The quantum threat to bitcoin: Google in Science, 6 million BTC with exposed public keys and Germany's deadlines

What happened this week

The quantum threat to bitcoin is back in the news, and from three directions at once:

None of this means bitcoin can be broken today. But taken together, it shows that governments, Google and the crypto industry itself no longer treat the topic as science fiction.

What Google did

A quantum computer capable of breaking bitcoin signatures has to run long computations without errors. That requires special quantum states known as magic states: by some estimates, producing them could take up to 95% of such a machine's resources.

On October 15, the Google Quantum AI team published a paper in Science on how to prepare these states on its Willow chip. The error rate dropped by a factor of 40, and fidelity reached 99.99%. The price: more than nine out of ten attempts are discarded.

It is important to keep the scale in mind. According to Decrypt, the experiment used no more than 54 qubits, and breaking RSA-2048 encryption would require states roughly a million times cleaner than what was achieved. Google's post does not mention bitcoin or cryptography at all. This is a step toward reliable quantum computing, not a break.

But in March 2026, the same Google estimated what it would take to break a bitcoin signature: fewer than 1,200 or 1,450 logical qubits, depending on the circuit design, and fewer than 500,000 physical ones. Every engineering step like this one brings those numbers closer.

6 million bitcoin with exposed public keys

A bitcoin signature protects a key pair: a public key and a private key. In theory, a quantum computer will be able to derive the private key from the public one. That means the coins at risk are those whose public key is already visible on the blockchain.

The figure cited by the Quantum Alliance was calculated in May by the analytics firm Glassnode: 6.04 million BTC, or 30.2% of all coins, have exposed keys. CoinDesk's report says 6.4 million, which is a typo. Here is what makes up the 6.04 million:

• 1.92 million BTC are exposed "by design": the oldest P2PK addresses, where the key is written directly on the blockchain (including Satoshi-era coins), bare multisig and Taproot;
• 4.12 million BTC are exposed because of how the coins are used: address reuse, partial spends and custodian habits. Once coins are spent from an address, its key becomes visible, and whatever remains sits behind an exposed key. Of these, 1.66 million are on exchanges, which keep client coins on shared addresses they spend from constantly. That is one more reason to hold your coins yourself and receive them through a crypto exchange without registration straight to your own address.

A separate debate concerns the coins of Satoshi himself, about 1.1 million BTC by indirect estimates. They cannot be moved to new addresses because their owner is silent. Quantus CEO Christopher Smith, one of the alliance's founders, believes they will most likely be taken by whoever builds a powerful enough quantum computer first. What to do with them, whether to freeze them, move them or leave them alone, the community has yet to decide.

What the Quantum Alliance proposes

The alliance includes The Vault, Quantus, American Fortress, Intmax, Keystone, Midnight Foundation, Postquant Labs, Abelian and Hacken. They want to become an open standards body, modeled on the way internet standards are developed: four working groups will cover blockchain migration, secure proofs, wallet security and cross-chain compatibility.

Members name different timelines. Richard Carback of Postquant Labs, as reported by CoinDesk, considers 2028 realistic. Bryn Bennett of The Vault says nobody has a reliable number, and the main cost of the transition is getting everyone to agree at once: wallets, exchanges, custodians and developers.

Germany sets deadlines

On October 12, Germany's Federal Office for Information Security (BSI), together with the Interior Ministry and the Digital Ministry, published a transition guideline. It recommends making high-risk systems quantum-resistant by the end of 2030 at the latest, and medium-risk systems by the end of 2035. Preparation should be completed as early as the end of 2026.

The most telling detail is in a footnote: for the high-security domain, the German government works on the assumption that cryptographically relevant quantum computers will appear in the early 2030s. Google has set itself an even tighter migration deadline: 2029.

What is happening in bitcoin itself

The bitcoin network has not moved to post-quantum signatures yet. The main proposal is BIP-360, now called P2MR. In February 2026, the document was merged into the proposals repository, which means it is open for discussion but not activated. It introduces a new address type, essentially Taproot without the vulnerable key path spend, while post-quantum signatures themselves will be introduced by a separate BIP.

We covered how large companies are preparing for the transition in our article on Coinbase's call to prepare Bitcoin for quantum computers.

What bitcoin holders should do now

There is no reason to panic, but a few simple habits already protect you today. Based on the recommendations in Google's research:

1. Don't reuse addresses. Receive coins to a new address every time; modern wallets do this automatically.
2. Spend all or nothing from an address. After a partial spend, the remainder sits behind an exposed key.
3. Receive to bc1q addresses, not bc1p. For SegWit addresses that have never been spent from, only the hash of the key is visible on the blockchain. Taproot (bc1p) keeps the key in the open. We explained the differences between formats in our guide to Bitcoin address types: bc1, 1 and 3.
4. Don't share your xpub with third-party services such as portfolio trackers: it reveals many keys at once.

A fair caveat: these measures do not protect against an attack at the moment of transfer, when the key is visible in the mempool. The final solution is for the whole network to move to new signatures. The sources do not call for urgent, mass transfers of coins.

Coins that have sat on an exchange for years usually live on exactly those reused addresses. It is better to keep them in your own wallet, on a fresh address.

How to receive bitcoin to a fresh address in your own wallet

A new address for every deposit is something you control yourself. On VertEXchange, you enter the receiving address for each exchange, which means you can give a fresh address from your wallet every time.

No account is needed: no email, no phone number, no password. The rate and the amount you will receive are shown before you send, the coins go straight to your address, and the service does not hold them.

• A fixed rate is held for about 15 minutes while your transfer is confirmed.
• You can provide a refund address in case the exchange does not go through.
• Personal fields of an operation are deleted 24 hours after it is completed.
• Support chat is available on every page, and issues are resolved using the exchange code.

This way you can exchange ETH to bitcoin straight to a new bc1q address or buy bitcoin with USDT TRC20 without going through a centralized exchange.

FAQ

Can a quantum computer break bitcoin today?

No. Current quantum chips are far from it: breaking a signature takes thousands of reliable logical qubits, while Google's October 15 experiment ran on a few dozen physical ones. Expert timelines range from the late 2020s to the 2030s.

How many bitcoin are vulnerable to a quantum computer?

According to Glassnode, 6.04 million BTC, or 30.2% of all coins, already have their public keys visible on the blockchain. About 1.92 million are exposed because of their address format, and the rest because of address reuse, partial spends and custodian habits.

Which bitcoin addresses are safer from a quantum attack?

bc1q addresses and legacy addresses starting with 1 that have never been spent from: only the hash of the key is visible on the blockchain. Taproot (bc1p) addresses and the oldest P2PK outputs keep the key in the open.

What is BIP-360?

A proposal to change bitcoin so that new addresses have no exposed key path spend. Since February 2026, it has been in the proposals repository under the name P2MR, but it is not activated.

Should I urgently move my bitcoin to a new address?

The sources do not advise an urgent mass transfer. It is sensible not to reuse addresses and to spend everything from an address at once. Coins on an address you have already spent from are worth moving to a new one over time.

What will happen to Satoshi's bitcoin?

Nobody knows. About 1.1 million BTC sit on addresses with exposed keys, and there is no one to move them. The community is discussing freezing them, moving them into a trust or doing nothing, and there is no decision yet.