How Will Quantum Computing Affect Bitcoin Mining?

Category: History and Future · Published 2026-07-01

Technically reviewed and sourced on 2026-07-03 · time-sensitive: revisit periodically

The short answer: mining is the strong part

You have probably seen the headline: quantum computers are coming to break Bitcoin. It is a dramatic story, and it gets the most important detail backwards. The part people usually mean by mining — the vast global search that secures each new block — is one of the most quantum-resistant pieces of the whole system. The part actually worth watching is different: the digital signatures that prove you own your coins.

Two different quantum algorithms are involved, and telling them apart unlocks the whole topic:

• Grover's algorithm is the one that touches mining. It offers only a modest square-root speedup — an edge that, as we will see, collapses in the real world.
• Shor's algorithm is the one that touches wallets. It is a far more powerful, exponential break — but of signatures, not of mining.

Both threats are still years away from any working machine, and when — if ever — one arrives is genuinely uncertain and debated among experts. This is a prepared-not-scared subject, so let us walk through the mechanism and leave you able to reason about it for yourself.

How mining works, and why quantum barely touches it

Mining is a giant guessing game. Miners take a block's data and run it through a one-way function called SHA-256 (twice, technically), changing a small number called a nonce each time, hunting for an output below a target value. There is no clever shortcut — each guess is an independent lottery draw. The machines that do this are ASICs: chips built to do nothing but SHA-256, unbelievably fast. Together the network makes on the order of a billion trillion guesses every second.

Grover's algorithm is a genuine quantum speedup for this kind of blind search, but only a quadratic one — roughly the square root of the work, not an instant answer. In practice that advantage never materializes for mining, for several independent reasons:

• Per-guess speed. A quantum computer must run SHA-256 as a delicate, error-corrected circuit of tens of thousands of steps, each far slower than a purpose-built ASIC gate. Per hash it is astronomically slower, and the ASIC's raw speed swamps Grover's square-root gain.
• The parallel wall. Classical mining scales cleanly: twice the machines, twice the chances. Grover does not — to search twice as fast you need four times as many quantum machines. Bitcoin mining is massively parallel, exactly the setting where Grover's edge falls apart.
• Economics. A March 2026 arXiv preprint (BTQ Technologies; not yet peer-reviewed)⁶ estimated that Grover-based mining at 2025 difficulty would need on the order of 10^23 physical qubits and star-scale power — around 10^25 watts, far beyond any national grid. Even its most favorable case still needed ~10^8 qubits and grid-scale power: a physical impossibility with any foreseeable technology.
• Difficulty. Even a working quantum miner would just be more hashpower: difficulty adjustment restores the ten-minute average block pace, and the quantum miner keeps only its proportional share of blocks — no takeover. Covered below.

Myth to retire: the idea that a quantum computer will instantly out-mine everyone and break SHA-256. Neither is true. Grover only halves SHA-256's effective security — from about 256 bits to about 128 — which is still so vast that a machine doing ten billion operations a second would need on the order of 10^21 years to exhaust it — over a hundred billion times the age of the universe. Cryptographers and standards bodies agree: 256-bit hashes stay quantum-safe, and no hash sizes need to change.

The real threat: Shor's algorithm versus your signatures

Owning Bitcoin means being able to produce a valid digital signature. Those signatures use the secp256k1 elliptic curve, through schemes called ECDSA and Schnorr. Your public key is derived from your private key by a one-way mathematical step; reversing it — recovering the private key from the public key — is something classical computers cannot do in any workable time.

Shor's algorithm changes that. On a large enough quantum computer it solves exactly this reversal in polynomial time — an exponential break, not a square-root one. Given a visible public key, such a machine could in principle derive the matching private key in hours or days, with some 2026 designs estimating minutes. The attacker out-hashes no one; they simply forge ownership. This is a wallet-and-signature problem, entirely separate from mining.

The crucial word is visible. A public key only becomes a target once it appears on the blockchain:

• The oldest coins. Early pay-to-public-key outputs, including Satoshi-era coins, wrote the full public key in plain sight. They are the most exposed — and many are also lost, so their owners could never move them to safety.
• Reused addresses. Hash-based address types (starting 1, 3 or bc1q) reveal only a hash of your public key when receiving; the key itself appears only when you spend. Taproot addresses (bc1p) are the deliberate exception — they place a public key directly in the output. Reuse an address after spending, and that now-public key becomes a standing target.
• The spend window. Broadcasting a transaction reveals your public key while it waits a few minutes to confirm. A fast enough machine could, in theory, crack it and race a competing transaction — but that needs minutes-scale key-breaking, far harder than attacking coins sitting at rest.

How much is at risk? Estimates vary by method, so treat it as a range: a meaningful share of supply sits in addresses that have already exposed a public key — the coins carrying this signature risk — though published estimates vary widely by method. Of that, a substantial share of the oldest coins (estimates vary widely) is believed lost for good. The remaining majority of supply, held in addresses that have never revealed a public key, faces only the harder spend-window risk. A note on the popular phrase harvest-now-decrypt-later: exposed keys are already public, so there is nothing to harvest — and nothing can be done to them until a capable quantum computer actually exists.

