Can a quantum computer break Bitcoin?

State as of: September 3, 2026. Asked plainly, the answer is no: no quantum computer has ever broken a Bitcoin key, and the largest public quantum attack on the kind of cryptography Bitcoin uses is a 15-bit demonstration — against the 256 bits of a real key — whose own significance is disputed. But "no" is only half the ledger. On paper, Bitcoin is a cheaper quantum target than RSA-2048: a March 2026 engineering blueprint from Google Quantum AI, with co-authors at Stanford and the Ethereum Foundation, puts one secp256k1 key at under 500,000 physical qubits and minutes of runtime — on a machine nobody has built. Rosetta Q reads both clocks below, every number with a source and a date.

What exactly would a quantum computer break in Bitcoin?

The signature, not the mining. Bitcoin proves ownership with ECDSA (and, since Taproot, Schnorr) signatures over the elliptic curve secp256k1. Shor's algorithm solves the underlying elliptic-curve discrete logarithm problem: given a public key, a large enough fault-tolerant quantum computer could derive the private key and spend the coins. That is the entire threat model — and it only bites where a public key is actually visible.

What Shor does not touch: mining and hashing. SHA-256 gets at most Grover's quadratic speedup — provably no more in the query model — and a quadratic speedup does not pay at these scales. A hashed address whose public key never appeared on-chain shows an attacker only a hash; the key becomes visible the moment you spend, and only until the transaction confirms. So "can quantum break Bitcoin?" decomposes into two honest questions: how big a machine does one key take, and whose keys are already visible.

How many qubits would it take to break one Bitcoin key?

The published requirement has collapsed roughly 3,800-fold in four years — entirely on paper. In 2017, Roetteler, Naehrig, Svore and Lauter set the logical-layer baseline for 256-bit curves: about 2,330 logical qubits and 1.26×10¹¹ Toffoli gates (arXiv:1706.06752). In 2022, Webber et al. translated the attack into physical qubits on a surface code: 1.9 billion to finish inside Bitcoin's 10-minute window, 317 million inside an hour, 13 million inside a day (AVS Quantum Sci. 4, 013801). In 2023, Litinski cut the gate count to 50 million Toffolis and estimated about 6.9 million physical qubits on a photonic active-volume architecture, one key every 10 minutes (arXiv:2306.08585); the same year Gouzien et al. costed it at 126,133 cat qubits over 9 hours (PRL 131, 040602).

Then, on March 30, 2026, Google Quantum AI — with Craig Gidney, whose RSA estimates our RSA-2048 post tracked, among the authors, plus Dan Boneh (Stanford) and Justin Drake (Ethereum Foundation) — published two concrete circuits for secp256k1: about 1,200 logical qubits with 90 million Toffolis, or about 1,450 logical qubits with 70 million Toffolis; under 500,000 physical qubits either way; roughly 18–23 minutes per key on the assumed hardware, and about 9 minutes for the live portion of an "on-spend" attack from a precomputed ("primed") state. The physical assumptions are deliberately the same "benign" ones as the 2025 RSA blueprint: 0.1% error rates, 1 µs cycle time, planar connectivity.

Our arithmetic, declared as such: 1.9 billion (2022, 10-minute window) to under 500,000 (2026, ≈20 minutes) is a division of published figures, ÷3,800 across four years — and the plans are not strictly comparable point to point (different architectures, error-correction schemes and attack windows; each paper prints its own assumptions). The pattern is the one we documented for RSA: the curve measures software, not hardware. The fine print is printed by the authors themselves: no such machine exists at any of these sizes; more aggressive but experimentally undemonstrated assumptions could cut requirements a further 10–100×; and, as they note, attacks only ever get better.

Why is Bitcoin a cheaper quantum target than RSA-2048?

Because 256-bit curve keys are much smaller mathematical objects than 2048-bit RSA keys — and Shor's arithmetic scales with the object. By the Google paper's own comparison, breaking secp256k1 takes roughly 100× fewer Toffoli gates than RSA-2048 (70–90 million vs about 6.5 billion in Gidney's May 2025 estimate, arXiv:2505.15917) and about half the physical qubits. Elliptic-curve keys are almost an order of magnitude smaller than RSA keys at similar classical security — that compactness is exactly why the world moved to ECC, and exactly what makes it the nearer quantum target.

The consequence is counterintuitive and worth stating carefully: on the paper curve, the cryptography under Bitcoin falls before the cryptography under legacy RSA — if and when such a machine arrives, the sequencing matters for anyone planning a migration. The comparison is unusually clean because the same author line produced both blueprints under matching physical assumptions. None of this is an accusation of hype: the paper states plainly that the machine does not exist, and published a zero-knowledge proof of its circuit constructions instead of the circuits themselves — an experiment in responsible disclosure for quantum cryptanalysis.

Which bitcoins are already exposed today?

Somewhere between roughly 1.7 million and 6.9 million BTC sit behind public keys that are already public — and the spread is a methodology choice, not a measurement dispute. The attack splits into two shapes. A long-range attack targets keys already printed on-chain: P2PK outputs from the genesis era (about 1.7 million BTC, including Satoshi-era rewards, per the Google paper), plus legacy addresses whose keys were revealed by reuse (roughly 0.6 million more in the same accounting). Against these there is no time pressure at all: the attacker computes offline, and the attack becomes feasible the day a large enough machine exists. An on-spend attack targets everyone else: a hashed address reveals its key only at broadcast, so the attacker must derive the private key and front-run confirmation inside about 10 minutes — the Google paper estimates roughly a 41% success probability for its fast circuit under idealized conditions (single-signature transaction, no congestion, 9-minute derivation).

