This distinction is the whole point, since the popular version of this story, where quantum shows up one day and Bitcoin dies, gets both the mechanism and the timing wrong. The risk is tangible and specific, and it's been baked into Bitcoin since its earliest days.
Where the risk resides
Bitcoin's main quantum weak spot isn't the blockchain itself. The mining and block history rest on SHA-256, and the best quantum attack on it, Grover's algorithm, offers only a quadratic speedup, which current analyses find too weak to threaten Bitcoin mining anytime soon.
The piece that’s threatened is the signature layer, the secp256k1 keys that authorize spending. Bitcoin signs with ECDSA on legacy and SegWit outputs, and with Schnorr on Taproot. Theoretically, a powerful enough quantum computer running Shor's algorithm can pull a private key out of the matching public key, then spend your coins.
The catch specific to Bitcoin is that a public key, once it appears on-chain, is exposed forever. There’s no turning back. What that key still guards can change, though. Spend those coins into a fresh, unused address, and the old key stays visible but controls nothing.
So the exposed balance is whatever sits behind a visible key at any given moment, and it shifts as those coins are spent or moved. Which addresses are safe and which aren't depends on the address type, which we cover in our Is Bitcoin quantum safe? post.
Where the exposure comes from
Bitcoin's oldest exposure is structural. The earliest mining rewards, including much of the estimated 1 million BTC commonly attributed to Satoshi, sit in pay-to-public-key outputs from 2009 and 2010, which place the public key in the open from the start. Those coins stay a live target for as long as they sit there unspent. Reusing an address adds more, as it puts that key back in the open each time.
How much is exposed depends on how you count. A 2020 Deloitte analysis found more than 4 million BTC under a narrower, older classification. More comprehensive 2026 analyses, including Project Eleven's Bitcoin Risq List and Google's own study, place long-range exposed balances near 6.9 million BTC.
The two numbers don't measure the same thing. The newer figures also cover Taproot, reused SegWit, and other output types Deloitte left out, so the higher 2026 number partly reflects a wider count, not just more coins becoming exposed over time.
Two estimates under different methods. Source: qLABS
The two clocks
Bitcoin's quantum risk comes down to a race between two clocks.
The threat clock refers to how long we have until a strong enough quantum computer is able to break ECDSA in practice. No one can set it precisely. Expert surveys spread the odds across the 2030s and beyond, with aggressive scenarios in the late 2020s.
On the other hand, the migration clock counts down until the moment Bitcoin ships a quantum-safe signature scheme and holders start to move their coins onto it.
Which clock finishes first shapes the outcome.
If the migration one wins, owners who still control their coins can move them to safe outputs. It doesn't rescue everyone, though: lost and dormant coins can't move themselves, so old exposed outputs stay a target unless Bitcoin adopts contested rules to freeze or sunset them. If the threat clock wins first, anything still behind an exposed key and not defended in time is up for grabs.
Two clocks, one race: whichever finishes first decides whether exposed coins stay safe. Source: qLABS
Why Bitcoin's clock runs slow
Bitcoin isn't the least-prepared chain, as our own index scores several chains worse on migration readiness, but its upgrade path is slow and contentious by design, and that's the issue at stake here. Consensus changes need wide agreement across a decentralized network with no central organization to set the direction.
The last two upgrades, SegWit in 2017 and Taproot in 2021 (which introduced Schnorr signatures), took years from proposal to activation. A post-quantum migration is a heavier lift than either, because it has to handle legacy and dormant outputs, not just add an option for fresh coins.
As we speak, there's still no finalized plan. The leading draft is BIP-360, a Pay-to-Merkle-Root proposal that would remove Taproot's exposed key-path spend and blunt long-exposure attacks. It's an early step, well short of a finished fix.
On its own, it doesn't stop a fast mempool attack, and it has no agreed activation date. Bitcoin hasn't put a date on any of this. The best estimate, ours included, is a first post-quantum output type in the late 2020s or early 2030s, and even that runs uncomfortably close to the threat clock estimates. This overlap is a big reason Bitcoin tops the risk rankings.
How much is at stake
By value, Bitcoin dominates crypto's quantum exposure, but the numbers need care. On our L1 Quantum Vulnerability Index, a proprietary scale that blends exposed-key history, market value, chain age, and preparedness, Bitcoin scores 8.33 out of 10, the highest of the ten chains ranked. One of those inputs is Bitcoin's entire market capitalization, the value of every coin on the chain, whether or not its key is exposed.
