The real quantum threat to Bitcoin lies in the signature bottleneck, not in the nonexistent encryption.

For years, the industry has repeated a frightening phrase: “Quantum computers will break Bitcoin.” But this narrative suffers from a fundamental terminology error. The truth is more nuanced, but also more manageable than it seems.

The Big Misunderstanding: Bitcoin doesn’t use encryption, it uses digital signatures

Here’s the critical point that most forget: Bitcoin does not hide information through encryption. The blockchain is a completely public ledger. Anyone can see every transaction, every amount, and every address. Nothing is encrypted.

What Bitcoin does protect is the ability to spend your coins, and that is achieved mainly through digital signatures (ECDSA and Schnorr) and hash-based commitments. When a public key is exposed on the chain, a sufficiently powerful quantum computer could use Shor’s algorithm to derive the corresponding private key.

The real security bottleneck is not encryption. It is the exposure of public keys.

Where the real risk lies: visible public keys

Depending on the address format you use, the public key can be exposed at different times:

• Addresses with hash (P2PKH, P2WPKH): The public key is hidden behind a hash until you spend the funds. Small exposure window.
• Pay-to-pubkey and Taproot (P2TR): Include the public key directly in the script. Larger exposure window, especially if you reuse addresses.
• Address reuse: Turns a temporary exposure into a persistent target for a hypothetical quantum attacker.

Project Eleven, an open-source project specializing in mapping this vulnerability, estimates that approximately 6.7 million BTC meet the criteria for quantum exposure. That represents UTXOs where public keys are already visible on the blockchain.

Calculating the quantum cost: from logical qubits to physical qubits

For a quantum computer to truly break the system, it needs:

2,330 logical qubits as an upper bound to compute a 256-bit elliptic curve discrete logarithm (according to Roetteler et al.).

But turning that into a fault-tolerant real machine requires massive error correction:

• 10-minute scenario: ~6.9 million physical qubits (Litinski, 2023)
• 1-day scenario: ~13 million physical qubits
• 1-hour scenario: ~317 million physical qubits

These figures are not theoretical. They are estimates based on realistic quantum architectures. IBM, in its recent corporate roadmap, talks about reaching a fault-tolerant system around 2029. Reuters covered statements about advances in quantum error correction.

The risk is measurable today, though not imminent

Here’s the crucial point: although capable Shor algorithm quantum computers do not exist today, Project Eleven runs an automated weekly scan to track which UTXOs are vulnerable. The data is public and accessible.

That means the risk is not speculative. You can quantify it now:

• What percentage of the supply has exposed keys
• Which specific addresses are involved
• When was the last time those funds moved

Taproot (BIP 341) changed the exposure pattern by including a 32-byte public key directly in the output. It doesn’t create a new vulnerability today, but it establishes what would be exposed if key recovery becomes feasible.

From theoretical exposure to practical migration

The way forward is not a sudden technological battle. It is a matter of migration of signatures and user behavior.

NIST has already standardized post-quantum primitives (ML-KEM, FIPS 203) for broader infrastructures. Within Bitcoin, BIP 360 proposes a type of output “Pay to Quantum Resistant Hash.” There is also pressure to deprecate legacy signatures and incentivize migration to resistant formats.

Practical levers include:

• Wallet design (avoid address reuse)
• Bandwidth and fees (post-quantum signatures are kilobytes)
• Community coordination to adopt new spending routes

The key takeaway

“Quantum computing breaks Bitcoin encryption” is a phrase that fails both in terminology and mechanics. What developers need to monitor is: how much of the UTXO has exposed public keys, how wallets respond to that exposure, and how quickly the network can adopt resistant spending routes while maintaining validation constraints and fee market dynamics.

It is not an immediate threat. It is an infrastructure challenge with a comprehensible timeline and levers we can calculate today.