Quantum Resistant Bitcoin Upgrade: How It Protects Coins

Open a block explorer and look at the coinbase output of almost any block Satoshi mined in 2009. You won't find an address. You'll find a raw public key sitting in the scriptPubKey where anyone can read it, and it has been there for more than 17 years. Today that's harmless, because getting from a secp256k1 public key back to its private key is computationally out of reach. On a large enough quantum computer, it isn't.

That gap is what a quantum resistant Bitcoin upgrade is meant to close. This deep-dive covers which cryptographic primitives a quantum computer actually breaks and which output types leak public keys. It also explains how the leading proposals, BIP-360 (P2QRH) and P2TRH, would change transaction flows, and why dormant coins are a governance problem more than a cryptography problem.

Key Takeaways:Shor’s algorithm on a cryptographically relevant quantum computer (CRQC) breaks the elliptic-curve discrete logarithm problem behind both ECDSA and Schnorr signatures, but it does not meaningfully break Bitcoin’s SHA-256 proof-of-work.Bitcoin Suisse estimates that about 6.7 million BTC sits in outputs vulnerable to a CRQC because of unsafe output types or address reuse, according to its Outlook 2026 analysis.A post-quantum soft fork protects only coins that are actively moved into new output types, so coins with lost keys stay exposed unless consensus rules change how they can be spent.NIST’s ML-DSA-44 post-quantum signature plus public key takes about 3,732 bytes, compared with about 105 bytes for a P2WPKH ECDSA spend, which makes a post-quantum input roughly 14 times heavier in block weight.Moving coins into quantum-resistant outputs is cheap because the migrating input still uses a small legacy signature, so coordination limits a Bitcoin quantum upgrade more than block space does.

Table of Contents

• What Is a Quantum Resistant Bitcoin Upgrade?
• Bitcoin Quantum Computing Threat Explained: What Do Shor and Grover Actually Break?
• Which Bitcoin Output Types Expose Public Keys?
• Why Is Dormant Bitcoin the Quantum Risk Nobody Can Patch?
• How Do Post-Quantum Signatures for Bitcoin Work?
• How Would BIP-360 and P2TRH Change Bitcoin Transactions?
• What Happens to Coins That Never Move? Four Migration Models
• Is Block Space or Coordination the Real Bottleneck?
• What Does Quantum Risk Mean for Wrapped and Bridged BTC?
• What Can Bitcoin Holders Do Today?
• Frequently Asked Questions
• Conclusion

What Is a Quantum Resistant Bitcoin Upgrade?

A quantum resistant Bitcoin upgrade is a consensus change, most likely a soft fork, that adds new output types and signature schemes whose security does not depend on elliptic-curve discrete logarithms. Holders can then move funds into those outputs before a quantum computer can derive private keys from exposed public keys.

The word “upgrade” makes it sound like a firmware patch. It doesn’t work that way.

Bitcoin can’t swap the cryptography under existing UTXOs, because every unspent output is locked by a script committed years ago. The protocol can add a new, safer kind of lock. Each owner then has to unlock their coins the old way, one final time, and re-lock them the new way.

That is why the Bitcoin Optech quantum-resistance topic page is a useful starting point. The subject splits into two separate problems:

1. Making new coins safe. This is a cryptographic engineering problem: choose a post-quantum signature scheme, define an output type, and soft-fork it in.
2. Deciding what happens to old coins that never move. This is a social and economic problem with no purely technical answer.

Bitcoin Suisse’s Outlook 2026 projected that social consensus on a post-quantum path would form by the end of 2026, with a soft fork likely built around BIP-360 (P2QRH) or Pay to Taproot Hash (P2TRH). Neither proposal has a confirmed activation date in the sources reviewed here.

Bitcoin Quantum Computing Threat Explained: What Do Shor and Grover Actually Break?

The quantum threat to Bitcoin is specific: Shor’s algorithm breaks its signatures, while Grover’s algorithm only weakens its hash functions. Mixing the two up leads to most of the bad takes on this subject.

Shor’s algorithm vs. the elliptic-curve discrete log

Bitcoin signs transactions with ECDSA over the secp256k1 curve. Since Taproot activated in November 2021, it also uses Schnorr signatures (BIP-340) over the same curve. Both rely on the elliptic-curve discrete logarithm problem (ECDLP). Given a public key P = k·G, where G is the curve’s generator point and k is the private key, recovering k takes roughly 2¹²⁸ operations on classical hardware.

