Bitcoin’s Quantum Threat Is Compressing From Decades to Years

In April 2026, independent researcher Giancarlo Lelli cracked a 15-bit elliptic curve key using publicly accessible quantum hardware, winning a 1 BTC bounty from quantum security firm Project Eleven. That result marked a 512-fold improvement over the prior public record, set seven months earlier, and arrived the same month Google Quantum AI published research showing Bitcoin’s elliptic curve cryptography could be broken with fewer than 500,000 physical qubits, roughly a 20-fold reduction from the previous leading estimate.

Quip.Network, built by Casper, Wyoming-based Postquant Labs, drew more than 13,000 researcher signups for its public testnet launched on April 2, 2026. The platform offers post-quantum protection for existing Bitcoin and Ethereum wallets without requiring a protocol-level consensus vote or a soft fork, positioning it differently from the formal upgrade proposals now dividing Bitcoin’s developer community.

How Public Keys Become Attack Surfaces

Bitcoin’s security rests on the elliptic curve digital signature algorithm (ECDSA), the system that lets a wallet prove ownership of funds without exposing the private key. When a user sends Bitcoin, the spending transaction broadcasts a public key to the network, where it sits on the blockchain indefinitely.

Classical computers cannot reverse-engineer a private key from a public key in any practical timeframe. Shor’s algorithm, a quantum computation technique first described by mathematician Peter Shor in 1994, changes that calculus. On a sufficiently powerful quantum machine, it derives a private key from an exposed public key in minutes.

Hash functions face a weaker quantum problem. Grover’s algorithm speeds up hash-brute-forcing but only quadratically; Shor’s attacks elliptic curves exponentially faster. That asymmetry explains why the NIST post-quantum cryptography standards program uses hash-based constructions as the mathematical foundation for its new digital signature algorithms.

The addresses at greatest risk are those that have already spent at least once (exposing the public key in the spending signature), all early pay-to-public-key (P2PK) outputs from Bitcoin’s first two years, and every Taproot (P2TR) keypath spend. When Bitcoin activated Taproot in November 2021, it introduced keypath spends where a single public key sits directly on the blockchain, visible to any node. Project Eleven estimates roughly 6.9 million BTC sits in that exposed pool. The BIP-361 proposal document, drawing from on-chain data as of March 1, 2026, placed the share at over 34% of all circulating Bitcoin.

A 20-Fold Drop in Qubit Requirements

Three research papers published in the first four months of 2026 have shifted how experts define the quantum threat. The headline revision came from Google Quantum AI, whose March 2026 whitepaper, co-authored with Dan Boneh of Stanford University and Justin Drake of the Ethereum Foundation, described optimized quantum circuits for breaking the 256-bit Elliptic Curve Discrete Logarithm Problem (ECDLP-256). The previous leading resource estimate, from researcher Litinski in 2023, required roughly 9 million physical qubits on a photonic architecture. Google’s paper brought that figure below 500,000, with a runtime measured in minutes.

• Sub-500,000 physical qubits: Google Quantum AI’s revised estimate to break Bitcoin’s secp256k1 elliptic curve, down from the 2023 Litinski estimate of 9 million
• 20-fold reduction in projected qubit requirements over roughly two years of published research
• 512x jump in the publicly demonstrated attack scale from September 2025 to April 2026, as the broken key size moved from 6 bits to 15 bits
• ~10% probability of a cryptographically relevant quantum computer existing by March 2028, per Quip.Network’s published internal model

Boneh, in a May 2026 interview, warned that “a hasty transition to post quantum is more likely to cause a catastrophic bug than we’ll be attacked by a quantum computer,” while also calling for gradual migration toward hybrid cryptographic systems. Google has set its own internal post-quantum migration deadline at 2029.

The previous public quantum attack on elliptic curve cryptography was a 6-bit key break by independent researcher Steve Tippeconnic in September 2025, on IBM’s 133-qubit machine. Lelli’s 15-bit result arrived seven months later on publicly accessible hardware. Bitcoin’s 256-bit keys remain far beyond what any current machine can target, but research groups cited in the BIP-361 proposal, including McKinsey, place the possibility of a cryptographically relevant quantum computer in the 2027 to 2030 window.

Bitcoin’s Freeze Debate

BIP-360 Protects New Transactions

Bitcoin developers have two formal improvement proposals addressing quantum exposure, covering different parts of the problem. BIP-360, published February 11, 2026, and merged into Bitcoin’s official proposal repository, introduces a new output type called Pay-to-Merkle-Root (P2MR). The format works like Bitcoin’s existing Taproot addresses but strips the quantum-vulnerable key path, so new coins sent to P2MR addresses don’t expose a public key even at spend time.

BTQ Technologies, a blockchain company, built the first working implementation on Bitcoin Quantum testnet v0.3.0 in March 2026. That testnet has attracted over 50 miners, surpassed 100,000 blocks mined, and assembled more than 100 contributing cryptographers. The proposal protects future transactions. It does nothing for the coins already sitting in exposed addresses.

BIP-361’s Five-Year Ultimatum

Co-authored by six contributors including Jameson Lopp, CTO of Bitcoin custody company Casa, and submitted to GitHub on April 14, 2026, BIP-361 carries the formal title “Post Quantum Migration and Legacy Signature Sunset.” It builds a three-phase migration schedule on top of BIP-360’s infrastructure:

• Phase A: Three years after activation, new Bitcoin cannot be sent to legacy quantum-vulnerable addresses; all users are expected to have migrated to quantum-resistant formats by this point
• Phase B: Five years after activation, legacy ECDSA and Schnorr signatures are invalidated at the consensus layer; coins that have not migrated become permanently frozen and unspendable
• Phase C: A recovery mechanism using zero-knowledge proofs, allowing holders who missed the migration deadline but still possess their seed phrase to reclaim frozen funds

The proposal directly targets an estimated 1.7 million BTC in early P2PK addresses from Bitcoin’s first two years, including roughly 1.1 million BTC in addresses associated with Satoshi Nakamoto. BIP-361’s authors argue that leaving those coins unaddressed creates an attack surface large enough to destabilize both Bitcoin’s price and miner incentives if a quantum attacker ever drains them covertly over weeks or months.

