Quantum-Safe Bitcoin: Can BTC Survive a Quantum Attack without a Fork?

For years, the cryptocurrency community treated quantum computing as a distant, almost science-fiction threat—something to worry about in 2040, not 2026. That comfortable timeline evaporated on March 30, 2026, when Google Quantum AI dropped a bombshell whitepaper co-authored with researchers from the Ethereum Foundation and Stanford University .

The finding? A sufficiently powerful quantum computer could crack Bitcoin’s secp256k1 elliptic curve cryptography in just nine minutes—faster than Bitcoin’s average 10-minute block confirmation time. Even more alarming, the estimated physical qubit requirement had plummeted from 20 million to under 500,000—a 20x reduction that rewrites every risk assessment the industry has relied upon .

Suddenly, the question isn’t whether quantum computers will threaten Bitcoin, but how soon—and whether the network can adapt without tearing itself apart in another block-size-style civil war.

Enter Quantum-Safe Bitcoin (QSB) , a provocative new proposal from StarkWare researcher Avihu Mordechai Levy that claims to offer something remarkable: quantum-resistant transactions today, without touching Bitcoin’s core protocol .

Understanding the Quantum Threat to Bitcoin

How Bitcoin’s Security Works (And Why Quantum Breaks It)

Bitcoin’s security model rests on a cryptographic assumption: given a public key, it’s computationally infeasible to derive the corresponding private key. This assumption holds true for classical computers but collapses against Shor’s algorithm running on a sufficiently powerful quantum computer .

The vulnerability manifests in two distinct attack vectors:

1. On-Spend Attacks (The 9-Minute Window)
When you broadcast a Bitcoin transaction, your public key is exposed in the mempool—the waiting room for unconfirmed transactions. A quantum attacker monitoring the mempool could theoretically derive your private key and broadcast a competing transaction with a higher fee, stealing your funds before the original transaction confirms. Google’s research suggests this could happen in as little as nine minutes on a fast-clock superconducting quantum architecture .

2. At-Rest Attacks (The Satoshi-Era Time Bomb)
Early Bitcoin addresses used Pay-to-Public-Key (P2PK) scripts that permanently exposed public keys on the blockchain. Approximately 1.7 million BTC—including an estimated 1.1 million BTC attributed to Satoshi Nakamoto—sit in these vulnerable addresses, their public keys visible to anyone who cares to look. Unlike on-spend attacks, there’s no time constraint here; a quantum computer could work through the cryptography at its own pace .

The total exposure is staggering: Google’s whitepaper estimates roughly 6.9 million BTC are currently vulnerable across various address types .

Why Google’s March 2026 Paper Changed Everything

The Google Quantum AI whitepaper didn’t just update estimates—it fundamentally reframed the conversation. Key revelations include:

• Physical qubit requirement: Under 500,000 (down from ~20 million)

• Logical qubit requirement: 1,200–1,450

• Attack duration: 9–23 minutes on fast-clock architectures

• Success probability: 41% per attempt on the optimized circuit 

Perhaps most tellingly, Google took the unprecedented step of publishing a zero-knowledge proof verifying their resource estimates rather than revealing the actual quantum circuits—a “responsible disclosure” approach designed to prevent malicious actors from obtaining an attack blueprint while still alerting the community to the danger .

“This paper directly refutes every argument the crypto industry has used to dismiss the quantum threat,” said Alex Pruden, CEO of post-quantum migration company Project Eleven .

What Is Quantum-Safe Bitcoin (QSB)?

A Hash-Based Workaround

Published in April 2026, Avihu Levy’s QSB proposal offers a radically different approach to quantum resistance. Instead of upgrading Bitcoin’s signature scheme through a soft fork—the path taken by proposals like BIP-360—QSB works entirely within Bitcoin’s existing consensus rules .

The core innovation is replacing elliptic curve cryptography with hash-based constructions. Here’s how it works:

1. The Hash-to-Signature Puzzle
Rather than proving ownership through an ECDSA signature (which quantum computers can forge), QSB requires the transaction creator to find an input whose hash output randomly resembles a valid signature. This is a brute-force search problem that even quantum computers cannot shortcut—they can only search slightly faster via Grover’s algorithm, which provides at most a quadratic speedup .

2. Lamport Signatures
QSB embeds Lamport signatures—an early form of hash-based cryptography dating back to 1979—directly into Bitcoin’s scripting system. Unlike ECDSA, Lamport signatures rely solely on hash preimage resistance, which remains quantum-resistant .

3. Transaction Pinning
The scheme includes a “pinning” mechanism that binds transaction parameters to the computational puzzle. Any modification to the transaction requires solving the puzzle again from scratch, preventing attackers from reusing valid components .