Where quantum hardware actually is today

To run Shor against Bitcoin, a machine needs many high-quality logical qubits, and that word matters. Physical qubits are the raw, noisy hardware; error correction bundles many physical qubits together to make one reliable logical qubit — often a hundred to a thousand physical per logical. Shor at cryptographic scale needs hundreds of thousands of these, held stable through millions of error-corrected steps.

Where is the field in mid-2026? The best publicly reported machines have on the order of a few thousand physical qubits and logical-qubit counts only in the tens to low hundreds at the leading labs, and a single demonstrated logical qubit from Google. Meanwhile the estimated hardware requirement has fallen sharply as designs improve:

• In 2019, an early landmark estimate put breaking RSA-2048 at around 20 million noisy qubits — a different problem than Bitcoin's elliptic curve, but a sign of how daunting these attacks looked.
• In March 2026, a Google Quantum AI team estimated breaking Bitcoin's curve at roughly 1,200–1,450 logical qubits and fewer than 500,000 physical qubits, at about 9 minutes per key⁵ — roughly a twentyfold cut in the physical-qubit count versus the prior best estimate.

Read those numbers carefully. They are theoretical circuit designs and resource estimates, not demonstrations. No machine has broken any real key or factored a cryptographically meaningful number. The gap between a few thousand noisy qubits today and hundreds of thousands of stable, error-corrected ones is enormous, and keeping error correction running in real time remains genuinely hard.

So when is Q-day? Honestly, nobody knows — this part is speculative and contested. Most published expert surveys and resource estimates place a cryptographically relevant machine in the 2030s or later — though some vendor roadmaps target the very end of this decade, and all such dates are projections, not commitments. The government deadlines you may have heard of — NIST advising retirement of classical public-key cryptography between 2030 and 2035 — are for general IT security, not for Bitcoin. The direction of travel points toward feasibility; the timing is an open question.

Why difficulty adjustment defuses any mining edge

Suppose, despite everything above, someone did build a quantum miner with a small edge. Bitcoin has a built-in shock absorber that has already tamed decades of hardware leaps: the difficulty adjustment. Every 2,016 blocks — about two weeks — the network recalculates how hard the puzzle is, aiming to keep blocks arriving roughly every ten minutes. If total hashing speed rises, blocks come faster, and difficulty simply rises to match, pulling the pace back to ten minutes.

This is exactly how the network absorbed every generation of faster ASICs: no takeover, no broken chain, just a higher difficulty and reshuffled economics. A hypothetical quantum miner would be no different — and because Grover's square-root parallel penalty means it could not cheaply scale up all at once, it would have to ramp in gradually, giving difficulty ample time to adapt.

The adjustment is even clamped so it cannot move more than a factor of four in either direction per period, though a gradual arrival never tests that limit. The takeaway: a working quantum miner would be an evolutionary competitive pressure at most, not a 51%-in-a-day catastrophe. Mining is simply not where the fragility lives.

What is already being done

The reassuring part is that the cryptography already exists. In August 2024, after an eight-year public process, NIST finalized its first post-quantum standards — including lattice-based and hash-based signature schemes designed to resist Shor's algorithm. The catch for Bitcoin is that these quantum-resistant signatures and keys are much larger than today's, which costs precious block space and fees.

Bitcoin-specific work is underway, though nothing is live yet:

• BIP-360 proposes a first quantum-resistant address type. It was merged into the Bitcoin standards repository in February 2026, but is not activated — it would be an optional, opt-in protection you could choose to move funds into.
• BIP-361, proposed in April 2026, is the harder and more contentious idea: a deadline after which coins still sitting behind old, quantum-vulnerable signatures could no longer be spent — effectively freezing them to deny them to a future attacker.
• Several other designs are in discussion, from quantum-safe Taproot spend paths to hash-based signature schemes tracked by Bitcoin Optech.

The genuinely unresolved problems are not mathematical but human. Upgrading Bitcoin requires broad social consensus, and a migration touching perhaps a large share of supply would be unprecedented. Hardest of all are the lost coins: a substantial share of the oldest coins (estimates vary widely), including Satoshi's holdings, can never be moved by their owners. The community faces an unresolved choice between leaving them as a future bounty, freezing them, or recycling them — each option carrying serious ethical and economic objections, with no consensus in sight.

For an ordinary holder today, the sensible posture is low-cost and boring: do not reuse addresses, and keep funds in hash-based address types that never expose a public key until you spend (such as bc1q; note that Taproot bc1p addresses expose a public key by design). That is the whole ecosystem's stance — prepared, not scared. And because fear sells, it is worth remembering the goal is to understand the mechanism, not to buy anything sold on a scary quantum headline.

Sources

1. NIST Post-Quantum Cryptography project
2. Transition to Post-Quantum Cryptography Standards (NIST IR 8547, draft) — NIST
3. Bitcoin Improvement Proposals (post-quantum address proposals) — bitcoin/bips
4. How to factor 2048-bit RSA integers in 8 hours using 20 million noisy qubits (arXiv:1905.09749) — Gidney & Ekerå
5. Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations (Google Quantum AI, March 2026) — arXiv
6. Kardashev Scale Quantum Computing for Bitcoin Mining (Dallaire-Demers / BTQ, March 2026 preprint) — arXiv

Some specific claims in this article are scheduled for further source review; citations may be expanded (see our editorial policy).

Related educational reading

• The History of Bitcoin: From the White Paper to a Global Network
• The Genesis Block
• How Will AI Affect Bitcoin and the Crypto Space?