A sufficiently capable quantum computer could threaten Bitcoin’s signatures, not its supply cap or issuance schedule. In a report published on November 12, 2026, the Bitcoin Security Consortium, working with Presidio Bitcoin, described two ways that risk could appear: an attack on coins whose public keys are already exposed, or an attack during the interval between broadcasting a transaction and its inclusion in a block. No cryptographically relevant quantum computer had been demonstrated at the time of the report.
Public keys that are already exposed
Bitcoin uses signatures to prove control of coins without revealing a private key. The report says a sufficiently capable machine running Shor’s algorithm could derive a private key from an exposed public key. Reused addresses and older pay-to-public-key (P2PK) outputs are therefore the main standing exposure. For most active addresses using modern output types, the public key remains hidden until the coins are spent.
Citing Project Eleven, the report estimates that roughly 7.1 million BTC, or about 35% of the total, would be vulnerable to theft if such a machine existed. It says about three-quarters of that amount is in reused addresses, much of it at large exchanges. Moving funds to fresh, unused addresses could reduce that exposure without a Bitcoin consensus change.
P2PK coins pose a harder question. The report first describes roughly 1.8 million BTC in P2PK outputs as largely presumed lost, making migration potentially impossible. Later, in its discussion of policy choices, it gives a narrower figure of about 1.7 million BTC across 20,000 P2PK addresses, including an estimated 1.1 million BTC attributed to Satoshi Nakamoto. Those figures serve different parts of the report and should not be treated as a single exact count.
The window when a transaction is in flight
Spending a coin can reveal its public key before the transaction is included in a block. The report describes that interval as roughly ten minutes in a typical case, though its actual length depends on the time from submission to inclusion. It cites a Google estimate that a prepared, fast-clock quantum device could theoretically derive a private key in as little as nine minutes. That is a model of a possible future attack, not a demonstrated theft capability.
Recent research is a reason to prepare, not evidence that the required machine exists. The report points to advances in error correction and to more efficient proposed Shor-algorithm circuits. It also stresses the engineering gap: it says the best demonstrated system had 48 error-corrected logical qubits, while breaking Bitcoin’s elliptic-curve scheme would require at least about 1,200. Circuit designs and runtime estimates are not working attacks.
What preparation can—and cannot—settle
The report identifies three lines of work. First, holders and custodians can stop reusing addresses and move exposed funds where their keys are still available. Second, developers can pursue post-quantum signatures. It highlights Blockstream’s SHRINCS proposal, tested on Liquid in March 2026 and described in a Bitcoin Improvement Proposal released with other contributors in August. The report says a formal security proof was still pending and deployment across Bitcoin would require a soft fork.
Third, Bitcoin users would need to decide what, if anything, to do about vulnerable P2PK coins that may be lost. The report attributes three prominent options to Presidio Bitcoin: leave older spends valid, limit how quickly those coins can move, or freeze older spends while providing a recovery path for owners. Each choice has consequences for legitimate owners as well as potential attackers; none is presented as settled consensus.
The practical distinction is between exposure that can be reduced now through address practices and exposure that would require new signatures or difficult collective decisions. The report does not establish when a capable quantum computer will exist—or that any proposed response will be adopted.
Original report on ChainCatcher · Originally published November 12, 2026, 09:18:34 UTC+08:00. Authored by the Bitcoin Security Consortium; translated by 谷昱 for ChainCatcher.