No Fork Required: The Technical Achievement

What makes QSB remarkable isn’t just its cryptographic approach—it’s that the entire scheme fits within Bitcoin’s legacy script constraints:

• Maximum 201 non-push opcodes

• Maximum 10,000 bytes per script

Levy’s design operates entirely within these boundaries, meaning it requires no soft fork, no miner signaling, and no activation timeline. Transactions can theoretically be created and broadcast today .

“This shows Bitcoin’s original design has more flexibility than previously understood,” the research notes, though it stops short of claiming Satoshi intentionally built in quantum resistance .

The Catch: QSB’s Limitations and Tradeoffs

If QSB sounds too good to be true, that’s because it comes with significant asterisks. The scheme is explicitly designed as a “last-resort measure” —not a replacement for protocol-level upgrades .

Cost: $75–$200 Per Transaction

The most immediate barrier is cost. Each QSB transaction requires massive off-chain computation—searching through billions of candidate values to satisfy the hash puzzle. Levy estimates this would cost between $75 and $200 per transaction using commodity cloud GPUs .

For context, a standard Bitcoin transaction currently costs around $0.33. QSB transactions are 200–600x more expensive, making them impractical for everyday payments. The scheme would only make sense for securing high-value transfers or emergency migration of vulnerable funds .

Relay Policy and Miner Dependencies

QSB transactions exceed Bitcoin’s default relay policy limits—the rules that govern how transactions propagate across the network. This means they won’t spread through the peer-to-peer network like normal transactions. Instead, users would need to submit them directly to miners, likely through services like Slipstream .

This creates friction and centralization concerns. If only a few mining pools are willing to process QSB transactions, it introduces potential censorship vectors and fee-gouging risks.

What QSB Doesn’t Protect

Crucially, QSB only secures newly created outputs using its custom scripting scheme. It does nothing for:

• Existing vulnerable addresses (the 1.7 million BTC in P2PK outputs)

• Lightning Network channels

• Widely used address formats like P2PKH and P2WPKH

As Bitcoin ESG specialist Daniel Batten noted, calling QSB a complete solution is “an overstatement” because exposed public keys and dormant wallets remain unaddressed .

Security Degradation Under Quantum Attacks

Even with hash-based security, QSB faces degradation from Grover’s algorithm. The design offers roughly 118-bit security against classical attacks, but Grover’s algorithm reduces this to approximately 59 bits in a quantum context . While still computationally expensive to break, it’s not the ironclad 128-bit security that post-quantum cryptography standards typically target.

QSB vs. The Alternatives: A Comparative Analysis

QSB doesn’t exist in a vacuum. The Bitcoin community is actively debating at least four distinct approaches to quantum resistance:

BIP-360: The Long-Term Solution

BIP-360, merged into the official Bitcoin Improvement Proposal repository in February 2026, introduces a Pay-to-Merkle-Root output type that hides public keys from chain observers. It’s the most thoroughly vetted quantum-resistance proposal but requires a soft fork—a network-wide upgrade that demands broad consensus .

The challenge is governance. Bitcoin’s last major upgrade, Taproot, took approximately seven and a half years from concept to deployment. Polymarket bettors currently price BIP-360 activation in 2026 at low odds .

The Hourglass Debate: What to Do With Satoshi’s Coins?

Perhaps the most politically charged question involves assets that cannot be migrated—coins in wallets whose private keys are lost forever. Google’s whitepaper introduced a “digital salvage” framework, drawing an analogy to maritime salvage law .

Options under discussion include:

• Burn: Render unmigrated coins permanently unspendable after a deadline

• Hourglass: Rate-limit spending of vulnerable coins (e.g., one BTC per block)

• Do Nothing: Accept that quantum-equipped actors will eventually claim them

Each option forces the community to confront fundamental questions about Bitcoin’s immutability versus economic stability .

What This Means for Bitcoin Holders

Immediate Steps You Can Take

While the quantum threat isn’t imminent—Google’s most advanced Willow chip operates with just 105 physical qubits, far from the 500,000 required—there are prudent steps Bitcoin holders can take today :

1. Use Taproot or SegWit Addresses
Modern address formats (bc1p for Taproot, bc1q for SegWit) don’t expose public keys until you spend from them. This dramatically reduces your attack surface .

2. Avoid Address Reuse
Generate a new address for each transaction. Every address reuse creates another permanently exposed public key.

3. Consider Cold Storage for Large Holdings
Offline storage eliminates the mempool exposure window entirely, though at-rest vulnerability remains for any address that has ever spent funds.

