Bitcoin
Which bitcoins are quantum-exposed?
A quantum attacker needs a public key. Whether yours is visible depends on the output type and on whether you have reused addresses.
Bitcoin signatures use secp256k1, which Shor's algorithm breaks. But an attacker needs the public key, and many outputs only commit to a hash of it.
Exposed at rest
- P2PK: early outputs, including many mined in 2009–2010, put the raw public key in the script.
- Bare multisig: every participant key sits in the output script.
- P2TR (Taproot): the output commits to a tweaked public key that is visible on-chain and spendable through the key path.
Exposed on spend
P2PKH, P2WPKH, P2SH, and P2WSH only reveal keys when coins are spent. Reusing an address after spending from it leaves the remaining coins exposed at rest.
What can be done
- Users: avoid address reuse, and prefer hashed output types for long-term cold storage until post-quantum options exist.
- Protocol: proposals such as BIP-360 explore new output types and post-quantum signature schemes; any change needs broad review and a soft fork.
- Research: measuring how many coins sit in exposed outputs informs how urgent migration is.
Our btc-toolkit package classifies any address, script, or PSBT output by quantum exposure.