Short answer: not today — but the threat is real enough that it's worth understanding exactly how it would work. No quantum computer that exists in 2026 can steal anyone's Bitcoin. The concern is a future machine, combined with the fact that a blockchain never forgets. Here is the honest version of the risk, with the fear stripped out.
How the theft would actually work
Bitcoin, Ethereum and almost every major chain prove ownership with an elliptic-curve signature (ECDSA). Your private key signs; anyone can verify with your public key. The security rests on one assumption: you cannot work backwards from the public key to the private key.
Shor's algorithm, run on a large fault-tolerant quantum computer, breaks that assumption. Given your public key, it can compute your private key. Whoever runs the attack first can then sign a transaction as you and move your coins.
So the attack isn't magic and it isn't hacking the network — it's deriving a private key from a public key that's already out in the open. Which raises the real question: whose public key is out in the open?
Which wallets are actually exposed
This is the part most scare-articles skip. On Bitcoin, your public key is not always visible. It becomes visible when you spend.
| Wallet situation | Public key exposed? | Quantum risk |
|---|---|---|
| Address that has spent at least once | ✅ Yes — on chain forever | Exposed |
| Reused address (receives + spends repeatedly) | ✅ Yes | Exposed |
| Legacy pay-to-public-key outputs | ✅ Yes | Exposed |
| Fresh address, only ever received | ❌ Not yet | Protected until first spend |
The takeaway: spending reveals your public key permanently. An address you've spent from is exposed for the rest of the chain's life. A brand-new address holding coins you've never moved is, for now, shielded behind a hash — but the moment you spend, the key is public and the clock starts.
This is why "just move your coins when quantum computers arrive" is a trap: the act of moving them is exactly what exposes the key, and by then the attacker may be faster than your transaction.
Why the timeline doesn't save you: "harvest now, decrypt later"
Even though no dangerous quantum computer exists yet, the timing works against exposed chains because of harvest now, decrypt later.
An adversary doesn't need a quantum computer today. They can record every exposed public key on the blockchain now — it's public data, freely available — store it, and wait. When capable hardware eventually arrives, they decrypt the whole harvested set retroactively. A blockchain is the perfect target: the exposed keys are already sitting in an immutable, permanently-downloadable ledger.
That's the asymmetry. The attacker's "record now" step is free and happening whether anyone notices or not. Your "migrate later" step can't undo a key that was exposed years earlier.
What actually removes the risk
There are two layers of defence, one partial and one complete.
Partial (what you can do on Bitcoin today): minimise exposure. Don't reuse addresses. Prefer wallet software that keeps the public key hidden until spend and moves the full balance in one go. This shrinks the window but never closes it — every spend still exposes a key.
Complete (what the protocol has to do): sign with post-quantum cryptography. If the signature scheme itself has no shortcut for Shor's algorithm, then exposing the public key is harmless — there's nothing to derive. This is the only defence that protects the ledger permanently rather than shrinking a window.
That's the entire design premise of a quantum-resistant chain. QRL signs with XMSS (hash-based) on Legacy and ML-DSA-87 (lattice-based, NIST FIPS 204) on QRL 2.0. On those chains, a published public key gives an attacker nothing, because the private key can't be recovered from it — with a quantum computer or without one. It's also why hash-based schemes go a step further and never reuse a signing key; see one-time signatures and OTS keys.
So should you panic about your Bitcoin?
No. But the honest risk assessment is:
- No theft is possible today — the hardware doesn't exist.
- The exposure is real and permanent for any address you've spent from, and "harvest now, decrypt later" means it can't be reversed after the fact.
- Timeline is unknown — could be over a decade, could be never.
- The only complete fix is protocol-level post-quantum signatures, which most major chains have not deployed.
Whether that tail risk matters to you depends on how long you plan to hold and whether you believe the hardware will arrive. If you want to check any chain's real standing rather than trust its marketing, use the quantum-resistance checklist — and see which blockchains are actually quantum-resistant for where the major ones land today.