The security of assets and transactions in cryptocurrencies, including Bitcoin, is based on digital signatures whose security derives from the difficulty of solving the discrete logarithm problem over elliptic curves using classical computers. However, quantum algorithms such as Shor’s algorithm for integer factorization, or analogous quantum algorithms for solving the discrete logarithm problem over elliptic curves, reduce the complexity of solving these problems on quantum computers to polynomial time. As a result, they could threaten the security of digital assets and transactions by allowing an attacker to derive users’ private keys from their public keys.
Public Keys and Quantum Attack Scenarios
The public keys of users in blockchain networks, including Bitcoin, may become accessible in different ways. In scripts that store the public key directly on the blockchain, such as P2PK, the public key is explicitly recorded on the blockchain, making long-duration or At-Rest attacks possible even with relatively slow quantum algorithms and quantum computers. In scripts that store the public key in hashed form on the blockchain, such as P2PKH, recovering the public key directly from the hashed data is not possible. However, if that public key has previously been used in another transaction, an attacker may be able to recover it and subsequently derive the corresponding private key, allowing the attacker to transfer the user’s assets to their own wallet.
In any case, across all script types, when users broadcast a transaction and request that it be included in the next blockchain block, their public key becomes exposed in the memory pool while the network is processing the transaction and before miners add it to the blockchain. During this period, the public key is accessible to all network participants, including potential attackers, creating the possibility of an On-Spend attack.
Is Bitcoin Mining Also Vulnerable to Quantum Threats?
Although quantum computers can threaten the security of digital signatures and, consequently, the ownership of cryptocurrencies, the process of creating and validating blocks in networks that use Proof of Work (PoW), such as Bitcoin, does not appear likely to face an immediate threat.
This is because Grover’s quantum search algorithm provides only a quadratic speedup, which may be offset by the computational overhead required for quantum error correction. In addition, Grover’s algorithm cannot be efficiently parallelized in the same way as classical mining systems. Classical machines used for mining, such as ASICs, achieve extensive parallelization in hash computations and can therefore provide performance hundreds of times greater than quantum implementations of Grover’s algorithm on quantum computers expected to be built over the coming decades.
What Quantum Hardware Would Be Required to Break Current Signatures?
Although Shor’s algorithm theoretically makes it possible to break current digital signature algorithms, running it against elliptic-curve-based digital signature schemes that use 256-bit keys requires quantum hardware that is not currently available.
One initial estimate places the required number of logical qubits at approximately 1,450 and the number of Toffoli gates at around 70 million, respectively affecting the hardware complexity and execution time of the attack. Using current quantum error-correction codes, such a configuration could be implemented with approximately 0.5 million physical qubits.
Such hardware could potentially break a 256-bit digital signature in approximately 18 minutes, with about half of that time spent in the preprocessing stage. This means that obtaining the private key itself could take roughly 9 minutes, creating the possibility of forging Bitcoin transactions and stealing assets currently being transferred, given that the average time required to generate a new Bitcoin block is approximately 10 minutes.
To counter these security threats posed by quantum computers, a temporary solution is to use scripts that store public keys in hashed form on the blockchain and to avoid reusing the same address in multiple transactions. The ultimate solution, however, is to migrate toward scripts whose transaction security is based on digital signatures built on post-quantum cryptographic algorithms.
Post-Quantum Cryptography and Emerging Standards
Post-Quantum Cryptography (PQC) refers to a set of cryptographic algorithms designed to resist attacks from quantum computers. The most important categories include lattice-based cryptography, code-based cryptography, and hash-based cryptography.
In August 2024, the U.S. National Institute of Standards and Technology (NIST) finalized three major standards. In addition, in March 2025, NIST selected the code-based HQC algorithm for standardization as a complementary option for key exchange, while the Falcon algorithm is also under development as another digital signature standard and is currently used in certain blockchain networks such as Algorand.
These standards are designed to reduce the risks arising from advances in quantum computing, but selecting the appropriate algorithm depends on the specific application, security requirements, and implementation constraints.
The Challenge of Migrating Blockchains to the Post-Quantum Era
There are, of course, challenges associated with migrating to post-quantum protocols, including larger key sizes compared with elliptic-curve algorithms, greater computational requirements, and other implementation-related issues. Solutions to these challenges must be developed according to the specific requirements of blockchain applications.
Nevertheless, networks such as Algorand, Solana, and XRP have implemented processes for migrating toward post-quantum protocols, while networks such as QRL, Mochimo, and Abelian were designed from the outset around such protocols, demonstrating the feasibility of this transition.
Why Should We Prepare for the Post-Quantum Era Today?
Finally, it is important to recognize that although breaking cryptographic systems and forging cryptocurrency digital signatures using quantum algorithms is not currently possible, security planning and implementation should not wait until critical thresholds are crossed, such as the successful breaking of cryptocurrencies using 32-bit keys or similar milestones.
The capabilities of quantum computers, particularly in terms of the number of logical qubits, may grow very rapidly, and the time required to progress from breaking 6-bit keys to 32-bit keys is not necessarily comparable to the time required to progress from 32-bit keys to 256-bit keys.
Moreover, creating new blocks on a blockchain network in order to confirm transactions is a time-consuming process. Therefore, transferring all existing cryptocurrencies to new addresses that use post-quantum protocols could take months or even years. Special measures must also be considered for assets that, for various reasons such as the loss of private keys, can no longer be accessed or transferred to new addresses.