Is Bitcoin more quantum-vulnerable than other cryptocurrencies?

Updated August 6, 2026

Ethereum signs its transactions with ECDSA over secp256k1, the exact same elliptic curve Bitcoin uses. So does most of the account-based side of the industry, in one form or another. If a quantum computer ever gets fast enough to run Shor's algorithm against that curve, it doesn't just have a Bitcoin problem, it has a problem with a large share of everything built on public-key cryptography since the 1970s. The question of quantum exposure isn't really "is Bitcoin vulnerable," it's "how is this shared vulnerability being handled, chain by chain."

The same curve, the same math problem

Bitcoin's private keys are large random numbers, and the matching public key is derived from them through elliptic curve multiplication, a one-way operation that's trivial to compute forward and, as far as anyone can currently prove, infeasible to reverse on a classical computer. Shor's algorithm is the theoretical exception: run on a sufficiently large, error-corrected quantum computer, it could solve that reversal efficiently. That's a property of the discrete logarithm problem itself, not of Bitcoin's specific implementation. Ethereum's accounts, most Cosmos-ecosystem chains, and a good chunk of everything else that calls itself a cryptocurrency lean on some variant of the same idea, whether that's secp256k1 or a different curve like Ed25519. Different curve, same underlying assumption, same category of theoretical exposure once a capable enough quantum computer exists.

Our main explainer on quantum risk covers this in more depth for Bitcoin specifically: today, no quantum computer that exists or is credibly expected in the next few years can touch secp256k1 fast enough to matter. Nothing here changes that baseline for other chains either. This is a forward-looking engineering question, not an active emergency.

Where exposure actually differs

The interesting differences show up in the details of how each system reveals public keys, not in whether the underlying math is shakier somewhere. In Bitcoin, older address formats (P2PKH, P2SH, and SegWit v0) only expose the actual public key once you spend from them; before that, only a hash sits on chain. Taproot addresses, active since November 2021, commit to the public key directly, so it's visible the moment funds arrive, spend or no spend. That's a real, quantifiable split, and it's why a tool like the Schrodinger's wallet checker can look at a given address and tell you which exposure tier it falls into.

Other account-based chains tend to work differently at the account level, often exposing a public key (or something equivalent to it) as soon as an account is created or funded, rather than only on spend. The details vary a lot by chain and I won't pretend to have a precise, verified inventory of every major network's address scheme here. The honest summary is: exposure timing differs across ecosystems, sometimes chain by chain and sometimes wallet by wallet, but almost none of them get to skip the underlying question entirely.

Standards exist, adoption doesn't yet

In 2024, NIST finalized a set of post-quantum cryptography standards: ML-KEM for key exchange, ML-DSA for general signatures, and SLH-DSA, a hash-based signature scheme with a more conservative security story. These give the wider industry, Bitcoin included, a common reference point instead of everyone inventing their own math from scratch. Bitcoin hasn't adopted any of them yet. BIP-360 and BIP-361 are the draft proposals sketching out what a quantum-resistant address format and migration path could look like, but they're proposals, not protocol rules, and the specifics are still being argued over and will likely keep changing before anything activates. Other chains are having versions of the same conversation, at various stages of seriousness, and as far as I know none of them have shipped a finished, adopted solution either. This is early-stage, industry-wide groundwork, not a race anyone has won.

The governance difference is the real story

Where chains genuinely diverge is upgrade mechanics, and that's mostly a social and coordination question, not a cryptographic one. Bitcoin's history, SegWit in 2017 and Taproot in 2021, shows a pattern of slow, deliberately conservative upgrades that need very broad agreement before they activate. That caution cuts both ways: it protects against rushed mistakes, but it also means a quantum-resistance migration would likely take years to fully roll out even after a proposal is finalized. Some other chains have faster, more centralized upgrade paths, which could mean a quicker rollout of new cryptography, or could mean less scrutiny before something ships. Neither approach is obviously better in the abstract. They're different tradeoffs between speed and consensus, and the same tradeoff shows up in Bitcoin's own quantum debate: proposals that would eventually restrict spending from long-dormant exposed addresses (most visibly the roughly 1.1 million BTC tied to Satoshi-era mining, sitting untouched since around 2010) sit uneasily against the norm that nobody gets to decide whose coins can move. That's a governance fight, not a math problem, and every chain with an active community will end up having some version of it.

If you're curious where your own holdings sit rather than the industry in the abstract, the more useful move is checking a specific address: run one through the wallet exposure checker and see whether it's sitting in a hash-protected format or one that's already revealed its public key.