Shor’s algorithm turns the discrete log into a period-finding problem, which a quantum Fourier transform solves in polynomial time. A CRQC running Shor against secp256k1 would recover k from P directly. Moving from ECDSA to Schnorr doesn’t help, because both schemes sit on the same hardness assumption. Bitcoin Suisse defines a CRQC as exactly this: a machine that can run Shor at the scale needed to extract private keys from exposed public keys.

Grover’s algorithm vs. SHA-256 and RIPEMD-160

Grover’s algorithm gives a quadratic speedup for unstructured search. A preimage attack on SHA-256 drops from 2²⁵⁶ to about 2¹²⁸ quantum operations, which is still far beyond reach. Grover also parallelizes poorly: splitting the search across N machines gives only a √N speedup.

Mining, which is a bounded SHA-256 search, would see an advantage only if quantum hardware got cheap and fast enough per operation to beat ASICs. Few researchers expect that soon.

One nuance generic articles skip: the 160-bit HASH160 used in P2PKH and P2WPKH has a Grover preimage cost of about 2⁸⁰. That’s far weaker on paper, but because Grover runs serially, it’s still impractical to execute. The meaningful 160-bit concern is classical collision attacks on multi-party P2SH constructions, which is why P2WSH moved to 256-bit hashes.

How big a quantum computer is “big enough”?

Resource estimates keep falling. In May 2025, Google Quantum AI’s Craig Gidney published an estimate that RSA-2048 could be factored with fewer than one million noisy qubits in under a week. Reports in April 2026 said Bitcoin developers were accelerating quantum-resistance work after further Google Quantum AI warnings. Those reports didn’t cite a primary technical document.

The summary: no CRQC exists today, and published timeline estimates range from about 10 to 30 years.

Which Bitcoin Output Types Expose Public Keys?

A Bitcoin output is quantum-exposed if its public key is visible on-chain, either because the output type stores it directly or because the same key has already signed a spend. Hashed outputs keep the key hidden until the coins move.

The useful distinction is between two kinds of attack:

• Long-range (at-rest) attack: the public key has been on-chain for months or years. The attacker can spend as long as needed deriving the private key, then sweep the funds whenever they like.
• Short-range (in-flight) attack: the key becomes visible only when the owner broadcasts a spend. The attacker has to derive the private key and broadcast a conflicting, higher-fee transaction before the original confirms, which is a window of about 10 minutes on average.

The last row surprises people. Taproot puts the output key directly in the scriptPubKey to save space and enable key-path spends.

Taproot was designed for efficiency and privacy, and quantum attackers weren’t part of its threat model. P2TR outputs are therefore as exposed at rest as Satoshi-era P2PK. That’s one reason P2TRH, which hashes the Taproot output key, was proposed at all.

Exposure is also behavioral, not just structural. Exchanges and custodians that reuse deposit or cold-storage addresses have already revealed their public keys. Blockstream has estimated that about 30% of circulating bitcoin sits behind exposed public keys, though no methodology is given.

Why Is Dormant Bitcoin the Quantum Risk Nobody Can Patch?

Dormant coins are the hardest part of any quantum resistant Bitcoin upgrade, because only the private key holder can migrate an output and many dormant holders are gone for good. Lost seeds, deceased owners, and Satoshi’s early mining rewards can’t opt into a soft fork.

Published estimates of the scale differ because each uses a different definition:

• ~6.7 million BTC in vulnerable outputs, counting unsafe UTXO types plus address reuse, per Bitcoin Suisse.
• ~4 million BTC described as dormant and at risk, per CryptoRank’s coverage of the dormant-coin debate. This is a narrower definition and shouldn’t be added to the 6.7M figure.

These numbers can’t be reconciled without shared methodology, and readers should be skeptical of any article that treats them as interchangeable. Both point to the same structural fact, though: millions of BTC are locked by keys that a CRQC could derive, and a large share will never be moved voluntarily.

That leaves the community choosing between two uncomfortable outcomes. If nothing is done, a CRQC operator could eventually take those coins and dump them on the market.

