A new model puts a key-breaking machine at about 30,000 qubits. Which bitcoin is exposed and what to check in your wallet.
On October 27, a net 14,942 BTC left exchanges, the largest single-day outflow in five weeks, according to Santiment. The firm noted that such moves can simply be custody transfers. The same week, Paris-based Alice & Bob published a model in which a quantum computer with about 30,000 physical qubits could derive a Bitcoin private key from its public key in just over an hour.
Whoever holds those coins now, on a hardware wallet or with a custodian, has a new question to ask about the keys.
Why a 30,000-qubit number made headlines
Estimates of the machine needed to attack Bitcoin’s cryptography used to run into the millions of physical qubits. In March 2026, Google Quantum AI cut that to fewer than 500,000. The Alice & Bob figure of 29,588 is about 17 times lower again, though it rests on the company’s own “cat qubit” hardware, which handles errors differently from Google’s design.
Nobody has built such a machine. Alice & Bob’s researchers point to potentially threatening hardware toward the early 2030s. Google has set 2029 as the deadline for its own move to post-quantum cryptography, ahead of NIST’s 2035 guideline, and now puts signatures and authentication first.
That priority fits the threat. A quantum computer running Shor’s algorithm could work backward from a public key on secp256k1, the curve Bitcoin uses, to the private key behind it. The ledger history is a separate matter, and 21Shares researchers describe it as safe from rewriting.
Which Bitcoin addresses are exposed to quantum attacks?
Coins are exposed when their public key is already visible on the blockchain. That covers three groups. The first is the oldest pay-to-public-key (P2PK) outputs. The second is any address that has been spent from and still holds a balance. The third is Taproot addresses, which put the public key into the address itself from the moment coins arrive.
Coins sitting on a hashed address that has never been spent from keep the public key hidden. BitGo CEO Mike Belshe put it simply when his company launched a Quantum Risk Score for custody clients on July 9: the safest key is one whose public key has never appeared on-chain.
Estimates of the exposed total range from about 6.3 million to 6.9 million BTC, roughly a third of supply, depending on how they count. The Quantum Alliance, a group of nine companies including Hacken, Midnight Foundation, Quantus and Postquant Labs that launched on October 15, puts it at 6.4 million. CoinShares counts roughly 1.6 million BTC in the oldest P2PK format alone.
A narrower risk sits at the moment of spending. Google’s March whitepaper estimated that an “on-spend” attack, which tries to crack a key while a transaction waits for confirmation, could take 9 to 23 minutes with 1,200 to 1,450 logical qubits. That machine does not exist either.
Lost coins and Satoshi’s 1.1 million BTC
A holder who controls an exposed address can move the coins once a quantum-resistant format exists. Lost coins cannot move at all. A July guide to storing bitcoin safely and self-custody cites estimates that 2.3 million to 4 million BTC, roughly 11% to 19% of supply, are permanently lost, mostly through forgotten passwords, lost seed phrases and destroyed hardware.
Some of those coins sit on exposed addresses, including about 1.1 million BTC attributed to Satoshi Nakamoto. That is where the argument turns political. On a June podcast, Binance founder Changpeng Zhao asked whether the community should freeze Satoshi’s coins if they stay unmoved after an upgrade, then pushed back on reports that he planned to. Jameson Lopp co-authored BIP-361, which would switch off the old signature system over several years and leave unmoved coins frozen. Postquant Labs CTO Richard Carback prefers placing vulnerable coins in a trust that owners could claim by proving ownership.
Bryn Bennett, chief revenue officer at The Vault, told CoinDesk that “any freeze would trade quantum risk for a precedent on property rights and neutrality.” Quantus CEO Christopher Smith described what happens to dormant coins if nobody acts: “The most likely scenario is that whoever gets the first CRQC (Cryptographically Relevant Quantum Computer) will take them, probably with the blessing of whichever national government.”
