Quantum Computer

Is Bitcoin under a quantum threat?

Tags: #Bitcoin #Quantum #QuantumComputer #Cryptography

A lot is being written and discussed about whether Bitcoin will be affected by the arrival of quantum computers, but is the threat real?

In this article, we will try to understand whether this is a real and imminent concern or something unlikely to happen. And most importantly, if it were real, how it would affect us, where it would affect us, and whether anything could be done about it. Let's get to it!

First, let's look at hash functions in a simple way and their role in digital security

What are hash functions?

A hash function is an algorithm that transforms any data (text, file, or number) into a unique fixed-length fingerprint.

If the input data changes, even minimally, the hash output changes completely.

They are very useful for verifying the integrity and authenticity of information, as they allow detection of any alteration to the original data.

Imagine you have a document, a photo, or a set of instructions. A hash function is like a "blender" that takes that input information and turns it into a unique code, making it a kind of digital fingerprint.

If the content changes—even just a period or a capital letter turned lowercase—the hash result will change entirely.

These functions are essential in the modern digital world. They are used to verify that information has not been altered and apply in all kinds of contexts: from banking systems to secure networks, messaging apps, or encrypted storage.

How are they used in Bitcoin?

Bitcoin uses hash functions as key tools to ensure the security, integrity, and decentralization of the system.

These functions are involved in several critical parts of the protocol:

Transaction verification:
When you make a transaction, it is grouped with others and organized in a structure called a Merkle tree. Hash functions are applied to build this tree and verify that no transaction has been altered, without needing to review the entire block:

If a single transaction changes, the entire tree hash changes.

Proof of work and block creation:
To add a new block to the chain, miners must find a value that, when hashed with SHA-256, produces a result with specific characteristics (such as starting with several zeros):

This ensures that creating a block requires real computational work, making network attacks extremely expensive (with no guarantee of success).

Address generation:
Strictly speaking, Bitcoin addresses are not derived directly from the public key, but for their creation, the public key is subjected to several hash functions (SHA-256 and then RIPEMD-160):

This adds an extra layer of security and makes addresses shorter and easier to handle.

Protection of keys and seeds:
In modern wallets, private keys are derived from a mnemonic seed or phrase. Robust hash functions (such as HMAC-SHA512 or PBKDF2) are used to protect this process, making it very difficult for someone to calculate your keys from your phrase, even if they know the algorithm.

Note on Merkle trees: A Merkle tree is a tree-shaped structure that allows efficient organization and verification of a set of transactions in Bitcoin. Each transaction becomes a hash, then paired with another to form a new hash, and this process repeats in levels until reaching a single final hash: the Merkle root, which represents the entire block content.
This efficiency allows, for example, light wallets (SPV) to verify transactions without downloading the entire blockchain.

Here is a description of the most relevant hash functions in Bitcoin, along with some of their uses outside the ecosystem:

| Hash function | Use in Bitcoin | Also used in |

|---------------------|---------------------------------------------------------|--------------------------------------------------------|

| SHA-256 | Mining (proof of work), address creation | HTTPS, bank cards, digital signatures |

| RIPEMD-160 | Address generation (combined with SHA-256) | Some PGP implementations |

| HMAC-SHA512 | Key derivation in HD wallets (BIP-32) | Password security |

| PBKDF2 | Seed phrase strengthening (BIP-39) | Password managers, file encryption |

| HASH160 | P2PKH address generation | Bitcoin-specific (SHA-256 + RIPEMD-160) |

Very important to know, as it is often misinterpreted:

SHA-256 was not developed by the NSA alone. The NSA participated in the design of SHA-256 as part of the SHA-2 family, but it was standardized and published by NIST. The algorithm is openly published and has been publicly audited for years. There is no known backdoor.

Others, such as RIPEMD-160 or HMAC, have roots in open-source cryptography.

Bitcoin simply applies them to ensure its security. And that means that if these algorithms ever break, Bitcoin would not be the only system at risk.

The hash functions used in Bitcoin were not invented by Satoshi Nakamoto. They are well-established cryptographic algorithms, publicly audited, and used in many other systems.

What about ECDSA?

In addition to hash functions, Bitcoin also uses a digital signature system called ECDSA (Elliptic Curve Digital Signature Algorithm).

ECDSA is the mechanism that allows a user to prove ownership of a private key without revealing it. This is what makes secure transaction signing possible.

This component is, in fact, the most vulnerable point against quantum computing—not just in Bitcoin, but in all systems that use it.

If a sufficiently advanced quantum computer could run Shor's algorithm, it would be able to calculate a private key from the associated public key for a specific address (the one revealed when signing a transaction).
This does not affect the master key or all possible user addresses, but it does allow compromising that specific private key and thus spending the funds in that address if they haven't been moved yet.

That would allow an attacker to spend funds from a Bitcoin address after seeing a signed transaction. For example, if someone broadcasts a transaction, their public key is exposed. A quantum-equipped attacker could use it to derive the private key and steal funds before the transaction confirms.

What is Shor's algorithm?
It is an algorithm developed by mathematician Peter Shor in 1994 that allows quantum computers to solve certain mathematical problems (such as factorization or discrete logarithms) much faster than classical computers.
This breaks the security of many current encryption systems, like RSA or ECDSA, which rely on the difficulty of those problems.

So, is Bitcoin in danger?

Not for now. It's important to understand the current reality.

Quantum computers pose a hypothetical but not immediate threat.

According to estimates by NIST and other analysts, quantum computers capable of breaking current cryptography are not expected before the mid- or late 2030s.