Avoiding that requires changing consensus rules so that some currently valid spends become invalid, which immutability advocates call confiscation. Willy Woo has argued for identifying and potentially freezing vulnerable dormant outputs alongside a post-quantum signature soft fork. Adam Back and others reject freezing as a dangerous precedent.

How Do Post-Quantum Signatures for Bitcoin Work?

Post-quantum signatures replace the elliptic-curve discrete log with problems that have no known efficient quantum algorithm, mainly structured lattice problems and hash-function security. The cost is size: post-quantum signatures and public keys are tens to hundreds of times larger than Schnorr’s 64-byte signature and 32-byte key.

In August 2024, NIST finalized its first post-quantum standards, after starting the standardization process in 2016. These include FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA), with FN-DSA (Falcon) still to follow. Each is built on a different idea:

• ML-DSA (Module-Lattice Digital Signature Algorithm, derived from CRYSTALS-Dilithium): security rests on the Module Learning With Errors (MLWE) and Module Short Integer Solution (MSIS) problems. Recovering a short secret vector from noisy linear equations over a polynomial ring is believed to be hard for quantum computers too.
• SLH-DSA (Stateless Hash-Based DSA, derived from SPHINCS+): security rests only on the hash function. It makes the most conservative assumption of the three, but it has the largest signatures.
• FN-DSA (Falcon): a lattice scheme over NTRU lattices. Its signatures are compact, but constant-time floating-point arithmetic makes it notoriously hard to implement safely in wallets and hardware signers.

Here’s how they compare with what Bitcoin uses today, using published parameter sizes at roughly 128-bit security:

Method: each input carries 41 non-witness bytes (outpoint, empty scriptSig, sequence) at 4 WU/byte = 164 WU, plus witness bytes at 1 WU/byte for signature, public key and small length/script overhead. Post-quantum figures assume the key is revealed in the witness at spend time, as hash-committed output types require.

The SegWit witness discount matters a lot here. Since witness bytes count once rather than four times, a 4 MWU block can still hold roughly 1,000 ML-DSA-44 inputs.

Company-led implementations are also appearing. In October 2025, BTQ Technologies announced a demonstration it called “Bitcoin Quantum Core Release 0.2”, which replaces ECDSA with ML-DSA. That is a self-reported project from a listed company, not a Bitcoin Core consensus change, and it doesn’t make mainnet BTC any safer.

How Would BIP-360 and P2TRH Change Bitcoin Transactions?

BIP-360 (P2QRH, Pay to Quantum Resistant Hash) adds a new output type that commits to a hash of post-quantum spending conditions, so no elliptic-curve key is ever needed to spend from it. P2TRH takes a lighter approach: it hashes a Taproot output key so the key stays hidden at rest.

The BIP-360 specification has been revised since its first draft, so its name, witness version, and exact commitment structure should be checked against the repository. The common design pattern is clear enough to walk through, though.

Transaction flow: migrating a P2WPKH UTXO into a P2QRH output

1. Key generation. The wallet generates a post-quantum keypair (e.g., ML-DSA-44) and, optionally, a classical keypair for hybrid policies.
2. Commitment. The wallet hashes the post-quantum public key(s), or a Merkle root of allowed spending leaves, into a 32-byte commitment. The scriptPubKey becomes <new witness version> <32-byte commitment>, which is the same on-chain footprint as a P2TR output.
3. Migration spend. The user spends the old P2WPKH UTXO with an ordinary ECDSA signature and sends the funds to the new output. This step briefly exposes the old public key, so it has to happen before a CRQC exists.
4. At rest. Only the hash commitment is on-chain. A CRQC learns nothing usable from it, and Grover offers no practical shortcut against a 256-bit preimage.
5. Future spend. To spend, the witness reveals the post-quantum public key, the post-quantum signature over the sighash, and any Merkle path. Nodes check the hash against the commitment, then verify the signature with the post-quantum algorithm.

Why P2TRH is not equivalent

P2TRH fixes Taproot’s at-rest exposure by committing to H(output_key) instead of the key itself. When the coin is spent, though, it still reveals a secp256k1 key and a Schnorr signature.