The threats that already empty wallets
The same self-custody guide spends most of its length on attacks with a track record. In February 2025, attackers took about $1.5 billion in ether from a Bybit multisig wallet without breaking any cryptography. They tampered with the signing interface until approvers signed fraudulent transactions. Nothing in that method depends on which coin the wallet holds.
Fake wallet apps keep slipping past app review. In 2021 a counterfeit Trezor app cost one iPhone user 17.1 BTC. In July 2026 three customers sued Apple over a fake wallet app, and Apple said it had removed apps impersonating Sparrow Wallet. Malware such as RedLine and Vidar scans devices for seed phrases saved in notes apps, screenshots or cloud-synced files.
In my view, these cases deserve more of a typical holder’s attention this year than qubit counts do. The seed phrase photographed and synced to the cloud has drained wallets for years, and it needs no new physics. I would also expect scammers to start using “quantum migration” as a pretext for asking people to move funds or enter seed phrases, since the topic is new and confusing.
Banks and governments face the same migration
Blockchain now runs payment and identity systems far from trading, and they depend on digital signatures too. A Science Times overview of real-world blockchain use cases in 2026 collects several. JPMorgan says its Kinexys platform has processed more than $4 trillion since launch and averages about $7 billion a day. South Korea’s national mobile ID system, built for about 45 million people, runs on RaonSecure’s blockchain-based OmniOne platform.
Each of those operators will need a post-quantum plan, and each can order one. Karim AbdelMawla of 21Shares put the contrast in an April interview: “A bank can mandate a new security standard from the top down. Bitcoin has no such authority.” He added that wallets, exchanges and dormant holders each have to migrate on their own, and no protocol can force them.
Large custodians have started on their side. Coinbase is building a post-quantum version of its CoreKMS signing system and targets an automated pipeline within about a year, with full support for lattice-based signatures two to three years out. BitGo signed a test transaction with Silence Laboratories using ML-DSA, a NIST-approved scheme, as a simulation, since Bitcoin cannot yet accept such signatures.
What a holder can check this year
None of this requires selling anything or moving coins in a hurry. A few checks are worth doing now:
- Find out whether any of your coins sit on an address you have already spent from. Wallets with coin control list each UTXO and its address. Moving coins to a fresh address hides the public key again, but only until the next spend.
- Use a fresh receive address each time. HD wallets built on the BIP-32 standard can generate a new one for every payment.
- Know which address type you use. Taproot exposes the public key on receipt, while native SegWit (bc1q) and legacy hashed addresses hide it until you spend.
- Keep the seed phrase off any internet-connected device, and consider a passphrase, which the July guide describes as a “25th word” that opens a hidden wallet.
- Treat any message urging an urgent “quantum migration” as phishing until the wallet maker confirms it on its official site.
BIP-360, Q-Day and the 2028 to 2035 window
Bitcoin has no agreed quantum-resistant upgrade. BIP-360 entered Bitcoin’s official BIP repository in February 2026 and remains a draft. It would add a Pay-to-Merkle-Root (P2MR) output type without Taproot’s key-path spend, which reduces long-term exposure of public keys but adds no post-quantum signatures. In late October, Coinbase, which says it holds about 12% of all bitcoin, listed P2MR among designs that would let developers add such signatures later.
Timelines spread widely. Carback calls 2028 realistic for a machine able to break today’s cryptography. 21Shares puts the risk window between 2029 and 2035. Benchmark analyst Mark Palmer sees capable machines at least 10 to 20 years away.
Bennett’s framing is the most practical one I have seen: “Nobody knows the date, but the estimates keep falling, and the risk is one we can already plan for.” My cautious forecast, offered as opinion: the first concrete change most holders will notice will come through their wallet software, as a new address type and a prompt to move coins, well before any quantum computer touches a real Bitcoin key.
Is Your Bitcoin Quantum-Safe? What Holders Can Check in Late 2026 was originally published in The Capital on Medium, where people are continuing the conversation by highlighting and responding to this story.
