by a private key — separately from the mining described in what Bitcoin is and what mining actually does — and ownership is proved with ECDSA over the secp256k1 elliptic curve. The security of that scheme rests on the discrete logarithm problem being hard — given a public key, you cannot work backwards to the private key.

Shor’s algorithm solves exactly that problem. A sufficiently large, error-corrected quantum computer running it could derive a private key from a public key, which means spending coins that belong to someone else. That is a real, well-understood, structural vulnerability, and it is the one worth taking seriously.

Note what it is not. It would let an attacker steal bitcoin. It would not let them mine bitcoin any faster.

The part that is not: proof of work

Mining is a search for a SHA-256 output below a target — what a block really is covers what the machine is physically doing. Hash functions are not vulnerable to Shor’s algorithm; the relevant quantum method is Grover’s algorithm, which delivers only a quadratic speedup. Halving the effective bit-strength of a search sounds dramatic until you put numbers on the machines.

A current ASIC does on the order of 100 trillion hashes per second, continuously, for a few thousand watts. Quantum gate operations run at rates many orders of magnitude below that, and each Grover iteration is a sequence of gates that cannot be parallelised the way ASIC hashing trivially is. A square-root advantage over an enormous deficit is still an enormous deficit.

The peer-reviewed assessment is blunt about it. Quantum attacks on Bitcoin, and how to protect against them concludes that “the proof-of-work used by Bitcoin is relatively resistant to substantial speedup by quantum computers in the next 10 years, mainly because specialized ASIC miners are extremely fast compared to the estimated clock speed of near-term quantum computers” — while finding the signature scheme “much more at risk”.

A correction to what this page used to say

An earlier version of this article said that quantum algorithms “could make mining more efficient” and might “usher in a new era of computational efficiency” in mining, in the way GPUs and then ASICs did. That was wrong, and it was wrong in the direction that matters to anyone reading a hardware dealer’s website: it implied a machine bought today might be leapfrogged by a different kind of computer. It will not be. It will be leapfrogged by a more efficient ASIC, which is a much duller and much more certain fate.

The paper that says so was already in this page’s own further-reading list. We would rather correct it in public than quietly delete the sentence.

Which coins are actually exposed

The risk is not uniform across the chain. It depends on whether a public key is visible:

• Pay-to-public-key outputs from 2009–2010, including most early coinbase rewards, publish the key on the chain. These are the most exposed coins in existence, and a large share of them have never moved.
• Reused addresses. The first time you spend from an address, its public key goes into the blockchain permanently. Anything left at that address afterwards is protected only by the curve.
• Taproot outputs commit to a public key directly, which is what makes them efficient and also what makes them visible.
• An unspent standard address publishes only a hash of the public key. Shor’s algorithm has nothing to attack there — you would have to break the hash first, and that is Grover territory again.

The practical consequence is unglamorous and free: do not reuse addresses. That single habit moves your coins from the exposed category to the protected one, today, without waiting for anyone to upgrade anything.

How close is it, really

Not close — and the honest way to see that is to stop counting the qubits in press releases.

Today’s machines carry hundreds to a few thousand physical qubits, which are noisy and hold their state for fractions of a second. Running Shor’s algorithm against a 256-bit curve requires logical qubits: error-corrected, stable, each built out of many physical ones. Published estimates put the requirement at roughly 2,300 logical qubits for secp256k1, and at current error rates a single logical qubit costs on the order of a thousand physical ones. That puts the machine somewhere in the millions of physical qubits, with an error-correction stack nobody has yet demonstrated at scale.

Where that actually stands, August 2026. The largest published error-correction demonstration is IBM’s with the University of Chicago, announced on 30 July 2026: 70 logical qubits, run through 2,415 logical two-qubit operations and 468 logical T gates. That is a genuine result and it is progress in exactly the right place. It is also 70 against a requirement near 2,300, with the gate counts involved in factoring larger than 2,415 by about eleven orders of magnitude. IBM’s own published roadmap targets 200 logical qubits by 2029.

One caution when reading the announcements, because it is where most of the confusion comes from: logical-qubit counts are not interchangeable between platforms. The error-correcting code and the physical error rate underneath them differ enormously, so a neutral-atom machine reporting a higher logical count than a superconducting one is not thereby closer to running Shor’s algorithm. Compare the operations demonstrated, not the headline number — and note that the useful progress is in error correction, which is the slowest part of the problem and the reason none of this moves as fast as a press release implies.

