What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Bitcoin is not facing an immediate quantum attack, but its long-term safety is conditional. A sufficiently capable, fault-tolerant quantum computer running Shor’s algorithm could derive a private key from an exposed Bitcoin public key and authorize a conflicting spend. That machine does not exist today, and no reliable arrival date is known. Your current choices—especially avoiding address reuse, understanding which output types expose keys, and following real protocol migration proposals—matter more than reacting to a speculative deadline.
What “quantum risk” actually means for Bitcoin
Bitcoin is not protected by one single cryptographic mechanism. Transaction authorization uses elliptic-curve signatures: historically ECDSA and, for Taproot key-path spending, Schnorr signatures. The security assumption is that deriving a private key from its public key is infeasible for a conventional computer. A private key signs a transaction; the corresponding public key lets the network verify that signature.
As an Amazon Associate I earn from qualifying purchases.
Shor’s algorithm changes that assumption for a sufficiently powerful quantum computer. If such a machine can obtain a public key, it could in principle solve the elliptic-curve discrete-log problem and calculate the associated private key. The attacker could then create a valid-looking transaction that spends the coins before the legitimate owner does. This is a key-exposure problem, not a claim that a quantum computer can instantly reverse every block, rewrite the entire chain or automatically defeat Bitcoin’s proof-of-work.
Recommended Free Tools
The practical threat has two timing windows:
- Long-exposure attacks: a public key is visible on-chain for a long period, giving an eventual quantum attacker time to calculate the private key.
- Short-exposure attacks: a public key becomes visible when a spend enters the mempool, and an attacker races to derive the key and broadcast a conflicting transaction before confirmation.
BIP 360’s draft glossary uses these distinctions. Its authors argue that preventing long exposure is a different engineering problem from protecting a key during the short period between broadcast and confirmation.
#1 Best Overall
- BITCOIN EXCLUSIVE, PHONE VERIFICATION: Bitkey is designed from the ground up exclusively for bitcoin — a dedicated hardware wallet for secure bitcoin storage. Approve transactions with a tap using your phone and NFC. No device screen is required.
- SELF-CUSTODY, NO EXCHANGE OR CUSTODIAN REQUIRED: You hold two of the three keys in the Bitkey system – one on your phone and one on your Bitkey device. The third is stored on Bitkey’s server and cannot move your bitcoin on its own.
- NO SEED PHRASE: Set up and use Bitkey without creating or storing a seed phrase.
- 2-of-3 MULTISIG: Three keys are stored separately across your phone, Bitkey device, and Bitkey’s server. Any two keys are required to move your bitcoin.
- BUILT-IN RECOVERY: Encrypted backup and recovery tools can help you regain access if you lose your phone or Bitkey device. You can also designate a Recovery Contact.
Why some bitcoin is more exposed than other bitcoin
Bitcoin addresses do not all reveal the same information. The decisive question is whether the public key is visible while funds are sitting still, or only revealed when the owner spends.
| Output or behavior | What is visible before spending? | Quantum implication |
|---|---|---|
| P2PK | The public key is recorded directly in the output. | Long-exposure risk: a future quantum machine could target the visible key while coins remain unspent. |
| P2TR (Taproot) | The output’s key-path public key is exposed on-chain. | Long-exposure risk for the key-path spend; BIP 360 specifically proposes removing this path in a new output type. |
| P2PKH or P2WPKH | A hash of the public key is normally visible; the full public key appears when the address is spent. | Funds whose key has never otherwise been revealed are not subject to the described at-rest attack, although a spend creates short exposure. |
| Any reused address | A previous spend may already have disclosed the public key. | Reuse can turn a normally hidden-key output into a long-exposed one. |
Google Quantum AI’s 2026 paper estimated approximately 6.9 million BTC vulnerable under its defined output categories and data snapshot. That is the paper’s estimate, not a universally accepted total. Chaincode Labs’ May 2025 report used different assumptions and estimated that 20–50% of bitcoin in circulation—roughly 4–10 million BTC in that analysis—could be exposed. The figures cannot be added together or treated as a single consensus count.
