Quantum computing and your coins: what's actually at risk

Quantum computing is the crypto topic most reliably discussed badly. One camp says everything is about to break; the other says it's decades away and stops thinking. Both skip the part that's genuinely useful, which is knowing which part of the system is vulnerable and which of your coins are exposed.

Because the answer isn't uniform. Some outputs are meaningfully more at risk than others, and the difference is something you can act on today.

Two algorithms, two very different problems

Almost all of the concern comes down to two results from the 1990s.

Shor's algorithm efficiently solves the problems that public-key cryptography relies on — factoring, and the discrete logarithm problem that secp256k1 signatures are built on. A sufficiently large quantum computer running Shor's could derive a private key from a public key. That is the real threat, and it is not a small one: it breaks signatures outright rather than weakening them.

Grover's algorithm speeds up unstructured search, but only quadratically. Against a hash function it roughly halves the effective security. SHA-256 drops from 256 bits to about 128 bits of resistance, which is still far beyond reach. Mining gets a theoretical speedup that matters much less than it sounds, because proof of work is a race against other miners, not a fixed target.

So the summary that actually matters: hashing is fine, signatures are not. Every serious concern is downstream of that one sentence.

Why an address is not a public key

Here's the part most discussions skip, and it's the part that determines your exposure.

Bitcoin addresses aren't public keys. They're hashes of public keys — or, for script-based addresses, hashes of a script. The public key doesn't appear on the chain when you receive funds. It appears when you spend them, because spending requires publishing a signature and the key that validates it.

That creates two categories of coin:

Hashed and unspent. The chain shows only a hash. To attack it, a quantum adversary would need to break the hash first — and Grover doesn't get them there. These outputs are protected by an extra layer that has nothing to do with signatures.

Public key exposed. Once you spend from an address, the key is public forever. Anything still sitting at that address afterwards is protected only by the signature scheme itself.

That distinction is why "don't reuse addresses" turns out to be quantum-relevant advice, having been recommended for years on privacy grounds alone. Reusing an address means the second payment sits behind an exposed public key rather than a hash.

What's actually exposed today

Early Bitcoin outputs. The earliest transactions paid directly to public keys rather than to hashes. Those raw keys are visible on-chain right now. A large fraction of very old, never-moved coins — including much of what's presumed to be Satoshi's — sits in this category.

Any reused address. Spend once, and everything you receive there afterwards is behind a published key.

Every Ethereum address that has ever transacted. This is worth stating plainly because it surprises people: on EVM chains the public key is recoverable from any signature. If an address has sent a single transaction, its key is effectively public. Ethereum has no equivalent of Bitcoin's unspent-and-hashed category.

Taproot outputs. Taproot puts a public key directly in the output rather than a hash of one. It's an elegant design with real privacy and efficiency benefits, and it does mean key-path outputs expose a key from the moment they're funded. Worth knowing; not a reason for alarm today.

The mempool window. When you do spend, your public key becomes visible the instant you broadcast — before confirmation. A quantum attacker fast enough to derive a key and get a competing transaction mined within that window could steal funds in flight. This is a real theoretical attack and it requires capabilities far beyond anything demonstrated.

Where SSP sits, honestly

SSP's Bitcoin addresses are P2WSH — a hash of a witness script. That puts your unspent coins in the hashed category: what's on-chain before you spend is a hash, not keys. When you spend, the script and both public keys are revealed, exactly as with any other script-based output.

Now the part where it would be easy to overclaim, so let's not. Does 2-of-2 multisig help against quantum? Barely.

An attacker running Shor's against your spent script needs to derive two keys instead of one. That's roughly twice the work. Twice is a constant factor, and constant factors are not security — an adversary with the capability to break one secp256k1 key almost certainly has the capability to break two. Two-of-two multisig is excellent protection against device compromise, phishing, theft, and coercion of a single key. Against a cryptographically relevant quantum computer it is close to irrelevant, and anyone selling multisig as quantum protection is misleading you.

What genuinely matters is chain-level migration to post-quantum signatures, and that is not something a wallet can do unilaterally.

How close is any of this?

Not close, on any honest reading.

Breaking secp256k1 with Shor's requires a large, error-corrected quantum computer. Because physical qubits are noisy, you need many of them to produce one reliable logical qubit, and published estimates for attacking real-world key sizes run into the millions of physical qubits. Current machines are many orders of magnitude short — not a matter of one more generation of hardware.

Two things stop that from being a reason to ignore the subject.

First, the timeline is genuinely uncertain. "Many orders of magnitude away" is an honest description of today and a poor basis for confident predictions about 2040.

Second, and more importantly: exposed keys don't expire. With encrypted data there's a "harvest now, decrypt later" concern. With coins, the equivalent is simpler and worse — a public key that's visible today stays visible, and coins sitting behind it can be taken whenever the capability arrives. There's no window that closes. That's the argument for caring now about which category your coins are in, even while the threat remains distant.

What's actually being done

The cryptographic groundwork exists. NIST has standardised post-quantum signature schemes — ML-DSA and SLH-DSA, derived from the Dilithium and SPHINCS+ submissions — and they're deployable today in ordinary software.

Blockchains are the hard case. Changing the signature scheme is a consensus change: every node, every wallet, every exchange, every piece of infrastructure has to agree and migrate. Post-quantum signatures are also substantially larger than the ones in use, which has direct consequences for block space and fees. And someone has to decide what happens to coins whose owners never migrate — including old outputs whose owners may be unreachable or dead. That's a governance problem at least as hard as the technical one.

Work is happening. It is not urgent yet, and it will take years when it becomes so.

What to do

Don't reuse addresses. You should already be doing this for privacy. It also keeps your coins in the hashed category rather than behind exposed keys. It's the only meaningful thing an individual can do today, and it's free.

Don't restructure your holdings over this. No panic move is warranted. Anyone urging you to move funds urgently because of quantum computing is running a scam or selling something.

Keep the threat in proportion. Realistically, you are far more likely to lose crypto to a lost seed phrase, a phishing site, or an approval you didn't read than to a quantum computer. Those are today's risks and they deserve today's attention.

Expect it to be handled at the protocol layer. When migration comes, it will arrive as a chain upgrade with a long transition, not as something your wallet quietly fixes.

The honest position is unglamorous: a real problem, correctly identified, still distant, being worked on, and not currently the thing standing between you and losing your money.