That stops long-range attacks but leaves the short-range mempool attack open. A fast enough CRQC could derive the key during the roughly 10 minutes before confirmation and race the transaction with a higher-fee replacement. P2TRH buys time before a full migration. It doesn’t replace one.

What Happens to Coins That Never Move? Four Migration Models

Four broad approaches exist for vulnerable coins that don’t migrate: leave them alone, sunset legacy signatures, add a commit-delay-reveal rescue path, or allow recovery through zero-knowledge proof of seed ownership. Each one trades immutability against systemic risk differently.

Whatever you think of freezing, the phased structure of these proposals says something useful: what matters most is the deadline, not the cryptography. A deadline is what pushes the holders who can migrate to actually do it.

Governance capacity is uneven across chains. An XRPL validator has argued that XRP Ledger can coordinate a quantum-resistant hard fork more easily while Bitcoin “may struggle”. Justin Sun said at Bitcoin Asia on August 27, 2026 that TRON is targeting network-wide quantum resistance by the end of 2026, after its original Q3 2026 mainnet target was expected to slip. Faster governance isn’t automatically better governance, though. Bitcoin’s slowness is also what makes its rules credible.

Is Block Space or Coordination the Real Bottleneck?

Block space is not what limits migration; coordination is. This is the contrarian point from running the numbers, and it changes which risks are worth worrying about.

The common fear is that migrating to bulky post-quantum signatures would clog Bitcoin for years. But the migration transaction itself spends a legacy input with a small ECDSA or Schnorr signature and creates a 32-byte hash-committed output. A 1-input, 1-output P2WPKH → P2QRH-style transaction is about 110 vB, roughly the same as a P2WPKH → P2TR send today.

• 1,000,000 vB per block ÷ ~110 vB ≈ ~9,000 migrations per block
• × 144 blocks per day ≈ ~1.3 million UTXOs per day at 100% block usage

That is a rough illustration: even a UTXO set in the low hundreds of millions of entries would take months of completely full blocks to move, and batching several inputs per transaction makes it faster. In practice, many of those UTXOs are dust that will never be worth migrating, so the economically relevant set is much smaller. The heavy block-weight cost arrives later, when coins are spent from post-quantum outputs at roughly 14x the weight of today’s inputs under ML-DSA-44. That’s a long-term change in fees, not a migration emergency.

The real constraint is time. Wallets have to ship support, hardware signers have to fit post-quantum libraries into constrained memory, and exchanges have to rotate cold storage. All of it has to happen before a CRQC exists, because the migration spend itself reveals the legacy key. If migration starts too late, it creates the short-range attack window it was meant to prevent.

What Does Quantum Risk Mean for Wrapped and Bridged BTC?

Every wrapped BTC token is only as quantum-safe as the Bitcoin outputs that back it and the signature scheme on the destination chain. No wrapper is quantum resistant today, because Bitcoin, Ethereum, and most EVM chains all sign with elliptic-curve cryptography.

The useful question is which parts of a bridge depend on what. Verification, meaning how the destination chain learns that BTC was deposited, and custody, meaning who controls the backing UTXOs, behave differently under a quantum threat model.

There’s a protocol-level subtlety here. SPV verification checks SHA-256 proof-of-work on block headers and SHA-256d Merkle paths. Those primitives sit on the Grover side of the line, not the Shor side.

A bridge that verifies Bitcoin through light-client proofs instead of a committee’s signatures avoids adding a separate elliptic-curve signer set whose keys would be another target for a CRQC. That is the design behind TeleSwap, which mints TeleBTC only against a verified Bitcoin transaction using SPV light-client proofs. TeleSwap has processed $517.8M across 548,519 bridge transactions on 13 networks, per TeleSwap network stats. Its verification layer inherits Bitcoin’s security model directly. Its Bitcoin-side scripts, like everyone else’s, will need to adopt whatever post-quantum output type Bitcoin standardizes.

For a practical view of how these routes handle custody and fees today, see Ethereum Validator Security & Bitcoin Bridge Risks and Trustless BTC Swap: 7-Step No-KYC Guide (2026).

What Can Bitcoin Holders Do Today?

The most effective step available today is to stop exposing public keys at rest. That means no address reuse and keeping long-term holdings in hashed output types until a post-quantum output type is activated.