In a separate May 2026 qLABS analysis, this value came to about $1.6 trillion, or 71% of the top 20 Layer 1s at that snapshot. The balance sitting behind exposed keys is far smaller, on the order of a few hundred billion dollars at 2026 prices.
Disclosure: qLABS builds quantum-safe products and runs that index, so weigh the ranking accordingly. The methodology and conflict-of-interest statement sit with the qLVI, and the scoring is reproducible.
What you can do about your own risk
You can't speed up Bitcoin's migration, but you can shrink your own slice of the risk, as most of it comes from exposed keys you control.
Don't reuse addresses, and keep long-term holdings in address types that hide the public key behind a hash and have never been spent from, so the key stays off-chain until the day you move the coins.
Avoid Taproot for cold storage because it exposes the key from the moment it's funded. This protects coins as long as their key stays hidden. It doesn't protect the spend itself, since the key appears in the transaction, where a fast enough attacker could target it in the mempool. It lowers exposure without making the coins quantum safe.
There's also the application layer route. qLABS's own qVAULT adds a post-quantum lock on top of a standard wallet, covering qONE and HYPE on HyperEVM today, with Ethereum and stablecoins planned. Bitcoin’s base layer isn’t a smart-contract chain, so for native BTC the defense is key hygiene now and Bitcoin’s eventual migration later.
Please note that none of this is financial advice, just ways to lower your own exposure in the meantime.
Where the risk goes from here
Bitcoin's quantum exposure is large and slow to unwind. The set of disclosed keys keeps growing, and the value on the chain is enormous. The migration that would neutralize it grinds through a decentralized process. So, the honest read is that Bitcoin carries the biggest quantum exposure in crypto and will keep carrying it until the network ships a quantum-safe scheme and holders move their coins.
The threat clock might still have years on it, but you don't need to know the year to act. What's in your control is your own exposure. Check which of your coins sit behind exposed keys, and keep new keys off-chain. Then, read Bitcoin's spot on the qLVI for what it is. It's the most valuable chain, and it carries the largest pool of exposed coins.
FAQ
How real is Bitcoin's quantum risk?
Real, but not immediate. No quantum computer today can break Bitcoin's signatures. The risk is that one will be capable enough eventually. And a meaningful share of Bitcoin already sits behind public keys visible on-chain, where those coins stay exposed until they move to a quantum-safe address. Expert surveys spread the odds of a capable machine across the 2030s and beyond, with aggressive scenarios setting the date earlier.
How much Bitcoin is exposed to a quantum attack?
By 2026, Project Eleven's Bitcoin Risq List put long-range exposed balances near 6.9 million BTC, up from a 2020 Deloitte estimate of more than 4 million. The two aren't directly comparable, since the newer count covers more output types. It includes much of the early mining rewards commonly attributed to Satoshi. The figure shifts over time as exposed coins are moved or migrated, not only upward.
Can Bitcoin be upgraded to resist quantum computers?
Yes, but slowly. It needs new, quantum-resistant spending rules added through a consensus change. BIP-360 is the leading draft, a first step that removes Taproot's exposed key path, though it doesn't finish the job on its own, and Bitcoin's upgrades take years. No finalized migration path exists yet.
Will quantum computers destroy Bitcoin?
No, not directly. Mining and block history will keep working because SHA-256 will survive a quantum attack. The danger is theft. Coins behind an exposed public key could be spent by whoever breaks the key first. At scale, especially from the dormant early coins, that theft could cause serious market and governance disruption. The ledger would survive, but a smooth outcome isn't guaranteed.
What can I do to lower my Bitcoin quantum risk?
Keep your public keys off-chain. Don't reuse addresses, and hold long-term funds in unspent hash-based addresses. Avoid Taproot for cold storage. That won't make Bitcoin quantum safe, but it keeps your coins out of the exposed set as long as their keys stay hidden, until the protocol catches up.
qLABS Editorial. Sources are linked inline. See the L1 Quantum Vulnerability Index for our full methodology and conflict-of-interest disclosure.
%20copy-600x290.jpg)
%20copy%202-600x290.jpg)