iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Bitcoin is not facing an immediate quantum attack, but its long-term safety is conditional. A sufficiently capable, fault-tolerant quantum computer running Shor’s algorithm could derive a private key from an exposed Bitcoin public key and authorize a conflicting spend. That machine does not exist today, and NIST says nobody knows when a cryptographically relevant quantum computer will arrive. The practical risk depends on which output type holds your coins, whether a public key is already visible or reused, and whether Bitcoin adopts a post-quantum migration before powerful machines appear.
What “safe long term” means for Bitcoin
There are two different questions hidden in the phrase “safe to hold.” First, can somebody steal coins from your wallet today through malware, a compromised exchange, a leaked seed phrase, or a stolen signing device? Second, could future computing technology defeat the mathematics that lets Bitcoin prove ownership? Cold storage addresses parts of the first problem. It does not change the cryptographic assumptions behind the second.
Bitcoin currently uses elliptic-curve signatures: ECDSA for older signature paths and Schnorr signatures for Taproot key-path spending. A private key produces a public key and a valid signature. With present-day classical computers, calculating the private key from a known public key is considered infeasible. Shor’s algorithm would change that relationship if run on a sufficiently large, error-corrected quantum computer.
This would not mean a quantum computer could instantly reverse every transaction, erase the blockchain, or automatically defeat proof of work. The central concern is narrower: once an attacker can see a public key, they may be able to derive the corresponding private key quickly enough to sign a competing transaction. The attacker would still need to get that transaction confirmed and would face Bitcoin’s normal rules for spending and fee competition.
#1 Best Overall
- BITCOIN EXCLUSIVE, PHONE VERIFICATION: Bitkey is designed from the ground up exclusively for bitcoin — a dedicated hardware wallet for secure bitcoin storage. Approve transactions with a tap using your phone and NFC. No device screen is required.
- SELF-CUSTODY, NO EXCHANGE OR CUSTODIAN REQUIRED: You hold two of the three keys in the Bitkey system – one on your phone and one on your Bitkey device. The third is stored on Bitkey’s server and cannot move your bitcoin on its own.
- NO SEED PHRASE: Set up and use Bitkey without creating or storing a seed phrase.
- 2-of-3 MULTISIG: Three keys are stored separately across your phone, Bitkey device, and Bitkey’s server. Any two keys are required to move your bitcoin.
- BUILT-IN RECOVERY: Encrypted backup and recovery tools can help you regain access if you lose your phone or Bitkey device. You can also designate a Recovery Contact.
Why public-key exposure matters
Bitcoin does not expose the same information for every output. Some output types place a public key on-chain immediately. Others commit to a hash that normally reveals the public key only when the owner spends. That distinction creates different quantum risk windows.
| Output or situation | What is visible before spending | Quantum implication |
|---|---|---|
| P2PK | The public key is included in the output. | Long exposure: an attacker can work against the visible key while the coins remain unspent. |
| P2TR (Taproot) | The Taproot output key is visible on-chain. | The key-path design exposes a public key at rest; BIP 360 identifies this as a vulnerable path. |
| P2PKH or P2WPKH | A hash of the public key is normally visible; the public key is revealed when the output is spent. | If the key has not otherwise been exposed, the described at-rest attack is blocked while the coins remain unspent. The spend creates a short exposure period. |
| Reused address | A previous spend may already have revealed the public key. | Reuse can turn a hash-based output into a long-exposure target and removes much of the protection gained by using a fresh address. |
This table describes exposure, not a guarantee that any address is “quantum-proof.” A public key can be disclosed through spending, address reuse, transaction construction, or other wallet behavior. Google Quantum AI’s 2026 analysis estimated approximately 6.9 million BTC vulnerable under its defined categories and data snapshot. That figure is the paper’s methodology-dependent estimate, not a universally settled count of coins at risk.
Long-exposure and short-exposure attacks
Long-exposure attacks
A long-exposure attack occurs when a public key remains available for an extended period while funds sit at that key. The attacker has time to acquire a quantum computer, derive the private key, and prepare a theft transaction. P2PK and Taproot’s key-path output are examples discussed in the BIP 360 draft glossary.
Rank #2
- Unparalleled Security: Protect your assets NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Rest assured with Multi-share Backup, eliminating single points of failure for secure cold wallet recovery
Short-exposure attacks
A short-exposure attack begins after a legitimate owner broadcasts a spending transaction and the public key becomes visible. The attacker would have only the interval before confirmation to derive the key and broadcast a conflicting transaction. BIP 360 notes that protecting this window may require post-quantum signatures; merely changing address formats does not make an exposed classical signature quantum-resistant.
The distinction explains why “Bitcoin is either safe or broken” is misleading. Two holders can own the same asset while facing different exposure because their wallets use different output types, spending histories, and address-reuse patterns.
How soon could a quantum attack happen?
There is no reliable launch date to put on a calendar. NIST’s post-quantum cryptography guidance states: “No one knows how long it will take to build a cryptographically relevant quantum computer.” Forecasts range widely, and NIST notes that some people believe it could be possible in less than 10 years without endorsing that timetable.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
| Source and date | Published estimate | How to interpret it |
|---|---|---|
| NIST, 2024 guidance | No known arrival date; three post-quantum cryptography standards were finalized and organizations were encouraged to begin migration. | Institutional migration advice, not a Bitcoin attack forecast. |
| Chaincode Labs report, May 2025 | One-third of respondents in its cited expert survey assigned at least a 50% likelihood to a cryptographically relevant computer emerging between 2030 and 2035. | A survey result, not a consensus prediction. The report also estimated 20–50% of circulating bitcoin, or 4–10 million BTC, could be exposed under its assumptions. |
| Gershteyn and Alber preprint, June 2026 | About one-in-six chance by 2035, near 30% by 2040, and about 60% by 2050. | Model outputs from a preprint, not dates endorsed by NIST. |
These estimates cannot be added together. They use different definitions of a cryptographically relevant machine, different datasets, and different assumptions about exposed keys and attacker capability. The responsible conclusion is that the risk is material enough to plan for, but no source establishes a guaranteed deadline for moving funds.