1. Never reuse addresses. Every spend from an address reveals its public key, and any remaining balance at that address is then exposed to a long-range attack.
2. Prefer P2WPKH or P2WSH for deep cold storage. They keep the key behind a hash until you spend. P2TR is fine for active use, but its output key is visible at rest.
3. Audit legacy holdings. If you hold P2PK outputs or reused P2PKH addresses from the early years, moving them to a fresh hashed address now removes them from the long-range attack pool.
4. Track BIP-360 and Bitcoin Optech. Once an activation path is set, early migration avoids both fee spikes and the short-range attack window.
5. Ask your custodian or bridge about their plan. Exchanges, ETFs, and wrapped-BTC issuers hold some of the largest reused-key balances, so their migration plans matter as much as yours.
6. Be skeptical of “quantum-safe Bitcoin” products. Any token or fork that claims quantum safety without a Bitcoin consensus change is a separate asset, not protected BTC.

Frequently Asked Questions

Can a quantum computer steal Bitcoin today?

No, no existing quantum computer can derive a Bitcoin private key. Current machines have far fewer error-corrected logical qubits than Shor’s algorithm needs against secp256k1. Published estimates for the timeline before a cryptographically relevant quantum computer exists range from about 10 to 30 years, and resource estimates have been falling.

Does quantum computing break Bitcoin mining?

No, quantum computing does not meaningfully threaten Bitcoin mining. Mining is a SHA-256 search, and Grover’s algorithm gives only a quadratic speedup that parallelizes poorly. Shor’s algorithm, the real threat, targets the elliptic-curve signatures that authorize spends, not proof-of-work.

What is BIP-360 (P2QRH)?

BIP-360 is a Bitcoin Improvement Proposal for a new output type that commits to a hash of post-quantum spending conditions. Coins in such an output can be spent with quantum-resistant signatures such as ML-DSA instead of ECDSA or Schnorr. It would need a soft fork to activate, and its specification has been revised several times.

Are Taproot addresses quantum resistant?

No, Taproot (P2TR) outputs are among the most quantum-exposed output types. A P2TR scriptPubKey contains the 32-byte tweaked public key directly, so it’s visible on-chain from the moment the output is created. Hashed types like P2WPKH hide the key until the coins are spent.

What happens to Satoshi’s coins in a quantum resistant Bitcoin upgrade?

Nothing happens to them automatically; a soft fork can only protect coins whose owners move them. Satoshi-era coins mostly sit in P2PK outputs with exposed public keys. Whether they stay spendable by anyone who can derive the key, or get frozen by a legacy-signature sunset, is the central unresolved governance question.

Why are post-quantum signatures so much larger than ECDSA?

Post-quantum schemes rely on lattice or hash-based structures that need far more data to reach the same security level. ML-DSA-44 uses a 1,312-byte public key and a 2,420-byte signature, and SLH-DSA-128s signatures are 7,856 bytes. For comparison, Schnorr uses a 32-byte key and a 64-byte signature.

Is wrapped Bitcoin safe from quantum attacks?

No wrapped Bitcoin is quantum resistant today, because both Bitcoin and most destination chains use elliptic-curve signatures. Bridges that verify deposits with SPV light-client proofs depend on hash-based header and Merkle verification. Bridges that rely on custodians or signer committees add another set of elliptic-curve keys that would have to be migrated.

Conclusion

A quantum resistant Bitcoin upgrade is not one switch. It is three things: a new hash-committed output type, a post-quantum signature scheme, and a social decision about coins that will never move. The cryptography is largely settled now that NIST has standardized ML-DSA and SLH-DSA. The block-space cost of migration looks manageable. The hard part is agreeing on a deadline and on what happens after it.

Three things to remember: Shor breaks signatures, not proof-of-work. Exposure depends on whether your public key is on-chain, and Taproot exposes it at rest. Dormant coins are a governance problem that no cryptographic scheme can solve alone.

If you move BTC across chains in the meantime, it’s worth choosing infrastructure that verifies Bitcoin through proofs rather than a signer committee. You can see how a light-client bridge handles BTC → ERC-20 routes, such as BTC to USDC on Ethereum, at teleswap.xyz, and read the protocol design in the docs at teleswap.xyz/docs.