A hash does not make a coin permanently quantum-proof. It delays public-key exposure until a spend, and address reuse removes much of that benefit. P2PK and P2TR are not interchangeable categories in every wallet or transaction pattern, so identifying the actual output type is more useful than judging a wallet by its marketing label.
How likely is a breaking quantum computer?
No one can provide a dependable launch date. NIST states plainly that “No one knows how long it will take to build a cryptographically relevant quantum computer.” Its post-quantum cryptography guidance notes that predictions vary widely, with some observers believing it could happen in less than 10 years. That is a range of opinion, not a timetable.
Other estimates illustrate the uncertainty rather than resolve it:
Rank #2
- Unparalleled Security: Protect your assets NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Rest assured with Multi-share Backup, eliminating single points of failure for secure cold wallet recovery
| Publication | Estimate | How to interpret it |
|---|---|---|
| Chaincode Labs, May 2025 | One-third of respondents in its cited expert survey assigned at least a 50% likelihood to a cryptographically relevant machine emerging between 2030 and 2035. | A survey result reported by the authors, not a scientific consensus or promised date. |
| Gershteyn and Alber, “Quantum Horizon,” June 2026 preprint | About a one-in-six chance by 2035, near 30% by 2040 and about 60% by 2050. | Model-derived probabilities that depend on the preprint’s assumptions; NIST does not endorse these dates. |
The estimates also use different definitions of “cryptographically relevant,” hardware assumptions and data. A prudent holder should therefore plan for protocol change without claiming that a break is imminent or safely distant.
What a quantum attacker could and could not do
They could target exposed spending keys
Once a public key is available, Shor’s algorithm is the relevant threat. The attacker would still need to construct and broadcast a transaction, pay fees and compete with the legitimate owner or other transactions. A key being theoretically recoverable does not mean every coin is stolen automatically at the instant a quantum computer appears.
They could race a normal spend
For a hash-based output, the public key is generally revealed when the owner spends. During the mempool interval, a quantum attacker could attempt a short-exposure attack. BIP 360 says protection against this case may require post-quantum signatures, not merely hiding the key until spending.
They would not simply “break Bitcoin” in one step
Mining and consensus effects are separate questions. The Chaincode Labs report treats possible quantum advantages in mining as more speculative than the signature issue. The most immediate protocol concern discussed by the technical material is unauthorized spending from outputs whose public keys are exposed.
What Bitcoin’s current proposals actually do
Bitcoin has draft proposals, not an activated quantum migration. Their status matters: neither proposal is a rule that wallets or miners must follow today.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
BIP 360: P2MR and removal of the Taproot key path
BIP 360 proposes a new “Pay-to-Merkle-Root” (P2MR) output. It is designed to resemble Taproot while removing the quantum-vulnerable key-path spend. Spending would rely on a script path rather than publishing a long-lived public key in the same way as P2TR.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The draft describes a “prepared not scared” approach: users could choose additional protection if the proposal were adopted. It does not make existing P2TR coins safe by itself, and it does not supply a complete answer for short-exposure spends. The proposal notes that post-quantum signatures may be needed for that case.
BIP 361: staged migration and a legacy-signature sunset
BIP 361 describes a possible sequence. First, Bitcoin would implement a post-quantum output type. Later, the protocol could restrict sending to vulnerable address types and eventually sunset legacy ECDSA and Schnorr signatures. Its text says the approach follows implementation of a post-quantum output and introduces a pre-announced sunset for legacy signatures.
That plan raises difficult access questions. Coins that are lost, abandoned or held in unmigrated outputs could become controversial if old signatures are eventually rejected. The draft is therefore both a technical migration proposal and a governance debate. It is not permission to assume a particular deadline, recovery rule or activation outcome.