Free tools Windows power users keep installed
One-click scans. No signup required.
What Bitcoin’s current proposals would change
Bitcoin has draft proposals for reducing quantum exposure, but neither proposal is an activated protocol rule. Any migration would require review, implementation, wallet support, user action, and agreement over what happens to funds that are not moved.
BIP 360: removing Taproot’s key path
BIP 360 proposes a new Pay-to-Merkle-Root output, abbreviated P2MR. It is designed to resemble Taproot while removing the quantum-vulnerable key-path spend. The holder would use a script path instead. BIP 360 describes this as a “prepared not scared” option: users could choose increased protection without waiting for every detail of a full post-quantum transition.
Rank #4
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
Removing the key path does not solve every exposure problem. A script-path spend still needs an appropriate signature system, and a transaction waiting in the mempool can create a short-exposure window. The proposal itself says post-quantum signatures may be needed for that case.
BIP 361: phased migration and a legacy-signature sunset
BIP 361 describes a sequence that would first add a post-quantum output type, then restrict sending to vulnerable address types, and eventually sunset legacy ECDSA and Schnorr signatures. Its draft wording says the approach follows implementation of a post-quantum output and introduces a pre-announced sunset of legacy signatures.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →That plan raises difficult governance and access questions. Coins in old outputs might need to be moved before restrictions take effect. Lost coins, dormant holdings, and owners who cannot upgrade could be treated differently depending on the final rules. BIP 361 is a proposal, not a promise that Bitcoin will adopt this sequence or any particular date.
Best Value
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
What holders can do now
- Identify exposure instead of assuming all addresses are equal. Review whether your wallet uses fresh P2PKH, P2WPKH, Taproot, or older P2PK outputs, and whether an address has ever been spent from. Your wallet’s receive and transaction-history screens may show output details; a block explorer can confirm what is publicly visible.
- Stop reusing receiving addresses. Generate a new address for each payment when your wallet supports it. Reuse can reveal a public key earlier and links balances to one exposed key.
- Separate ordinary custody from protocol risk. Use a reputable offline-signing setup, protect your seed phrase from digital copies, verify transaction details on the signing device, and maintain a tested recovery method. These controls reduce online theft and operational mistakes, but they do not make ECDSA or Schnorr quantum-resistant.
- Keep software upgradeable. A long-term wallet should receive security updates and support new Bitcoin output types if the network adopts them. An air-gapped device that cannot be updated may become harder to migrate later.
- Watch Bitcoin development rather than a speculative countdown. Before moving funds because of a headline, verify whether a proposal is still a draft, whether your wallet supports the new output, and what the network’s activation rules actually require.
- Plan a staged migration. If a post-quantum output becomes available, move a small amount first, confirm that you can receive and spend it, back up the new recovery material, and then migrate larger balances. Do not send funds to an address format your wallet cannot restore.
What a hardware wallet can—and cannot—protect
Bitcoin.org describes hardware wallets and other cold-wallet methods as ways to keep private keys offline. That is valuable against malware, remote account takeover, and many forms of online theft. A hardware device can also make it easier to verify a destination address and sign without exposing the seed to an internet-connected computer.
Offline storage does not alter the mathematics of Bitcoin’s signature scheme. If the corresponding public key is already exposed, a future quantum attacker does not need to compromise the hardware wallet to derive the private key mathematically. Nor does a device become post-quantum merely because it is kept in a safe. Quantum resistance depends on the output type and signature algorithm used by the Bitcoin protocol and supported by the wallet.
What could happen if powerful quantum computers arrive first?
Scenario 1: Bitcoin activates a migration in time
Developers could deploy a post-quantum output, wallets could add support, and holders could move exposed funds before an attacker can exploit them. The hard parts would be coordination, transaction capacity, usability, fees, and recovery of funds held in old formats.
Scenario 2: The network has a warning period
A machine might initially be too slow or expensive for profitable theft. Bitcoin could then restrict vulnerable outputs or prioritize migration while users still have time to act. This is one reason avoiding address reuse and maintaining an upgradeable wallet matters even before a final migration rule exists.
Scenario 3: Capability appears suddenly
If an attacker gains a major advantage before the network agrees on a response, exposed outputs could be targeted rapidly. Hash-based outputs whose public keys remain hidden would have a different risk profile from outputs with visible keys, but spending them could reveal the key during a race. No custody practice can guarantee safety in this scenario without protocol-level post-quantum support.
How to judge future claims
- Ask whether the claim concerns public-key cryptanalysis, mining, or another attack. The Chaincode Labs report treats mining effects as a separate and more speculative issue.
- Check whether a number is a one-time estimate, a model probability, or a survey result. Keep the stated date, assumptions, and dataset attached to it.
- Distinguish a Bitcoin Improvement Proposal from an activated consensus change. A draft does not change what your wallet or the network accepts.
- Look for the exact output types covered. “Bitcoin” is not one uniform exposure category.
- Reject claims that cold storage alone is quantum-safe or that a particular year is guaranteed.
Bottom line: Bitcoin remains usable for long-term custody today, and no cryptographically relevant quantum computer is known to exist. Its long-term safety is not unconditional: exposed public keys could eventually become vulnerable, forecasts are uncertain, and migration proposals are still drafts. Reduce ordinary custody risks now, avoid address reuse, use an upgradeable wallet, and evaluate any future migration by the actual Bitcoin rules and wallet support available at that time.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