Let's put things in context:

There is currently no quantum computer capable of breaking SHA-256 or ECDSA at scale.

Even if one existed, SHA-256 would remain resistant: a quantum attack (Grover's algorithm) would reduce its security from 256 bits to 128 bits, which is still considered secure by current standards.

In contrast, ECDSA would be vulnerable to Shor's algorithm.

The risk is not exclusive to Bitcoin: governments, banks, tech companies, and communication platforms rely on the same algorithms.

The scientific community is already working on quantum-resistant algorithms (post-quantum cryptography).

And yes, Bitcoin can be adapted. Though not simple (it requires network consensus), it is possible to update cryptographic components if needed.

What is Grover's algorithm?
It is a quantum algorithm that speeds up searching for a solution in a very large set of possibilities.
For hash functions like SHA-256, Grover could reduce the time to find a collision or preimage from 2²⁵⁶ to 2¹²⁸ operations.
This is a significant speedup, but it does not break security, as 2¹²⁸ remains an extremely large number.
Thus, SHA-256 is still considered safe against quantum attacks, at least until sufficiently powerful quantum computers exist.

Quantum computing is not an exclusive problem for Bitcoin

Bitcoin is not alone in these risks.

Hash functions are pillars of global digital security.

Satoshi did not invent these algorithms but took well-known tools and combined them with unique genius.

When discussing the impact of quantum computing on Bitcoin, it is often framed as if Bitcoin were an isolated system facing a gigantic problem alone.
But this view ignores a fundamental context: Bitcoin uses standard cryptography widely adopted worldwide, far beyond the Bitcoin ecosystem.

And, at the risk of sounding repetitive, I insist because it matters: the cryptographic algorithms currently protecting Bitcoin (digital signatures and hash functions) are also used to:

Protect communications between banks and payment networks.

Secure credit card and financial data transmissions.

Safeguard government and military information confidentiality.

Protect core Internet infrastructure (certificates, HTTPS, digital identity).

This has a key consequence: Bitcoin would not be the first system needing protection against quantum computing.

If a quantum computer capable of breaking current cryptography existed tomorrow, the first compromised systems would be state, financial, and national security infrastructures. Long before Bitcoin, central banks, governments, militaries, and much of the Internet as we know it would be at risk.

That is precisely why the greatest economic, political, and strategic incentives to solve this problem are not in Bitcoin but in states and large corporations. And these actors have been working for years (as has the Bitcoin community) on developing quantum-resistant cryptography.

This work includes academic research, standardization processes, and testing in critical environments. All that effort, even if not specifically designed for Bitcoin, directly benefits Bitcoin, which can adopt mature, audited, and tested solutions when necessary.

Bitcoin also follows a conservative technical philosophy: not pioneering immature technologies but integrating solutions when they are sufficiently proven. Prematurely changing Bitcoin's cryptography could introduce more risks than it eliminates.

A more realistic way to frame the problem: If the world learns to defend itself against quantum computing, Bitcoin will learn alongside it. And if the world fails, Bitcoin will likely be the least of our problems.

The real danger is not quantum computing, but stopping learning.

What is being done in Bitcoin against the quantum risk?

Although the quantum computing danger remains theoretical, the Bitcoin developer community is already discussing ways to prepare.

International organizations have been developing and standardizing quantum-attack-resistant algorithms for years, which will eventually reduce risk for all infrastructure, including Bitcoin.

Current proposals focus on improving public key management and incorporating post-quantum cryptography.

Some of the ideas I consider most important at this time (note: I am not a cryptography expert, so my view may not be fully complete):

Avoid exposing public keys prematurely
Today, broadcasting a transaction reveals the associated public key. This is not a problem with classical computers but would be with quantum ones.
A proposal is to use addresses that do not reveal the public key until strictly necessary, such as Pay-to-Taproot (P2TR). This was already implemented in 2021 with the Taproot upgrade.

Change the digital signature system
Bitcoin currently uses ECDSA, vulnerable to Shor's algorithm. An alternative under discussion is to replace it with quantum-resistant signature schemes, such as:

XMSS, LMS, or SPHINCS+, hash-based.

Dilithium or Falcon, lattice-based, proposed by NIST.

These schemes are more secure against quantum computers, though often heavier (larger keys and signatures) and require significant technical adjustments.

Design a smooth transition
Updating the signature system is not as simple as changing a parameter. Bitcoin relies on network consensus, so any change must be backward-compatible, voluntary, and thoroughly tested.
Mechanisms like soft forks or new address types that users adopt gradually.

Important: There is no final solution yet adopted by network consensus, but the debate is active, and Bitcoin's code is designed to evolve.
The key will be to anticipate and act before a real threat emerges.

Some references

If you're interested in researching further, here are some links. I recommend following publications on the Bitcoin developer mailing list. Though not easy to follow, it helps stay updated on discussions and proposals:

XMSS (eXtended Merkle Signature Scheme)
Description: XMSS is an extension of the Merkle signature scheme that uses Merkle trees to generate multiple signatures from a single private key.
Advantages: High security level; can generate many signatures before key exhaustion.
Disadvantages: Requires additional storage to maintain Merkle tree state.

LMS (Leighton-Micali Signature Scheme)
Description: LMS is an original Merkle-based scheme using hash functions.
Advantages: Relatively simple and resource-efficient.
Disadvantages: Limited number of signatures before key exhaustion.

SPHINCS+
Description: An improved stateless hash-based signature scheme.
Advantages: Balance between security and performance; unlimited signatures.
Disadvantages: More complex implementation.

Bitcoin Optech - Quantum resistance

✨ Keep learning. If you like this article, share it. ✨