Short answer: not today — but the threat is real enough that it's worth understanding exactly how it would work. No quantum computer that exists in 2026 can steal anyone's Bitcoin. The concern is a future machine, combined with the fact that a blockchain never forgets. Here is the honest version of the risk, with the fear stripped out.
How the theft would actually work
Bitcoin, Ethereum and almost every major chain prove ownership with an elliptic-curve signature (ECDSA). Your private key signs; anyone can verify with your public key. The security rests on one assumption: you cannot work backwards from the public key to the private key.
Shor's algorithm, run on a large fault-tolerant quantum computer, breaks that assumption. Given your public key, it can compute your private key. Whoever runs the attack first can then sign a transaction as you and move your coins.
So the attack isn't magic and it isn't hacking the network — it's deriving a private key from a public key that's already out in the open. Which raises the real question: whose public key is out in the open?
Which wallets are actually exposed
This is the part most scare-articles skip. On Bitcoin, your public key is not always visible. It becomes visible when you spend.
| Wallet situation | Public key exposed? | Quantum risk |
|---|---|---|
| Address that has spent at least once | ✅ Yes — on chain forever | Exposed |
| Reused address (receives + spends repeatedly) | ✅ Yes | Exposed |
| Legacy pay-to-public-key outputs | ✅ Yes | Exposed |
Taproot (P2TR, bc1p…) address, even if it only ever received | ✅ Yes — the output itself contains a (tweaked) public key | Exposed |
Fresh hashed address (P2PKH 1…, P2WPKH bc1q…), only ever received | ❌ Not yet | Protected until first spend |
The takeaway: spending reveals your public key permanently. An address you've spent from is exposed for the rest of the chain's life. A brand-new hashed address holding coins you've never moved is, for now, shielded behind a hash — but the moment you spend, the key is public and the clock starts.
Taproot is the exception to "only spending exposes you". Taproot (P2TR) outputs, introduced in 2021, store a tweaked public key directly in the output instead of a hash of it, so a Taproot address is exposed from the moment it receives coins. Google Quantum AI's March 2026 whitepaper calls this a security regression from a quantum standpoint (source). The proposed fix is BIP-360, Pay-to-Merkle-Root (P2MR, bc1z…): Taproot with the quantum-vulnerable key-path spend removed. It was merged into the BIP repository as a draft in February 2026 — that is a proposal, not an activated upgrade — and like every other Bitcoin output type it still reveals the key when you spend.
This is why "just move your coins when quantum computers arrive" is a trap: the act of moving them is exactly what exposes the key, and by then the attacker may be faster than your transaction. Google Quantum AI estimates that a first fast (superconducting) attack machine could derive a key in about 9 minutes from a pre-computed state — close to Bitcoin's 10-minute average block time (source).
Why the timeline doesn't save you: "harvest now, decrypt later"
Even though no dangerous quantum computer exists yet, the timing works against exposed chains because of harvest now, decrypt later.
An adversary doesn't need a quantum computer today. They can record every exposed public key on the blockchain now — it's public data, freely available — store it, and wait. When capable hardware eventually arrives, they decrypt the whole harvested set retroactively. A blockchain is the perfect target: the exposed keys are already sitting in an immutable, permanently-downloadable ledger.
That's the asymmetry. The attacker's "record now" step is free and happening whether anyone notices or not. Your "migrate later" step can't undo a key that was exposed years earlier.
What actually removes the risk
There are two layers of defence, one partial and one complete.
Partial (what you can do on Bitcoin today): minimise exposure. Don't reuse addresses. Prefer wallet software that keeps the public key hidden until spend and moves the full balance in one go. Avoid Taproot (bc1p…) addresses for coins you plan to leave untouched for years. This shrinks the window but never closes it — every spend still exposes a key.
Complete (what the protocol has to do): sign with post-quantum cryptography. If the signature scheme itself has no shortcut for Shor's algorithm, then exposing the public key is harmless — there's nothing to derive. This is the only defence that protects the ledger permanently rather than shrinking a window.
That's the entire design premise of a quantum-resistant chain. QRL signs with XMSS (hash-based) on Legacy and ML-DSA-87 (lattice-based, NIST FIPS 204) on QRL 2.0. On those chains, a published public key gives an attacker nothing, because the private key can't be recovered from it — with a quantum computer or without one. It's also why hash-based schemes go a step further and never reuse a signing key; see one-time signatures and OTS keys.
So should you panic about your Bitcoin?
No. But the honest risk assessment is:
- No theft is possible today — the hardware doesn't exist.
- The exposure is real and permanent for any address you've spent from, and "harvest now, decrypt later" means it can't be reversed after the fact.
- Timeline is unknown — could be over a decade, could be never. Published estimates of the hardware needed keep falling, though; the Q-Day progress tracker shows estimates next to what has actually been built.
- The only complete fix is protocol-level post-quantum signatures, which most major chains have not deployed.
Whether that tail risk matters to you depends on how long you plan to hold and whether you believe the hardware will arrive. If you want to check any chain's real standing rather than trust its marketing, use the quantum-resistance checklist — and see which blockchains are actually quantum-resistant for where the major ones land today.