Quantum computing and crypto: is your wallet at risk?

Every few months a headline says quantum computers will "break Bitcoin." In October 2026 the debate got louder: one Ethereum researcher urged holders to plan a move to fresh addresses, and Vitalik Buterin replied that nobody should scramble. So what does quantum computing mean for crypto, really? No quantum computer can steal coins today. When one can, it won't hit every wallet equally. It needs your public key, and most wallets keep that hidden until you spend. This guide explains which coins are exposed, how close the threat is, and what's sensible to do now.

Last updated: October 2026

How does quantum computing threaten crypto?

Quantum computing threatens crypto by attacking the digital signatures that prove you own your coins. Bitcoin and Ethereum use elliptic-curve signatures (ECDSA, and Schnorr for Bitcoin's Taproot). A large enough quantum computer running Shor's algorithm could work backward from a public key to the private key, and then sign transactions as you.

What a quantum computer could break

Your wallet holds a private key. From it, the wallet computes a public key, and from that, your address. Today, going from public key back to private key is practically impossible. Shor's algorithm changes that for elliptic curves.

The good news is in the last step. Most addresses are a hash of the public key, not the key itself. A hash is one-way, so seeing an address doesn't reveal the public key. The key only appears on-chain when you spend, because the network needs it to check your signature. Our guide to seed phrases and private keys covers how those layers fit together.

What it probably can't

• Mining. Bitcoin mining uses SHA-256 hashing. The known quantum speed-up for hashing (Grover's algorithm) is only a square-root gain, so mining and the 21 million supply cap aren't the near-term problem.
• Your seed phrase directly. A seed phrase isn't attacked on its own. The risk is the public key derived from it, once that key is visible.
• Every coin at once. An attacker would need serious time on a very expensive machine for each key. Exposed, high-value addresses would come first.

Can quantum computers break Bitcoin today?

No. No existing quantum computer can break Bitcoin's or Ethereum's signatures. What changed in 2026 is the estimate of how big a machine would need to be, and it dropped sharply.

These are designs on paper, not demonstrated attacks. The 500,000-qubit target is roughly 500 times larger than today's biggest devices. Google's team didn't publish the attack circuits. It released a zero-knowledge proof so others could check the claim without getting a recipe.

When could Q-Day arrive?

"Q-Day" is the day a quantum computer can break today's public-key cryptography. Nobody knows the date. IonQ expects machines of the size it describes around 2028, and some researchers call 2028 realistic. Others see the mid-2030s as just as plausible. In October 2026, Ethereum Foundation researcher Justin Drake also warned that AI-assisted mathematics could weaken elliptic-curve signatures before quantum hardware arrives, and called for a "bunker mode" plan.

The practical takeaway: the threat isn't here, but the timeline is shorter than it looked two years ago. That's why networks are planning upgrades now.

Which coins are exposed to a quantum attack?

Coins are exposed when their public key is already visible on the blockchain. That depends on the address type and on whether the address has ever been spent from, not on which coin you hold. The table below shows the common cases.

Coins at rest

Estimates of how much bitcoin is exposed range widely, from about 2.3 million to about 7 million BTC. The low end counts early P2PK coins (about 1.7 million BTC) plus coins exposed through address reuse. Higher 2026 estimates also count Taproot outputs and large reused wallets, such as exchange hot wallets, and land at roughly 6–7 million BTC, or about 30–35% of supply. Satoshi Nakamoto's estimated 1.1 million BTC sit in that exposed group. If those keys are lost, the coins can never be moved to a safer address.

If you use Coin98 Super Wallet, it offers Legacy and Bech32 (Native SegWit) Bitcoin addresses. Both store a hash of your public key, so the key stays hidden until you spend. Our explainer on Legacy, SegWit, and Taproot addresses compares the formats.

One detail matters here: when you spend from a Bitcoin address, some wallets send the leftover amount (the "change") back to the same address. If it does, that balance now sits behind a visible public key. Our guide to how Bitcoin tracks coins as UTXOs explains how change works.

Coins in transit

Even a hidden key appears for a few minutes while a transaction waits to confirm. Google's March 2026 estimate looked at an attacker who precomputes half the work and waits. With Bitcoin's 10-minute average block time, it gave that attacker roughly a 41% chance of deriving the key before the transaction confirms. On Ethereum, with 12-second slots, that kind of attack was judged impractical for first-generation machines.