What you can do now without panic
1. Inventory the outputs you actually control
Use your wallet’s transaction details or a block explorer to determine whether holdings are P2PK, P2TR, P2PKH, P2WPKH or another output type. The address format alone may not tell the whole story after spending or reuse. For substantial holdings, document which public keys have appeared on-chain.
Rank #4
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
2. Stop reusing receiving addresses
Generate a fresh receiving address for each payment and use wallet software that supports modern address management. Reuse can expose a public key that would otherwise remain hidden behind a hash. It also weakens ordinary privacy, independently of quantum computing.
3. Do not confuse consolidation with risk elimination
Combining many outputs into one transaction can simplify bookkeeping, but spending an output reveals its public key. Consolidation is not automatically a quantum-hardening step. Before moving funds, understand whether the transaction creates a long-lived exposed output or a short-exposure race during confirmation.
4. Track compatible wallet and protocol updates
Any real migration would require consensus activation, wallet support, fee and transaction-policy changes, and user action. Follow the status of BIP 360, BIP 361 and any later post-quantum output proposal rather than relying on headlines or a vendor’s claim that a device is “quantum safe.”
5. Use offline storage for the threats it actually addresses
Bitcoin.org describes cold storage, including hardware wallets, as a way to keep private keys offline and reduce online compromise. That is valuable against malware, remote theft and a compromised computer. It does not change ECDSA or Schnorr into post-quantum signatures, and it cannot protect a public key that is already exposed from future quantum cryptanalysis.
Free tools Windows power users keep installed
One-click scans. No signup required.
6. Keep recovery material available for a future migration
Back up seed phrases according to your wallet’s security model, test recovery procedures with small amounts and record which wallets control which outputs. A future migration could require signing a transaction from an old output into a post-quantum one. If the seed is lost, the owner may be unable to move funds even if the protocol provides a safe destination.
Best Value
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Should you move coins immediately?
There is no evidence in the cited material of an operational quantum attacker or a fixed deadline requiring every holder to move coins today. Moving funds can create its own risks: a phishing site, a compromised wallet, a backup error, an address-copying attack or a fee mistake. A quantum-motivated transaction also reveals keys when the spend is broadcast, so “move everything now” is not a universal solution.
A sensible decision framework is:
- Immediate online theft risk: improve device security, backups and offline signing now.
- Address exposure: avoid reuse and identify outputs with visible public keys.
- Protocol uncertainty: monitor activated Bitcoin Improvement Proposals and wallet support, not draft language alone.
- Large or long-term holdings: document custody and recovery so a future migration can be completed deliberately.
How the competing exposure estimates should be read
Numbers such as 20–50%, 4–10 million BTC and approximately 6.9 million BTC describe different analyses. Chaincode Labs’ range depends on its assumptions about exposed supply. Google Quantum AI’s estimate depends on its output categories and a particular blockchain snapshot. The “one-in-six by 2035” and later probabilities from the 2026 preprint are model outputs, not measurements of the current network.
These figures are useful for showing why migration planning matters, but they should not be merged into a single forecast. The amount at risk will change as people spend, reuse addresses, migrate to new output types and as the protocol’s rules evolve.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat “safe long term” means in practice
If “safe” means protected from ordinary online theft, a well-managed offline wallet can materially improve safety today. If “safe” means guaranteed against a future quantum computer, no current ECDSA- or Schnorr-based Bitcoin holding can make that promise once its public key is exposed.
Long-term safety therefore has three layers: secure custody now, limited public-key exposure, and a credible migration path to post-quantum signatures if the network adopts one. The first layer is available immediately. The second depends on your output history and spending habits. The third depends on Bitcoin consensus, wallet developers and holders coordinating before a cryptographically relevant machine exists.
The most accurate answer to “Is Bitcoin safe to hold long term as quantum computing advances?” is conditional: Bitcoin is usable and not under an immediate quantum attack, but its long-term security depends on migrating exposed or vulnerable signature schemes before a capable quantum computer can exploit them.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