One more distinction the headlines blur: "harvest now, decrypt later" — the clock that drives post-quantum migration for communications — does not transfer to Bitcoin unchanged. For communications, HNDL requires intercepting traffic today. Bitcoin's ledger is public by design: for every exposed key, the harvest happened at publication, and there is nothing left to intercept. Exposed coins are simply waiting on the machine; hashed coins risk only the confirmation window. That asymmetry — not any prediction of a Q-day date — is what gives the migration debate its deadline logic.

What has actually been measured?

The public record is a 15-bit key — and even that is disputed. On April 24, 2026, Project Eleven awarded its 1-BTC Q-Day Prize to Giancarlo Lelli for running a Shor-variant attack on a 15-bit elliptic-curve key — a keyspace of 32,767 — on cloud-accessible IBM hardware, the largest public quantum ECC attack to date and a 512× jump over the 6-bit demonstration of September 2025. Within days, Bitcoin developers published a counter-analysis: the same "key recovery" pipeline succeeds when the quantum backend is replaced with /dev/urandom, because at roughly 98,000 gates and 99.5% per-gate fidelity the circuit's outputs are statistically indistinguishable from coin flips — and a 15-bit keyspace is small enough for chance plus classical post-processing to solve. In our credibility-checklist terms, the dispute is exactly the quantitative-bound question: nothing in the published run certifies that the quantum processor, rather than luck, found the key.

None of this is an accusation in either direction. The prize was designed to elicit the strongest honest public attack and paid out on its published criteria; the critics published reproducible counter-evidence within days. That loop — claim, artifacts, independent re-run — is the verification system working, and it is the same loop that produced the caveats on quantum factoring records, where the honest Shor record stands at N ≤ 35 with equivalent fine print. For scale: the largest announced quantum chip holds 1,121 physical qubits — logical qubits are the unit that matters, and logical demos stand in the tens against the ≈1,200–1,450 the blueprint asks for. Bitcoins stolen by a quantum computer, as of today: zero.

What is Bitcoin doing about it?

Migrating on paper — the first post-quantum output type is already merged. BIP-360 ("Pay to Quantum Resistant Hash") was merged into the Bitcoin BIP repository on February 11, 2026: a new SegWit output version (addresses beginning bc1r) that removes the quantum-vulnerable key path and is designed to carry NIST post-quantum signature schemes such as ML-DSA, deployable as a soft fork. The printed cost is size: an ECDSA signature is about 71 bytes; ML-DSA runs 2.4–4.6 KB and SLH-DSA 7.8–49 KB (Chaincode Labs, 2025) — block space is the migration tax, and Chaincode's roadmap estimates a comprehensive migration takes on the order of 7 years. Then, on April 14, 2026, BIP-361 ("Post Quantum Migration and Legacy Signature Sunset") proposed the hard part: a deadline after which legacy signatures stop validating, freezing unmigrated coins — including, by construction, the Satoshi-era 1.7 million.

The debate around BIP-361 is the honest fork in the road, and we present both positions as printed: advocates argue that doing nothing guarantees those coins are eventually stolen, a more chaotic form of loss; opponents argue that freezing other people's coins violates the property guarantees Bitcoin exists to provide. Rosetta Q takes no position on that governance question. We note the structure: the network is planning against the paper clock, not against the 15-bit measured record — the same posture NIST took for RSA, and the roadmap caveat from our timing post applies to every date in this paragraph.

Our own data: none in this class — declared. Rosetta Q's sealed runs are small optimization and quantum-walk experiments, nowhere near cryptanalysis; we have no measurements against any cryptographic system and claim none. Every number above is someone else's, linked and dated.

What we know / what we don't know

We know: no Bitcoin key has ever been broken by a quantum computer, and the measured record for a public quantum ECC attack is a disputed 15-bit demonstration (April 2026); the published paper requirement for one secp256k1 key fell from billions of physical qubits (2022) to under 500,000 (March 2026), with each paper's assumptions in print; by the same authors' comparison, 256-bit ECC is roughly 100× cheaper in Toffoli gates than RSA-2048; between about 1.7 and 6.9 million BTC sit behind already-exposed public keys, depending on what you count; BIP-360 is merged and BIP-361 is proposed, with dates.

We don't know: when — or whether — a cryptographically relevant quantum computer of that size arrives; vendor roadmap dates have an empty track record either way. Whether the 2026 blueprint's constants survive contact with engineering, in either direction — its own authors bracket a further 10–100× of undemonstrated improvement. The true exposed total — each census opens a different set of doors, and none is audited. Whether small-keyspace demos can ever distinguish quantum success from chance before fault-tolerant hardware exists — the 15-bit dispute suggests the demonstration format itself saturates. And whether the freeze-versus-theft debate resolves before it stops being hypothetical.

Rosetta Q publishes verdicts with reproducible raw data. This is educational content, not a product claim.