Bitcoin’s Post-Quantum Solutions

Bitcoin’s quantum risk is serious but manageable if holders and developers migrate exposed coins and adopt adaptable post-quantum signatures before cryptographically relevant quantum computers arrive.

• Google Quantum AI and Oratomic/Caltech research has moved estimates for breaking Bitcoin’s 256-bit elliptic-curve cryptography from decades away to potentially within a decade, while approximately 35% of BTC supply is exposed through public keys and roughly two-thirds of ETH and all SOL face comparable exposure.
• Shor’s algorithm could derive private keys from public keys, whereas Grover’s algorithm would only reduce SHA-256’s effective security from 256 to 128 bits; the immediate distinction is between short-range attacks racing Bitcoin’s roughly 10-minute block interval and long-range attacks targeting already exposed coins over weeks or months.
• Long-range attacks are likely to become feasible first because they may run on fault-tolerant platforms such as neutral atoms, while short-range attacks require much faster superconducting or photonic systems; the article therefore emphasizes address migration and advance protocol coordination.
• BIP-360, merged into the BIP repository in February 2026, proposes Pay-to-Merkle-Root outputs that remove the quantum-vulnerable Taproot key path, but it does not choose a post-quantum signature or protect ordinary elliptic-curve spends from short-exposure attacks.
• Hash-based signatures offer the most conservative security trade-off but can reach 8,000–50,000 bytes, while lattice-based alternatives such as ML-DSA range from about 2.4–4.6 kilobytes and Falcon-512 is about 666 bytes; hybrids, modular designs and commit-delay-reveal schemes add protection at the cost of size, complexity or incomplete coverage.
• Around 1.6–1.8 million BTC is held by exchanges and custodians with exposed balances, including approximately 83–85% of Binance’s balance and 100% of Robinhood’s, while an estimated 8–12% of total supply may remain permanently exposed because it is lost.

Takeaway: Bitcoin should begin transitioning toward hidden-key addresses, flexible post-quantum infrastructure and a consensus decision on vulnerable or lost coins well before Q-Day, although no current solution fully resolves signature size, governance, migration and permanently inaccessible supply.