4. Monitor Migration Deadlines
As quantum timelines firm up, expect clear guidance on when and how to migrate funds to quantum-resistant address formats.

The Industry Response

The crypto industry isn’t standing still. Key developments include:

• Ethereum Foundation launched a public resource hub consolidating eight years of post-quantum research, targeting core Layer 1 upgrades by 2029 through sequential hard forks .

• Lightning Labs CTO Olaoluwa Osuntokun published a quantum “escape hatch” prototype enabling users to prove wallet ownership from seed phrases without revealing them .

• Solana initiated development of “quantum vaults” for asset protection .

Conclusion

Quantum-Safe Bitcoin represents something genuinely novel in the Bitcoin ecosystem: an emergency brake that works without permission. In a network where consensus changes move at glacial speeds, having a fallback that requires no one’s approval is strategically valuable—even if it’s expensive and incomplete.

Levy himself frames QSB as a transitional tool. “While this article describes a solution that works today for quantum-safe Bitcoin transactions, it should be treated as a last-resort measure,” the paper concludes. Protocol-level changes remain the preferred long-term path .

The broader lesson is that Bitcoin’s scripting system retains more flexibility than most developers assumed. Features once dismissed as vestigial remnants of Satoshi’s original design—like the ability to embed hash puzzles and Lamport signatures within legacy constraints—may prove unexpectedly useful as the network confronts existential threats .

But QSB doesn’t solve the governance problem. It doesn’t protect Satoshi’s coins. It doesn’t make Lightning quantum-safe. It doesn’t reduce transaction fees or improve scalability. It’s a survival tool, not an upgrade.

The real test isn’t technical—it’s social. Can Bitcoin’s decentralized governance process reach consensus on quantum migration before the hardware catches up? Google’s 2029 target for its own post-quantum migration suggests the window is narrower than anyone comfortable assumes .

For now, QSB offers something valuable: proof that Bitcoin has options. Whether the community uses them wisely is the next chapter in this unfolding story.

Frequently Asked Questions

Is Bitcoin currently vulnerable to quantum attacks?

No, not yet. The largest existing quantum computers (Google’s Willow at 105 qubits, IBM’s Condor at 1,121 qubits) remain far below the ~500,000 physical qubits estimated to break Bitcoin’s cryptography. However, the timeline is compressing faster than previously anticipated, with some researchers projecting viable cryptographically relevant quantum computers by 2029–2030 .

How does QSB differ from BIP-360?

QSB requires no fork and works within existing consensus rules but is expensive ($75–$200 per transaction) and only protects newly created outputs. BIP-360 requires a soft fork but would enable quantum-resistant addresses with standard transaction fees. QSB is an emergency tool; BIP-360 is a permanent upgrade .

What happens to Satoshi Nakamoto’s bitcoins?

Satoshi’s estimated 1.1 million BTC sit in early P2PK addresses with permanently exposed public keys, making them vulnerable to at-rest quantum attacks. The community is divided on whether to freeze/burn these coins, rate-limit their spending, or accept that quantum-equipped actors will eventually claim them. This debate involves fundamental questions about Bitcoin’s immutability .

Can I use QSB to protect my bitcoin today?

Technically yes, practically no. QSB has not been demonstrated on-chain, lacks wallet integration, and requires direct miner submission. For everyday users, the most practical protection is using Taproot/SegWit addresses and avoiding address reuse .

How much time does Bitcoin have to upgrade?

Google has set a 2029 deadline for migrating its own authentication services to post-quantum cryptography. The Ethereum Foundation targets similar timelines. While no one knows exactly when quantum computers will reach the required scale, the convergence of estimates around 2029–2030 suggests the migration window is measured in years, not decades .

Does quantum computing threaten Bitcoin mining?

No, mining is relatively safe. Grover’s algorithm provides at most a quadratic speedup for proof-of-work, and this theoretical advantage is effectively negated by quantum error-correction overhead and the massive parallelization of existing classical ASIC miners. Private key theft, not mining acceleration, is the existential vector .

Will Bitcoin need a hard fork to become quantum-safe?

Not necessarily. Proposals like BIP-360 achieve partial quantum resistance through soft forks. However, protecting already-exposed funds or implementing full post-quantum signature schemes may require hard forks. The governance challenge is reaching consensus on which path to take .

What are post-quantum signature schemes?

The U.S. National Institute of Standards and Technology (NIST) has standardized several post-quantum cryptographic algorithms, including ML-DSA (Dilithium) and SPHINCS+. These are designed to resist both classical and quantum attacks. The challenge for Bitcoin is that these signatures are significantly larger than ECDSA—10x to 125x larger—which would increase transaction fees and potentially reignite block size debates .