Bitcoin has a quantum problem, and it's baked into the ledger itself.
Every time a Bitcoin address spends coins, its public key becomes visible on the blockchain. After 16 years of transactions, millions of those keys sit in plain sight. If a sufficiently powerful quantum computer ever materializes, that visibility could become a liability. Traditional cryptography that secures Bitcoin today—specifically the elliptic curve digital signature algorithm (ECDSA)—would break under quantum attack. An adversary with a quantum computer could theoretically derive a private key from a public one and steal those coins.
The threat isn't imminent. Cryptographically relevant quantum computers remain years or decades away, depending on which researcher you ask. But the timeline doesn't matter much when upgrade cycles move in years themselves. Bitcoin's consensus model makes protocol changes glacially slow. Any shift to quantum-resistant cryptography would require coordination across miners, node operators, and exchanges—a coordination problem that makes even routine upgrades contentious.
Other layer-1 protocols are moving faster. Stellar has begun integrating post-quantum signature schemes, including Dilithium and Kyber, cryptographic algorithms vetted by the U.S. National Institute of Standards and Technology in 2022. These aren't theoretical: they're implementations designed to survive a quantum-capable attacker.
The core issue is exposure asymmetry. Bitcoin's public ledger means every key is a known target. Other blockchains and traditional systems at least have the option to keep some keys private until they need to move assets. Bitcoin can't retroactively hide a transaction.
Security researchers have assessed the timeline differently depending on assumptions about quantum hardware progress. Most estimates cluster in the 10-to-15-year window, though that's not a fixed floor. The actual danger window opens whenever quantum computers become specific enough to run Shor's algorithm at scale—the math that breaks ECDSA.
Bitcoin developers have discussed potential paths. One route involves creating new transaction types that accept post-quantum signatures alongside existing ECDSA proofs, allowing a gradual migration. Another requires a harder consensus shift. Neither is simple. Both require the network to agree that quantum risk justifies the disruption.
The conversation hasn't stalled entirely. Researchers continue publishing on post-quantum Bitcoin variants. But publications and actual upgrades aren't the same thing. Until the network signals readiness to prioritize this risk, Bitcoin's public keys remain a quantum-era sword of Damocles.