Quantum risk to Bitcoin

Bitcoin uses digital signatures to prove who can spend coins. A sufficiently powerful quantum computer could calculate a private key from its corresponding public key and forge those signatures. Preparing for that possibility involves both better hardware forecasts and decisions about how Bitcoin would adopt new signature schemes.

Google has a migration target for 2029

Google set a 2029 target for its own post-quantum cryptography migration in March 2026. That date describes Google’s plan to replace vulnerable cryptography. The arrival date of a quantum computer capable of breaking Bitcoin keys remains uncertain.

Cryptographic migration takes time because software, hardware and data formats must work together. Google’s deadline is evidence of preparation by a large technology company; assessing Bitcoin’s exposure also requires examining its specific transaction types and consensus rules.

Both ECDSA and Schnorr signatures are exposed

Bitcoin uses ECDSA signatures in older transaction types and Schnorr signatures in Taproot. Both depend on elliptic-curve cryptography that a sufficiently capable implementation of Shor’s algorithm could break.

The distinction makes address format important. A fresh Taproot address already exposes its output key. Hash-based address types limit how long a public key is visible before spending, while a future attacker fast enough to derive a key during transaction confirmation would present a further risk.

BIP 360 proposes a different output structure

BIP 360, named Pay-to-Merkle-Root or P2MR, remains a draft on 10 October 2026. It proposes removing Taproot’s public-key spending path and committing directly to a tree of scripts. The proposal aims to reduce exposure from public keys left visible for long periods.

Defence against attacks during the short spending window would require additional post-quantum signature work. NIST’s post-quantum standards programme supplies standardised building blocks, while Bitcoin participants would still need to select and activate suitable network rules.

Moving coins requires network agreement and owner action

A migration would need wallet support, an agreed activation process and a way for owners to move funds into new output types. Dormant coins raise a separate coordination problem: a network upgrade cannot make an absent owner sign a transaction.

Follow the actual BIP status, wallet implementation and independently documented hardware results. The quantum threat tracker keeps proposed machines, experimental results and cryptographic migration milestones in their own context.