The community response was sharp. Bitcoin Magazine editor Brian Trollz rejected it outright. TFTC founder Marty Bent called it “ridiculous.” Phil Geiger, Head of Business Development at Metaplanet, said: “We have to steal people’s money to prevent their money from being stolen.” No activation has occurred, and Bitcoin Core and the broader developer community remain cautious, with no consensus date in sight.

Quip.Network’s No-Fork Bridge

Postquant Labs built a layer that sits on Bitcoin’s existing rules, requiring no protocol changes and no community vote.

The platform runs two independent layers. The Compute Layer operates a blockchain using proof of useful work (PoUW), rewarding participants in QUIP tokens for solving real optimization problems on D-Wave Quantum’s Advantage2 annealing computers rather than burning cycles on arbitrary hashes. The Asset Layer wraps existing wallets in post-quantum security without requiring users to move funds to a new chain, a setup detailed in Postquant Labs’ April 2, 2026 testnet launch announcement.

The signature scheme is Winternitz One-Time Signature plus (WOTS+, a hash-based cryptographic system considered resistant to Shor’s algorithm). Quantum-resistant wallets using WOTS+ are live on Ethereum’s virtual machine (EVM) and Solana. Bitcoin support followed in late April through a partnership with Arch Network, a Bitcoin-native smart contract platform that enables smart contract functionality directly on Bitcoin’s base layer without bridges or wrapped assets. The method commits quantum-safe keys directly to Bitcoin through Arch Network’s smart contract layers.

Colton Dillion, CEO and co-founder of Postquant Labs, laid out the business case in the company’s April 28, 2026 quantum-resistant Bitcoin wallet announcement:

Developers say any protocol upgrade could take 5 to 10 years, but with Quip’s approach, we provide similar protection immediately. It’s simple and works on top of Bitcoin today, using existing rules, with no community vote required.

The arch-sdk for developers is available on npm and the codebase is open-source on GitHub. Dr. Richard Carback, CTO and co-founder of Postquant Labs, said the project is open-source because “quantum advantage shouldn’t be a marketing claim, but rather a verifiable result.” D-Wave’s role is limited to hardware access and technical consultancy; no formal investment arrangement exists between the two companies.

How Big Is the Post-Quantum Signature Tax?

Any shift to post-quantum cryptography carries a practical cost the governance debate rarely addresses: signature size. Bitcoin’s current ECDSA signatures run approximately 71 bytes. The three standards the U.S. National Institute of Standards and Technology (NIST) finalized on August 13, 2024, produce signatures that are substantially larger, per NIST’s August 2024 post-quantum standards release.

Every added byte raises storage, bandwidth, and mempool fee requirements. BTQ Technologies’ BIP-360 testnet included a SegWit-style size discount specifically to offset the post-quantum signature penalty, acknowledging in the implementation what the proposal still has to solve before mainnet. NIST will deprecate quantum-vulnerable algorithms from its standards by 2035 under the transition timeline in NIST IR 8547; for Bitcoin, the equivalent threshold depends on when, or whether, the freeze proposal ever finds consensus.

Frequently Asked Questions

Is My Bitcoin at Risk From Quantum Computers Right Now?

No quantum computer capable of breaking Bitcoin’s 256-bit elliptic curve encryption currently exists. The largest public demonstration of a quantum attack on elliptic curve cryptography, the April 2026 Project Eleven Q-Day Prize result, cracked a 15-bit key. Bitcoin’s security lives at 256-bit, and the computational gap between those figures is enormous. Researchers estimate timelines ranging from 2027 to well beyond 2030 for a cryptographically relevant machine, with significant disagreement about where in that range the risk falls.

What Makes a Bitcoin Address Quantum-Vulnerable?

An address becomes quantum-vulnerable when its public key is exposed on the blockchain. That exposure happens any time a wallet sends a transaction (the public key appears in the spending signature), for all P2PK outputs from Bitcoin’s earliest blocks, and for Taproot keypath spends. Addresses that have only received Bitcoin and have never sent a transaction have not yet revealed their public key.

Do I Need to Move My Bitcoin to Stay Protected?

No immediate action is required under any currently active protocol rule. The proposal that would eventually freeze coins in unmigrated addresses, BIP-361, has not been activated and faces significant community opposition. Transferring Bitcoin to a new address generated by modern wallet software does reset the exposure clock, since a fresh address with no spending history has not yet exposed its public key. Check your address type in any standard blockchain explorer to confirm.

How Does Quip.Network Protect Bitcoin Without a Fork?

The Quip.Network platform wraps existing wallets in a second layer of post-quantum signatures using WOTS+ hash-based cryptography, without requiring changes to Bitcoin’s base-layer consensus rules. Through its integration with Arch Network, a Bitcoin-native smart contract layer, the platform commits quantum-safe keys directly to Bitcoin without bridges or wrapped assets. Both the classical signature and the quantum-resistant cosignature must validate for any transaction to be accepted, so a quantum attacker breaking only the classical key cannot authorize a transfer.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency holdings involve significant risk, including the possibility of loss. Readers considering any wallet migration or security decisions should consult a qualified financial and cybersecurity professional. All figures cited are sourced from publicly available research, proposals, and announcements, accurate as of the date of publication.