What the network can do about it

The replacement cryptography is not hypothetical. NIST released its principal post-quantum standards in August 2024 — FIPS 203 (ML-KEM) for key establishment, FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for signatures — with further algorithms including Falcon and HQC still working through the process. Details are on the NIST post-quantum cryptography project.

Adding a quantum-resistant output type to Bitcoin is a soft fork. That is the easy half. The hard half is not cryptographic, it is social: every vulnerable coin has to be moved to a new output type by whoever controls it, and a great many early coins will never be moved because nobody alive can move them. Any serious discussion of a migration is really a discussion about what to do with those. There is no consensus on that, and there does not need to be one yet.

What this means if you are buying a miner

Nothing, and that is the useful conclusion rather than a dismissive one.

An ASIC bought today is evaluated on a two-to-four-year horizon, against one number: joules per terahash measured against the price you actually pay for electricity. On that horizon the machine’s competition is next year’s machine, not a quantum computer. A 34 J/TH used S19 is already displaced by a 15 J/TH S21 Pro at any electricity price above about 4¢/kWh — that displacement is happening now, it is measurable, and it is the one that will decide what your hardware is worth.

The ASIC miner buying guide works through that arithmetic, what a miner actually earns puts dollars on it, and the machines it argues about are the ones sitting in the full ASIC miner inventory. If you would rather have an argument about your own numbers than read another spec sheet, tell us what you are running — we buy, repair, host and resell this hardware, and who we are is on the record.

Further reading

• Quantum attacks on Bitcoin, and how to protect against them — the analysis quoted above, and the one to read if you read only one.
• NIST Post-Quantum Cryptography — the standards themselves.
• IBM Quantum — current state of the hardware, from one of the groups building it.
• The Bitcoin whitepaper — where the signature scheme and the proof of work are first set out, three pages apart.

Frequently Asked Questions

Will a quantum computer make my ASIC miner obsolete?

No — and this is the part most coverage gets backwards. Bitcoin mining is a race to find SHA-256 hash outputs, and the best known quantum method for that, Grover’s algorithm, gives only a quadratic speedup. Against that, a modern ASIC performs on the order of 100 trillion hashes a second while quantum gate operations run many orders of magnitude slower, so the square-root advantage does not come close to closing the gap. The peer-reviewed analysis this page links concludes that Bitcoin’s proof of work is relatively resistant to quantum speedup, precisely because ASICs are so fast. Your miner will be retired by the next generation’s efficiency long before quantum hardware is relevant to it.

What part of Bitcoin is actually vulnerable to quantum computing?

The signature scheme. Bitcoin uses ECDSA over the secp256k1 curve, and Shor’s algorithm solves the discrete logarithm problem that curve relies on. A sufficiently large, error-corrected quantum computer could derive a private key from a public key. That is a threat to coins, not to mining: it would let an attacker spend someone else’s bitcoin, but it would not help them win blocks.

Which bitcoins are most exposed?

Any whose public key is already visible on the chain. That includes the early pay-to-public-key coinbase outputs from 2009 to 2010, any address that has been spent from and then reused, and Taproot outputs, which publish the key directly. A standard address that has never been spent from reveals only a hash of the public key, which Shor’s algorithm cannot attack — only Grover’s can, and quadratically. Not reusing addresses is meaningful protection today and costs nothing.

How close are quantum computers to breaking Bitcoin?

Not close, and the gap is measured in engineering rather than years of announcements. Today’s machines have hundreds to a few thousand physical qubits that are noisy and short-lived. Published estimates for breaking secp256k1 call for a couple of thousand stable, error-corrected logical qubits, and at present error rates each logical qubit costs thousands of physical ones — so the requirement lands in the millions. Headline qubit counts are not the number to watch; error-corrected logical qubits are.

Can Bitcoin be upgraded to resist quantum attacks?

The cryptography exists: NIST released its principal post-quantum standards in August 2024 — FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) — with further algorithms still in process. Adding a quantum-resistant output type to Bitcoin is a soft fork, and technically the easier half. The hard half is social: coins in vulnerable outputs have to be moved by whoever holds the keys, and a large number of early coins will never be moved because nobody can move them.

Should any of this change what mining hardware I buy?

No. The economics of an ASIC purchase are decided by joules per terahash against the electricity price you actually pay, on a horizon of two to four years. Nothing about quantum computing is expected to matter on that horizon, and a machine bought today is superseded on efficiency grounds long before it is superseded on cryptography. Run the break-even arithmetic, not the headline.