Ethereum accounts

Ethereum uses the same idea, but most active accounts are exposed. An account that has sent even one transaction has revealed its public key. An emergency plan outlined in 2024 covers that case: a hard fork that would switch off ordinary account transactions and let owners move funds by proving they know the seed behind the account.

What's being done, and what should you do now?

Networks and standards bodies are building quantum-resistant cryptography now, and most holders don't need to move funds today. The sensible steps are simple and cheap: avoid exposed setups, keep backups in order, and ignore anyone pushing an urgent "quantum upgrade."

Quantum-resistant crypto is coming

• Standards exist. On August 13, 2024, the US standards agency NIST finalized its first post-quantum standards: ML-KEM for encryption, and ML-DSA and SLH-DSA for digital signatures.
• Bitcoin has proposals, not upgrades. BIP-360 proposes a new output type that hides the public key and prepares for post-quantum signatures. It's a draft with no activation date. Other proposals would phase out vulnerable signatures over time, and freezing untouched exposed coins is openly debated.
• Ethereum and its layer 2s have targets. Ethereum's roadmap aims for core post-quantum pieces around 2029. In October 2026, Starknet said it is "actively considering" becoming its own layer 1 so it can reach full quantum resistance by 2027.
• There's a cost. Post-quantum signatures are larger, so they take more block space and may raise fees.

A calm checklist for today

1. Don't rush a migration. Buterin's advice in October 2026 was not to scramble, noting he'd lost more money to botched migrations than to hacks. A careless transfer is a bigger risk today than a quantum computer.
2. Stop reusing addresses. Use a fresh receiving address when your wallet offers one, and don't send new funds to an address you've already spent from.
3. Move exposed long-term savings when it's easy. Funds in an address that has already spent, or in Taproot outputs, can go to a fresh address that has never sent a transaction. Do it once, carefully, with a small test first.
4. Keep your seed phrase backed up. Any future upgrade will mean moving funds, and you'll need working access to do it. Our seed phrase guide covers safe storage.
5. Treat "quantum upgrade" messages as scams. No wallet will email you a link to "make your coins quantum-safe." Our guide to protecting yourself from crypto scams and Super Wallet's security and privacy features are good places to start.

FAQ

Can a quantum computer steal my bitcoin today?

No. No quantum computer today is anywhere near large enough. The 2026 estimates describe machines hundreds of times bigger than any that exist. The risk is in the future, and it applies first to coins whose public keys are already visible on-chain.

How many qubits does it take to break Bitcoin?

Estimates published in 2026 range from about 19,400 physical qubits in one trapped-ion design to fewer than 500,000 physical qubits in a superconducting design. Both need around 1,200–1,450 error-corrected "logical" qubits. Neither has been built.

What is Q-Day?

Q-Day is the day a quantum computer becomes able to break today's public-key cryptography, including the signatures used by Bitcoin and Ethereum. Its date is unknown. Planning dates in the industry range from about 2028 to the 2030s.

Is Ethereum more exposed than Bitcoin?

At rest, often yes, because any Ethereum account that has sent a transaction has revealed its public key. In transit, Ethereum's 12-second slots make attacks on pending transactions much harder than on Bitcoin's 10-minute blocks.

Should I move my crypto to a quantum-resistant wallet now?

For most people, no. Quantum-resistant signatures aren't live on Bitcoin or Ethereum yet, so there's nowhere fully quantum-safe to move to. Avoiding address reuse and keeping funds in addresses that haven't sent a transaction is a reasonable precaution.

Is quantum computing a threat to Bitcoin mining?

Not in the near term. Mining relies on hashing, and quantum computers offer a much smaller advantage against hashes than against signatures.

Conclusion

Quantum computing is a real long-term threat to crypto, but it targets public keys, not every coin at once. Most addresses stay hidden until you spend, and good habits keep it that way: don't reuse addresses, back up your seed phrase, and ignore urgent "quantum upgrade" offers. Coin98 Super Wallet offers Legacy and Bech32 Bitcoin addresses, which keep your public key hidden until you spend.